192 files changed, 10575 insertions, 5056 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index fe649081fbdc..a1f16303703a 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -225,12 +225,6 @@ int vlan_check_real_dev(struct net_device *real_dev, u16 vlan_id)
                 return -EOPNOTSUPP;
         }
 
-        /* The real device must be up and operating in order to
-         * assosciate a VLAN device with it.
-         */
-        if (!(real_dev->flags & IFF_UP))
-                return -ENETDOWN;
-
         if (__find_vlan_dev(real_dev, vlan_id) != NULL)
                 return -EEXIST;
 
@@ -468,6 +462,19 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                 }
                 break;
 
+        case NETDEV_CHANGEMTU:
+                for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
+                        vlandev = vlan_group_get_device(grp, i);
+                        if (!vlandev)
+                                continue;
+
+                        if (vlandev->mtu <= dev->mtu)
+                                continue;
+
+                        dev_set_mtu(vlandev, dev->mtu);
+                }
+                break;
+
         case NETDEV_FEAT_CHANGE:
                 /* Propagate device features to underlying device */
                 for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index b55a091a33df..6262c335f3c2 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -107,7 +107,7 @@ static const struct file_operations vlandev_fops = {
  */
 
 /* Strings */
-static const char *vlan_name_type_str[VLAN_NAME_TYPE_HIGHEST] = {
+static const char *const vlan_name_type_str[VLAN_NAME_TYPE_HIGHEST] = {
     [VLAN_NAME_TYPE_RAW_PLUS_VID]        = "VLAN_NAME_TYPE_RAW_PLUS_VID",
     [VLAN_NAME_TYPE_PLUS_VID_NO_PAD]     = "VLAN_NAME_TYPE_PLUS_VID_NO_PAD",
     [VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD] = "VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD",
diff --git a/net/Kconfig b/net/Kconfig
index 7051b9710675..041c35edb763 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -23,6 +23,26 @@ menuconfig NET
 
 if NET
 
+config WANT_COMPAT_NETLINK_MESSAGES
+        bool
+        help
+          This option can be selected by other options that need compat
+          netlink messages.
+
+config COMPAT_NETLINK_MESSAGES
+        def_bool y
+        depends on COMPAT
+        depends on WIRELESS_EXT || WANT_COMPAT_NETLINK_MESSAGES
+        help
+          This option makes it possible to send different netlink messages
+          to tasks depending on whether the task is a compat task or not. To
+          achieve this, you need to set skb_shinfo(skb)->frag_list to the
+          compat skb before sending the skb, the netlink code will sort out
+          which message to actually pass to the task.
+
+          Newly written code should NEVER need this option but do
+          compat-independent messages instead!
+
 menu "Networking options"
 
 source "net/packet/Kconfig"
diff --git a/net/Makefile b/net/Makefile
index ba324aefda73..1542e7268a7b 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -24,7 +24,6 @@ obj-y				+= ipv6/
 endif
 obj-$(CONFIG_PACKET)            += packet/
 obj-$(CONFIG_NET_KEY)           += key/
-obj-$(CONFIG_NET_SCHED)         += sched/
 obj-$(CONFIG_BRIDGE)            += bridge/
 obj-$(CONFIG_NET_DSA)           += dsa/
 obj-$(CONFIG_IPX)               += ipx/
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 875eda5dbad7..0d42d5da50ad 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1400,7 +1400,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         __u16 len_hops;
 
         if (!net_eq(dev_net(dev), &init_net))
-                goto freeit;
+                goto drop;
 
         /* Don't mangle buffer if shared */
         if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
@@ -1408,7 +1408,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
 
         /* Size check and make sure header is contiguous */
         if (!pskb_may_pull(skb, sizeof(*ddp)))
-                goto freeit;
+                goto drop;
 
         ddp = ddp_hdr(skb);
 
@@ -1426,7 +1426,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         if (skb->len < sizeof(*ddp) || skb->len < (len_hops & 1023)) {
                 pr_debug("AppleTalk: dropping corrupted frame (deh_len=%u, "
                          "skb->len=%u)\n", len_hops & 1023, skb->len);
-                goto freeit;
+                goto drop;
         }
 
         /*
@@ -1436,7 +1436,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         if (ddp->deh_sum &&
             atalk_checksum(skb, len_hops & 1023) != ddp->deh_sum)
                 /* Not a valid AppleTalk frame - dustbin time */
-                goto freeit;
+                goto drop;
 
         /* Check the packet is aimed at us */
         if (!ddp->deh_dnet)     /* Net 0 is 'this network' */
@@ -1449,7 +1449,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
                  * AppleTalk iface
                  */
                 atalk_route_packet(skb, dev, ddp, len_hops, origlen);
-                goto out;
+                return NET_RX_SUCCESS;
         }
 
         /* if IP over DDP is not selected this code will be optimized out */
@@ -1465,18 +1465,21 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
 
         sock = atalk_search_socket(&tosat, atif);
         if (!sock) /* But not one of our sockets */
-                goto freeit;
+                goto drop;
 
         /* Queue packet (standard) */
         skb->sk = sock;
 
         if (sock_queue_rcv_skb(sock, skb) < 0)
-                goto freeit;
-out:
-        return 0;
-freeit:
+                goto drop;
+
+        return NET_RX_SUCCESS;
+
+drop:
         kfree_skb(skb);
-        goto out;
+out:
+        return NET_RX_DROP;
+
 }
 
 /*
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 2912665fc58c..848af113ba2a 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -238,7 +238,7 @@ static int br2684_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* netif_stop_queue(dev); */
                 dev_kfree_skb(skb);
                 read_unlock(&devs_lock);
-                return 0;
+                return NETDEV_TX_OK;
         }
         if (!br2684_xmit_vcc(skb, dev, brvcc)) {
                 /*
@@ -252,7 +252,7 @@ static int br2684_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 dev->stats.tx_fifo_errors++;
         }
         read_unlock(&devs_lock);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 /*
diff --git a/net/atm/clip.c b/net/atm/clip.c
index e65a3b1477f8..64910bb86089 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -373,7 +373,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 printk(KERN_ERR "clip_start_xmit: skb_dst(skb) == NULL\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
-                return 0;
+                return NETDEV_TX_OK;
         }
         if (!skb_dst(skb)->neighbour) {
 #if 0
@@ -387,7 +387,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 printk(KERN_ERR "clip_start_xmit: NO NEIGHBOUR !\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
-                return 0;
+                return NETDEV_TX_OK;
         }
         entry = NEIGH2ENTRY(skb_dst(skb)->neighbour);
         if (!entry->vccs) {
@@ -402,7 +402,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         dev_kfree_skb(skb);
                         dev->stats.tx_dropped++;
                 }
-                return 0;
+                return NETDEV_TX_OK;
         }
         pr_debug("neigh %p, vccs %p\n", entry, entry->vccs);
         ATM_SKB(skb)->vcc = vcc = entry->vccs->vcc;
@@ -421,14 +421,14 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         old = xchg(&entry->vccs->xoff, 1);      /* assume XOFF ... */
         if (old) {
                 printk(KERN_WARNING "clip_start_xmit: XOFF->XOFF transition\n");
-                return 0;
+                return NETDEV_TX_OK;
         }
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
         vcc->send(vcc, skb);
         if (atm_may_send(vcc, 0)) {
                 entry->vccs->xoff = 0;
-                return 0;
+                return NETDEV_TX_OK;
         }
         spin_lock_irqsave(&clip_priv->xoff_lock, flags);
         netif_stop_queue(dev);  /* XOFF -> throttle immediately */
@@ -440,7 +440,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
            of the brief netif_stop_queue. If this isn't true or if it
            changes, use netif_wake_queue instead. */
         spin_unlock_irqrestore(&clip_priv->xoff_lock, flags);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int clip_mkip(struct atm_vcc *vcc, int timeout)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index ff2e594dca9b..8e723c2654cb 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -289,7 +289,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
                 kfree_skb(skb);
                 if (skb2 == NULL)
-                        return 0;
+                        return NETDEV_TX_OK;
                 skb = skb2;
         }
         skb_push(skb, 2);
@@ -307,7 +307,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
                 kfree_skb(skb);
                 if (skb2 == NULL)
-                        return 0;
+                        return NETDEV_TX_OK;
                 skb = skb2;
         }
 #endif
@@ -345,7 +345,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         dev_kfree_skb(skb);
                         if (skb2 == NULL) {
                                 dev->stats.tx_dropped++;
-                                return 0;
+                                return NETDEV_TX_OK;
                         }
                         skb = skb2;
                 }
@@ -416,7 +416,7 @@ out:
         if (entry)
                 lec_arp_put(entry);
         dev->trans_start = jiffies;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 /* The inverse routine to net_open(). */
@@ -935,9 +935,9 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
 }
 
 #ifdef CONFIG_PROC_FS
-static char *lec_arp_get_status_string(unsigned char status)
+static const char *lec_arp_get_status_string(unsigned char status)
 {
-        static char *lec_arp_status_string[] = {
+        static const char *const lec_arp_status_string[] = {
                 "ESI_UNKNOWN       ",
                 "ESI_ARP_PENDING   ",
                 "ESI_VC_PENDING    ",
@@ -1121,7 +1121,8 @@ static void *lec_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
 static int lec_seq_show(struct seq_file *seq, void *v)
 {
-        static char lec_banner[] = "Itf  MAC          ATM destination"
+        static const char lec_banner[] =
+            "Itf  MAC          ATM destination"
             "                          Status            Flags "
             "VPI/VCI Recv VPI/VCI\n";
 
@@ -1505,7 +1506,7 @@ lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
 }
 
 #if DEBUG_ARP_TABLE
-static char *get_status_string(unsigned char st)
+static const char *get_status_string(unsigned char st)
 {
         switch (st) {
         case ESI_UNKNOWN:
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index e5bf11453a18..1ac4b94bf626 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -554,7 +554,7 @@ static int mpc_send_packet(struct sk_buff *skb, struct net_device *dev)
         while (i < mpc->number_of_mps_macs) {
                 if (!compare_ether_addr(eth->h_dest, (mpc->mps_macs + i*ETH_ALEN)))
                         if ( send_via_shortcut(skb, mpc) == 0 )           /* try shortcut */
-                                return 0;                                 /* success!     */
+                                return NETDEV_TX_OK;                      /* success!     */
                 i++;
         }
 
diff --git a/net/atm/proc.c b/net/atm/proc.c
index 38de5ff61ecd..ab8419a324b6 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -151,8 +151,9 @@ static void *vcc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
 static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
 {
-        static const char *class_name[] = { "off","UBR","CBR","VBR","ABR" };
-        static const char *aal_name[] = {
+        static const char *const class_name[] =
+                {"off","UBR","CBR","VBR","ABR"};
+        static const char *const aal_name[] = {
                 "---",  "1",    "2",    "3/4",  /*  0- 3 */
                 "???",  "5",    "???",  "???",  /*  4- 7 */
                 "???",  "???",  "???",  "???",  /*  8-11 */
@@ -178,7 +179,7 @@ static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
 
 static const char *vcc_state(struct atm_vcc *vcc)
 {
-        static const char *map[] = { ATM_VS2TXT_MAP };
+        static const char *const map[] = { ATM_VS2TXT_MAP };
 
         return map[ATM_VF2VS(vcc->flags)];
 }
@@ -335,7 +336,7 @@ static const struct file_operations vcc_seq_fops = {
 
 static int svc_seq_show(struct seq_file *seq, void *v)
 {
-        static char atm_svc_banner[] =
+        static const char atm_svc_banner[] =
                 "Itf VPI VCI           State      Remote\n";
 
         if (v == SEQ_START_TOKEN)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 0250e0600150..8cfb5a849841 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -49,7 +49,7 @@ static struct net_proto_family *bt_proto[BT_MAX_PROTO];
 static DEFINE_RWLOCK(bt_proto_lock);
 
 static struct lock_class_key bt_lock_key[BT_MAX_PROTO];
-static const char *bt_key_strings[BT_MAX_PROTO] = {
+static const char *const bt_key_strings[BT_MAX_PROTO] = {
         "sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP",
         "sk_lock-AF_BLUETOOTH-BTPROTO_HCI",
         "sk_lock-AF_BLUETOOTH-BTPROTO_SCO",
@@ -61,7 +61,7 @@ static const char *bt_key_strings[BT_MAX_PROTO] = {
 };
 
 static struct lock_class_key bt_slock_key[BT_MAX_PROTO];
-static const char *bt_slock_key_strings[BT_MAX_PROTO] = {
+static const char *const bt_slock_key_strings[BT_MAX_PROTO] = {
         "slock-AF_BLUETOOTH-BTPROTO_L2CAP",
         "slock-AF_BLUETOOTH-BTPROTO_HCI",
         "slock-AF_BLUETOOTH-BTPROTO_SCO",
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index d7a0e9722def..9c42990126a0 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -175,14 +175,14 @@ static int bnep_net_xmit(struct sk_buff *skb, struct net_device *dev)
 #ifdef CONFIG_BT_BNEP_MC_FILTER
         if (bnep_net_mc_filter(skb, s)) {
                 kfree_skb(skb);
-                return 0;
+                return NETDEV_TX_OK;
         }
 #endif
 
 #ifdef CONFIG_BT_BNEP_PROTO_FILTER
         if (bnep_net_proto_filter(skb, s)) {
                 kfree_skb(skb);
-                return 0;
+                return NETDEV_TX_OK;
         }
 #endif
 
@@ -203,7 +203,7 @@ static int bnep_net_xmit(struct sk_buff *skb, struct net_device *dev)
                 netif_stop_queue(dev);
         }
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct net_device_ops bnep_netdev_ops = {
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 18538d7460d7..15d43ba86b53 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -39,7 +39,7 @@ int br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         else
                 br_flood_deliver(br, skb);
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int br_dev_open(struct net_device *dev)
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index d2c27c808d3b..bc1704ac6cd9 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -22,7 +22,8 @@
 static inline int should_deliver(const struct net_bridge_port *p,
                                  const struct sk_buff *skb)
 {
-        return (skb->dev != p->dev && p->state == BR_STATE_FORWARDING);
+        return (((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
+                p->state == BR_STATE_FORWARDING);
 }
 
 static inline unsigned packet_length(const struct sk_buff *skb)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index eb404dc3ed6e..e486f1fc3632 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -256,6 +256,7 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
         p->path_cost = port_cost(dev);
         p->priority = 0x8000 >> BR_PORT_BITS;
         p->port_no = index;
+        p->flags = 0;
         br_init_port(p);
         p->state = BR_STATE_DISABLED;
         br_stp_port_timer_init(p);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index d22f611e4004..4fde7425077d 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -905,46 +905,62 @@ static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff *skb,
  * For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
  * ip_refrag() can return NF_STOLEN. */
 static struct nf_hook_ops br_nf_ops[] __read_mostly = {
-        { .hook = br_nf_pre_routing,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_PRE_ROUTING,
-          .priority = NF_BR_PRI_BRNF, },
-        { .hook = br_nf_local_in,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_LOCAL_IN,
-          .priority = NF_BR_PRI_BRNF, },
-        { .hook = br_nf_forward_ip,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_FORWARD,
-          .priority = NF_BR_PRI_BRNF - 1, },
-        { .hook = br_nf_forward_arp,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_FORWARD,
-          .priority = NF_BR_PRI_BRNF, },
-        { .hook = br_nf_local_out,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_LOCAL_OUT,
-          .priority = NF_BR_PRI_FIRST, },
-        { .hook = br_nf_post_routing,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_POST_ROUTING,
-          .priority = NF_BR_PRI_LAST, },
-        { .hook = ip_sabotage_in,
-          .owner = THIS_MODULE,
-          .pf = PF_INET,
-          .hooknum = NF_INET_PRE_ROUTING,
-          .priority = NF_IP_PRI_FIRST, },
-        { .hook = ip_sabotage_in,
-          .owner = THIS_MODULE,
-          .pf = PF_INET6,
-          .hooknum = NF_INET_PRE_ROUTING,
-          .priority = NF_IP6_PRI_FIRST, },
+        {
+                .hook = br_nf_pre_routing,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_PRE_ROUTING,
+                .priority = NF_BR_PRI_BRNF,
+        },
+        {
+                .hook = br_nf_local_in,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_LOCAL_IN,
+                .priority = NF_BR_PRI_BRNF,
+        },
+        {
+                .hook = br_nf_forward_ip,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_FORWARD,
+                .priority = NF_BR_PRI_BRNF - 1,
+        },
+        {
+                .hook = br_nf_forward_arp,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_FORWARD,
+                .priority = NF_BR_PRI_BRNF,
+        },
+        {
+                .hook = br_nf_local_out,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_LOCAL_OUT,
+                .priority = NF_BR_PRI_FIRST,
+        },
+        {
+                .hook = br_nf_post_routing,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_POST_ROUTING,
+                .priority = NF_BR_PRI_LAST,
+        },
+        {
+                .hook = ip_sabotage_in,
+                .owner = THIS_MODULE,
+                .pf = PF_INET,
+                .hooknum = NF_INET_PRE_ROUTING,
+                .priority = NF_IP_PRI_FIRST,
+        },
+        {
+                .hook = ip_sabotage_in,
+                .owner = THIS_MODULE,
+                .pf = PF_INET6,
+                .hooknum = NF_INET_PRE_ROUTING,
+                .priority = NF_IP6_PRI_FIRST,
+        },
 };
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index d5b5537272b4..8319247dad5d 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -81,6 +81,9 @@ struct net_bridge_port
         struct timer_list               message_age_timer;
         struct kobject                  kobj;
         struct rcu_head                 rcu;
+
+        unsigned long                   flags;
+#define BR_HAIRPIN_MODE         0x00000001
 };
 
 struct net_bridge
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 0660515f3992..fd3f8d6c0998 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -21,7 +21,7 @@
  */
 #define MESSAGE_AGE_INCR        ((HZ < 256) ? 1 : (HZ/256))
 
-static const char *br_port_state_names[] = {
+static const char *const br_port_state_names[] = {
         [BR_STATE_DISABLED] = "disabled",
         [BR_STATE_LISTENING] = "listening",
         [BR_STATE_LEARNING] = "learning",
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 4a3cdf8f3813..820643a3ba9c 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -143,6 +143,22 @@ static ssize_t store_flush(struct net_bridge_port *p, unsigned long v)
 }
 static BRPORT_ATTR(flush, S_IWUSR, NULL, store_flush);
 
+static ssize_t show_hairpin_mode(struct net_bridge_port *p, char *buf)
+{
+        int hairpin_mode = (p->flags & BR_HAIRPIN_MODE) ? 1 : 0;
+        return sprintf(buf, "%d\n", hairpin_mode);
+}
+static ssize_t store_hairpin_mode(struct net_bridge_port *p, unsigned long v)
+{
+        if (v)
+                p->flags |= BR_HAIRPIN_MODE;
+        else
+                p->flags &= ~BR_HAIRPIN_MODE;
+        return 0;
+}
+static BRPORT_ATTR(hairpin_mode, S_IRUGO | S_IWUSR,
+                   show_hairpin_mode, store_hairpin_mode);
+
 static struct brport_attribute *brport_attrs[] = {
         &brport_attr_path_cost,
         &brport_attr_priority,
@@ -159,6 +175,7 @@ static struct brport_attribute *brport_attrs[] = {
         &brport_attr_forward_delay_timer,
         &brport_attr_hold_timer,
         &brport_attr_flush,
+        &brport_attr_hairpin_mode,
         NULL
 };
 
diff --git a/net/compat.c b/net/compat.c
index 8d739053afe4..12728b17a226 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -743,6 +743,18 @@ asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, uns
         return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
+asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned flags)
+{
+        return sys_recv(fd, buf, len, flags | MSG_CMSG_COMPAT);
+}
+
+asmlinkage long compat_sys_recvfrom(int fd, void __user *buf, size_t len,
+                                    unsigned flags, struct sockaddr __user *addr,
+                                    int __user *addrlen)
+{
+        return sys_recvfrom(fd, buf, len, flags | MSG_CMSG_COMPAT, addr, addrlen);
+}
+
 asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
 {
         int ret;
@@ -788,10 +800,11 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
                 ret = sys_sendto(a0, compat_ptr(a1), a[2], a[3], compat_ptr(a[4]), a[5]);
                 break;
         case SYS_RECV:
-                ret = sys_recv(a0, compat_ptr(a1), a[2], a[3]);
+                ret = compat_sys_recv(a0, compat_ptr(a1), a[2], a[3]);
                 break;
         case SYS_RECVFROM:
-                ret = sys_recvfrom(a0, compat_ptr(a1), a[2], a[3], compat_ptr(a[4]), compat_ptr(a[5]));
+                ret = compat_sys_recvfrom(a0, compat_ptr(a1), a[2], a[3],
+                                          compat_ptr(a[4]), compat_ptr(a[5]));
                 break;
         case SYS_SHUTDOWN:
                 ret = sys_shutdown(a0,a1);
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b0fe69211eef..1c6cf3a1a4f6 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -55,6 +55,7 @@
 #include <net/checksum.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
+#include <trace/events/skb.h>
 
 /*
  *      Is a socket 'connection oriented' ?
@@ -284,6 +285,8 @@ int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
         int i, copy = start - offset;
         struct sk_buff *frag_iter;
 
+        trace_skb_copy_datagram_iovec(skb, len);
+
         /* Copy header. */
         if (copy > 0) {
                 if (copy > len)
diff --git a/net/core/dev.c b/net/core/dev.c
index 6a94475aee85..09fb03fa1ae6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -272,7 +272,7 @@ static const unsigned short netdev_lock_type[] =
          ARPHRD_PHONET_PIPE, ARPHRD_IEEE802154, ARPHRD_IEEE802154_PHY,
          ARPHRD_VOID, ARPHRD_NONE};
 
-static const char *netdev_lock_name[] =
+static const char *const netdev_lock_name[] =
         {"_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
          "_xmit_PRONET", "_xmit_CHAOS", "_xmit_IEEE802", "_xmit_ARCNET",
          "_xmit_APPLETLK", "_xmit_DLCI", "_xmit_ATM", "_xmit_METRICOM",
@@ -1704,7 +1704,7 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                         skb_dst_drop(skb);
 
                 rc = ops->ndo_start_xmit(skb, dev);
-                if (rc == 0)
+                if (rc == NETDEV_TX_OK)
                         txq_trans_update(txq);
                 /*
                  * TODO: if skb_orphan() was called by
@@ -1730,7 +1730,7 @@ gso:
                 skb->next = nskb->next;
                 nskb->next = NULL;
                 rc = ops->ndo_start_xmit(nskb, dev);
-                if (unlikely(rc)) {
+                if (unlikely(rc != NETDEV_TX_OK)) {
                         nskb->next = skb->next;
                         skb->next = nskb;
                         return rc;
@@ -1744,7 +1744,7 @@ gso:
 
 out_kfree_skb:
         kfree_skb(skb);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static u32 skb_tx_hashrnd;
@@ -1786,6 +1786,40 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
         return netdev_get_tx_queue(dev, queue_index);
 }
 
+static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
+                                 struct net_device *dev,
+                                 struct netdev_queue *txq)
+{
+        spinlock_t *root_lock = qdisc_lock(q);
+        int rc;
+
+        spin_lock(root_lock);
+        if (unlikely(test_bit(__QDISC_STATE_DEACTIVATED, &q->state))) {
+                kfree_skb(skb);
+                rc = NET_XMIT_DROP;
+        } else if ((q->flags & TCQ_F_CAN_BYPASS) && !qdisc_qlen(q) &&
+                   !test_and_set_bit(__QDISC_STATE_RUNNING, &q->state)) {
+                /*
+                 * This is a work-conserving queue; there are no old skbs
+                 * waiting to be sent out; and the qdisc is not running -
+                 * xmit the skb directly.
+                 */
+                __qdisc_update_bstats(q, skb->len);
+                if (sch_direct_xmit(skb, q, dev, txq, root_lock))
+                        __qdisc_run(q);
+                else
+                        clear_bit(__QDISC_STATE_RUNNING, &q->state);
+
+                rc = NET_XMIT_SUCCESS;
+        } else {
+                rc = qdisc_enqueue_root(skb, q);
+                qdisc_run(q);
+        }
+        spin_unlock(root_lock);
+
+        return rc;
+}
+
 /**
  *      dev_queue_xmit - transmit a buffer
  *      @skb: buffer to transmit
@@ -1859,19 +1893,7 @@ gso:
         skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_EGRESS);
 #endif
         if (q->enqueue) {
-                spinlock_t *root_lock = qdisc_lock(q);
-
-                spin_lock(root_lock);
-
-                if (unlikely(test_bit(__QDISC_STATE_DEACTIVATED, &q->state))) {
-                        kfree_skb(skb);
-                        rc = NET_XMIT_DROP;
-                } else {
-                        rc = qdisc_enqueue_root(skb, q);
-                        qdisc_run(q);
-                }
-                spin_unlock(root_lock);
-
+                rc = __dev_xmit_skb(skb, q, dev, txq);
                 goto out;
         }
 
@@ -3927,6 +3949,7 @@ int __dev_addr_sync(struct dev_addr_list **to, int *to_count,
         }
         return err;
 }
+EXPORT_SYMBOL_GPL(__dev_addr_sync);
 
 void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
                        struct dev_addr_list **from, int *from_count)
@@ -3946,6 +3969,7 @@ void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
                 da = next;
         }
 }
+EXPORT_SYMBOL_GPL(__dev_addr_unsync);
 
 /**
  *      dev_unicast_sync - Synchronize device's unicast list to another device
@@ -5347,6 +5371,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
 out:
         return err;
 }
+EXPORT_SYMBOL_GPL(dev_change_net_namespace);
 
 static int dev_cpu_callback(struct notifier_block *nfb,
                             unsigned long action,
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index d9d5160610d5..44e571111d3a 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -30,10 +30,17 @@ u32 ethtool_op_get_link(struct net_device *dev)
         return netif_carrier_ok(dev) ? 1 : 0;
 }
 
+u32 ethtool_op_get_rx_csum(struct net_device *dev)
+{
+        return (dev->features & NETIF_F_ALL_CSUM) != 0;
+}
+EXPORT_SYMBOL(ethtool_op_get_rx_csum);
+
 u32 ethtool_op_get_tx_csum(struct net_device *dev)
 {
         return (dev->features & NETIF_F_ALL_CSUM) != 0;
 }
+EXPORT_SYMBOL(ethtool_op_get_tx_csum);
 
 int ethtool_op_set_tx_csum(struct net_device *dev, u32 data)
 {
@@ -1004,7 +1011,9 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
                 break;
         case ETHTOOL_GRXCSUM:
                 rc = ethtool_get_value(dev, useraddr, ethcmd,
-                                       dev->ethtool_ops->get_rx_csum);
+                                       (dev->ethtool_ops->get_rx_csum ?
+                                        dev->ethtool_ops->get_rx_csum :
+                                        ethtool_op_get_rx_csum));
                 break;
         case ETHTOOL_SRXCSUM:
                 rc = ethtool_set_rx_csum(dev, useraddr);
@@ -1068,7 +1077,9 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
                 break;
         case ETHTOOL_GFLAGS:
                 rc = ethtool_get_value(dev, useraddr, ethcmd,
-                                       dev->ethtool_ops->get_flags);
+                                       (dev->ethtool_ops->get_flags ?
+                                        dev->ethtool_ops->get_flags :
+                                        ethtool_op_get_flags));
                 break;
         case ETHTOOL_SFLAGS:
                 rc = ethtool_set_value(dev, useraddr,
@@ -1116,7 +1127,6 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
 EXPORT_SYMBOL(ethtool_op_get_link);
 EXPORT_SYMBOL(ethtool_op_get_sg);
 EXPORT_SYMBOL(ethtool_op_get_tso);
-EXPORT_SYMBOL(ethtool_op_get_tx_csum);
 EXPORT_SYMBOL(ethtool_op_set_sg);
 EXPORT_SYMBOL(ethtool_op_set_tso);
 EXPORT_SYMBOL(ethtool_op_set_tx_csum);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 163b4f5b0365..e587e6819698 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -692,75 +692,74 @@ static void neigh_connect(struct neighbour *neigh)
                 hh->hh_output = neigh->ops->hh_output;
 }
 
-static void neigh_periodic_timer(unsigned long arg)
+static void neigh_periodic_work(struct work_struct *work)
 {
-        struct neigh_table *tbl = (struct neigh_table *)arg;
+        struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
         struct neighbour *n, **np;
-        unsigned long expire, now = jiffies;
+        unsigned int i;
 
         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 
-        write_lock(&tbl->lock);
+        write_lock_bh(&tbl->lock);
 
         /*
          *      periodically recompute ReachableTime from random function
          */
 
-        if (time_after(now, tbl->last_rand + 300 * HZ)) {
+        if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
                 struct neigh_parms *p;
-                tbl->last_rand = now;
+                tbl->last_rand = jiffies;
                 for (p = &tbl->parms; p; p = p->next)
                         p->reachable_time =
                                 neigh_rand_reach_time(p->base_reachable_time);
         }
 
-        np = &tbl->hash_buckets[tbl->hash_chain_gc];
-        tbl->hash_chain_gc = ((tbl->hash_chain_gc + 1) & tbl->hash_mask);
+        for (i = 0 ; i <= tbl->hash_mask; i++) {
+                np = &tbl->hash_buckets[i];
 
-        while ((n = *np) != NULL) {
-                unsigned int state;
+                while ((n = *np) != NULL) {
+                        unsigned int state;
 
-                write_lock(&n->lock);
+                        write_lock(&n->lock);
 
-                state = n->nud_state;
-                if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
-                        write_unlock(&n->lock);
-                        goto next_elt;
-                }
+                        state = n->nud_state;
+                        if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
+                                write_unlock(&n->lock);
+                                goto next_elt;
+                        }
 
-                if (time_before(n->used, n->confirmed))
-                        n->used = n->confirmed;
+                        if (time_before(n->used, n->confirmed))
+                                n->used = n->confirmed;
 
-                if (atomic_read(&n->refcnt) == 1 &&
-                    (state == NUD_FAILED ||
-                     time_after(now, n->used + n->parms->gc_staletime))) {
-                        *np = n->next;
-                        n->dead = 1;
+                        if (atomic_read(&n->refcnt) == 1 &&
+                            (state == NUD_FAILED ||
+                             time_after(jiffies, n->used + n->parms->gc_staletime))) {
+                                *np = n->next;
+                                n->dead = 1;
+                                write_unlock(&n->lock);
+                                neigh_cleanup_and_release(n);
+                                continue;
+                        }
                         write_unlock(&n->lock);
-                        neigh_cleanup_and_release(n);
-                        continue;
-                }
-                write_unlock(&n->lock);
 
 next_elt:
-                np = &n->next;
+                        np = &n->next;
+                }
+                /*
+                 * It's fine to release lock here, even if hash table
+                 * grows while we are preempted.
+                 */
+                write_unlock_bh(&tbl->lock);
+                cond_resched();
+                write_lock_bh(&tbl->lock);
         }
-
         /* Cycle through all hash buckets every base_reachable_time/2 ticks.
          * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
          * base_reachable_time.
          */
-        expire = tbl->parms.base_reachable_time >> 1;
-        expire /= (tbl->hash_mask + 1);
-        if (!expire)
-                expire = 1;
-
-        if (expire>HZ)
-                mod_timer(&tbl->gc_timer, round_jiffies(now + expire));
-        else
-                mod_timer(&tbl->gc_timer, now + expire);
-
-        write_unlock(&tbl->lock);
+        schedule_delayed_work(&tbl->gc_work,
+                              tbl->parms.base_reachable_time >> 1);
+        write_unlock_bh(&tbl->lock);
 }
 
 static __inline__ int neigh_max_probes(struct neighbour *n)
@@ -1316,7 +1315,7 @@ void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
 }
 EXPORT_SYMBOL(pneigh_enqueue);
 
-static inline struct neigh_parms *lookup_neigh_params(struct neigh_table *tbl,
+static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
                                                       struct net *net, int ifindex)
 {
         struct neigh_parms *p;
@@ -1337,7 +1336,7 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
         struct net *net = dev_net(dev);
         const struct net_device_ops *ops = dev->netdev_ops;
 
-        ref = lookup_neigh_params(tbl, net, 0);
+        ref = lookup_neigh_parms(tbl, net, 0);
         if (!ref)
                 return NULL;
 
@@ -1442,10 +1441,8 @@ void neigh_table_init_no_netlink(struct neigh_table *tbl)
         get_random_bytes(&tbl->hash_rnd, sizeof(tbl->hash_rnd));
 
         rwlock_init(&tbl->lock);
-        setup_timer(&tbl->gc_timer, neigh_periodic_timer, (unsigned long)tbl);
-        tbl->gc_timer.expires  = now + 1;
-        add_timer(&tbl->gc_timer);
-
+        INIT_DELAYED_WORK_DEFERRABLE(&tbl->gc_work, neigh_periodic_work);
+        schedule_delayed_work(&tbl->gc_work, tbl->parms.reachable_time);
         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
         skb_queue_head_init_class(&tbl->proxy_queue,
                         &neigh_table_proxy_queue_class);
@@ -1482,7 +1479,8 @@ int neigh_table_clear(struct neigh_table *tbl)
         struct neigh_table **tp;
 
         /* It is not clean... Fix it to unload IPv6 module safely */
-        del_timer_sync(&tbl->gc_timer);
+        cancel_delayed_work(&tbl->gc_work);
+        flush_scheduled_work();
         del_timer_sync(&tbl->proxy_timer);
         pneigh_queue_purge(&tbl->proxy_queue);
         neigh_ifdown(tbl, NULL);
@@ -1752,7 +1750,6 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
                         .ndtc_hash_rnd          = tbl->hash_rnd,
                         .ndtc_hash_mask         = tbl->hash_mask,
-                        .ndtc_hash_chain_gc     = tbl->hash_chain_gc,
                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
                 };
 
@@ -1906,7 +1903,7 @@ static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 if (tbp[NDTPA_IFINDEX])
                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
 
-                p = lookup_neigh_params(tbl, net, ifindex);
+                p = lookup_neigh_parms(tbl, net, ifindex);
                 if (p == NULL) {
                         err = -ENOENT;
                         goto errout_tbl_lock;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 3994680c08b9..ad91e9e5f475 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -141,7 +141,7 @@ static ssize_t show_dormant(struct device *dev,
         return -EINVAL;
 }
 
-static const char *operstates[] = {
+static const char *const operstates[] = {
         "unknown",
         "notpresent", /* currently unused */
         "down",
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 197283072cc8..1c1af2756f38 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -6,6 +6,8 @@
 #include <linux/delay.h>
 #include <linux/sched.h>
 #include <linux/idr.h>
+#include <linux/rculist.h>
+#include <linux/nsproxy.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 
@@ -127,7 +129,7 @@ static struct net *net_create(void)
         rv = setup_net(net);
         if (rv == 0) {
                 rtnl_lock();
-                list_add_tail(&net->list, &net_namespace_list);
+                list_add_tail_rcu(&net->list, &net_namespace_list);
                 rtnl_unlock();
         }
         mutex_unlock(&net_mutex);
@@ -156,9 +158,16 @@ static void cleanup_net(struct work_struct *work)
 
         /* Don't let anyone else find us. */
         rtnl_lock();
-        list_del(&net->list);
+        list_del_rcu(&net->list);
         rtnl_unlock();
 
+        /*
+         * Another CPU might be rcu-iterating the list, wait for it.
+         * This needs to be before calling the exit() notifiers, so
+         * the rcu_barrier() below isn't sufficient alone.
+         */
+        synchronize_rcu();
+
         /* Run all of the network namespace exit methods */
         list_for_each_entry_reverse(ops, &pernet_list, list) {
                 if (ops->exit)
@@ -193,6 +202,26 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
 }
 #endif
 
+struct net *get_net_ns_by_pid(pid_t pid)
+{
+        struct task_struct *tsk;
+        struct net *net;
+
+        /* Lookup the network namespace */
+        net = ERR_PTR(-ESRCH);
+        rcu_read_lock();
+        tsk = find_task_by_vpid(pid);
+        if (tsk) {
+                struct nsproxy *nsproxy;
+                nsproxy = task_nsproxy(tsk);
+                if (nsproxy)
+                        net = get_net(nsproxy->net_ns);
+        }
+        rcu_read_unlock();
+        return net;
+}
+EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
+
 static int __init net_ns_init(void)
 {
         struct net_generic *ng;
@@ -219,7 +248,7 @@ static int __init net_ns_init(void)
                 panic("Could not setup the initial network namespace");
 
         rtnl_lock();
-        list_add_tail(&init_net.list, &net_namespace_list);
+        list_add_tail_rcu(&init_net.list, &net_namespace_list);
         rtnl_unlock();
 
         mutex_unlock(&net_mutex);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index df30feb2fc72..0ac309154b0d 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -9,6 +9,7 @@
  * Copyright (C) 2002  Red Hat, Inc.
  */
 
+#include <linux/moduleparam.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/string.h>
@@ -50,6 +51,9 @@ static atomic_t trapped;
 static void zap_completion_queue(void);
 static void arp_reply(struct sk_buff *skb);
 
+static unsigned int carrier_timeout = 4;
+module_param(carrier_timeout, uint, 0644);
+
 static void queue_process(struct work_struct *work)
 {
         struct netpoll_info *npinfo =
@@ -732,7 +736,7 @@ int netpoll_setup(struct netpoll *np)
                 }
 
                 atleast = jiffies + HZ/10;
-                atmost = jiffies + 4*HZ;
+                atmost = jiffies + carrier_timeout * HZ;
                 while (!netif_carrier_ok(ndev)) {
                         if (time_after(jiffies, atmost)) {
                                 printk(KERN_NOTICE
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d78030f88bd0..b44775f9f2bf 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -35,7 +35,6 @@
 #include <linux/security.h>
 #include <linux/mutex.h>
 #include <linux/if_addr.h>
-#include <linux/nsproxy.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -52,6 +51,7 @@
 #include <net/pkt_sched.h>
 #include <net/fib_rules.h>
 #include <net/rtnetlink.h>
+#include <net/net_namespace.h>
 
 struct rtnl_link
 {
@@ -725,25 +725,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
         [IFLA_INFO_DATA]        = { .type = NLA_NESTED },
 };
 
-static struct net *get_net_ns_by_pid(pid_t pid)
-{
-        struct task_struct *tsk;
-        struct net *net;
-
-        /* Lookup the network namespace */
-        net = ERR_PTR(-ESRCH);
-        rcu_read_lock();
-        tsk = find_task_by_vpid(pid);
-        if (tsk) {
-                struct nsproxy *nsproxy;
-                nsproxy = task_nsproxy(tsk);
-                if (nsproxy)
-                        net = get_net(nsproxy->net_ns);
-        }
-        rcu_read_unlock();
-        return net;
-}
-
 static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
 {
         if (dev) {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9e0597d189b0..80a96166df39 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -559,9 +559,6 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 #endif
 #endif
         new->vlan_tci           = old->vlan_tci;
-#if defined(CONFIG_MAC80211) || defined(CONFIG_MAC80211_MODULE)
-        new->do_not_encrypt     = old->do_not_encrypt;
-#endif
 
         skb_copy_secmark(new, old);
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index bbb25be7ddfe..3ac34ea6ec05 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -142,7 +142,7 @@ static struct lock_class_key af_family_slock_keys[AF_MAX];
  * strings build-time, so that runtime initialization of socket
  * locks is fast):
  */
-static const char *af_family_key_strings[AF_MAX+1] = {
+static const char *const af_family_key_strings[AF_MAX+1] = {
   "sk_lock-AF_UNSPEC", "sk_lock-AF_UNIX"     , "sk_lock-AF_INET"     ,
   "sk_lock-AF_AX25"  , "sk_lock-AF_IPX"      , "sk_lock-AF_APPLETALK",
   "sk_lock-AF_NETROM", "sk_lock-AF_BRIDGE"   , "sk_lock-AF_ATMPVC"   ,
@@ -158,7 +158,7 @@ static const char *af_family_key_strings[AF_MAX+1] = {
   "sk_lock-AF_IEEE802154",
   "sk_lock-AF_MAX"
 };
-static const char *af_family_slock_key_strings[AF_MAX+1] = {
+static const char *const af_family_slock_key_strings[AF_MAX+1] = {
   "slock-AF_UNSPEC", "slock-AF_UNIX"     , "slock-AF_INET"     ,
   "slock-AF_AX25"  , "slock-AF_IPX"      , "slock-AF_APPLETALK",
   "slock-AF_NETROM", "slock-AF_BRIDGE"   , "slock-AF_ATMPVC"   ,
@@ -174,7 +174,7 @@ static const char *af_family_slock_key_strings[AF_MAX+1] = {
   "slock-AF_IEEE802154",
   "slock-AF_MAX"
 };
-static const char *af_family_clock_key_strings[AF_MAX+1] = {
+static const char *const af_family_clock_key_strings[AF_MAX+1] = {
   "clock-AF_UNSPEC", "clock-AF_UNIX"     , "clock-AF_INET"     ,
   "clock-AF_AX25"  , "clock-AF_IPX"      , "clock-AF_APPLETALK",
   "clock-AF_NETROM", "clock-AF_BRIDGE"   , "clock-AF_ATMPVC"   ,
@@ -482,6 +482,8 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
                 sk->sk_reuse = valbool;
                 break;
         case SO_TYPE:
+        case SO_PROTOCOL:
+        case SO_DOMAIN:
         case SO_ERROR:
                 ret = -ENOPROTOOPT;
                 break;
@@ -764,6 +766,14 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 v.val = sk->sk_type;
                 break;
 
+        case SO_PROTOCOL:
+                v.val = sk->sk_protocol;
+                break;
+
+        case SO_DOMAIN:
+                v.val = sk->sk_family;
+                break;
+
         case SO_ERROR:
                 v.val = -sock_error(sk);
                 if (v.val == 0)
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index a27b7f4c19c5..f596ce149c3c 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -52,7 +52,7 @@ static int ccid3_debug;
 #ifdef CONFIG_IP_DCCP_CCID3_DEBUG
 static const char *ccid3_tx_state_name(enum ccid3_hc_tx_states state)
 {
-        static char *ccid3_state_names[] = {
+        static const char *const ccid3_state_names[] = {
         [TFRC_SSTATE_NO_SENT]  = "NO_SENT",
         [TFRC_SSTATE_NO_FBACK] = "NO_FBACK",
         [TFRC_SSTATE_FBACK]    = "FBACK",
@@ -646,7 +646,7 @@ enum ccid3_fback_type {
 #ifdef CONFIG_IP_DCCP_CCID3_DEBUG
 static const char *ccid3_rx_state_name(enum ccid3_hc_rx_states state)
 {
-        static char *ccid3_rx_state_names[] = {
+        static const char *const ccid3_rx_state_names[] = {
         [TFRC_RSTATE_NO_DATA] = "NO_DATA",
         [TFRC_RSTATE_DATA]    = "DATA",
         [TFRC_RSTATE_TERM]    = "TERM",
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index b04160a2eea5..972b8dc918d6 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -213,7 +213,7 @@ static int dccp_feat_default_value(u8 feat_num)
  */
 static const char *dccp_feat_fname(const u8 feat)
 {
-        static const char *feature_names[] = {
+        static const char *const feature_names[] = {
                 [DCCPF_RESERVED]        = "Reserved",
                 [DCCPF_CCID]            = "CCID",
                 [DCCPF_SHORT_SEQNOS]    = "Allow Short Seqnos",
@@ -236,8 +236,9 @@ static const char *dccp_feat_fname(const u8 feat)
         return feature_names[feat];
 }
 
-static const char *dccp_feat_sname[] = { "DEFAULT", "INITIALISING", "CHANGING",
-                                         "UNSTABLE", "STABLE" };
+static const char *const dccp_feat_sname[] = {
+        "DEFAULT", "INITIALISING", "CHANGING", "UNSTABLE", "STABLE",
+};
 
 #ifdef CONFIG_IP_DCCP_DEBUG
 static const char *dccp_feat_oname(const u8 opt)
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 1bca9205104e..923db06c7e55 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -124,7 +124,7 @@ EXPORT_SYMBOL_GPL(dccp_done);
 
 const char *dccp_packet_name(const int type)
 {
-        static const char *dccp_packet_names[] = {
+        static const char *const dccp_packet_names[] = {
                 [DCCP_PKT_REQUEST]  = "REQUEST",
                 [DCCP_PKT_RESPONSE] = "RESPONSE",
                 [DCCP_PKT_DATA]     = "DATA",
@@ -147,7 +147,7 @@ EXPORT_SYMBOL_GPL(dccp_packet_name);
 
 const char *dccp_state_name(const int state)
 {
-        static char *dccp_state_names[] = {
+        static const char *const dccp_state_names[] = {
         [DCCP_OPEN]             = "OPEN",
         [DCCP_REQUESTING]       = "REQUESTING",
         [DCCP_PARTOPEN]         = "PARTOPEN",
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 1d6ca8a98dc6..9383d3e5a1ab 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -774,7 +774,7 @@ static int dn_rt_bug(struct sk_buff *skb)
 
         kfree_skb(skb);
 
-        return NET_RX_BAD;
+        return NET_RX_DROP;
 }
 
 static int dn_rt_set_next_hop(struct dn_route *rt, struct dn_fib_res *res)
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index f0bbc57926cd..0e0254fd767d 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -1073,7 +1073,7 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
                 skb->protocol = htons(ETH_P_IP);
                 skb_pull(skb, sizeof(struct ec_framehdr));
                 netif_rx(skb);
-                return 0;
+                return NET_RX_SUCCESS;
         }
 
         sk = ec_listening_socket(hdr->port, hdr->src_stn, hdr->src_net);
@@ -1084,7 +1084,7 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
                             hdr->port))
                 goto drop;
 
-        return 0;
+        return NET_RX_SUCCESS;
 
 drop:
         kfree_skb(skb);
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index af661805b9fa..d504c349cb0c 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -34,8 +34,8 @@
 #include <net/tcp_states.h>
 #include <net/route.h>
 
-#include <net/ieee802154/af_ieee802154.h>
-#include <net/ieee802154/netdevice.h>
+#include <net/af_ieee802154.h>
+#include <net/ieee802154_netdev.h>
 
 #include "af802154.h"
 
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index ba8b214dda8f..77ae6852b93d 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -26,9 +26,9 @@
 #include <linux/if_arp.h>
 #include <linux/list.h>
 #include <net/sock.h>
-#include <net/ieee802154/af_ieee802154.h>
-#include <net/ieee802154/mac_def.h>
-#include <net/ieee802154/netdevice.h>
+#include <net/af_ieee802154.h>
+#include <net/ieee802154.h>
+#include <net/ieee802154_netdev.h>
 
 #include <asm/ioctls.h>
 
@@ -40,9 +40,11 @@ static DEFINE_RWLOCK(dgram_lock);
 struct dgram_sock {
         struct sock sk;
 
-        int bound;
         struct ieee802154_addr src_addr;
         struct ieee802154_addr dst_addr;
+
+        unsigned bound:1;
+        unsigned want_ack:1;
 };
 
 static inline struct dgram_sock *dgram_sk(const struct sock *sk)
@@ -50,7 +52,6 @@ static inline struct dgram_sock *dgram_sk(const struct sock *sk)
         return container_of(sk, struct dgram_sock, sk);
 }
 
-
 static void dgram_hash(struct sock *sk)
 {
         write_lock_bh(&dgram_lock);
@@ -73,6 +74,7 @@ static int dgram_init(struct sock *sk)
 
         ro->dst_addr.addr_type = IEEE802154_ADDR_LONG;
         ro->dst_addr.pan_id = 0xffff;
+        ro->want_ack = 1;
         memset(&ro->dst_addr.hwaddr, 0xff, sizeof(ro->dst_addr.hwaddr));
         return 0;
 }
@@ -86,18 +88,18 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
 {
         struct sockaddr_ieee802154 *addr = (struct sockaddr_ieee802154 *)uaddr;
         struct dgram_sock *ro = dgram_sk(sk);
-        int err = 0;
+        int err = -EINVAL;
         struct net_device *dev;
 
+        lock_sock(sk);
+
         ro->bound = 0;
 
         if (len < sizeof(*addr))
-                return -EINVAL;
+                goto out;
 
         if (addr->family != AF_IEEE802154)
-                return -EINVAL;
-
-        lock_sock(sk);
+                goto out;
 
         dev = ieee802154_get_dev(sock_net(sk), &addr->addr);
         if (!dev) {
@@ -113,6 +115,7 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
         memcpy(&ro->src_addr, &addr->addr, sizeof(struct ieee802154_addr));
 
         ro->bound = 1;
+        err = 0;
 out_put:
         dev_put(dev);
 out:
@@ -235,7 +238,10 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         skb_reset_network_header(skb);
 
-        mac_cb(skb)->flags = IEEE802154_FC_TYPE_DATA | MAC_CB_FLAG_ACKREQ;
+        mac_cb(skb)->flags = IEEE802154_FC_TYPE_DATA;
+        if (ro->want_ack)
+                mac_cb(skb)->flags |= MAC_CB_FLAG_ACKREQ;
+
         mac_cb(skb)->seq = ieee802154_mlme_ops(dev)->get_dsn(dev);
         err = dev_hard_header(skb, dev, ETH_P_IEEE802154, &ro->dst_addr,
                         ro->bound ? &ro->src_addr : NULL, size);
@@ -380,13 +386,59 @@ int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
 static int dgram_getsockopt(struct sock *sk, int level, int optname,
                     char __user *optval, int __user *optlen)
 {
-        return -EOPNOTSUPP;
+        struct dgram_sock *ro = dgram_sk(sk);
+
+        int val, len;
+
+        if (level != SOL_IEEE802154)
+                return -EOPNOTSUPP;
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        len = min_t(unsigned int, len, sizeof(int));
+
+        switch (optname) {
+        case WPAN_WANTACK:
+                val = ro->want_ack;
+                break;
+        default:
+                return -ENOPROTOOPT;
+        }
+
+        if (put_user(len, optlen))
+                return -EFAULT;
+        if (copy_to_user(optval, &val, len))
+                return -EFAULT;
+        return 0;
 }
 
 static int dgram_setsockopt(struct sock *sk, int level, int optname,
                     char __user *optval, int __user optlen)
 {
-        return -EOPNOTSUPP;
+        struct dgram_sock *ro = dgram_sk(sk);
+        int val;
+        int err = 0;
+
+        if (optlen < sizeof(int))
+                return -EINVAL;
+
+        if (get_user(val, (int __user *)optval))
+                return -EFAULT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case WPAN_WANTACK:
+                ro->want_ack = !!val;
+                break;
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
 }
 
 struct proto ieee802154_dgram_prot = {
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 27eda9fdf3c2..cd0567f06716 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -19,6 +19,7 @@
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Maxim Osipov <maxim.osipov@siemens.com>
  */
 
 #include <linux/kernel.h>
@@ -26,10 +27,12 @@
 #include <linux/netdevice.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
+#include <net/sock.h>
 #include <linux/nl802154.h>
-#include <net/ieee802154/af_ieee802154.h>
-#include <net/ieee802154/nl802154.h>
-#include <net/ieee802154/netdevice.h>
+#include <net/af_ieee802154.h>
+#include <net/nl802154.h>
+#include <net/ieee802154.h>
+#include <net/ieee802154_netdev.h>
 
 static unsigned int ieee802154_seq_num;
 
@@ -73,7 +76,7 @@ static int ieee802154_nl_finish(struct sk_buff *msg)
         /* XXX: nlh is right at the start of msg */
         void *hdr = genlmsg_data(NLMSG_DATA(msg->data));
 
-        if (!genlmsg_end(msg, hdr))
+        if (genlmsg_end(msg, hdr) < 0)
                 goto out;
 
         return genlmsg_multicast(msg, 0, ieee802154_coord_mcgrp.id,
@@ -260,6 +263,60 @@ nla_put_failure:
 }
 EXPORT_SYMBOL(ieee802154_nl_scan_confirm);
 
+int ieee802154_nl_start_confirm(struct net_device *dev, u8 status)
+{
+        struct sk_buff *msg;
+
+        pr_debug("%s\n", __func__);
+
+        msg = ieee802154_nl_create(0, IEEE802154_START_CONF);
+        if (!msg)
+                return -ENOBUFS;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                        dev->dev_addr);
+
+        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
+
+        return ieee802154_nl_finish(msg);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+EXPORT_SYMBOL(ieee802154_nl_start_confirm);
+
+static int ieee802154_nl_fill_iface(struct sk_buff *msg, u32 pid,
+        u32 seq, int flags, struct net_device *dev)
+{
+        void *hdr;
+
+        pr_debug("%s\n", __func__);
+
+        hdr = genlmsg_put(msg, 0, seq, &ieee802154_coordinator_family, flags,
+                IEEE802154_LIST_IFACE);
+        if (!hdr)
+                goto out;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                dev->dev_addr);
+        NLA_PUT_U16(msg, IEEE802154_ATTR_SHORT_ADDR,
+                ieee802154_mlme_ops(dev)->get_short_addr(dev));
+        NLA_PUT_U16(msg, IEEE802154_ATTR_PAN_ID,
+                ieee802154_mlme_ops(dev)->get_pan_id(dev));
+        return genlmsg_end(msg, hdr);
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+out:
+        return -EMSGSIZE;
+}
+
 /* Requests from userspace */
 static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
 {
@@ -272,7 +329,7 @@ static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
                 dev = dev_get_by_name(&init_net, name);
         } else if (info->attrs[IEEE802154_ATTR_DEV_INDEX])
                 dev = dev_get_by_index(&init_net,
-                                nla_get_u32(info->attrs[IEEE802154_ATTR_DEV_INDEX]));
+                        nla_get_u32(info->attrs[IEEE802154_ATTR_DEV_INDEX]));
         else
                 return NULL;
 
@@ -431,6 +488,12 @@ static int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
         blx = nla_get_u8(info->attrs[IEEE802154_ATTR_BAT_EXT]);
         coord_realign = nla_get_u8(info->attrs[IEEE802154_ATTR_COORD_REALIGN]);
 
+        if (addr.short_addr == IEEE802154_ADDR_BROADCAST) {
+                ieee802154_nl_start_confirm(dev, IEEE802154_NO_SHORT_ADDRESS);
+                dev_put(dev);
+                return -EINVAL;
+        }
+
         ret = ieee802154_mlme_ops(dev)->start_req(dev, &addr, channel,
                 bcn_ord, sf_ord, pan_coord, blx, coord_realign);
 
@@ -466,6 +529,67 @@ static int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
         return ret;
 }
 
+static int ieee802154_list_iface(struct sk_buff *skb,
+        struct genl_info *info)
+{
+        /* Request for interface name, index, type, IEEE address,
+           PAN Id, short address */
+        struct sk_buff *msg;
+        struct net_device *dev = NULL;
+        int rc = -ENOBUFS;
+
+        pr_debug("%s\n", __func__);
+
+        dev = ieee802154_nl_get_dev(info);
+        if (!dev)
+                return -ENODEV;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                goto out_dev;
+
+        rc = ieee802154_nl_fill_iface(msg, info->snd_pid, info->snd_seq,
+                        0, dev);
+        if (rc < 0)
+                goto out_free;
+
+        dev_put(dev);
+
+        return genlmsg_unicast(&init_net, msg, info->snd_pid);
+out_free:
+        nlmsg_free(msg);
+out_dev:
+        dev_put(dev);
+        return rc;
+
+}
+
+static int ieee802154_dump_iface(struct sk_buff *skb,
+        struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+        int idx;
+        int s_idx = cb->args[0];
+
+        pr_debug("%s\n", __func__);
+
+        idx = 0;
+        for_each_netdev(net, dev) {
+                if (idx < s_idx || (dev->type != ARPHRD_IEEE802154))
+                        goto cont;
+
+                if (ieee802154_nl_fill_iface(skb, NETLINK_CB(cb->skb).pid,
+                        cb->nlh->nlmsg_seq, NLM_F_MULTI, dev) < 0)
+                        break;
+cont:
+                idx++;
+        }
+        cb->args[0] = idx;
+
+        return skb->len;
+}
+
 #define IEEE802154_OP(_cmd, _func)                      \
         {                                               \
                 .cmd    = _cmd,                         \
@@ -475,12 +599,22 @@ static int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
                 .flags  = GENL_ADMIN_PERM,              \
         }
 
+#define IEEE802154_DUMP(_cmd, _func, _dump)             \
+        {                                               \
+                .cmd    = _cmd,                         \
+                .policy = ieee802154_policy,            \
+                .doit   = _func,                        \
+                .dumpit = _dump,                        \
+        }
+
 static struct genl_ops ieee802154_coordinator_ops[] = {
         IEEE802154_OP(IEEE802154_ASSOCIATE_REQ, ieee802154_associate_req),
         IEEE802154_OP(IEEE802154_ASSOCIATE_RESP, ieee802154_associate_resp),
         IEEE802154_OP(IEEE802154_DISASSOCIATE_REQ, ieee802154_disassociate_req),
         IEEE802154_OP(IEEE802154_SCAN_REQ, ieee802154_scan_req),
         IEEE802154_OP(IEEE802154_START_REQ, ieee802154_start_req),
+        IEEE802154_DUMP(IEEE802154_LIST_IFACE, ieee802154_list_iface,
+                                                        ieee802154_dump_iface),
 };
 
 static int __init ieee802154_nl_init(void)
diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c
index c7d71d1adcac..83cb4ccef90d 100644
--- a/net/ieee802154/nl_policy.c
+++ b/net/ieee802154/nl_policy.c
@@ -24,7 +24,7 @@
 
 #define NLA_HW_ADDR NLA_U64
 
-struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
+const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
         [IEEE802154_ATTR_DEV_NAME] = { .type = NLA_STRING, },
         [IEEE802154_ATTR_DEV_INDEX] = { .type = NLA_U32, },
 
@@ -50,3 +50,4 @@ struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
         [IEEE802154_ATTR_DURATION] = { .type = NLA_U8, },
         [IEEE802154_ATTR_ED_LIST] = { .len = 27 },
 };
+
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index 9315977c4c61..60dee69a1d04 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -26,7 +26,7 @@
 #include <linux/if_arp.h>
 #include <linux/list.h>
 #include <net/sock.h>
-#include <net/ieee802154/af_ieee802154.h>
+#include <net/af_ieee802154.h>
 
 #include "af802154.h"
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 566ea6c4321d..197d024b2536 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1187,6 +1187,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features)
         int proto;
         int ihl;
         int id;
+        unsigned int offset = 0;
 
         if (!(features & NETIF_F_V4_CSUM))
                 features &= ~NETIF_F_SG;
@@ -1229,7 +1230,14 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features)
         skb = segs;
         do {
                 iph = ip_hdr(skb);
-                iph->id = htons(id++);
+                if (proto == IPPROTO_UDP) {
+                        iph->id = htons(id);
+                        iph->frag_off = htons(offset >> 3);
+                        if (skb->next != NULL)
+                                iph->frag_off |= htons(IP_MF);
+                        offset += (skb->len - skb->mac_len - iph->ihl * 4);
+                } else
+                        iph->id = htons(id++);
                 iph->tot_len = htons(skb->len - skb->mac_len);
                 iph->check = 0;
                 iph->check = ip_fast_csum(skb_network_header(skb), iph->ihl);
@@ -1425,6 +1433,8 @@ static struct net_protocol tcp_protocol = {
 static struct net_protocol udp_protocol = {
         .handler =      udp_rcv,
         .err_handler =  udp_err,
+        .gso_send_check = udp4_ufo_send_check,
+        .gso_segment = udp4_ufo_fragment,
         .no_policy =    1,
         .netns_ok =     1,
 };
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 63c2fa7b68c4..fe3c846b99a6 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -164,6 +164,14 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn);
 static struct tnode *halve(struct trie *t, struct tnode *tn);
 /* tnodes to free after resize(); protected by RTNL */
 static struct tnode *tnode_free_head;
+static size_t tnode_free_size;
+
+/*
+ * synchronize_rcu after call_rcu for that many pages; it should be especially
+ * useful before resizing the root node with PREEMPT_NONE configs; the value was
+ * obtained experimentally, aiming to avoid visible slowdown.
+ */
+static const int sync_pages = 128;
 
 static struct kmem_cache *fn_alias_kmem __read_mostly;
 static struct kmem_cache *trie_leaf_kmem __read_mostly;
@@ -319,6 +327,8 @@ static const int inflate_threshold = 50;
 static const int halve_threshold_root = 15;
 static const int inflate_threshold_root = 25;
 
+static int inflate_threshold_root_fix;
+#define INFLATE_FIX_MAX 10      /* a comment in resize() */
 
 static void __alias_free_mem(struct rcu_head *head)
 {
@@ -393,6 +403,8 @@ static void tnode_free_safe(struct tnode *tn)
         BUG_ON(IS_LEAF(tn));
         tn->tnode_free = tnode_free_head;
         tnode_free_head = tn;
+        tnode_free_size += sizeof(struct tnode) +
+                           (sizeof(struct node *) << tn->bits);
 }
 
 static void tnode_free_flush(void)
@@ -404,6 +416,11 @@ static void tnode_free_flush(void)
                 tn->tnode_free = NULL;
                 tnode_free(tn);
         }
+
+        if (tnode_free_size >= PAGE_SIZE * sync_pages) {
+                tnode_free_size = 0;
+                synchronize_rcu();
+        }
 }
 
 static struct leaf *leaf_new(void)
@@ -602,7 +619,8 @@ static struct node *resize(struct trie *t, struct tnode *tn)
         /* Keep root node larger  */
 
         if (!tn->parent)
-                inflate_threshold_use = inflate_threshold_root;
+                inflate_threshold_use = inflate_threshold_root +
+                                        inflate_threshold_root_fix;
         else
                 inflate_threshold_use = inflate_threshold;
 
@@ -626,15 +644,27 @@ static struct node *resize(struct trie *t, struct tnode *tn)
         }
 
         if (max_resize < 0) {
-                if (!tn->parent)
-                        pr_warning("Fix inflate_threshold_root."
-                                   " Now=%d size=%d bits\n",
-                                   inflate_threshold_root, tn->bits);
-                else
+                if (!tn->parent) {
+                        /*
+                         * It was observed that during large updates even
+                         * inflate_threshold_root = 35 might be needed to avoid
+                         * this warning; but it should be temporary, so let's
+                         * try to handle this automatically.
+                         */
+                        if (inflate_threshold_root_fix < INFLATE_FIX_MAX)
+                                inflate_threshold_root_fix++;
+                        else
+                                pr_warning("Fix inflate_threshold_root."
+                                           " Now=%d size=%d bits fix=%d\n",
+                                           inflate_threshold_root, tn->bits,
+                                           inflate_threshold_root_fix);
+                } else {
                         pr_warning("Fix inflate_threshold."
                                    " Now=%d size=%d bits\n",
                                    inflate_threshold, tn->bits);
-        }
+                }
+        } else if (max_resize > 3 && !tn->parent && inflate_threshold_root_fix)
+                inflate_threshold_root_fix--;
 
         check_tnode(tn);
 
@@ -1435,7 +1465,7 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
                         cindex = tkey_extract_bits(mask_pfx(key, current_prefix_length),
                                                    pos, bits);
 
-                n = tnode_get_child(pn, cindex);
+                n = tnode_get_child_rcu(pn, cindex);
 
                 if (n == NULL) {
 #ifdef CONFIG_IP_FIB_TRIE_STATS
@@ -1570,7 +1600,7 @@ backtrace:
                 if (chopped_off <= pn->bits) {
                         cindex &= ~(1 << (chopped_off-1));
                 } else {
-                        struct tnode *parent = node_parent((struct node *) pn);
+                        struct tnode *parent = node_parent_rcu((struct node *) pn);
                         if (!parent)
                                 goto failed;
 
@@ -1783,7 +1813,7 @@ static struct leaf *trie_firstleaf(struct trie *t)
 static struct leaf *trie_nextleaf(struct leaf *l)
 {
         struct node *c = (struct node *) l;
-        struct tnode *p = node_parent(c);
+        struct tnode *p = node_parent_rcu(c);
 
         if (!p)
                 return NULL;    /* trie with just one leaf */
@@ -2391,7 +2421,7 @@ static inline const char *rtn_scope(char *buf, size_t len, enum rt_scope_t s)
         }
 }
 
-static const char *rtn_type_names[__RTN_MAX] = {
+static const char *const rtn_type_names[__RTN_MAX] = {
         [RTN_UNSPEC] = "UNSPEC",
         [RTN_UNICAST] = "UNICAST",
         [RTN_LOCAL] = "LOCAL",
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index cb4a0f4bd5e5..b902ef55be7f 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -821,7 +821,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         stats->tx_dropped++;
                         dev_kfree_skb(skb);
                         tunnel->recursion--;
-                        return 0;
+                        return NETDEV_TX_OK;
                 }
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
@@ -889,7 +889,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         IPTUNNEL_XMIT();
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 
 tx_error_icmp:
         dst_link_failure(skb);
@@ -898,7 +898,7 @@ tx_error:
         stats->tx_errors++;
         dev_kfree_skb(skb);
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int ipgre_tunnel_bind_dev(struct net_device *dev)
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 93e2b787da20..98075b6d619c 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -486,7 +486,7 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         stats->tx_dropped++;
                         dev_kfree_skb(skb);
                         tunnel->recursion--;
-                        return 0;
+                        return NETDEV_TX_OK;
                 }
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
@@ -524,7 +524,7 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         IPTUNNEL_XMIT();
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 
 tx_error_icmp:
         dst_link_failure(skb);
@@ -532,7 +532,7 @@ tx_error:
         stats->tx_errors++;
         dev_kfree_skb(skb);
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static void ipip_tunnel_bind_dev(struct net_device *dev)
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9a8da5ed92b7..06c33fb6b321 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -212,7 +212,7 @@ static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
                           IGMPMSG_WHOLEPKT);
         read_unlock(&mrt_lock);
         kfree_skb(skb);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct net_device_ops reg_vif_netdev_ops = {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 278f46f5011b..fafbe163e2b5 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3442,7 +3442,7 @@ int __init ip_rt_init(void)
                 printk(KERN_ERR "Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
         xfrm_init();
-        xfrm4_init();
+        xfrm4_init(ip_rt_max_size);
 #endif
         rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL);
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index bd62712848fa..4e004424d400 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -59,6 +59,7 @@ int sysctl_tcp_base_mss __read_mostly = 512;
 /* By default, RFC2861 behavior.  */
 int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
 
+/* Account for new data that has been sent to the network. */
 static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -142,6 +143,7 @@ static void tcp_cwnd_restart(struct sock *sk, struct dst_entry *dst)
         tp->snd_cwnd_used = 0;
 }
 
+/* Congestion state accounting after a packet has been sent. */
 static void tcp_event_data_sent(struct tcp_sock *tp,
                                 struct sk_buff *skb, struct sock *sk)
 {
@@ -161,6 +163,7 @@ static void tcp_event_data_sent(struct tcp_sock *tp,
                 icsk->icsk_ack.pingpong = 1;
 }
 
+/* Account for an ACK we sent. */
 static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
 {
         tcp_dec_quickack_mode(sk, pkts);
@@ -276,6 +279,7 @@ static u16 tcp_select_window(struct sock *sk)
         return new_win;
 }
 
+/* Packet ECN state for a SYN-ACK */
 static inline void TCP_ECN_send_synack(struct tcp_sock *tp, struct sk_buff *skb)
 {
         TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_CWR;
@@ -283,6 +287,7 @@ static inline void TCP_ECN_send_synack(struct tcp_sock *tp, struct sk_buff *skb)
                 TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_ECE;
 }
 
+/* Packet ECN state for a SYN.  */
 static inline void TCP_ECN_send_syn(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -301,6 +306,9 @@ TCP_ECN_make_synack(struct request_sock *req, struct tcphdr *th)
                 th->ece = 1;
 }
 
+/* Set up ECN state for a packet on a ESTABLISHED socket that is about to
+ * be sent.
+ */
 static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
                                 int tcp_header_len)
 {
@@ -362,7 +370,9 @@ struct tcp_out_options {
         __u32 tsval, tsecr;     /* need to include OPTION_TS */
 };
 
-/* Beware: Something in the Internet is very sensitive to the ordering of
+/* Write previously computed TCP options to the packet.
+ *
+ * Beware: Something in the Internet is very sensitive to the ordering of
  * TCP options, we learned this through the hard way, so be careful here.
  * Luckily we can at least blame others for their non-compliance but from
  * inter-operatibility perspective it seems that we're somewhat stuck with
@@ -445,6 +455,9 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
         }
 }
 
+/* Compute TCP options for SYN packets. This is not the final
+ * network wire format yet.
+ */
 static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_out_options *opts,
                                 struct tcp_md5sig_key **md5) {
@@ -493,6 +506,7 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         return size;
 }
 
+/* Set up TCP options for SYN-ACKs. */
 static unsigned tcp_synack_options(struct sock *sk,
                                    struct request_sock *req,
                                    unsigned mss, struct sk_buff *skb,
@@ -541,6 +555,9 @@ static unsigned tcp_synack_options(struct sock *sk,
         return size;
 }
 
+/* Compute TCP options for ESTABLISHED sockets. This is not the
+ * final wire format yet.
+ */
 static unsigned tcp_established_options(struct sock *sk, struct sk_buff *skb,
                                         struct tcp_out_options *opts,
                                         struct tcp_md5sig_key **md5) {
@@ -705,7 +722,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         return net_xmit_eval(err);
 }
 
-/* This routine just queue's the buffer
+/* This routine just queues the buffer for sending.
  *
  * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames,
  * otherwise socket can stall.
@@ -722,6 +739,7 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
         sk_mem_charge(sk, skb->truesize);
 }
 
+/* Initialize TSO segments for a packet. */
 static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
                                  unsigned int mss_now)
 {
@@ -909,6 +927,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
         skb->len = skb->data_len;
 }
 
+/* Remove acked data from a packet in the transmit queue. */
 int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
 {
         if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
@@ -937,7 +956,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
         return 0;
 }
 
-/* Not accounting for SACKs here. */
+/* Calculate MSS. Not accounting for SACKs here.  */
 int tcp_mtu_to_mss(struct sock *sk, int pmtu)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -981,6 +1000,7 @@ int tcp_mss_to_mtu(struct sock *sk, int mss)
         return mtu;
 }
 
+/* MTU probing init per socket */
 void tcp_mtup_init(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -1143,7 +1163,8 @@ static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp,
         return 0;
 }
 
-/* This must be invoked the first time we consider transmitting
+/* Intialize TSO state of a skb.
+ * This must be invoked the first time we consider transmitting
  * SKB onto the wire.
  */
 static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
@@ -1158,6 +1179,7 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
         return tso_segs;
 }
 
+/* Minshall's variant of the Nagle send check. */
 static inline int tcp_minshall_check(const struct tcp_sock *tp)
 {
         return after(tp->snd_sml, tp->snd_una) &&
@@ -1242,6 +1264,7 @@ static unsigned int tcp_snd_test(struct sock *sk, struct sk_buff *skb,
         return cwnd_quota;
 }
 
+/* Test if sending is allowed right now. */
 int tcp_may_send_now(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -1378,6 +1401,10 @@ send_now:
 }
 
 /* Create a new MTU probe if we are ready.
+ * MTU probe is regularly attempting to increase the path MTU by
+ * deliberately sending larger packets.  This discovers routing
+ * changes resulting in larger path MTUs.
+ *
  * Returns 0 if we should wait to probe (no cwnd available),
  *         1 if a probe was sent,
  *         -1 otherwise
@@ -1790,6 +1817,7 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
         sk_wmem_free_skb(sk, next_skb);
 }
 
+/* Check if coalescing SKBs is legal. */
 static int tcp_can_collapse(struct sock *sk, struct sk_buff *skb)
 {
         if (tcp_skb_pcount(skb) > 1)
@@ -1808,6 +1836,9 @@ static int tcp_can_collapse(struct sock *sk, struct sk_buff *skb)
         return 1;
 }
 
+/* Collapse packets in the retransmit queue to make to create
+ * less packets on the wire. This is only done on retransmission.
+ */
 static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
                                      int space)
 {
@@ -1957,6 +1988,9 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         return err;
 }
 
+/* Check if we forward retransmits are possible in the current
+ * window/congestion state.
+ */
 static int tcp_can_forward_retransmit(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -2145,7 +2179,8 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
 }
 
-/* WARNING: This routine must only be called when we have already sent
+/* Send a crossed SYN-ACK during socket establishment.
+ * WARNING: This routine must only be called when we have already sent
  * a SYN packet that crossed the incoming SYN that caused this routine
  * to get called. If this assumption fails then the initial rcv_wnd
  * and rcv_wscale values will not be correct.
@@ -2180,9 +2215,7 @@ int tcp_send_synack(struct sock *sk)
         return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
 }
 
-/*
- * Prepare a SYN-ACK.
- */
+/* Prepare a SYN-ACK. */
 struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                                 struct request_sock *req)
 {
@@ -2269,9 +2302,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         return skb;
 }
 
-/*
- * Do all connect socket setups that can be done AF independent.
- */
+/* Do all connect socket setups that can be done AF independent. */
 static void tcp_connect_init(struct sock *sk)
 {
         struct dst_entry *dst = __sk_dst_get(sk);
@@ -2330,9 +2361,7 @@ static void tcp_connect_init(struct sock *sk)
         tcp_clear_retrans(tp);
 }
 
-/*
- * Build a SYN and send it off.
- */
+/* Build a SYN and send it off. */
 int tcp_connect(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -2493,6 +2522,7 @@ static int tcp_xmit_probe_skb(struct sock *sk, int urgent)
         return tcp_transmit_skb(sk, skb, 0, GFP_ATOMIC);
 }
 
+/* Initiate keepalive or window probe from timer. */
 int tcp_write_wakeup(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 80e3812837ad..29ebb0d27a1e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -110,11 +110,12 @@ struct udp_table udp_table;
 EXPORT_SYMBOL(udp_table);
 
 int sysctl_udp_mem[3] __read_mostly;
-int sysctl_udp_rmem_min __read_mostly;
-int sysctl_udp_wmem_min __read_mostly;
-
 EXPORT_SYMBOL(sysctl_udp_mem);
+
+int sysctl_udp_rmem_min __read_mostly;
 EXPORT_SYMBOL(sysctl_udp_rmem_min);
+
+int sysctl_udp_wmem_min __read_mostly;
 EXPORT_SYMBOL(sysctl_udp_wmem_min);
 
 atomic_t udp_memory_allocated;
@@ -158,7 +159,7 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
  */
 int udp_lib_get_port(struct sock *sk, unsigned short snum,
                        int (*saddr_comp)(const struct sock *sk1,
-                                         const struct sock *sk2 )    )
+                                         const struct sock *sk2))
 {
         struct udp_hslot *hslot;
         struct udp_table *udptable = sk->sk_prot->h.udp_table;
@@ -221,14 +222,15 @@ fail_unlock:
 fail:
         return error;
 }
+EXPORT_SYMBOL(udp_lib_get_port);
 
 static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
 {
         struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
 
-        return  ( !ipv6_only_sock(sk2)  &&
-                  (!inet1->rcv_saddr || !inet2->rcv_saddr ||
-                   inet1->rcv_saddr == inet2->rcv_saddr      ));
+        return  (!ipv6_only_sock(sk2)  &&
+                 (!inet1->rcv_saddr || !inet2->rcv_saddr ||
+                   inet1->rcv_saddr == inet2->rcv_saddr));
 }
 
 int udp_v4_get_port(struct sock *sk, unsigned short snum)
@@ -383,8 +385,8 @@ found:
 void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
 {
         struct inet_sock *inet;
-        struct iphdr *iph = (struct iphdr*)skb->data;
-        struct udphdr *uh = (struct udphdr*)(skb->data+(iph->ihl<<2));
+        struct iphdr *iph = (struct iphdr *)skb->data;
+        struct udphdr *uh = (struct udphdr *)(skb->data+(iph->ihl<<2));
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
         struct sock *sk;
@@ -439,7 +441,7 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
                 if (!harderr || sk->sk_state != TCP_ESTABLISHED)
                         goto out;
         } else {
-                ip_icmp_error(sk, skb, err, uh->dest, info, (u8*)(uh+1));
+                ip_icmp_error(sk, skb, err, uh->dest, info, (u8 *)(uh+1));
         }
         sk->sk_err = err;
         sk->sk_error_report(sk);
@@ -474,7 +476,7 @@ EXPORT_SYMBOL(udp_flush_pending_frames);
  *              (checksum field must be zeroed out)
  */
 static void udp4_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
-                                 __be32 src, __be32 dst, int len      )
+                                 __be32 src, __be32 dst, int len)
 {
         unsigned int offset;
         struct udphdr *uh = udp_hdr(skb);
@@ -545,7 +547,7 @@ static int udp_push_pending_frames(struct sock *sk)
 
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
 
-                udp4_hwcsum_outgoing(sk, skb, fl->fl4_src,fl->fl4_dst, up->len);
+                udp4_hwcsum_outgoing(sk, skb, fl->fl4_src, fl->fl4_dst, up->len);
                 goto send;
 
         } else                                           /*   `normal' UDP    */
@@ -553,7 +555,7 @@ static int udp_push_pending_frames(struct sock *sk)
 
         /* add protocol-dependent pseudo-header */
         uh->check = csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst, up->len,
-                                      sk->sk_protocol, csum             );
+                                      sk->sk_protocol, csum);
         if (uh->check == 0)
                 uh->check = CSUM_MANGLED_0;
 
@@ -592,7 +594,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Check the flags.
          */
 
-        if (msg->msg_flags&MSG_OOB)     /* Mirror BSD error message compatibility */
+        if (msg->msg_flags & MSG_OOB) /* Mirror BSD error message compatibility */
                 return -EOPNOTSUPP;
 
         ipc.opt = NULL;
@@ -619,7 +621,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Get and verify the address.
          */
         if (msg->msg_name) {
-                struct sockaddr_in * usin = (struct sockaddr_in*)msg->msg_name;
+                struct sockaddr_in * usin = (struct sockaddr_in *)msg->msg_name;
                 if (msg->msg_namelen < sizeof(*usin))
                         return -EINVAL;
                 if (usin->sin_family != AF_INET) {
@@ -684,7 +686,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         }
 
         if (connected)
-                rt = (struct rtable*)sk_dst_check(sk, 0);
+                rt = (struct rtable *)sk_dst_check(sk, 0);
 
         if (rt == NULL) {
                 struct flowi fl = { .oif = ipc.oif,
@@ -782,6 +784,7 @@ do_confirm:
         err = 0;
         goto out;
 }
+EXPORT_SYMBOL(udp_sendmsg);
 
 int udp_sendpage(struct sock *sk, struct page *page, int offset,
                  size_t size, int flags)
@@ -871,6 +874,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 
         return 0;
 }
+EXPORT_SYMBOL(udp_ioctl);
 
 /*
  *      This should be easy, if there is something there we
@@ -892,7 +896,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Check any passed addresses
          */
         if (addr_len)
-                *addr_len=sizeof(*sin);
+                *addr_len = sizeof(*sin);
 
         if (flags & MSG_ERRQUEUE)
                 return ip_recv_error(sk, msg, len);
@@ -923,9 +927,11 @@ try_again:
 
         if (skb_csum_unnecessary(skb))
                 err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied       );
+                                              msg->msg_iov, copied);
         else {
-                err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
+                err = skb_copy_and_csum_datagram_iovec(skb,
+                                                       sizeof(struct udphdr),
+                                                       msg->msg_iov);
 
                 if (err == -EINVAL)
                         goto csum_copy_err;
@@ -941,8 +947,7 @@ try_again:
         sock_recv_timestamp(msg, sk, skb);
 
         /* Copy the address. */
-        if (sin)
-        {
+        if (sin) {
                 sin->sin_family = AF_INET;
                 sin->sin_port = udp_hdr(skb)->source;
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
@@ -995,6 +1000,7 @@ int udp_disconnect(struct sock *sk, int flags)
         sk_dst_reset(sk);
         return 0;
 }
+EXPORT_SYMBOL(udp_disconnect);
 
 void udp_lib_unhash(struct sock *sk)
 {
@@ -1044,7 +1050,7 @@ drop:
  * Note that in the success and error cases, the skb is assumed to
  * have either been requeued or freed.
  */
-int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         struct udp_sock *up = udp_sk(sk);
         int rc;
@@ -1214,7 +1220,7 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
         if (uh->check == 0) {
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         } else if (skb->ip_summed == CHECKSUM_COMPLETE) {
-               if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
+                if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
                                       proto, skb->csum))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
@@ -1355,7 +1361,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
         int err = 0;
         int is_udplite = IS_UDPLITE(sk);
 
-        if (optlen<sizeof(int))
+        if (optlen < sizeof(int))
                 return -EINVAL;
 
         if (get_user(val, (int __user *)optval))
@@ -1426,6 +1432,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
 
         return err;
 }
+EXPORT_SYMBOL(udp_lib_setsockopt);
 
 int udp_setsockopt(struct sock *sk, int level, int optname,
                    char __user *optval, int optlen)
@@ -1453,7 +1460,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
         struct udp_sock *up = udp_sk(sk);
         int val, len;
 
-        if (get_user(len,optlen))
+        if (get_user(len, optlen))
                 return -EFAULT;
 
         len = min_t(unsigned int, len, sizeof(int));
@@ -1486,10 +1493,11 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
 
         if (put_user(len, optlen))
                 return -EFAULT;
-        if (copy_to_user(optval, &val,len))
+        if (copy_to_user(optval, &val, len))
                 return -EFAULT;
         return 0;
 }
+EXPORT_SYMBOL(udp_lib_getsockopt);
 
 int udp_getsockopt(struct sock *sk, int level, int optname,
                    char __user *optval, int __user *optlen)
@@ -1528,9 +1536,9 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
         int     is_lite = IS_UDPLITE(sk);
 
         /* Check for false positives due to checksum errors */
-        if ( (mask & POLLRDNORM) &&
-             !(file->f_flags & O_NONBLOCK) &&
-             !(sk->sk_shutdown & RCV_SHUTDOWN)){
+        if ((mask & POLLRDNORM) &&
+            !(file->f_flags & O_NONBLOCK) &&
+            !(sk->sk_shutdown & RCV_SHUTDOWN)) {
                 struct sk_buff_head *rcvq = &sk->sk_receive_queue;
                 struct sk_buff *skb;
 
@@ -1552,6 +1560,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
         return mask;
 
 }
+EXPORT_SYMBOL(udp_poll);
 
 struct proto udp_prot = {
         .name              = "UDP",
@@ -1582,6 +1591,7 @@ struct proto udp_prot = {
         .compat_getsockopt = compat_udp_getsockopt,
 #endif
 };
+EXPORT_SYMBOL(udp_prot);
 
 /* ------------------------------------------------------------------------ */
 #ifdef CONFIG_PROC_FS
@@ -1703,11 +1713,13 @@ int udp_proc_register(struct net *net, struct udp_seq_afinfo *afinfo)
                 rc = -ENOMEM;
         return rc;
 }
+EXPORT_SYMBOL(udp_proc_register);
 
 void udp_proc_unregister(struct net *net, struct udp_seq_afinfo *afinfo)
 {
         proc_net_remove(net, afinfo->name);
 }
+EXPORT_SYMBOL(udp_proc_unregister);
 
 /* ------------------------------------------------------------------------ */
 static void udp4_format_sock(struct sock *sp, struct seq_file *f,
@@ -1741,7 +1753,7 @@ int udp4_seq_show(struct seq_file *seq, void *v)
                 int len;
 
                 udp4_format_sock(v, seq, state->bucket, &len);
-                seq_printf(seq, "%*s\n", 127 - len ,"");
+                seq_printf(seq, "%*s\n", 127 - len, "");
         }
         return 0;
 }
@@ -1816,16 +1828,64 @@ void __init udp_init(void)
         sysctl_udp_wmem_min = SK_MEM_QUANTUM;
 }
 
-EXPORT_SYMBOL(udp_disconnect);
-EXPORT_SYMBOL(udp_ioctl);
-EXPORT_SYMBOL(udp_prot);
-EXPORT_SYMBOL(udp_sendmsg);
-EXPORT_SYMBOL(udp_lib_getsockopt);
-EXPORT_SYMBOL(udp_lib_setsockopt);
-EXPORT_SYMBOL(udp_poll);
-EXPORT_SYMBOL(udp_lib_get_port);
+int udp4_ufo_send_check(struct sk_buff *skb)
+{
+        const struct iphdr *iph;
+        struct udphdr *uh;
+
+        if (!pskb_may_pull(skb, sizeof(*uh)))
+                return -EINVAL;
+
+        iph = ip_hdr(skb);
+        uh = udp_hdr(skb);
+
+        uh->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
+                                       IPPROTO_UDP, 0);
+        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_offset = offsetof(struct udphdr, check);
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        return 0;
+}
+
+struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, int features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        unsigned int mss;
+        int offset;
+        __wsum csum;
+
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
+        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
+                /* Packet is from an untrusted source, reset gso_segs. */
+                int type = skb_shinfo(skb)->gso_type;
+
+                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
+                             !(type & (SKB_GSO_UDP))))
+                        goto out;
+
+                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
+
+                segs = NULL;
+                goto out;
+        }
+
+        /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
+         * do checksum of UDP packets sent as multiple IP fragments.
+         */
+        offset = skb->csum_start - skb_headroom(skb);
+        csum = skb_checksum(skb, offset, skb->len - offset, 0);
+        offset += skb->csum_offset;
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        skb->ip_summed = CHECKSUM_NONE;
+
+        /* Fragment the skb. IP headers of the fragments are updated in
+         * inet_gso_segment()
+         */
+        segs = skb_segment(skb, features);
+out:
+        return segs;
+}
 
-#ifdef CONFIG_PROC_FS
-EXPORT_SYMBOL(udp_proc_register);
-EXPORT_SYMBOL(udp_proc_unregister);
-#endif
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 0071ee6f441f..74fb2eb833ec 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -264,6 +264,22 @@ static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
         .fill_dst =             xfrm4_fill_dst,
 };
 
+#ifdef CONFIG_SYSCTL
+static struct ctl_table xfrm4_policy_table[] = {
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "xfrm4_gc_thresh",
+                .data           = &xfrm4_dst_ops.gc_thresh,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        { }
+};
+
+static struct ctl_table_header *sysctl_hdr;
+#endif
+
 static void __init xfrm4_policy_init(void)
 {
         xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
@@ -271,12 +287,31 @@ static void __init xfrm4_policy_init(void)
 
 static void __exit xfrm4_policy_fini(void)
 {
+#ifdef CONFIG_SYSCTL
+        if (sysctl_hdr)
+                unregister_net_sysctl_table(sysctl_hdr);
+#endif
         xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
 }
 
-void __init xfrm4_init(void)
+void __init xfrm4_init(int rt_max_size)
 {
         xfrm4_state_init();
         xfrm4_policy_init();
+        /*
+         * Select a default value for the gc_thresh based on the main route
+         * table hash size.  It seems to me the worst case scenario is when
+         * we have ipsec operating in transport mode, in which we create a
+         * dst_entry per socket.  The xfrm gc algorithm starts trying to remove
+         * entries at gc_thresh, and prevents new allocations as 2*gc_thresh
+         * so lets set an initial xfrm gc_thresh value at the rt_max_size/2.
+         * That will let us store an ipsec connection per route table entry,
+         * and start cleaning when were 1/2 full
+         */
+        xfrm4_dst_ops.gc_thresh = rt_max_size/2;
+#ifdef CONFIG_SYSCTL
+        sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv4_ctl_path,
+                                                xfrm4_policy_table);
+#endif
 }
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index caa0278d30a9..bf85d5f97032 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -772,6 +772,11 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct ipv6hdr *ipv6h;
         struct inet6_protocol *ops;
+        int proto;
+        struct frag_hdr *fptr;
+        unsigned int unfrag_ip6hlen;
+        u8 *prevhdr;
+        int offset = 0;
 
         if (!(features & NETIF_F_V6_CSUM))
                 features &= ~NETIF_F_SG;
@@ -791,10 +796,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
         __skb_pull(skb, sizeof(*ipv6h));
         segs = ERR_PTR(-EPROTONOSUPPORT);
 
+        proto = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
         rcu_read_lock();
-        ops = rcu_dereference(inet6_protos[
-                ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr)]);
-
+        ops = rcu_dereference(inet6_protos[proto]);
         if (likely(ops && ops->gso_segment)) {
                 skb_reset_transport_header(skb);
                 segs = ops->gso_segment(skb, features);
@@ -808,6 +812,16 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
                 ipv6h = ipv6_hdr(skb);
                 ipv6h->payload_len = htons(skb->len - skb->mac_len -
                                            sizeof(*ipv6h));
+                if (proto == IPPROTO_UDP) {
+                        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                        fptr = (struct frag_hdr *)(skb_network_header(skb) +
+                                unfrag_ip6hlen);
+                        fptr->frag_off = htons(offset);
+                        if (skb->next != NULL)
+                                fptr->frag_off |= htons(IP6_MF);
+                        offset += (ntohs(ipv6h->payload_len) -
+                                   sizeof(struct frag_hdr));
+                }
         }
 
 out:
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index eab62a7a8f06..e2325f6a05fb 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -323,7 +323,7 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
         int iif = 0;
         int addr_type = 0;
         int len;
-        int hlimit, tclass;
+        int hlimit;
         int err = 0;
 
         if ((u8 *)hdr < skb->head ||
@@ -469,10 +469,6 @@ route_done:
         if (hlimit < 0)
                 hlimit = ip6_dst_hoplimit(dst);
 
-        tclass = np->tclass;
-        if (tclass < 0)
-                tclass = 0;
-
         msg.skb = skb;
         msg.offset = skb_network_offset(skb);
         msg.type = type;
@@ -488,8 +484,8 @@ route_done:
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
                               len + sizeof(struct icmp6hdr),
-                              sizeof(struct icmp6hdr),
-                              hlimit, tclass, NULL, &fl, (struct rt6_info*)dst,
+                              sizeof(struct icmp6hdr), hlimit,
+                              np->tclass, NULL, &fl, (struct rt6_info*)dst,
                               MSG_DONTWAIT);
         if (err) {
                 ip6_flush_pending_frames(sk);
@@ -522,7 +518,6 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         struct dst_entry *dst;
         int err = 0;
         int hlimit;
-        int tclass;
 
         saddr = &ipv6_hdr(skb)->daddr;
 
@@ -562,10 +557,6 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (hlimit < 0)
                 hlimit = ip6_dst_hoplimit(dst);
 
-        tclass = np->tclass;
-        if (tclass < 0)
-                tclass = 0;
-
         idev = in6_dev_get(skb->dev);
 
         msg.skb = skb;
@@ -573,7 +564,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         msg.type = ICMPV6_ECHO_REPLY;
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
-                                sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl,
+                                sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl,
                                 (struct rt6_info*)dst, MSG_DONTWAIT);
 
         if (err) {
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 52ee1dced2ff..0e93ca56eb69 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -164,12 +164,6 @@ static __inline__ void rt6_release(struct rt6_info *rt)
                 dst_free(&rt->u.dst);
 }
 
-#ifdef CONFIG_IPV6_MULTIPLE_TABLES
-#define FIB_TABLE_HASHSZ 256
-#else
-#define FIB_TABLE_HASHSZ 1
-#endif
-
 static void fib6_link_table(struct net *net, struct fib6_table *tb)
 {
         unsigned int h;
@@ -180,7 +174,7 @@ static void fib6_link_table(struct net *net, struct fib6_table *tb)
          */
         rwlock_init(&tb->tb6_lock);
 
-        h = tb->tb6_id & (FIB_TABLE_HASHSZ - 1);
+        h = tb->tb6_id & (FIB6_TABLE_HASHSZ - 1);
 
         /*
          * No protection necessary, this is the only list mutatation
@@ -231,7 +225,7 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
 
         if (id == 0)
                 id = RT6_TABLE_MAIN;
-        h = id & (FIB_TABLE_HASHSZ - 1);
+        h = id & (FIB6_TABLE_HASHSZ - 1);
         rcu_read_lock();
         head = &net->ipv6.fib_table_hash[h];
         hlist_for_each_entry_rcu(tb, node, head, tb6_hlist) {
@@ -382,7 +376,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         arg.net = net;
         w->args = &arg;
 
-        for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
+        for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_e = 0) {
                 e = 0;
                 head = &net->ipv6.fib_table_hash[h];
                 hlist_for_each_entry(tb, node, head, tb6_hlist) {
@@ -1368,7 +1362,7 @@ void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
         unsigned int h;
 
         rcu_read_lock();
-        for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
+        for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
                 head = &net->ipv6.fib_table_hash[h];
                 hlist_for_each_entry_rcu(table, node, head, tb6_hlist) {
                         write_lock_bh(&table->tb6_lock);
@@ -1483,7 +1477,7 @@ static int fib6_net_init(struct net *net)
         if (!net->ipv6.rt6_stats)
                 goto out_timer;
 
-        net->ipv6.fib_table_hash = kcalloc(FIB_TABLE_HASHSZ,
+        net->ipv6.fib_table_hash = kcalloc(FIB6_TABLE_HASHSZ,
                                            sizeof(*net->ipv6.fib_table_hash),
                                            GFP_KERNEL);
         if (!net->ipv6.fib_table_hash)
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 6d6a4277c677..2d9cbaa67edb 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -63,7 +63,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
         if (skb->pkt_type == PACKET_OTHERHOST) {
                 kfree_skb(skb);
-                return 0;
+                return NET_RX_DROP;
         }
 
         rcu_read_lock();
@@ -133,7 +133,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                 if (ipv6_parse_hopopts(skb) < 0) {
                         IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INHDRERRORS);
                         rcu_read_unlock();
-                        return 0;
+                        return NET_RX_DROP;
                 }
         }
 
@@ -149,7 +149,7 @@ err:
 drop:
         rcu_read_unlock();
         kfree_skb(skb);
-        return 0;
+        return NET_RX_DROP;
 }
 
 /*
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 87f8419a68fd..6ad5aadf81ad 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -57,18 +57,6 @@
 
 static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
 
-static __inline__ void ipv6_select_ident(struct sk_buff *skb, struct frag_hdr *fhdr)
-{
-        static u32 ipv6_fragmentation_id = 1;
-        static DEFINE_SPINLOCK(ip6_id_lock);
-
-        spin_lock_bh(&ip6_id_lock);
-        fhdr->identification = htonl(ipv6_fragmentation_id);
-        if (++ipv6_fragmentation_id == 0)
-                ipv6_fragmentation_id = 1;
-        spin_unlock_bh(&ip6_id_lock);
-}
-
 int __ip6_local_out(struct sk_buff *skb)
 {
         int len;
@@ -206,7 +194,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         struct ipv6hdr *hdr;
         u8  proto = fl->proto;
         int seg_len = skb->len;
-        int hlimit, tclass;
+        int hlimit = -1;
+        int tclass = 0;
         u32 mtu;
 
         if (opt) {
@@ -249,19 +238,13 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         /*
          *      Fill in the IPv6 header
          */
-
-        hlimit = -1;
-        if (np)
+        if (np) {
+                tclass = np->tclass;
                 hlimit = np->hop_limit;
+        }
         if (hlimit < 0)
                 hlimit = ip6_dst_hoplimit(dst);
 
-        tclass = -1;
-        if (np)
-                tclass = np->tclass;
-        if (tclass < 0)
-                tclass = 0;
-
         *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
 
         hdr->payload_len = htons(seg_len);
@@ -706,7 +689,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 skb_reset_network_header(skb);
                 memcpy(skb_network_header(skb), tmp_hdr, hlen);
 
-                ipv6_select_ident(skb, fh);
+                ipv6_select_ident(fh);
                 fh->nexthdr = nexthdr;
                 fh->reserved = 0;
                 fh->frag_off = htons(IP6_MF);
@@ -844,7 +827,7 @@ slow_path:
                 fh->nexthdr = nexthdr;
                 fh->reserved = 0;
                 if (!frag_id) {
-                        ipv6_select_ident(skb, fh);
+                        ipv6_select_ident(fh);
                         frag_id = fh->identification;
                 } else
                         fh->identification = frag_id;
@@ -1087,11 +1070,13 @@ static inline int ip6_ufo_append_data(struct sock *sk,
         if (!err) {
                 struct frag_hdr fhdr;
 
-                /* specify the length of each IP datagram fragment*/
-                skb_shinfo(skb)->gso_size = mtu - fragheaderlen -
-                                            sizeof(struct frag_hdr);
+                /* Specify the length of each IPv6 datagram fragment.
+                 * It has to be a multiple of 8.
+                 */
+                skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
+                                             sizeof(struct frag_hdr)) & ~7;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
-                ipv6_select_ident(skb, &fhdr);
+                ipv6_select_ident(&fhdr);
                 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                 __skb_queue_tail(&sk->sk_write_queue, skb);
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 51f410e7775a..a1d6045c4694 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1063,14 +1063,14 @@ ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto tx_err;
 
         t->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 
 tx_err:
         stats->tx_errors++;
         stats->tx_dropped++;
         kfree_skb(skb);
         t->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static void ip6_tnl_set_cap(struct ip6_tnl *t)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c769f155c698..07ded5075b33 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -427,7 +427,7 @@ static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
                            MRT6MSG_WHOLEPKT);
         read_unlock(&mrt_lock);
         kfree_skb(skb);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct net_device_ops reg_vif_netdev_ops = {
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index a7fdf9a27f15..f5e0682b402d 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -315,6 +315,9 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                         goto e_inval;
                 if (val < -1 || val > 0xff)
                         goto e_inval;
+                /* RFC 3542, 6.5: default traffic class of 0x0 */
+                if (val == -1)
+                        val = 0;
                 np->tclass = val;
                 retv = 0;
                 break;
@@ -1037,8 +1040,6 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
 
         case IPV6_TCLASS:
                 val = np->tclass;
-                if (val < 0)
-                        val = 0;
                 break;
 
         case IPV6_RECVTCLASS:
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 4b264ed40a8c..71c3dacec1ed 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2107,7 +2107,6 @@ static int ip6_mc_add_src(struct inet6_dev *idev, struct in6_addr *pmca,
                 for (j=0; j<i; j++)
                         (void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
         } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
-                struct inet6_dev *idev = pmc->idev;
                 struct ip6_sf_list *psf;
 
                 /* filter mode change */
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 9eb68e92cc18..1ba42bd65577 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -955,8 +955,8 @@ static void ndisc_recv_na(struct sk_buff *skb)
                  */
                 if (skb->pkt_type != PACKET_LOOPBACK)
                         ND_PRINTK1(KERN_WARNING
-                           "ICMPv6 NA: someone advertises our address on %s!\n",
-                           ifp->idev->dev->name);
+                           "ICMPv6 NA: someone advertises our address %pI6 on %s!\n",
+                           &ifp->addr, ifp->idev->dev->name);
                 in6_ifa_put(ifp);
                 return;
         }
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 590ddefb7ffc..c9605c3ad91f 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -101,7 +101,7 @@ static struct snmp_mib snmp6_icmp6_list[] = {
 };
 
 /* RFC 4293 v6 ICMPMsgStatsTable; named items for RFC 2466 compatibility */
-static char *icmp6type2name[256] = {
+static const char *const icmp6type2name[256] = {
         [ICMPV6_DEST_UNREACH] = "DestUnreachs",
         [ICMPV6_PKT_TOOBIG] = "PktTooBigs",
         [ICMPV6_TIME_EXCEED] = "TimeExcds",
@@ -144,7 +144,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
         /* print by name -- deprecated items */
         for (i = 0; i < ICMP6MSG_MIB_MAX; i++) {
                 int icmptype;
-                char *p;
+                const char *p;
 
                 icmptype = i & 0xff;
                 p = icmp6type2name[icmptype];
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d6c3c1c34b2d..506841030fbe 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -877,11 +877,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                         hlimit = ip6_dst_hoplimit(dst);
         }
 
-        if (tclass < 0) {
+        if (tclass < 0)
                 tclass = np->tclass;
-                if (tclass < 0)
-                        tclass = 0;
-        }
 
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 98b7327d0949..d335a306a4db 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -753,7 +753,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         stats->tx_dropped++;
                         dev_kfree_skb(skb);
                         tunnel->recursion--;
-                        return 0;
+                        return NETDEV_TX_OK;
                 }
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
@@ -794,7 +794,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         IPTUNNEL_XMIT();
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 
 tx_error_icmp:
         dst_link_failure(skb);
@@ -802,7 +802,7 @@ tx_error:
         stats->tx_errors++;
         dev_kfree_skb(skb);
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static void ipip6_tunnel_bind_dev(struct net_device *dev)
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index a031034720b4..0dc6a4e5ed4a 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -40,7 +40,7 @@ static ctl_table ipv6_table_template[] = {
         { .ctl_name = 0 }
 };
 
-static ctl_table ipv6_table[] = {
+static ctl_table ipv6_rotable[] = {
         {
                 .ctl_name       = NET_IPV6_MLD_MAX_MSF,
                 .procname       = "mld_max_msf",
@@ -130,7 +130,7 @@ int ipv6_sysctl_register(void)
 {
         int err = -ENOMEM;
 
-        ip6_header = register_net_sysctl_rotable(net_ipv6_ctl_path, ipv6_table);
+        ip6_header = register_net_sysctl_rotable(net_ipv6_ctl_path, ipv6_rotable);
         if (ip6_header == NULL)
                 goto out;
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 33b59bd92c4d..20d2ffc15f0d 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -638,6 +638,47 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
         }
 }
 
+/**
+ *      udp6_hwcsum_outgoing  -  handle outgoing HW checksumming
+ *      @sk:    socket we are sending on
+ *      @skb:   sk_buff containing the filled-in UDP header
+ *              (checksum field must be zeroed out)
+ */
+static void udp6_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
+                                 const struct in6_addr *saddr,
+                                 const struct in6_addr *daddr, int len)
+{
+        unsigned int offset;
+        struct udphdr *uh = udp_hdr(skb);
+        __wsum csum = 0;
+
+        if (skb_queue_len(&sk->sk_write_queue) == 1) {
+                /* Only one fragment on the socket.  */
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct udphdr, check);
+                uh->check = ~csum_ipv6_magic(saddr, daddr, len, IPPROTO_UDP, 0);
+        } else {
+                /*
+                 * HW-checksum won't work as there are two or more
+                 * fragments on the socket so that all csums of sk_buffs
+                 * should be together
+                 */
+                offset = skb_transport_offset(skb);
+                skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
+
+                skb->ip_summed = CHECKSUM_NONE;
+
+                skb_queue_walk(&sk->sk_write_queue, skb) {
+                        csum = csum_add(csum, skb->csum);
+                }
+
+                uh->check = csum_ipv6_magic(saddr, daddr, len, IPPROTO_UDP,
+                                            csum);
+                if (uh->check == 0)
+                        uh->check = CSUM_MANGLED_0;
+        }
+}
+
 /*
  *      Sending
  */
@@ -668,7 +709,11 @@ static int udp_v6_push_pending_frames(struct sock *sk)
 
         if (is_udplite)
                 csum = udplite_csum_outgoing(sk, skb);
-         else
+        else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
+                udp6_hwcsum_outgoing(sk, skb, &fl->fl6_src, &fl->fl6_dst,
+                                     up->len);
+                goto send;
+        } else
                 csum = udp_csum_outgoing(sk, skb);
 
         /* add protocol-dependent pseudo-header */
@@ -677,6 +722,7 @@ static int udp_v6_push_pending_frames(struct sock *sk)
         if (uh->check == 0)
                 uh->check = CSUM_MANGLED_0;
 
+send:
         err = ip6_push_pending_frames(sk);
 out:
         up->len = 0;
@@ -900,11 +946,8 @@ do_udp_sendmsg:
                         hlimit = ip6_dst_hoplimit(dst);
         }
 
-        if (tclass < 0) {
+        if (tclass < 0)
                 tclass = np->tclass;
-                if (tclass < 0)
-                        tclass = 0;
-        }
 
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
@@ -1032,9 +1075,102 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
 }
 #endif
 
+static int udp6_ufo_send_check(struct sk_buff *skb)
+{
+        struct ipv6hdr *ipv6h;
+        struct udphdr *uh;
+
+        if (!pskb_may_pull(skb, sizeof(*uh)))
+                return -EINVAL;
+
+        ipv6h = ipv6_hdr(skb);
+        uh = udp_hdr(skb);
+
+        uh->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
+                                     IPPROTO_UDP, 0);
+        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_offset = offsetof(struct udphdr, check);
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        return 0;
+}
+
+static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        unsigned int mss;
+        unsigned int unfrag_ip6hlen, unfrag_len;
+        struct frag_hdr *fptr;
+        u8 *mac_start, *prevhdr;
+        u8 nexthdr;
+        u8 frag_hdr_sz = sizeof(struct frag_hdr);
+        int offset;
+        __wsum csum;
+
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
+        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
+                /* Packet is from an untrusted source, reset gso_segs. */
+                int type = skb_shinfo(skb)->gso_type;
+
+                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
+                             !(type & (SKB_GSO_UDP))))
+                        goto out;
+
+                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
+
+                segs = NULL;
+                goto out;
+        }
+
+        /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
+         * do checksum of UDP packets sent as multiple IP fragments.
+         */
+        offset = skb->csum_start - skb_headroom(skb);
+        csum = skb_checksum(skb, offset, skb->len- offset, 0);
+        offset += skb->csum_offset;
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        skb->ip_summed = CHECKSUM_NONE;
+
+        /* Check if there is enough headroom to insert fragment header. */
+        if ((skb_headroom(skb) < frag_hdr_sz) &&
+            pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
+                goto out;
+
+        /* Find the unfragmentable header and shift it left by frag_hdr_sz
+         * bytes to insert fragment header.
+         */
+        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+        nexthdr = *prevhdr;
+        *prevhdr = NEXTHDR_FRAGMENT;
+        unfrag_len = skb_network_header(skb) - skb_mac_header(skb) +
+                     unfrag_ip6hlen;
+        mac_start = skb_mac_header(skb);
+        memmove(mac_start-frag_hdr_sz, mac_start, unfrag_len);
+
+        skb->mac_header -= frag_hdr_sz;
+        skb->network_header -= frag_hdr_sz;
+
+        fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+        fptr->nexthdr = nexthdr;
+        fptr->reserved = 0;
+        ipv6_select_ident(fptr);
+
+        /* Fragment the skb. ipv6 header and the remaining fields of the
+         * fragment header are updated in ipv6_gso_segment()
+         */
+        segs = skb_segment(skb, features);
+
+out:
+        return segs;
+}
+
 static struct inet6_protocol udpv6_protocol = {
         .handler        =       udpv6_rcv,
         .err_handler    =       udpv6_err,
+        .gso_send_check =       udp6_ufo_send_check,
+        .gso_segment    =       udp6_ufo_fragment,
         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
 
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 3a3c677bc0f2..8ec3d45cd1d9 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -306,9 +306,26 @@ static void xfrm6_policy_fini(void)
         xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
 }
 
+#ifdef CONFIG_SYSCTL
+static struct ctl_table xfrm6_policy_table[] = {
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "xfrm6_gc_thresh",
+                .data           = &xfrm6_dst_ops.gc_thresh,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        { }
+};
+
+static struct ctl_table_header *sysctl_hdr;
+#endif
+
 int __init xfrm6_init(void)
 {
         int ret;
+        unsigned int gc_thresh;
 
         ret = xfrm6_policy_init();
         if (ret)
@@ -317,6 +334,23 @@ int __init xfrm6_init(void)
         ret = xfrm6_state_init();
         if (ret)
                 goto out_policy;
+        /*
+         * We need a good default value for the xfrm6 gc threshold.
+         * In ipv4 we set it to the route hash table size * 8, which
+         * is half the size of the maximaum route cache for ipv4.  It
+         * would be good to do the same thing for v6, except the table is
+         * constructed differently here.  Here each table for a net namespace
+         * can have FIB_TABLE_HASHSZ entries, so lets go with the same
+         * computation that we used for ipv4 here.  Also, lets keep the initial
+         * gc_thresh to a minimum of 1024, since, the ipv6 route cache defaults
+         * to that as a minimum as well
+         */
+        gc_thresh = FIB6_TABLE_HASHSZ * 8;
+        xfrm6_dst_ops.gc_thresh = (gc_thresh < 1024) ? 1024 : gc_thresh;
+#ifdef CONFIG_SYSCTL
+        sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv6_ctl_path,
+                                                xfrm6_policy_table);
+#endif
 out:
         return ret;
 out_policy:
@@ -326,6 +360,10 @@ out_policy:
 
 void xfrm6_fini(void)
 {
+#ifdef CONFIG_SYSCTL
+        if (sysctl_hdr)
+                unregister_net_sysctl_table(sysctl_hdr);
+#endif
         //xfrm6_input_fini();
         xfrm6_policy_fini();
         xfrm6_state_fini();
diff --git a/net/irda/ircomm/ircomm_event.c b/net/irda/ircomm/ircomm_event.c
index c35b3ef5c2f0..d78554fedbac 100644
--- a/net/irda/ircomm/ircomm_event.c
+++ b/net/irda/ircomm/ircomm_event.c
@@ -49,7 +49,7 @@ static int ircomm_state_waitr(struct ircomm_cb *self, IRCOMM_EVENT event,
 static int ircomm_state_conn(struct ircomm_cb *self, IRCOMM_EVENT event,
                              struct sk_buff *skb, struct ircomm_info *info);
 
-char *ircomm_state[] = {
+const char *const ircomm_state[] = {
         "IRCOMM_IDLE",
         "IRCOMM_WAITI",
         "IRCOMM_WAITR",
@@ -57,7 +57,7 @@ char *ircomm_state[] = {
 };
 
 #ifdef CONFIG_IRDA_DEBUG
-static char *ircomm_event[] = {
+static const char *const ircomm_event[] = {
         "IRCOMM_CONNECT_REQUEST",
         "IRCOMM_CONNECT_RESPONSE",
         "IRCOMM_TTP_CONNECT_INDICATION",
diff --git a/net/irda/ircomm/ircomm_tty_attach.c b/net/irda/ircomm/ircomm_tty_attach.c
index 9032a1d1190d..eafc010907c2 100644
--- a/net/irda/ircomm/ircomm_tty_attach.c
+++ b/net/irda/ircomm/ircomm_tty_attach.c
@@ -80,7 +80,7 @@ static int ircomm_tty_state_ready(struct ircomm_tty_cb *self,
                                   struct sk_buff *skb,
                                   struct ircomm_tty_info *info);
 
-char *ircomm_tty_state[] = {
+const char *const ircomm_tty_state[] = {
         "IRCOMM_TTY_IDLE",
         "IRCOMM_TTY_SEARCH",
         "IRCOMM_TTY_QUERY_PARAMETERS",
@@ -91,7 +91,7 @@ char *ircomm_tty_state[] = {
 };
 
 #ifdef CONFIG_IRDA_DEBUG
-static char *ircomm_tty_event[] = {
+static const char *const ircomm_tty_event[] = {
         "IRCOMM_TTY_ATTACH_CABLE",
         "IRCOMM_TTY_DETACH_CABLE",
         "IRCOMM_TTY_DATA_REQUEST",
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 4a105dc32dcd..294e34d3517c 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -44,7 +44,7 @@
 
 #ifdef CONFIG_IRDA_DEBUG
 /* FIXME: This one should go in irlmp.c */
-static const char *ias_charset_types[] = {
+static const char *const ias_charset_types[] = {
         "CS_ASCII",
         "CS_ISO_8859_1",
         "CS_ISO_8859_2",
@@ -966,7 +966,7 @@ static void iriap_watchdog_timer_expired(void *data)
 
 #ifdef CONFIG_PROC_FS
 
-static const char *ias_value_types[] = {
+static const char *const ias_value_types[] = {
         "IAS_MISSING",
         "IAS_INTEGER",
         "IAS_OCT_SEQ",
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index 774d73a76852..62116829b817 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -69,14 +69,14 @@ static int eth;   /* Use "eth" or "irlan" name for devices */
 static int access = ACCESS_PEER; /* PEER, DIRECT or HOSTED */
 
 #ifdef CONFIG_PROC_FS
-static const char *irlan_access[] = {
+static const char *const irlan_access[] = {
         "UNKNOWN",
         "DIRECT",
         "PEER",
         "HOSTED"
 };
 
-static const char *irlan_media[] = {
+static const char *const irlan_media[] = {
         "UNKNOWN",
         "802.3",
         "802.5"
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 724bcf951b80..64230cffcfee 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -177,7 +177,7 @@ static int irlan_eth_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 /* Did the realloc succeed? */
                 if (new_skb == NULL)
-                        return 0;
+                        return NETDEV_TX_OK;
 
                 /* Use the new skb instead */
                 skb = new_skb;
@@ -209,7 +209,7 @@ static int irlan_eth_xmit(struct sk_buff *skb, struct net_device *dev)
                 self->stats.tx_bytes += skb->len;
         }
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 /*
diff --git a/net/irda/irlap.c b/net/irda/irlap.c
index e4965b764b9b..356e65b1dc42 100644
--- a/net/irda/irlap.c
+++ b/net/irda/irlap.c
@@ -63,7 +63,7 @@ static void irlap_init_qos_capabilities(struct irlap_cb *self,
                                         struct qos_info *qos_user);
 
 #ifdef CONFIG_IRDA_DEBUG
-static char *lap_reasons[] = {
+static const char *const lap_reasons[] = {
         "ERROR, NOT USED",
         "LAP_DISC_INDICATION",
         "LAP_NO_RESPONSE",
diff --git a/net/irda/irlap_event.c b/net/irda/irlap_event.c
index 16c4ef0f5c1a..c5c51959e3ce 100644
--- a/net/irda/irlap_event.c
+++ b/net/irda/irlap_event.c
@@ -78,7 +78,7 @@ static int irlap_state_reset_check(struct irlap_cb *, IRLAP_EVENT event,
                                    struct sk_buff *, struct irlap_info *);
 
 #ifdef CONFIG_IRDA_DEBUG
-static const char *irlap_event[] = {
+static const char *const irlap_event[] = {
         "DISCOVERY_REQUEST",
         "CONNECT_REQUEST",
         "CONNECT_RESPONSE",
@@ -120,7 +120,7 @@ static const char *irlap_event[] = {
 };
 #endif  /* CONFIG_IRDA_DEBUG */
 
-const char *irlap_state[] = {
+const char *const irlap_state[] = {
         "LAP_NDM",
         "LAP_QUERY",
         "LAP_REPLY",
diff --git a/net/irda/irlmp_event.c b/net/irda/irlmp_event.c
index 78cce0cb073f..c1fb5db81042 100644
--- a/net/irda/irlmp_event.c
+++ b/net/irda/irlmp_event.c
@@ -33,13 +33,13 @@
 #include <net/irda/irlmp_frame.h>
 #include <net/irda/irlmp_event.h>
 
-const char *irlmp_state[] = {
+const char *const irlmp_state[] = {
         "LAP_STANDBY",
         "LAP_U_CONNECT",
         "LAP_ACTIVE",
 };
 
-const char *irlsap_state[] = {
+const char *const irlsap_state[] = {
         "LSAP_DISCONNECTED",
         "LSAP_CONNECT",
         "LSAP_CONNECT_PEND",
@@ -49,7 +49,7 @@ const char *irlsap_state[] = {
 };
 
 #ifdef CONFIG_IRDA_DEBUG
-static const char *irlmp_event[] = {
+static const char *const irlmp_event[] = {
         "LM_CONNECT_REQUEST",
         "LM_CONNECT_CONFIRM",
         "LM_CONNECT_RESPONSE",
diff --git a/net/irda/irnetlink.c b/net/irda/irnetlink.c
index 8dd7ed7e7c1f..476b307bd801 100644
--- a/net/irda/irnetlink.c
+++ b/net/irda/irnetlink.c
@@ -115,7 +115,7 @@ static int irda_nl_get_mode(struct sk_buff *skb, struct genl_info *info)
 
         genlmsg_end(msg, hdr);
 
-        return genlmsg_unicast(msg, info->snd_pid);
+        return genlmsg_reply(msg, info);
 
  err_out:
         nlmsg_free(msg);
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index 2ba1bc4f3c3a..bda96d18fd98 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -407,7 +407,7 @@ int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
                 return lapb->callbacks.data_indication(lapb->dev, skb);
 
         kfree_skb(skb);
-        return NET_RX_CN_HIGH; /* For now; must be != NET_RX_DROP */
+        return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
 }
 
 int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index f97be471fe2e..be47ac427f6b 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -143,7 +143,7 @@ out:
         return 0;
 }
 
-static char *llc_conn_state_names[] = {
+static const char *const llc_conn_state_names[] = {
         [LLC_CONN_STATE_ADM] =        "adm",
         [LLC_CONN_STATE_SETUP] =      "setup",
         [LLC_CONN_STATE_NORMAL] =     "normal",
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 7836ee928983..9db4ff836a3d 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -6,7 +6,6 @@ config MAC80211
         select CRYPTO_ARC4
         select CRYPTO_AES
         select CRC32
-        select WIRELESS_EXT
         ---help---
           This option enables the hardware independent IEEE 802.11
           networking stack.
@@ -14,22 +13,6 @@ config MAC80211
 comment "CFG80211 needs to be enabled for MAC80211"
         depends on CFG80211=n
 
-config MAC80211_DEFAULT_PS
-        bool "enable powersave by default"
-        depends on MAC80211
-        default y
-        help
-          This option enables powersave mode by default.
-
-          If this causes your applications to misbehave you should fix your
-          applications instead -- they need to register their network
-          latency requirement, see Documentation/power/pm_qos_interface.txt.
-
-config MAC80211_DEFAULT_PS_VALUE
-        int
-        default 1 if MAC80211_DEFAULT_PS
-        default 0
-
 menu "Rate control algorithm selection"
         depends on MAC80211 != n
 
@@ -83,12 +66,12 @@ endmenu
 config MAC80211_MESH
         bool "Enable mac80211 mesh networking (pre-802.11s) support"
         depends on MAC80211 && EXPERIMENTAL
-        depends on BROKEN
         ---help---
          This options enables support of Draft 802.11s mesh networking.
-         The implementation is based on Draft 1.08 of the Mesh Networking
-         amendment. For more information visit http://o11s.org/.
-
+         The implementation is based on Draft 2.08 of the Mesh Networking
+         amendment.  However, no compliance with that draft is claimed or even
+         possible, as drafts leave a number of identifiers to be defined after
+         ratification.  For more information visit http://o11s.org/.
 
 config MAC80211_LEDS
         bool "Enable LED triggers"
@@ -222,3 +205,15 @@ config MAC80211_DEBUG_COUNTERS
           and show them in debugfs.
 
           If unsure, say N.
+
+config MAC80211_DRIVER_API_TRACER
+        bool "Driver API tracer"
+        depends on MAC80211_DEBUG_MENU
+        depends on EVENT_TRACING
+        help
+          Say Y here to make mac80211 register with the ftrace
+          framework for the driver API -- you can see which
+          driver methods it is calling then by looking at the
+          trace.
+
+          If unsure, say N.
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 0e3ab88bb706..9f3cf7129324 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -3,7 +3,6 @@ obj-$(CONFIG_MAC80211) += mac80211.o
 # mac80211 objects
 mac80211-y := \
         main.o \
-        wext.o \
         sta_info.o \
         wep.o \
         wpa.o \
@@ -41,6 +40,9 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
 
 mac80211-$(CONFIG_PM) += pm.o
 
+mac80211-$(CONFIG_MAC80211_DRIVER_API_TRACER) += driver-trace.o
+CFLAGS_driver-trace.o := -I$(src)
+
 # objects for PID algorithm
 rc80211_pid-y := rc80211_pid_algo.o
 rc80211_pid-$(CONFIG_MAC80211_DEBUGFS) += rc80211_pid_debugfs.o
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index a24e59816b93..bd765f30dba2 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -391,9 +391,6 @@ static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
 
         if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                /* mark queue as pending, it is stopped already */
-                __set_bit(IEEE80211_QUEUE_STOP_REASON_PENDING,
-                          &local->queue_stop_reasons[queue]);
                 /* copy over remaining packets */
                 skb_queue_splice_tail_init(
                         &sta->ampdu_mlme.tid_tx[tid]->pending,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 3f47276caeb8..5608f6c68413 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -57,36 +57,21 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
         return 0;
 }
 
-static int ieee80211_del_iface(struct wiphy *wiphy, int ifindex)
+static int ieee80211_del_iface(struct wiphy *wiphy, struct net_device *dev)
 {
-        struct net_device *dev;
-        struct ieee80211_sub_if_data *sdata;
-
-        /* we're under RTNL */
-        dev = __dev_get_by_index(&init_net, ifindex);
-        if (!dev)
-                return -ENODEV;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        ieee80211_if_remove(sdata);
+        ieee80211_if_remove(IEEE80211_DEV_TO_SUB_IF(dev));
 
         return 0;
 }
 
-static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
+static int ieee80211_change_iface(struct wiphy *wiphy,
+                                  struct net_device *dev,
                                   enum nl80211_iftype type, u32 *flags,
                                   struct vif_params *params)
 {
-        struct net_device *dev;
         struct ieee80211_sub_if_data *sdata;
         int ret;
 
-        /* we're under RTNL */
-        dev = __dev_get_by_index(&init_net, ifindex);
-        if (!dev)
-                return -ENODEV;
-
         if (!nl80211_type_check(type))
                 return -EINVAL;
 
@@ -338,6 +323,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        sinfo->generation = sdata->local->sta_generation;
+
         sinfo->filled = STATION_INFO_INACTIVE_TIME |
                         STATION_INFO_RX_BYTES |
                         STATION_INFO_TX_BYTES |
@@ -924,6 +911,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
         else
                 memset(next_hop, 0, ETH_ALEN);
 
+        pinfo->generation = mesh_paths_generation;
+
         pinfo->filled = MPATH_INFO_FRAME_QLEN |
                         MPATH_INFO_DSN |
                         MPATH_INFO_METRIC |
@@ -1177,123 +1166,29 @@ static int ieee80211_scan(struct wiphy *wiphy,
 static int ieee80211_auth(struct wiphy *wiphy, struct net_device *dev,
                           struct cfg80211_auth_request *req)
 {
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        switch (req->auth_type) {
-        case NL80211_AUTHTYPE_OPEN_SYSTEM:
-                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_OPEN;
-                break;
-        case NL80211_AUTHTYPE_SHARED_KEY:
-                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_SHARED_KEY;
-                break;
-        case NL80211_AUTHTYPE_FT:
-                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_FT;
-                break;
-        case NL80211_AUTHTYPE_NETWORK_EAP:
-                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_LEAP;
-                break;
-        default:
-                return -EOPNOTSUPP;
-        }
-
-        memcpy(sdata->u.mgd.bssid, req->peer_addr, ETH_ALEN);
-        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-        sdata->u.mgd.flags |= IEEE80211_STA_BSSID_SET;
-
-        /* TODO: req->chan */
-        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_CHANNEL_SEL;
-
-        if (req->ssid) {
-                sdata->u.mgd.flags |= IEEE80211_STA_SSID_SET;
-                memcpy(sdata->u.mgd.ssid, req->ssid, req->ssid_len);
-                sdata->u.mgd.ssid_len = req->ssid_len;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
-        }
-
-        kfree(sdata->u.mgd.sme_auth_ie);
-        sdata->u.mgd.sme_auth_ie = NULL;
-        sdata->u.mgd.sme_auth_ie_len = 0;
-        if (req->ie) {
-                sdata->u.mgd.sme_auth_ie = kmalloc(req->ie_len, GFP_KERNEL);
-                if (sdata->u.mgd.sme_auth_ie == NULL)
-                        return -ENOMEM;
-                memcpy(sdata->u.mgd.sme_auth_ie, req->ie, req->ie_len);
-                sdata->u.mgd.sme_auth_ie_len = req->ie_len;
-        }
-
-        sdata->u.mgd.flags |= IEEE80211_STA_EXT_SME;
-        sdata->u.mgd.state = IEEE80211_STA_MLME_DIRECT_PROBE;
-        ieee80211_sta_req_auth(sdata);
-        return 0;
+        return ieee80211_mgd_auth(IEEE80211_DEV_TO_SUB_IF(dev), req);
 }
 
 static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
                            struct cfg80211_assoc_request *req)
 {
-        struct ieee80211_sub_if_data *sdata;
-        int ret;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (memcmp(sdata->u.mgd.bssid, req->peer_addr, ETH_ALEN) != 0 ||
-            !(sdata->u.mgd.flags & IEEE80211_STA_AUTHENTICATED))
-                return -ENOLINK; /* not authenticated */
-
-        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-        sdata->u.mgd.flags |= IEEE80211_STA_BSSID_SET;
-
-        /* TODO: req->chan */
-        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_CHANNEL_SEL;
-
-        if (req->ssid) {
-                sdata->u.mgd.flags |= IEEE80211_STA_SSID_SET;
-                memcpy(sdata->u.mgd.ssid, req->ssid, req->ssid_len);
-                sdata->u.mgd.ssid_len = req->ssid_len;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
-        } else
-                sdata->u.mgd.flags |= IEEE80211_STA_AUTO_SSID_SEL;
-
-        ret = ieee80211_sta_set_extra_ie(sdata, req->ie, req->ie_len);
-        if (ret && ret != -EALREADY)
-                return ret;
-
-        if (req->use_mfp) {
-                sdata->u.mgd.mfp = IEEE80211_MFP_REQUIRED;
-                sdata->u.mgd.flags |= IEEE80211_STA_MFP_ENABLED;
-        } else {
-                sdata->u.mgd.mfp = IEEE80211_MFP_DISABLED;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_MFP_ENABLED;
-        }
-
-        if (req->control_port)
-                sdata->u.mgd.flags |= IEEE80211_STA_CONTROL_PORT;
-        else
-                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
-
-        sdata->u.mgd.flags |= IEEE80211_STA_EXT_SME;
-        sdata->u.mgd.state = IEEE80211_STA_MLME_ASSOCIATE;
-        ieee80211_sta_req_auth(sdata);
-        return 0;
+        return ieee80211_mgd_assoc(IEEE80211_DEV_TO_SUB_IF(dev), req);
 }
 
 static int ieee80211_deauth(struct wiphy *wiphy, struct net_device *dev,
-                            struct cfg80211_deauth_request *req)
+                            struct cfg80211_deauth_request *req,
+                            void *cookie)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        /* TODO: req->ie, req->peer_addr */
-        return ieee80211_sta_deauthenticate(sdata, req->reason_code);
+        return ieee80211_mgd_deauth(IEEE80211_DEV_TO_SUB_IF(dev),
+                                    req, cookie);
 }
 
 static int ieee80211_disassoc(struct wiphy *wiphy, struct net_device *dev,
-                              struct cfg80211_disassoc_request *req)
+                              struct cfg80211_disassoc_request *req,
+                              void *cookie)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        /* TODO: req->ie, req->peer_addr */
-        return ieee80211_sta_disassociate(sdata, req->reason_code);
+        return ieee80211_mgd_disassoc(IEEE80211_DEV_TO_SUB_IF(dev),
+                                      req, cookie);
 }
 
 static int ieee80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
@@ -1374,6 +1269,16 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy, int *dbm)
         return 0;
 }
 
+static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
+                                  u8 *addr)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        memcpy(&sdata->u.wds.remote_addr, addr, ETH_ALEN);
+
+        return 0;
+}
+
 static void ieee80211_rfkill_poll(struct wiphy *wiphy)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
@@ -1381,6 +1286,85 @@ static void ieee80211_rfkill_poll(struct wiphy *wiphy)
         drv_rfkill_poll(local);
 }
 
+#ifdef CONFIG_NL80211_TESTMODE
+static int ieee80211_testmode_cmd(struct wiphy *wiphy, void *data, int len)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        if (!local->ops->testmode_cmd)
+                return -EOPNOTSUPP;
+
+        return local->ops->testmode_cmd(&local->hw, data, len);
+}
+#endif
+
+static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
+                                    bool enabled, int timeout)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_conf *conf = &local->hw.conf;
+
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
+                return -EOPNOTSUPP;
+
+        if (enabled == sdata->u.mgd.powersave &&
+            timeout == conf->dynamic_ps_timeout)
+                return 0;
+
+        sdata->u.mgd.powersave = enabled;
+        conf->dynamic_ps_timeout = timeout;
+
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+
+        ieee80211_recalc_ps(local, -1);
+
+        return 0;
+}
+
+static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
+                                      struct net_device *dev,
+                                      const u8 *addr,
+                                      const struct cfg80211_bitrate_mask *mask)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        int i, err = -EINVAL;
+        u32 target_rate;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        /* target_rate = -1, rate->fixed = 0 means auto only, so use all rates
+         * target_rate = X, rate->fixed = 1 means only rate X
+         * target_rate = X, rate->fixed = 0 means all rates <= X */
+        sdata->max_ratectrl_rateidx = -1;
+        sdata->force_unicast_rateidx = -1;
+
+        if (mask->fixed)
+                target_rate = mask->fixed / 100;
+        else if (mask->maxrate)
+                target_rate = mask->maxrate / 100;
+        else
+                return 0;
+
+        for (i=0; i< sband->n_bitrates; i++) {
+                struct ieee80211_rate *brate = &sband->bitrates[i];
+                int this_rate = brate->bitrate;
+
+                if (target_rate == this_rate) {
+                        sdata->max_ratectrl_rateidx = i;
+                        if (mask->fixed)
+                                sdata->force_unicast_rateidx = i;
+                        err = 0;
+                        break;
+                }
+        }
+
+        return err;
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1422,5 +1406,9 @@ struct cfg80211_ops mac80211_config_ops = {
         .set_wiphy_params = ieee80211_set_wiphy_params,
         .set_tx_power = ieee80211_set_tx_power,
         .get_tx_power = ieee80211_get_tx_power,
+        .set_wds_peer = ieee80211_set_wds_peer,
         .rfkill_poll = ieee80211_rfkill_poll,
+        CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
+        .set_power_mgmt = ieee80211_set_power_mgmt,
+        .set_bitrate_mask = ieee80211_set_bitrate_mask,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 6c439cd5ccea..96991b68f048 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -175,7 +175,7 @@ static ssize_t queues_read(struct file *file, char __user *user_buf,
         for (q = 0; q < local->hw.queues; q++)
                 res += sprintf(buf + res, "%02d: %#.8lx/%d\n", q,
                                 local->queue_stop_reasons[q],
-                                __netif_subqueue_stopped(local->mdev, q));
+                                skb_queue_len(&local->pending[q]));
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, res);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index e3420329f4e6..e9ec6cae2d39 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -95,33 +95,9 @@ IEEE80211_IF_FILE(force_unicast_rateidx, force_unicast_rateidx, DEC);
 IEEE80211_IF_FILE(max_ratectrl_rateidx, max_ratectrl_rateidx, DEC);
 
 /* STA attributes */
-IEEE80211_IF_FILE(state, u.mgd.state, DEC);
 IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
-IEEE80211_IF_FILE(prev_bssid, u.mgd.prev_bssid, MAC);
-IEEE80211_IF_FILE(ssid_len, u.mgd.ssid_len, SIZE);
 IEEE80211_IF_FILE(aid, u.mgd.aid, DEC);
-IEEE80211_IF_FILE(ap_capab, u.mgd.ap_capab, HEX);
 IEEE80211_IF_FILE(capab, u.mgd.capab, HEX);
-IEEE80211_IF_FILE(extra_ie_len, u.mgd.extra_ie_len, SIZE);
-IEEE80211_IF_FILE(auth_tries, u.mgd.auth_tries, DEC);
-IEEE80211_IF_FILE(assoc_tries, u.mgd.assoc_tries, DEC);
-IEEE80211_IF_FILE(auth_algs, u.mgd.auth_algs, HEX);
-IEEE80211_IF_FILE(auth_alg, u.mgd.auth_alg, DEC);
-IEEE80211_IF_FILE(auth_transaction, u.mgd.auth_transaction, DEC);
-
-static ssize_t ieee80211_if_fmt_flags(
-        const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
-{
-        return scnprintf(buf, buflen, "%s%s%s%s%s%s%s\n",
-                 sdata->u.mgd.flags & IEEE80211_STA_SSID_SET ? "SSID\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_BSSID_SET ? "BSSID\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_PREV_BSSID_SET ? "prev BSSID\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_AUTHENTICATED ? "AUTH\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED ? "ASSOC\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_PROBEREQ_POLL ? "PROBEREQ POLL\n" : "",
-                 sdata->vif.bss_conf.use_cts_prot ? "CTS prot\n" : "");
-}
-__IEEE80211_IF_FILE(flags);
 
 /* AP attributes */
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
@@ -184,20 +160,9 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(force_unicast_rateidx, sta);
         DEBUGFS_ADD(max_ratectrl_rateidx, sta);
 
-        DEBUGFS_ADD(state, sta);
         DEBUGFS_ADD(bssid, sta);
-        DEBUGFS_ADD(prev_bssid, sta);
-        DEBUGFS_ADD(ssid_len, sta);
         DEBUGFS_ADD(aid, sta);
-        DEBUGFS_ADD(ap_capab, sta);
         DEBUGFS_ADD(capab, sta);
-        DEBUGFS_ADD(extra_ie_len, sta);
-        DEBUGFS_ADD(auth_tries, sta);
-        DEBUGFS_ADD(assoc_tries, sta);
-        DEBUGFS_ADD(auth_algs, sta);
-        DEBUGFS_ADD(auth_alg, sta);
-        DEBUGFS_ADD(auth_transaction, sta);
-        DEBUGFS_ADD(flags, sta);
 }
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
@@ -317,20 +282,9 @@ static void del_sta_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_DEL(force_unicast_rateidx, sta);
         DEBUGFS_DEL(max_ratectrl_rateidx, sta);
 
-        DEBUGFS_DEL(state, sta);
         DEBUGFS_DEL(bssid, sta);
-        DEBUGFS_DEL(prev_bssid, sta);
-        DEBUGFS_DEL(ssid_len, sta);
         DEBUGFS_DEL(aid, sta);
-        DEBUGFS_DEL(ap_capab, sta);
         DEBUGFS_DEL(capab, sta);
-        DEBUGFS_DEL(extra_ie_len, sta);
-        DEBUGFS_DEL(auth_tries, sta);
-        DEBUGFS_DEL(assoc_tries, sta);
-        DEBUGFS_DEL(auth_algs, sta);
-        DEBUGFS_DEL(auth_alg, sta);
-        DEBUGFS_DEL(auth_transaction, sta);
-        DEBUGFS_DEL(flags, sta);
 }
 
 static void del_ap_files(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 90230c718b5b..33a2e892115b 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -120,45 +120,38 @@ STA_OPS(last_seq_ctrl);
 static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
                                         size_t count, loff_t *ppos)
 {
-        char buf[768], *p = buf;
+        char buf[30 + STA_TID_NUM * 70], *p = buf;
         int i;
         struct sta_info *sta = file->private_data;
-        p += scnprintf(p, sizeof(buf)+buf-p, "Agg state for STA is:\n");
-        p += scnprintf(p, sizeof(buf)+buf-p, " STA next dialog_token is %d \n "
-                        "TIDs info is: \n TID :",
-                        (sta->ampdu_mlme.dialog_token_allocator + 1));
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d", i);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n RX  :");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_rx[i]);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_rx[i] ?
-                        sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n TX  :");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i]);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i] ?
-                        sta->ampdu_mlme.tid_tx[i]->dialog_token : 0);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n SSN :");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i] ?
-                        sta->ampdu_mlme.tid_tx[i]->ssn : 0);
 
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n");
+        spin_lock_bh(&sta->lock);
+        p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
+                        sta->ampdu_mlme.dialog_token_allocator + 1);
+        for (i = 0; i < STA_TID_NUM; i++) {
+                p += scnprintf(p, sizeof(buf)+buf-p, "TID %02d:", i);
+                p += scnprintf(p, sizeof(buf)+buf-p, " RX=%x",
+                                sta->ampdu_mlme.tid_state_rx[i]);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/DTKN=%#.2x",
+                                sta->ampdu_mlme.tid_state_rx[i] ?
+                                sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/SSN=%#.3x",
+                                sta->ampdu_mlme.tid_state_rx[i] ?
+                                sta->ampdu_mlme.tid_rx[i]->ssn : 0);
+
+                p += scnprintf(p, sizeof(buf)+buf-p, " TX=%x",
+                                sta->ampdu_mlme.tid_state_tx[i]);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/DTKN=%#.2x",
+                                sta->ampdu_mlme.tid_state_tx[i] ?
+                                sta->ampdu_mlme.tid_tx[i]->dialog_token : 0);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/SSN=%#.3x",
+                                sta->ampdu_mlme.tid_state_tx[i] ?
+                                sta->ampdu_mlme.tid_tx[i]->ssn : 0);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/pending=%03d",
+                                sta->ampdu_mlme.tid_state_tx[i] ?
+                                skb_queue_len(&sta->ampdu_mlme.tid_tx[i]->pending) : 0);
+                p += scnprintf(p, sizeof(buf)+buf-p, "\n");
+        }
+        spin_unlock_bh(&sta->lock);
 
         return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 }
@@ -203,6 +196,22 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(inactive_ms);
         DEBUGFS_ADD(last_seq_ctrl);
         DEBUGFS_ADD(agg_status);
+        DEBUGFS_ADD(dev);
+        DEBUGFS_ADD(rx_packets);
+        DEBUGFS_ADD(tx_packets);
+        DEBUGFS_ADD(rx_bytes);
+        DEBUGFS_ADD(tx_bytes);
+        DEBUGFS_ADD(rx_duplicates);
+        DEBUGFS_ADD(rx_fragments);
+        DEBUGFS_ADD(rx_dropped);
+        DEBUGFS_ADD(tx_fragments);
+        DEBUGFS_ADD(tx_filtered);
+        DEBUGFS_ADD(tx_retry_failed);
+        DEBUGFS_ADD(tx_retry_count);
+        DEBUGFS_ADD(last_signal);
+        DEBUGFS_ADD(last_qual);
+        DEBUGFS_ADD(last_noise);
+        DEBUGFS_ADD(wep_weak_iv_count);
 }
 
 void ieee80211_sta_debugfs_remove(struct sta_info *sta)
@@ -212,6 +221,23 @@ void ieee80211_sta_debugfs_remove(struct sta_info *sta)
         DEBUGFS_DEL(inactive_ms);
         DEBUGFS_DEL(last_seq_ctrl);
         DEBUGFS_DEL(agg_status);
+        DEBUGFS_DEL(aid);
+        DEBUGFS_DEL(dev);
+        DEBUGFS_DEL(rx_packets);
+        DEBUGFS_DEL(tx_packets);
+        DEBUGFS_DEL(rx_bytes);
+        DEBUGFS_DEL(tx_bytes);
+        DEBUGFS_DEL(rx_duplicates);
+        DEBUGFS_DEL(rx_fragments);
+        DEBUGFS_DEL(rx_dropped);
+        DEBUGFS_DEL(tx_fragments);
+        DEBUGFS_DEL(tx_filtered);
+        DEBUGFS_DEL(tx_retry_failed);
+        DEBUGFS_DEL(tx_retry_count);
+        DEBUGFS_DEL(last_signal);
+        DEBUGFS_DEL(last_qual);
+        DEBUGFS_DEL(last_noise);
+        DEBUGFS_DEL(wep_weak_iv_count);
 
         debugfs_remove(sta->debugfs.dir);
         sta->debugfs.dir = NULL;
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index b13446afd48f..4100c361a99d 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -3,6 +3,7 @@
 
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-trace.h"
 
 static inline int drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
 {
@@ -11,29 +12,37 @@ static inline int drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
 
 static inline int drv_start(struct ieee80211_local *local)
 {
-        return local->ops->start(&local->hw);
+        int ret = local->ops->start(&local->hw);
+        trace_drv_start(local, ret);
+        return ret;
 }
 
 static inline void drv_stop(struct ieee80211_local *local)
 {
         local->ops->stop(&local->hw);
+        trace_drv_stop(local);
 }
 
 static inline int drv_add_interface(struct ieee80211_local *local,
                                     struct ieee80211_if_init_conf *conf)
 {
-        return local->ops->add_interface(&local->hw, conf);
+        int ret = local->ops->add_interface(&local->hw, conf);
+        trace_drv_add_interface(local, conf->mac_addr, conf->vif, ret);
+        return ret;
 }
 
 static inline void drv_remove_interface(struct ieee80211_local *local,
                                         struct ieee80211_if_init_conf *conf)
 {
         local->ops->remove_interface(&local->hw, conf);
+        trace_drv_remove_interface(local, conf->mac_addr, conf->vif);
 }
 
 static inline int drv_config(struct ieee80211_local *local, u32 changed)
 {
-        return local->ops->config(&local->hw, changed);
+        int ret = local->ops->config(&local->hw, changed);
+        trace_drv_config(local, changed, ret);
+        return ret;
 }
 
 static inline void drv_bss_info_changed(struct ieee80211_local *local,
@@ -43,6 +52,7 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
 {
         if (local->ops->bss_info_changed)
                 local->ops->bss_info_changed(&local->hw, vif, info, changed);
+        trace_drv_bss_info_changed(local, vif, info, changed);
 }
 
 static inline void drv_configure_filter(struct ieee80211_local *local,
@@ -53,14 +63,18 @@ static inline void drv_configure_filter(struct ieee80211_local *local,
 {
         local->ops->configure_filter(&local->hw, changed_flags, total_flags,
                                      mc_count, mc_list);
+        trace_drv_configure_filter(local, changed_flags, total_flags,
+                                            mc_count);
 }
 
 static inline int drv_set_tim(struct ieee80211_local *local,
                               struct ieee80211_sta *sta, bool set)
 {
+        int ret = 0;
         if (local->ops->set_tim)
-                return local->ops->set_tim(&local->hw, sta, set);
-        return 0;
+                ret = local->ops->set_tim(&local->hw, sta, set);
+        trace_drv_set_tim(local, sta, set, ret);
+        return ret;
 }
 
 static inline int drv_set_key(struct ieee80211_local *local,
@@ -68,7 +82,9 @@ static inline int drv_set_key(struct ieee80211_local *local,
                               struct ieee80211_sta *sta,
                               struct ieee80211_key_conf *key)
 {
-        return local->ops->set_key(&local->hw, cmd, vif, sta, key);
+        int ret = local->ops->set_key(&local->hw, cmd, vif, sta, key);
+        trace_drv_set_key(local, cmd, vif, sta, key, ret);
+        return ret;
 }
 
 static inline void drv_update_tkip_key(struct ieee80211_local *local,
@@ -79,32 +95,41 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
         if (local->ops->update_tkip_key)
                 local->ops->update_tkip_key(&local->hw, conf, address,
                                             iv32, phase1key);
+        trace_drv_update_tkip_key(local, conf, address, iv32);
 }
 
 static inline int drv_hw_scan(struct ieee80211_local *local,
                               struct cfg80211_scan_request *req)
 {
-        return local->ops->hw_scan(&local->hw, req);
+        int ret = local->ops->hw_scan(&local->hw, req);
+        trace_drv_hw_scan(local, req, ret);
+        return ret;
 }
 
 static inline void drv_sw_scan_start(struct ieee80211_local *local)
 {
         if (local->ops->sw_scan_start)
                 local->ops->sw_scan_start(&local->hw);
+        trace_drv_sw_scan_start(local);
 }
 
 static inline void drv_sw_scan_complete(struct ieee80211_local *local)
 {
         if (local->ops->sw_scan_complete)
                 local->ops->sw_scan_complete(&local->hw);
+        trace_drv_sw_scan_complete(local);
 }
 
 static inline int drv_get_stats(struct ieee80211_local *local,
                                 struct ieee80211_low_level_stats *stats)
 {
-        if (!local->ops->get_stats)
-                return -EOPNOTSUPP;
-        return local->ops->get_stats(&local->hw, stats);
+        int ret = -EOPNOTSUPP;
+
+        if (local->ops->get_stats)
+                ret = local->ops->get_stats(&local->hw, stats);
+        trace_drv_get_stats(local, stats, ret);
+
+        return ret;
 }
 
 static inline void drv_get_tkip_seq(struct ieee80211_local *local,
@@ -112,14 +137,17 @@ static inline void drv_get_tkip_seq(struct ieee80211_local *local,
 {
         if (local->ops->get_tkip_seq)
                 local->ops->get_tkip_seq(&local->hw, hw_key_idx, iv32, iv16);
+        trace_drv_get_tkip_seq(local, hw_key_idx, iv32, iv16);
 }
 
 static inline int drv_set_rts_threshold(struct ieee80211_local *local,
                                         u32 value)
 {
+        int ret = 0;
         if (local->ops->set_rts_threshold)
-                return local->ops->set_rts_threshold(&local->hw, value);
-        return 0;
+                ret = local->ops->set_rts_threshold(&local->hw, value);
+        trace_drv_set_rts_threshold(local, value, ret);
+        return ret;
 }
 
 static inline void drv_sta_notify(struct ieee80211_local *local,
@@ -129,46 +157,57 @@ static inline void drv_sta_notify(struct ieee80211_local *local,
 {
         if (local->ops->sta_notify)
                 local->ops->sta_notify(&local->hw, vif, cmd, sta);
+        trace_drv_sta_notify(local, vif, cmd, sta);
 }
 
 static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
                               const struct ieee80211_tx_queue_params *params)
 {
+        int ret = -EOPNOTSUPP;
         if (local->ops->conf_tx)
-                return local->ops->conf_tx(&local->hw, queue, params);
-        return -EOPNOTSUPP;
+                ret = local->ops->conf_tx(&local->hw, queue, params);
+        trace_drv_conf_tx(local, queue, params, ret);
+        return ret;
 }
 
 static inline int drv_get_tx_stats(struct ieee80211_local *local,
                                    struct ieee80211_tx_queue_stats *stats)
 {
-        return local->ops->get_tx_stats(&local->hw, stats);
+        int ret = local->ops->get_tx_stats(&local->hw, stats);
+        trace_drv_get_tx_stats(local, stats, ret);
+        return ret;
 }
 
 static inline u64 drv_get_tsf(struct ieee80211_local *local)
 {
+        u64 ret = -1ULL;
         if (local->ops->get_tsf)
-                return local->ops->get_tsf(&local->hw);
-        return -1ULL;
+                ret = local->ops->get_tsf(&local->hw);
+        trace_drv_get_tsf(local, ret);
+        return ret;
 }
 
 static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
 {
         if (local->ops->set_tsf)
                 local->ops->set_tsf(&local->hw, tsf);
+        trace_drv_set_tsf(local, tsf);
 }
 
 static inline void drv_reset_tsf(struct ieee80211_local *local)
 {
         if (local->ops->reset_tsf)
                 local->ops->reset_tsf(&local->hw);
+        trace_drv_reset_tsf(local);
 }
 
 static inline int drv_tx_last_beacon(struct ieee80211_local *local)
 {
+        int ret = 1;
         if (local->ops->tx_last_beacon)
-                return local->ops->tx_last_beacon(&local->hw);
-        return 1;
+                ret = local->ops->tx_last_beacon(&local->hw);
+        trace_drv_tx_last_beacon(local, ret);
+        return ret;
 }
 
 static inline int drv_ampdu_action(struct ieee80211_local *local,
@@ -176,10 +215,12 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
                                    struct ieee80211_sta *sta, u16 tid,
                                    u16 *ssn)
 {
+        int ret = -EOPNOTSUPP;
         if (local->ops->ampdu_action)
-                return local->ops->ampdu_action(&local->hw, action,
-                                                sta, tid, ssn);
-        return -EOPNOTSUPP;
+                ret = local->ops->ampdu_action(&local->hw, action,
+                                               sta, tid, ssn);
+        trace_drv_ampdu_action(local, action, sta, tid, ssn, ret);
+        return ret;
 }
 
 
diff --git a/net/mac80211/driver-trace.c b/net/mac80211/driver-trace.c
new file mode 100644
index 000000000000..8ed8711b1a6d
--- /dev/null
+++ b/net/mac80211/driver-trace.c
@@ -0,0 +1,9 @@
+/* bug in tracepoint.h, it should include this */
+#include <linux/module.h>
+
+/* sparse isn't too happy with all macros... */
+#ifndef __CHECKER__
+#include "driver-ops.h"
+#define CREATE_TRACE_POINTS
+#include "driver-trace.h"
+#endif
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
new file mode 100644
index 000000000000..5a10da2d70fd
--- /dev/null
+++ b/net/mac80211/driver-trace.h
@@ -0,0 +1,648 @@
+#if !defined(__MAC80211_DRIVER_TRACE) || defined(TRACE_HEADER_MULTI_READ)
+#define __MAC80211_DRIVER_TRACE
+
+#include <linux/tracepoint.h>
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+
+#if !defined(CONFIG_MAC80211_DRIVER_API_TRACER) || defined(__CHECKER__)
+#undef TRACE_EVENT
+#define TRACE_EVENT(name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#endif
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM mac80211
+
+#define MAXNAME         32
+#define LOCAL_ENTRY     __array(char, wiphy_name, 32)
+#define LOCAL_ASSIGN    strlcpy(__entry->wiphy_name, wiphy_name(local->hw.wiphy), MAXNAME)
+#define LOCAL_PR_FMT    "%s"
+#define LOCAL_PR_ARG    __entry->wiphy_name
+
+#define STA_ENTRY       __array(char, sta_addr, ETH_ALEN)
+#define STA_ASSIGN      (sta ? memcpy(__entry->sta_addr, sta->addr, ETH_ALEN) : memset(__entry->sta_addr, 0, ETH_ALEN))
+#define STA_PR_FMT      " sta:%pM"
+#define STA_PR_ARG      __entry->sta_addr
+
+#define VIF_ENTRY       __field(enum nl80211_iftype, vif_type) __field(void *, vif)
+#define VIF_ASSIGN      __entry->vif_type = vif ? vif->type : 0; __entry->vif = vif
+#define VIF_PR_FMT      " vif:%p(%d)"
+#define VIF_PR_ARG      __entry->vif, __entry->vif_type
+
+TRACE_EVENT(drv_start,
+        TP_PROTO(struct ieee80211_local *local, int ret),
+
+        TP_ARGS(local, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_stop,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_add_interface,
+        TP_PROTO(struct ieee80211_local *local,
+                 const u8 *addr,
+                 struct ieee80211_vif *vif,
+                 int ret),
+
+        TP_ARGS(local, addr, vif, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __array(char, addr, 6)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                memcpy(__entry->addr, addr, 6);
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " addr:%pM ret:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->addr, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_remove_interface,
+        TP_PROTO(struct ieee80211_local *local,
+                 const u8 *addr, struct ieee80211_vif *vif),
+
+        TP_ARGS(local, addr, vif),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __array(char, addr, 6)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                memcpy(__entry->addr, addr, 6);
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " addr:%pM",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->addr
+        )
+);
+
+TRACE_EVENT(drv_config,
+        TP_PROTO(struct ieee80211_local *local,
+                 u32 changed,
+                 int ret),
+
+        TP_ARGS(local, changed, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, changed)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->changed = changed;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ch:%#x ret:%d",
+                LOCAL_PR_ARG, __entry->changed, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_bss_info_changed,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_vif *vif,
+                 struct ieee80211_bss_conf *info,
+                 u32 changed),
+
+        TP_ARGS(local, vif, info, changed),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(bool, assoc)
+                __field(u16, aid)
+                __field(bool, cts)
+                __field(bool, shortpre)
+                __field(bool, shortslot)
+                __field(u8, dtimper)
+                __field(u16, bcnint)
+                __field(u16, assoc_cap)
+                __field(u64, timestamp)
+                __field(u32, basic_rates)
+                __field(u32, changed)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->changed = changed;
+                __entry->aid = info->aid;
+                __entry->assoc = info->assoc;
+                __entry->shortpre = info->use_short_preamble;
+                __entry->cts = info->use_cts_prot;
+                __entry->shortslot = info->use_short_slot;
+                __entry->dtimper = info->dtim_period;
+                __entry->bcnint = info->beacon_int;
+                __entry->assoc_cap = info->assoc_capability;
+                __entry->timestamp = info->timestamp;
+                __entry->basic_rates = info->basic_rates;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " changed:%#x",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->changed
+        )
+);
+
+TRACE_EVENT(drv_configure_filter,
+        TP_PROTO(struct ieee80211_local *local,
+                 unsigned int changed_flags,
+                 unsigned int *total_flags,
+                 int mc_count),
+
+        TP_ARGS(local, changed_flags, total_flags, mc_count),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(unsigned int, changed)
+                __field(unsigned int, total)
+                __field(int, mc)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->changed = changed_flags;
+                __entry->total = *total_flags;
+                __entry->mc = mc_count;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " changed:%#x total:%#x mc:%d",
+                LOCAL_PR_ARG, __entry->changed, __entry->total, __entry->mc
+        )
+);
+
+TRACE_EVENT(drv_set_tim,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sta *sta, bool set, int ret),
+
+        TP_ARGS(local, sta, set, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                STA_ENTRY
+                __field(bool, set)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                STA_ASSIGN;
+                __entry->set = set;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT STA_PR_FMT " set:%d ret:%d",
+                LOCAL_PR_ARG, STA_PR_FMT, __entry->set, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_set_key,
+        TP_PROTO(struct ieee80211_local *local,
+                 enum set_key_cmd cmd, struct ieee80211_vif *vif,
+                 struct ieee80211_sta *sta,
+                 struct ieee80211_key_conf *key, int ret),
+
+        TP_ARGS(local, cmd, vif, sta, key, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                STA_ENTRY
+                __field(enum ieee80211_key_alg, alg)
+                __field(u8, hw_key_idx)
+                __field(u8, flags)
+                __field(s8, keyidx)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                STA_ASSIGN;
+                __entry->alg = key->alg;
+                __entry->flags = key->flags;
+                __entry->keyidx = key->keyidx;
+                __entry->hw_key_idx = key->hw_key_idx;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_update_tkip_key,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_key_conf *conf,
+                 const u8 *address, u32 iv32),
+
+        TP_ARGS(local, conf, address, iv32),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __array(u8, addr, 6)
+                __field(u32, iv32)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                memcpy(__entry->addr, address, 6);
+                __entry->iv32 = iv32;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " addr:%pM iv32:%#x",
+                LOCAL_PR_ARG, __entry->addr, __entry->iv32
+        )
+);
+
+TRACE_EVENT(drv_hw_scan,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct cfg80211_scan_request *req, int ret),
+
+        TP_ARGS(local, req, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_sw_scan_start,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_sw_scan_complete,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_get_stats,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_low_level_stats *stats,
+                 int ret),
+
+        TP_ARGS(local, stats, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+                __field(unsigned int, ackfail)
+                __field(unsigned int, rtsfail)
+                __field(unsigned int, fcserr)
+                __field(unsigned int, rtssucc)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+                __entry->ackfail = stats->dot11ACKFailureCount;
+                __entry->rtsfail = stats->dot11RTSFailureCount;
+                __entry->fcserr = stats->dot11FCSErrorCount;
+                __entry->rtssucc = stats->dot11RTSSuccessCount;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_get_tkip_seq,
+        TP_PROTO(struct ieee80211_local *local,
+                 u8 hw_key_idx, u32 *iv32, u16 *iv16),
+
+        TP_ARGS(local, hw_key_idx, iv32, iv16),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u8, hw_key_idx)
+                __field(u32, iv32)
+                __field(u16, iv16)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->hw_key_idx = hw_key_idx;
+                __entry->iv32 = *iv32;
+                __entry->iv16 = *iv16;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_set_rts_threshold,
+        TP_PROTO(struct ieee80211_local *local, u32 value, int ret),
+
+        TP_ARGS(local, value, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, value)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+                __entry->value = value;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " value:%d ret:%d",
+                LOCAL_PR_ARG, __entry->value, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_sta_notify,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_vif *vif,
+                 enum sta_notify_cmd cmd,
+                 struct ieee80211_sta *sta),
+
+        TP_ARGS(local, vif, cmd, sta),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                STA_ENTRY
+                __field(u32, cmd)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                STA_ASSIGN;
+                __entry->cmd = cmd;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " cmd:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->cmd
+        )
+);
+
+TRACE_EVENT(drv_conf_tx,
+        TP_PROTO(struct ieee80211_local *local, u16 queue,
+                 const struct ieee80211_tx_queue_params *params,
+                 int ret),
+
+        TP_ARGS(local, queue, params, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u16, queue)
+                __field(u16, txop)
+                __field(u16, cw_min)
+                __field(u16, cw_max)
+                __field(u8, aifs)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->queue = queue;
+                __entry->ret = ret;
+                __entry->txop = params->txop;
+                __entry->cw_max = params->cw_max;
+                __entry->cw_min = params->cw_min;
+                __entry->aifs = params->aifs;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " queue:%d ret:%d",
+                LOCAL_PR_ARG, __entry->queue, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_get_tx_stats,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_tx_queue_stats *stats,
+                 int ret),
+
+        TP_ARGS(local, stats, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_get_tsf,
+        TP_PROTO(struct ieee80211_local *local, u64 ret),
+
+        TP_ARGS(local, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u64, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%llu",
+                LOCAL_PR_ARG, (unsigned long long)__entry->ret
+        )
+);
+
+TRACE_EVENT(drv_set_tsf,
+        TP_PROTO(struct ieee80211_local *local, u64 tsf),
+
+        TP_ARGS(local, tsf),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u64, tsf)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->tsf = tsf;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " tsf:%llu",
+                LOCAL_PR_ARG, (unsigned long long)__entry->tsf
+        )
+);
+
+TRACE_EVENT(drv_reset_tsf,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_tx_last_beacon,
+        TP_PROTO(struct ieee80211_local *local, int ret),
+
+        TP_ARGS(local, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_ampdu_action,
+        TP_PROTO(struct ieee80211_local *local,
+                 enum ieee80211_ampdu_mlme_action action,
+                 struct ieee80211_sta *sta, u16 tid,
+                 u16 *ssn, int ret),
+
+        TP_ARGS(local, action, sta, tid, ssn, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                STA_ENTRY
+                __field(u32, action)
+                __field(u16, tid)
+                __field(u16, ssn)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                STA_ASSIGN;
+                __entry->ret = ret;
+                __entry->action = action;
+                __entry->tid = tid;
+                __entry->ssn = *ssn;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  STA_PR_FMT " action:%d tid:%d ret:%d",
+                LOCAL_PR_ARG, STA_PR_ARG, __entry->action, __entry->tid, __entry->ret
+        )
+);
+#endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE driver-trace
+#include <trace/define_trace.h>
diff --git a/net/mac80211/event.c b/net/mac80211/event.c
index f288d01a6344..01ae759518f6 100644
--- a/net/mac80211/event.c
+++ b/net/mac80211/event.c
@@ -7,8 +7,7 @@
  *
  * mac80211 - events
  */
-
-#include <net/iw_handler.h>
+#include <net/cfg80211.h>
 #include "ieee80211_i.h"
 
 /*
@@ -17,26 +16,12 @@
  * driver or is still in the frame), it should provide that information.
  */
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
-                                     struct ieee80211_hdr *hdr, const u8 *tsc)
+                                     struct ieee80211_hdr *hdr, const u8 *tsc,
+                                     gfp_t gfp)
 {
-        union iwreq_data wrqu;
-        char *buf = kmalloc(128, GFP_ATOMIC);
-
-        if (buf) {
-                /* TODO: needed parameters: count, key type, TSC */
-                sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
-                        "keyid=%d %scast addr=%pM)",
-                        keyidx, hdr->addr1[0] & 0x01 ? "broad" : "uni",
-                        hdr->addr2);
-                memset(&wrqu, 0, sizeof(wrqu));
-                wrqu.data.length = strlen(buf);
-                wireless_send_event(sdata->dev, IWEVCUSTOM, &wrqu, buf);
-                kfree(buf);
-        }
-
         cfg80211_michael_mic_failure(sdata->dev, hdr->addr2,
                                      (hdr->addr1[0] & 0x01) ?
                                      NL80211_KEYTYPE_GROUP :
                                      NL80211_KEYTYPE_PAIRWISE,
-                                     keyidx, tsc);
+                                     keyidx, tsc, gfp);
 }
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 0b30277eb366..920ec8792f4b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -57,7 +57,7 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
          */
         if (auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1)
                 ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, NULL, 0,
-                                    sdata->u.ibss.bssid, 0);
+                                    sdata->u.ibss.bssid, NULL, 0, 0);
 }
 
 static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
@@ -494,7 +494,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
 
         capability = WLAN_CAPABILITY_IBSS;
 
-        if (sdata->default_key)
+        if (ifibss->privacy)
                 capability |= WLAN_CAPABILITY_PRIVACY;
         else
                 sdata->drop_unencrypted = 0;
@@ -524,9 +524,8 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 return;
 
         capability = WLAN_CAPABILITY_IBSS;
-        if (sdata->default_key)
+        if (ifibss->privacy)
                 capability |= WLAN_CAPABILITY_PRIVACY;
-
         if (ifibss->fixed_bssid)
                 bssid = ifibss->bssid;
         if (ifibss->fixed_channel)
@@ -705,7 +704,7 @@ static void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         u16 fc;
 
-        rx_status = (struct ieee80211_rx_status *) skb->cb;
+        rx_status = IEEE80211_SKB_RXCB(skb);
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
@@ -743,7 +742,7 @@ static void ieee80211_ibss_work(struct work_struct *work)
         if (!netif_running(sdata->dev))
                 return;
 
-        if (local->sw_scanning || local->hw_scanning)
+        if (local->scanning)
                 return;
 
         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_ADHOC))
@@ -782,7 +781,7 @@ static void ieee80211_ibss_timer(unsigned long data)
         }
 
         set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
-        queue_work(local->hw.workqueue, &ifibss->work);
+        ieee80211_queue_work(&local->hw, &ifibss->work);
 }
 
 #ifdef CONFIG_PM
@@ -836,8 +835,7 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
 }
 
 ieee80211_rx_result
-ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                       struct ieee80211_rx_status *rx_status)
+ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_mgmt *mgmt;
@@ -852,11 +850,10 @@ ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-                memcpy(skb->cb, rx_status, sizeof(*rx_status));
         case IEEE80211_STYPE_PROBE_REQ:
         case IEEE80211_STYPE_AUTH:
                 skb_queue_tail(&sdata->u.ibss.skb_queue, skb);
-                queue_work(local->hw.workqueue, &sdata->u.ibss.work);
+                ieee80211_queue_work(&local->hw, &sdata->u.ibss.work);
                 return RX_QUEUED;
         }
 
@@ -874,6 +871,8 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         } else
                 sdata->u.ibss.fixed_bssid = false;
 
+        sdata->u.ibss.privacy = params->privacy;
+
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
         sdata->u.ibss.channel = params->channel;
@@ -913,7 +912,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_idle(sdata->local);
 
         set_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
-        queue_work(sdata->local->hw.workqueue, &sdata->u.ibss.work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.ibss.work);
 
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 68eb5052179a..a6abc7dfd903 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -24,7 +24,6 @@
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
 #include <net/cfg80211.h>
-#include <net/iw_handler.h>
 #include <net/mac80211.h>
 #include "key.h"
 #include "sta_info.h"
@@ -227,86 +226,81 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
+enum ieee80211_mgd_state {
+        IEEE80211_MGD_STATE_IDLE,
+        IEEE80211_MGD_STATE_PROBE,
+        IEEE80211_MGD_STATE_AUTH,
+        IEEE80211_MGD_STATE_ASSOC,
+};
+
+struct ieee80211_mgd_work {
+        struct list_head list;
+        struct ieee80211_bss *bss;
+        int ie_len;
+        u8 prev_bssid[ETH_ALEN];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 ssid_len;
+        unsigned long timeout;
+        enum ieee80211_mgd_state state;
+        u16 auth_alg, auth_transaction;
+
+        int tries;
+
+        u8 key[WLAN_KEY_LEN_WEP104];
+        u8 key_len, key_idx;
+
+        /* must be last */
+        u8 ie[0]; /* for auth or assoc frame, not probe */
+};
+
 /* flags used in struct ieee80211_if_managed.flags */
-#define IEEE80211_STA_SSID_SET          BIT(0)
-#define IEEE80211_STA_BSSID_SET         BIT(1)
-#define IEEE80211_STA_PREV_BSSID_SET    BIT(2)
-#define IEEE80211_STA_AUTHENTICATED     BIT(3)
-#define IEEE80211_STA_ASSOCIATED        BIT(4)
-#define IEEE80211_STA_PROBEREQ_POLL     BIT(5)
-#define IEEE80211_STA_CREATE_IBSS       BIT(6)
-#define IEEE80211_STA_CONTROL_PORT      BIT(7)
-#define IEEE80211_STA_WMM_ENABLED       BIT(8)
-/* hole at 9, please re-use */
-#define IEEE80211_STA_AUTO_SSID_SEL     BIT(10)
-#define IEEE80211_STA_AUTO_BSSID_SEL    BIT(11)
-#define IEEE80211_STA_AUTO_CHANNEL_SEL  BIT(12)
-#define IEEE80211_STA_PRIVACY_INVOKED   BIT(13)
-#define IEEE80211_STA_TKIP_WEP_USED     BIT(14)
-#define IEEE80211_STA_CSA_RECEIVED      BIT(15)
-#define IEEE80211_STA_MFP_ENABLED       BIT(16)
-#define IEEE80211_STA_EXT_SME           BIT(17)
-/* flags for MLME request */
-#define IEEE80211_STA_REQ_SCAN 0
-#define IEEE80211_STA_REQ_AUTH 1
-#define IEEE80211_STA_REQ_RUN  2
+enum ieee80211_sta_flags {
+        IEEE80211_STA_BEACON_POLL       = BIT(0),
+        IEEE80211_STA_CONNECTION_POLL   = BIT(1),
+        IEEE80211_STA_CONTROL_PORT      = BIT(2),
+        IEEE80211_STA_WMM_ENABLED       = BIT(3),
+        IEEE80211_STA_DISABLE_11N       = BIT(4),
+        IEEE80211_STA_CSA_RECEIVED      = BIT(5),
+        IEEE80211_STA_MFP_ENABLED       = BIT(6),
+};
 
-/* bitfield of allowed auth algs */
-#define IEEE80211_AUTH_ALG_OPEN BIT(0)
-#define IEEE80211_AUTH_ALG_SHARED_KEY BIT(1)
-#define IEEE80211_AUTH_ALG_LEAP BIT(2)
-#define IEEE80211_AUTH_ALG_FT BIT(3)
+/* flags for MLME request */
+enum ieee80211_sta_request {
+        IEEE80211_STA_REQ_SCAN,
+};
 
 struct ieee80211_if_managed {
         struct timer_list timer;
+        struct timer_list conn_mon_timer;
+        struct timer_list bcn_mon_timer;
         struct timer_list chswitch_timer;
         struct work_struct work;
+        struct work_struct monitor_work;
         struct work_struct chswitch_work;
         struct work_struct beacon_loss_work;
 
-        u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
+        unsigned long probe_timeout;
+        int probe_send_count;
 
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        size_t ssid_len;
+        struct mutex mtx;
+        struct ieee80211_bss *associated;
+        struct ieee80211_mgd_work *old_associate_work;
+        struct list_head work_list;
 
-        enum {
-                IEEE80211_STA_MLME_DISABLED,
-                IEEE80211_STA_MLME_DIRECT_PROBE,
-                IEEE80211_STA_MLME_AUTHENTICATE,
-                IEEE80211_STA_MLME_ASSOCIATE,
-                IEEE80211_STA_MLME_ASSOCIATED,
-        } state;
+        u8 bssid[ETH_ALEN];
 
         u16 aid;
-        u16 ap_capab, capab;
-        u8 *extra_ie; /* to be added to the end of AssocReq */
-        size_t extra_ie_len;
-
-        /* The last AssocReq/Resp IEs */
-        u8 *assocreq_ies, *assocresp_ies;
-        size_t assocreq_ies_len, assocresp_ies_len;
+        u16 capab;
 
         struct sk_buff_head skb_queue;
 
-        int assoc_scan_tries; /* number of scans done pre-association */
-        int direct_probe_tries; /* retries for direct probes */
-        int auth_tries; /* retries for auth req */
-        int assoc_tries; /* retries for assoc req */
-
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
 
         unsigned long request;
 
-        unsigned long last_probe;
-        unsigned long last_beacon;
-
         unsigned int flags;
 
-        unsigned int auth_algs; /* bitfield of allowed auth algs */
-        int auth_alg; /* currently used IEEE 802.11 authentication algorithm */
-        int auth_transaction;
-
         u32 beacon_crc;
 
         enum {
@@ -316,10 +310,6 @@ struct ieee80211_if_managed {
         } mfp; /* management frame protection */
 
         int wmm_last_param_set;
-
-        /* Extra IE data for management frames */
-        u8 *sme_auth_ie;
-        size_t sme_auth_ie_len;
 };
 
 enum ieee80211_ibss_request {
@@ -339,6 +329,7 @@ struct ieee80211_if_ibss {
 
         bool fixed_bssid;
         bool fixed_channel;
+        bool privacy;
 
         u8 bssid[ETH_ALEN];
         u8 ssid[IEEE80211_MAX_SSID_LEN];
@@ -364,7 +355,7 @@ struct ieee80211_if_mesh {
 
         unsigned long timers_running;
 
-        bool housekeeping;
+        unsigned long wrkq_flags;
 
         u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
         size_t mesh_id_len;
@@ -478,20 +469,9 @@ struct ieee80211_sub_if_data {
         union {
                 struct {
                         struct dentry *drop_unencrypted;
-                        struct dentry *state;
                         struct dentry *bssid;
-                        struct dentry *prev_bssid;
-                        struct dentry *ssid_len;
                         struct dentry *aid;
-                        struct dentry *ap_capab;
                         struct dentry *capab;
-                        struct dentry *extra_ie_len;
-                        struct dentry *auth_tries;
-                        struct dentry *assoc_tries;
-                        struct dentry *auth_algs;
-                        struct dentry *auth_alg;
-                        struct dentry *auth_transaction;
-                        struct dentry *flags;
                         struct dentry *force_unicast_rateidx;
                         struct dentry *max_ratectrl_rateidx;
                 } sta;
@@ -588,12 +568,44 @@ enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_CSA,
         IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
         IEEE80211_QUEUE_STOP_REASON_SUSPEND,
-        IEEE80211_QUEUE_STOP_REASON_PENDING,
         IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
 };
 
-struct ieee80211_master_priv {
-        struct ieee80211_local *local;
+/**
+ * mac80211 scan flags - currently active scan mode
+ *
+ * @SCAN_SW_SCANNING: We're currently in the process of scanning but may as
+ *      well be on the operating channel
+ * @SCAN_HW_SCANNING: The hardware is scanning for us, we have no way to
+ *      determine if we are on the operating channel or not
+ * @SCAN_OFF_CHANNEL: We're off our operating channel for scanning,
+ *      gets only set in conjunction with SCAN_SW_SCANNING
+ */
+enum {
+        SCAN_SW_SCANNING,
+        SCAN_HW_SCANNING,
+        SCAN_OFF_CHANNEL,
+};
+
+/**
+ * enum mac80211_scan_state - scan state machine states
+ *
+ * @SCAN_DECISION: Main entry point to the scan state machine, this state
+ *      determines if we should keep on scanning or switch back to the
+ *      operating channel
+ * @SCAN_SET_CHANNEL: Set the next channel to be scanned
+ * @SCAN_SEND_PROBE: Send probe requests and wait for probe responses
+ * @SCAN_LEAVE_OPER_CHANNEL: Leave the operating channel, notify the AP
+ *      about us leaving the channel and stop all associated STA interfaces
+ * @SCAN_ENTER_OPER_CHANNEL: Enter the operating channel again, notify the
+ *      AP about us being back and restart all associated STA interfaces
+ */
+enum mac80211_scan_state {
+        SCAN_DECISION,
+        SCAN_SET_CHANNEL,
+        SCAN_SEND_PROBE,
+        SCAN_LEAVE_OPER_CHANNEL,
+        SCAN_ENTER_OPER_CHANNEL,
 };
 
 struct ieee80211_local {
@@ -604,17 +616,30 @@ struct ieee80211_local {
 
         const struct ieee80211_ops *ops;
 
+        /*
+         * private workqueue to mac80211. mac80211 makes this accessible
+         * via ieee80211_queue_work()
+         */
+        struct workqueue_struct *workqueue;
+
         unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES];
         /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
         spinlock_t queue_stop_reason_lock;
 
-        struct net_device *mdev; /* wmaster# - "master" 802.11 device */
         int open_count;
         int monitors, cooked_mntrs;
         /* number of interfaces with corresponding FIF_ flags */
-        int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss;
+        int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
         unsigned int filter_flags; /* FIF_* */
         struct iw_statistics wstats;
+
+        /* protects the aggregated multicast list and filter calls */
+        spinlock_t filter_lock;
+
+        /* aggregated multicast list */
+        struct dev_addr_list *mc_list;
+        int mc_count;
+
         bool tim_in_locked_section; /* see ieee80211_beacon_get() */
 
         /*
@@ -653,6 +678,7 @@ struct ieee80211_local {
         struct list_head sta_list;
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
+        int sta_generation;
 
         struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
         struct tasklet_struct tx_pending_tasklet;
@@ -687,9 +713,9 @@ struct ieee80211_local {
 
         /* Scanning and BSS list */
         struct mutex scan_mtx;
-        bool sw_scanning, hw_scanning;
+        unsigned long scanning;
         struct cfg80211_ssid scan_ssid;
-        struct cfg80211_scan_request int_scan_req;
+        struct cfg80211_scan_request *int_scan_req;
         struct cfg80211_scan_request *scan_req;
         struct ieee80211_channel *scan_channel;
         const u8 *orig_ies;
@@ -697,7 +723,7 @@ struct ieee80211_local {
         int scan_channel_idx;
         int scan_ies_len;
 
-        enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
+        enum mac80211_scan_state next_scan_state;
         struct delayed_work scan_work;
         struct ieee80211_sub_if_data *scan_sdata;
         enum nl80211_channel_type oper_channel_type;
@@ -834,10 +860,6 @@ struct ieee80211_local {
 static inline struct ieee80211_sub_if_data *
 IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        BUG_ON(!local || local->mdev == dev);
-
         return netdev_priv(dev);
 }
 
@@ -937,21 +959,20 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
 void ieee80211_configure_filter(struct ieee80211_local *local);
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
 
-/* wireless extensions */
-extern const struct iw_handler_def ieee80211_iw_handler_def;
-
 /* STA code */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata);
+int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
+                       struct cfg80211_auth_request *req);
+int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_assoc_request *req);
+int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+                         struct cfg80211_deauth_request *req,
+                         void *cookie);
+int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
+                           struct cfg80211_disassoc_request *req,
+                           void *cookie);
 ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
-                                          struct sk_buff *skb,
-                                          struct ieee80211_rx_status *rx_status);
-int ieee80211_sta_commit(struct ieee80211_sub_if_data *sdata);
-int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
-int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
-int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
-void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata);
-int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason);
-int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
+                                          struct sk_buff *skb);
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata);
 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency);
@@ -967,8 +988,7 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
 ieee80211_rx_result
-ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                       struct ieee80211_rx_status *rx_status);
+ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                                         u8 *bssid, u8 *addr, u32 supp_rates);
 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
@@ -983,16 +1003,9 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
                                     const u8 *ssid, u8 ssid_len);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
-int ieee80211_scan_results(struct ieee80211_local *local,
-                           struct iw_request_info *info,
-                           char *buf, size_t len);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
 ieee80211_rx_result
-ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata,
-                  struct sk_buff *skb,
-                  struct ieee80211_rx_status *rx_status);
-int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
-                               const char *ie, size_t len);
+ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local);
 struct ieee80211_bss *
@@ -1008,8 +1021,6 @@ ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len);
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
-void ieee80211_rx_bss_remove(struct ieee80211_sub_if_data *sdata, u8 *bssid,
-                             int freq, u8 *ssid, u8 ssid_len);
 
 /* interface handling */
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
@@ -1025,7 +1036,6 @@ void ieee80211_recalc_idle(struct ieee80211_local *local);
 /* tx handling */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
 void ieee80211_tx_pending(unsigned long data);
-int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
@@ -1092,7 +1102,8 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
 int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
                              int rate, int erp, int short_preamble);
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
-                                     struct ieee80211_hdr *hdr, const u8 *tsc);
+                                     struct ieee80211_hdr *hdr, const u8 *tsc,
+                                     gfp_t gfp);
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
 void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                       int encrypt);
@@ -1129,8 +1140,8 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
-                         u8 *extra, size_t extra_len,
-                         const u8 *bssid, int encrypt);
+                         u8 *extra, size_t extra_len, const u8 *bssid,
+                         const u8 *key, u8 key_len, u8 key_idx);
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              const u8 *ie, size_t ie_len);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index b7c8a4484298..e8fb03b91a44 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -190,10 +190,6 @@ static int ieee80211_open(struct net_device *dev)
                                ETH_ALEN);
         }
 
-        if (compare_ether_addr(null_addr, local->mdev->dev_addr) == 0)
-                memcpy(local->mdev->dev_addr, local->hw.wiphy->perm_addr,
-                       ETH_ALEN);
-
         /*
          * Validate the MAC address for this device.
          */
@@ -224,18 +220,17 @@ static int ieee80211_open(struct net_device *dev)
                         local->fif_fcsfail++;
                 if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
                         local->fif_plcpfail++;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL) {
                         local->fif_control++;
+                        local->fif_pspoll++;
+                }
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss++;
 
-                netif_addr_lock_bh(local->mdev);
+                spin_lock_bh(&local->filter_lock);
                 ieee80211_configure_filter(local);
-                netif_addr_unlock_bh(local->mdev);
+                spin_unlock_bh(&local->filter_lock);
                 break;
-        case NL80211_IFTYPE_STATION:
-                sdata->u.mgd.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                /* fall through */
         default:
                 conf.vif = &sdata->vif;
                 conf.type = sdata->vif.type;
@@ -246,12 +241,19 @@ static int ieee80211_open(struct net_device *dev)
 
                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
                         local->fif_other_bss++;
-                        netif_addr_lock_bh(local->mdev);
+                        spin_lock_bh(&local->filter_lock);
                         ieee80211_configure_filter(local);
-                        netif_addr_unlock_bh(local->mdev);
+                        spin_unlock_bh(&local->filter_lock);
 
                         ieee80211_start_mesh(sdata);
+                } else if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                        local->fif_pspoll++;
+
+                        spin_lock_bh(&local->filter_lock);
+                        ieee80211_configure_filter(local);
+                        spin_unlock_bh(&local->filter_lock);
                 }
+
                 changed |= ieee80211_reset_erp_info(sdata);
                 ieee80211_bss_info_change_notify(sdata, changed);
                 ieee80211_enable_keys(sdata);
@@ -282,10 +284,6 @@ static int ieee80211_open(struct net_device *dev)
         }
 
         if (local->open_count == 0) {
-                res = dev_open(local->mdev);
-                WARN_ON(res);
-                if (res)
-                        goto err_del_interface;
                 tasklet_enable(&local->tx_pending_tasklet);
                 tasklet_enable(&local->tasklet);
         }
@@ -323,7 +321,7 @@ static int ieee80211_open(struct net_device *dev)
          * to fix this.
          */
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+                ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
 
         netif_tx_start_all_queues(dev);
 
@@ -346,7 +344,10 @@ static int ieee80211_stop(struct net_device *dev)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_init_conf conf;
         struct sta_info *sta;
+        unsigned long flags;
+        struct sk_buff *skb, *tmp;
         u32 hw_reconf_flags = 0;
+        int i;
 
         /*
          * Stop TX on this interface first.
@@ -366,18 +367,6 @@ static int ieee80211_stop(struct net_device *dev)
         rcu_read_unlock();
 
         /*
-         * Announce that we are leaving the network, in case we are a
-         * station interface type. This must be done before removing
-         * all stations associated with sta_info_flush, otherwise STA
-         * information will be gone and no announce being done.
-         */
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                if (sdata->u.mgd.state != IEEE80211_STA_MLME_DISABLED)
-                        ieee80211_sta_deauthenticate(sdata,
-                                WLAN_REASON_DEAUTH_LEAVING);
-        }
-
-        /*
          * Remove all stations associated with this interface.
          *
          * This must be done before calling ops->remove_interface()
@@ -408,13 +397,23 @@ static int ieee80211_stop(struct net_device *dev)
         if (sdata->flags & IEEE80211_SDATA_PROMISC)
                 atomic_dec(&local->iff_promiscs);
 
-        dev_mc_unsync(local->mdev, dev);
+        if (sdata->vif.type == NL80211_IFTYPE_AP)
+                local->fif_pspoll--;
+
+        netif_addr_lock_bh(dev);
+        spin_lock_bh(&local->filter_lock);
+        __dev_addr_unsync(&local->mc_list, &local->mc_count,
+                          &dev->mc_list, &dev->mc_count);
+        ieee80211_configure_filter(local);
+        spin_unlock_bh(&local->filter_lock);
+        netif_addr_unlock_bh(dev);
+
         del_timer_sync(&local->dynamic_ps_timer);
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         /* APs need special treatment */
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                struct ieee80211_sub_if_data *vlan, *tmp;
+                struct ieee80211_sub_if_data *vlan, *tmpsdata;
                 struct beacon_data *old_beacon = sdata->u.ap.beacon;
 
                 /* remove beacon */
@@ -423,7 +422,7 @@ static int ieee80211_stop(struct net_device *dev)
                 kfree(old_beacon);
 
                 /* down all dependent devices, that is VLANs */
-                list_for_each_entry_safe(vlan, tmp, &sdata->u.ap.vlans,
+                list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
                                          u.vlan.list)
                         dev_close(vlan->dev);
                 WARN_ON(!list_empty(&sdata->u.ap.vlans));
@@ -452,29 +451,32 @@ static int ieee80211_stop(struct net_device *dev)
                         local->fif_fcsfail--;
                 if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
                         local->fif_plcpfail--;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL) {
+                        local->fif_pspoll--;
                         local->fif_control--;
+                }
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss--;
 
-                netif_addr_lock_bh(local->mdev);
+                spin_lock_bh(&local->filter_lock);
                 ieee80211_configure_filter(local);
-                netif_addr_unlock_bh(local->mdev);
+                spin_unlock_bh(&local->filter_lock);
                 break;
         case NL80211_IFTYPE_STATION:
-                memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
                 del_timer_sync(&sdata->u.mgd.chswitch_timer);
                 del_timer_sync(&sdata->u.mgd.timer);
+                del_timer_sync(&sdata->u.mgd.conn_mon_timer);
+                del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
                 /*
-                 * If the timer fired while we waited for it, it will have
-                 * requeued the work. Now the work will be running again
+                 * If any of the timers fired while we waited for it, it will
+                 * have queued its work. Now the work will be running again
                  * but will not rearm the timer again because it checks
                  * whether the interface is running, which, at this point,
                  * it no longer is.
                  */
                 cancel_work_sync(&sdata->u.mgd.work);
                 cancel_work_sync(&sdata->u.mgd.chswitch_work);
-
+                cancel_work_sync(&sdata->u.mgd.monitor_work);
                 cancel_work_sync(&sdata->u.mgd.beacon_loss_work);
 
                 /*
@@ -485,12 +487,6 @@ static int ieee80211_stop(struct net_device *dev)
                  */
                 synchronize_rcu();
                 skb_queue_purge(&sdata->u.mgd.skb_queue);
-
-                sdata->u.mgd.flags &= ~(IEEE80211_STA_PRIVACY_INVOKED |
-                                        IEEE80211_STA_TKIP_WEP_USED);
-                kfree(sdata->u.mgd.extra_ie);
-                sdata->u.mgd.extra_ie = NULL;
-                sdata->u.mgd.extra_ie_len = 0;
                 /* fall through */
         case NL80211_IFTYPE_ADHOC:
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
@@ -507,9 +503,9 @@ static int ieee80211_stop(struct net_device *dev)
                         local->fif_other_bss--;
                         atomic_dec(&local->iff_allmultis);
 
-                        netif_addr_lock_bh(local->mdev);
+                        spin_lock_bh(&local->filter_lock);
                         ieee80211_configure_filter(local);
-                        netif_addr_unlock_bh(local->mdev);
+                        spin_unlock_bh(&local->filter_lock);
 
                         ieee80211_stop_mesh(sdata);
                 }
@@ -536,10 +532,20 @@ static int ieee80211_stop(struct net_device *dev)
                          * the scan_sdata is NULL already don't send out a
                          * scan event to userspace -- the scan is incomplete.
                          */
-                        if (local->sw_scanning)
+                        if (test_bit(SCAN_SW_SCANNING, &local->scanning))
                                 ieee80211_scan_completed(&local->hw, true);
                 }
 
+                /*
+                 * Disable beaconing for AP and mesh, IBSS can't
+                 * still be joined to a network at this point.
+                 */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT) {
+                        ieee80211_bss_info_change_notify(sdata,
+                                BSS_CHANGED_BEACON_ENABLED);
+                }
+
                 conf.vif = &sdata->vif;
                 conf.type = sdata->vif.type;
                 conf.mac_addr = dev->dev_addr;
@@ -555,14 +561,11 @@ static int ieee80211_stop(struct net_device *dev)
         ieee80211_recalc_ps(local, -1);
 
         if (local->open_count == 0) {
-                if (netif_running(local->mdev))
-                        dev_close(local->mdev);
-
                 drv_stop(local);
 
                 ieee80211_led_radio(local, false);
 
-                flush_workqueue(local->hw.workqueue);
+                flush_workqueue(local->workqueue);
 
                 tasklet_disable(&local->tx_pending_tasklet);
                 tasklet_disable(&local->tasklet);
@@ -575,6 +578,18 @@ static int ieee80211_stop(struct net_device *dev)
         if (hw_reconf_flags)
                 ieee80211_hw_config(local, hw_reconf_flags);
 
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+        for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
+                skb_queue_walk_safe(&local->pending[i], skb, tmp) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                        if (info->control.vif == &sdata->vif) {
+                                __skb_unlink(skb, &local->pending[i]);
+                                dev_kfree_skb_irq(skb);
+                        }
+                }
+        }
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+
         return 0;
 }
 
@@ -604,8 +619,11 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
                         atomic_dec(&local->iff_promiscs);
                 sdata->flags ^= IEEE80211_SDATA_PROMISC;
         }
-
-        dev_mc_sync(local->mdev, dev);
+        spin_lock_bh(&local->filter_lock);
+        __dev_addr_sync(&local->mc_list, &local->mc_count,
+                        &dev->mc_list, &dev->mc_count);
+        ieee80211_configure_filter(local);
+        spin_unlock_bh(&local->filter_lock);
 }
 
 /*
@@ -652,11 +670,6 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
                         kfree_skb(sdata->u.ibss.presp);
                 break;
         case NL80211_IFTYPE_STATION:
-                kfree(sdata->u.mgd.extra_ie);
-                kfree(sdata->u.mgd.assocreq_ies);
-                kfree(sdata->u.mgd.assocresp_ies);
-                kfree(sdata->u.mgd.sme_auth_ie);
-                break;
         case NL80211_IFTYPE_WDS:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_MONITOR:
@@ -695,7 +708,6 @@ static void ieee80211_if_setup(struct net_device *dev)
 {
         ether_setup(dev);
         dev->netdev_ops = &ieee80211_dataif_ops;
-        dev->wireless_handlers = &ieee80211_iw_handler_def;
         dev->destructor = free_netdev;
 }
 
@@ -798,6 +810,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                             name, ieee80211_if_setup);
         if (!ndev)
                 return -ENOMEM;
+        dev_net_set(ndev, wiphy_net(local->hw.wiphy));
 
         ndev->needed_headroom = local->tx_headroom +
                                 4*6 /* four MAC addresses */
@@ -814,7 +827,6 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
         memcpy(ndev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
-        ndev->features |= NETIF_F_NETNS_LOCAL;
 
         /* don't use IEEE80211_DEV_TO_SUB_IF because it checks too much */
         sdata = netdev_priv(ndev);
@@ -931,7 +943,7 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
         struct ieee80211_sub_if_data *sdata;
         int count = 0;
 
-        if (local->hw_scanning || local->sw_scanning)
+        if (local->scanning)
                 return ieee80211_idle_off(local, "scanning");
 
         list_for_each_entry(sdata, &local->interfaces, list) {
@@ -939,7 +951,8 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                         continue;
                 /* do not count disabled managed interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    sdata->u.mgd.state == IEEE80211_STA_MLME_DISABLED)
+                    !sdata->u.mgd.associated &&
+                    list_empty(&sdata->u.mgd.work_list))
                         continue;
                 /* do not count unused IBSS interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ce267565e180..659a42d529e3 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -67,6 +67,8 @@ static DECLARE_WORK(todo_work, key_todo);
  *
  * @key: key to add to do item for
  * @flag: todo flag(s)
+ *
+ * Must be called with IRQs or softirqs disabled.
  */
 static void add_todo(struct ieee80211_key *key, u32 flag)
 {
@@ -140,9 +142,9 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
         ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf);
 
         if (!ret) {
-                spin_lock(&todo_lock);
+                spin_lock_bh(&todo_lock);
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
         }
 
         if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
@@ -164,12 +166,12 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         if (!key || !key->local->ops->set_key)
                 return;
 
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
         if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
                 return;
         }
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 
         sta = get_sta_for_key(key);
         sdata = key->sdata;
@@ -188,9 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                        wiphy_name(key->local->hw.wiphy),
                        key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 }
 
 static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
@@ -437,14 +439,14 @@ void ieee80211_key_link(struct ieee80211_key *key,
 
         __ieee80211_key_replace(sdata, sta, old_key, key);
 
-        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
-
         /* free old key later */
         add_todo(old_key, KEY_FLAG_TODO_DELETE);
 
         add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
         if (netif_running(sdata->dev))
                 add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
+
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 }
 
 static void __ieee80211_key_free(struct ieee80211_key *key)
@@ -547,7 +549,7 @@ static void __ieee80211_key_todo(void)
          */
         synchronize_rcu();
 
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
         while (!list_empty(&todo_list)) {
                 key = list_first_entry(&todo_list, struct ieee80211_key, todo);
                 list_del_init(&key->todo);
@@ -558,7 +560,7 @@ static void __ieee80211_key_todo(void)
                                           KEY_FLAG_TODO_HWACCEL_REMOVE |
                                           KEY_FLAG_TODO_DELETE);
                 key->flags &= ~todoflags;
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
 
                 work_done = false;
 
@@ -591,9 +593,9 @@ static void __ieee80211_key_todo(void)
 
                 WARN_ON(!work_done);
 
-                spin_lock(&todo_lock);
+                spin_lock_bh(&todo_lock);
         }
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 }
 
 void ieee80211_key_todo(void)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 092a017b237e..b03fd84777fa 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -77,81 +77,23 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
         if (local->fif_other_bss)
                 new_flags |= FIF_OTHER_BSS;
 
+        if (local->fif_pspoll)
+                new_flags |= FIF_PSPOLL;
+
         changed_flags = local->filter_flags ^ new_flags;
 
         /* be a bit nasty */
         new_flags |= (1<<31);
 
         drv_configure_filter(local, changed_flags, &new_flags,
-                             local->mdev->mc_count,
-                             local->mdev->mc_list);
+                             local->mc_count,
+                             local->mc_list);
 
         WARN_ON(new_flags & (1<<31));
 
         local->filter_flags = new_flags & ~(1<<31);
 }
 
-/* master interface */
-
-static int header_parse_80211(const struct sk_buff *skb, unsigned char *haddr)
-{
-        memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); /* addr2 */
-        return ETH_ALEN;
-}
-
-static const struct header_ops ieee80211_header_ops = {
-        .create         = eth_header,
-        .parse          = header_parse_80211,
-        .rebuild        = eth_rebuild_header,
-        .cache          = eth_header_cache,
-        .cache_update   = eth_header_cache_update,
-};
-
-static int ieee80211_master_open(struct net_device *dev)
-{
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
-        struct ieee80211_sub_if_data *sdata;
-        int res = -EOPNOTSUPP;
-
-        /* we hold the RTNL here so can safely walk the list */
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (netif_running(sdata->dev)) {
-                        res = 0;
-                        break;
-                }
-        }
-
-        if (res)
-                return res;
-
-        netif_tx_start_all_queues(local->mdev);
-
-        return 0;
-}
-
-static int ieee80211_master_stop(struct net_device *dev)
-{
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
-        struct ieee80211_sub_if_data *sdata;
-
-        /* we hold the RTNL here so can safely walk the list */
-        list_for_each_entry(sdata, &local->interfaces, list)
-                if (netif_running(sdata->dev))
-                        dev_close(sdata->dev);
-
-        return 0;
-}
-
-static void ieee80211_master_set_multicast_list(struct net_device *dev)
-{
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
-
-        ieee80211_configure_filter(local);
-}
-
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
         struct ieee80211_channel *chan, *scan_chan;
@@ -259,7 +201,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
         }
 
         if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                if (local->sw_scanning) {
+                if (local->quiescing || !netif_running(sdata->dev) ||
+                    test_bit(SCAN_SW_SCANNING, &local->scanning)) {
                         sdata->vif.bss_conf.enable_beacon = false;
                 } else {
                         /*
@@ -310,7 +253,6 @@ void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int tmp;
 
-        skb->dev = local->mdev;
         skb->pkt_type = IEEE80211_TX_STATUS_MSG;
         skb_queue_tail(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS ?
                        &local->skb_queue : &local->skb_queue_unreliable, skb);
@@ -330,19 +272,16 @@ static void ieee80211_tasklet_handler(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *) data;
         struct sk_buff *skb;
-        struct ieee80211_rx_status rx_status;
         struct ieee80211_ra_tid *ra_tid;
 
         while ((skb = skb_dequeue(&local->skb_queue)) ||
                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
                 switch (skb->pkt_type) {
                 case IEEE80211_RX_MSG:
-                        /* status is in skb->cb */
-                        memcpy(&rx_status, skb->cb, sizeof(rx_status));
                         /* Clear skb->pkt_type in order to not confuse kernel
                          * netstack. */
                         skb->pkt_type = 0;
-                        __ieee80211_rx(local_to_hw(local), skb, &rx_status);
+                        ieee80211_rx(local_to_hw(local), skb);
                         break;
                 case IEEE80211_TX_STATUS_MSG:
                         skb->pkt_type = 0;
@@ -375,6 +314,31 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
+        /*
+         * XXX: This is temporary!
+         *
+         *      The problem here is that when we get here, the driver will
+         *      quite likely have pretty much overwritten info->control by
+         *      using info->driver_data or info->rate_driver_data. Thus,
+         *      when passing out the frame to the driver again, we would be
+         *      passing completely bogus data since the driver would then
+         *      expect a properly filled info->control. In mac80211 itself
+         *      the same problem occurs, since we need info->control.vif
+         *      internally.
+         *
+         *      To fix this, we should send the frame through TX processing
+         *      again. However, it's not that simple, since the frame will
+         *      have been software-encrypted (if applicable) already, and
+         *      encrypting it again doesn't do much good. So to properly do
+         *      that, we not only have to skip the actual 'raw' encryption
+         *      (key selection etc. still has to be done!) but also the
+         *      sequence number assignment since that impacts the crypto
+         *      encapsulation, of course.
+         *
+         *      Hence, for now, fix the bug by just dropping the frame.
+         */
+        goto drop;
+
         sta->tx_filtered_count++;
 
         /*
@@ -428,6 +392,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                 return;
         }
 
+ drop:
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         if (net_ratelimit())
                 printk(KERN_DEBUG "%s: dropped TX filtered frame, "
@@ -685,6 +650,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         if (!wiphy)
                 return NULL;
 
+        wiphy->netnsok = true;
         wiphy->privid = mac80211_wiphy_privid;
 
         /* Yes, putting cfg80211_bss into ieee80211_bss is a hack */
@@ -719,7 +685,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         mutex_init(&local->scan_mtx);
 
         spin_lock_init(&local->key_lock);
-
+        spin_lock_init(&local->filter_lock);
         spin_lock_init(&local->queue_stop_reason_lock);
 
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
@@ -755,30 +721,11 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 }
 EXPORT_SYMBOL(ieee80211_alloc_hw);
 
-static const struct net_device_ops ieee80211_master_ops = {
-        .ndo_start_xmit = ieee80211_master_start_xmit,
-        .ndo_open = ieee80211_master_open,
-        .ndo_stop = ieee80211_master_stop,
-        .ndo_set_multicast_list = ieee80211_master_set_multicast_list,
-        .ndo_select_queue = ieee80211_select_queue,
-};
-
-static void ieee80211_master_setup(struct net_device *mdev)
-{
-        mdev->type = ARPHRD_IEEE80211;
-        mdev->netdev_ops = &ieee80211_master_ops;
-        mdev->header_ops = &ieee80211_header_ops;
-        mdev->tx_queue_len = 1000;
-        mdev->addr_len = ETH_ALEN;
-}
-
 int ieee80211_register_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         int result;
         enum ieee80211_band band;
-        struct net_device *mdev;
-        struct ieee80211_master_priv *mpriv;
         int channels, i, j, max_bitrates;
         bool supp_ht;
         static const u32 cipher_suites[] = {
@@ -818,9 +765,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 supp_ht = supp_ht || sband->ht_cap.ht_supported;
         }
 
-        local->int_scan_req.n_channels = channels;
-        local->int_scan_req.channels = kzalloc(sizeof(void *) * channels, GFP_KERNEL);
-        if (!local->int_scan_req.channels)
+        local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) +
+                                      sizeof(void *) * channels, GFP_KERNEL);
+        if (!local->int_scan_req)
                 return -ENOMEM;
 
         /* if low-level driver supports AP, we also support VLAN */
@@ -877,19 +824,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (hw->queues > IEEE80211_MAX_QUEUES)
                 hw->queues = IEEE80211_MAX_QUEUES;
 
-        mdev = alloc_netdev_mq(sizeof(struct ieee80211_master_priv),
-                               "wmaster%d", ieee80211_master_setup,
-                               hw->queues);
-        if (!mdev)
-                goto fail_mdev_alloc;
-
-        mpriv = netdev_priv(mdev);
-        mpriv->local = local;
-        local->mdev = mdev;
-
-        local->hw.workqueue =
+        local->workqueue =
                 create_singlethread_workqueue(wiphy_name(local->hw.wiphy));
-        if (!local->hw.workqueue) {
+        if (!local->workqueue) {
                 result = -ENOMEM;
                 goto fail_workqueue;
         }
@@ -921,17 +858,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         }
 
         rtnl_lock();
-        result = dev_alloc_name(local->mdev, local->mdev->name);
-        if (result < 0)
-                goto fail_dev;
-
-        memcpy(local->mdev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
-        SET_NETDEV_DEV(local->mdev, wiphy_dev(local->hw.wiphy));
-        local->mdev->features |= NETIF_F_NETNS_LOCAL;
-
-        result = register_netdevice(local->mdev);
-        if (result < 0)
-                goto fail_dev;
 
         result = ieee80211_init_rate_ctrl_alg(local,
                                               hw->rate_control_algorithm);
@@ -956,13 +882,13 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         /* alloc internal scan request */
         i = 0;
-        local->int_scan_req.ssids = &local->scan_ssid;
-        local->int_scan_req.n_ssids = 1;
+        local->int_scan_req->ssids = &local->scan_ssid;
+        local->int_scan_req->n_ssids = 1;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (!hw->wiphy->bands[band])
                         continue;
                 for (j = 0; j < hw->wiphy->bands[band]->n_channels; j++) {
-                        local->int_scan_req.channels[i] =
+                        local->int_scan_req->channels[i] =
                                 &hw->wiphy->bands[band]->channels[j];
                         i++;
                 }
@@ -984,23 +910,17 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         ieee80211_led_exit(local);
         ieee80211_remove_interfaces(local);
  fail_rate:
-        unregister_netdevice(local->mdev);
-        local->mdev = NULL;
- fail_dev:
         rtnl_unlock();
         ieee80211_wep_free(local);
  fail_wep:
         sta_info_stop(local);
  fail_sta_info:
         debugfs_hw_del(local);
-        destroy_workqueue(local->hw.workqueue);
+        destroy_workqueue(local->workqueue);
  fail_workqueue:
-        if (local->mdev)
-                free_netdev(local->mdev);
- fail_mdev_alloc:
         wiphy_unregister(local->hw.wiphy);
  fail_wiphy_register:
-        kfree(local->int_scan_req.channels);
+        kfree(local->int_scan_req->channels);
         return result;
 }
 EXPORT_SYMBOL(ieee80211_register_hw);
@@ -1022,13 +942,8 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
          * because the driver cannot be handing us frames any
          * more and the tasklet is killed.
          */
-
-        /* First, we remove all virtual interfaces. */
         ieee80211_remove_interfaces(local);
 
-        /* then, finally, remove the master interface */
-        unregister_netdevice(local->mdev);
-
         rtnl_unlock();
 
         ieee80211_clear_tx_pending(local);
@@ -1043,12 +958,11 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         skb_queue_purge(&local->skb_queue);
         skb_queue_purge(&local->skb_queue_unreliable);
 
-        destroy_workqueue(local->hw.workqueue);
+        destroy_workqueue(local->workqueue);
         wiphy_unregister(local->hw.wiphy);
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
-        free_netdev(local->mdev);
-        kfree(local->int_scan_req.channels);
+        kfree(local->int_scan_req);
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 11cf45bce38a..3185e18c8214 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -47,14 +47,14 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        ifmsh->housekeeping = true;
+        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
 
         if (local->quiescing) {
                 set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
                 return;
         }
 
-        queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
 }
 
 /**
@@ -320,30 +320,6 @@ struct mesh_table *mesh_table_alloc(int size_order)
         return newtbl;
 }
 
-static void __mesh_table_free(struct mesh_table *tbl)
-{
-        kfree(tbl->hash_buckets);
-        kfree(tbl->hashwlock);
-        kfree(tbl);
-}
-
-void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
-{
-        struct hlist_head *mesh_hash;
-        struct hlist_node *p, *q;
-        int i;
-
-        mesh_hash = tbl->hash_buckets;
-        for (i = 0; i <= tbl->hash_mask; i++) {
-                spin_lock(&tbl->hashwlock[i]);
-                hlist_for_each_safe(p, q, &mesh_hash[i]) {
-                        tbl->free_node(p, free_leafs);
-                        atomic_dec(&tbl->entries);
-                }
-                spin_unlock(&tbl->hashwlock[i]);
-        }
-        __mesh_table_free(tbl);
-}
 
 static void ieee80211_mesh_path_timer(unsigned long data)
 {
@@ -357,63 +333,79 @@ static void ieee80211_mesh_path_timer(unsigned long data)
                 return;
         }
 
-        queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
 }
 
-struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
-{
-        struct mesh_table *newtbl;
-        struct hlist_head *oldhash;
-        struct hlist_node *p, *q;
-        int i;
-
-        if (atomic_read(&tbl->entries)
-                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
-                goto endgrow;
-
-        newtbl = mesh_table_alloc(tbl->size_order + 1);
-        if (!newtbl)
-                goto endgrow;
-
-        newtbl->free_node = tbl->free_node;
-        newtbl->mean_chain_len = tbl->mean_chain_len;
-        newtbl->copy_node = tbl->copy_node;
-        atomic_set(&newtbl->entries, atomic_read(&tbl->entries));
-
-        oldhash = tbl->hash_buckets;
-        for (i = 0; i <= tbl->hash_mask; i++)
-                hlist_for_each(p, &oldhash[i])
-                        if (tbl->copy_node(p, newtbl) < 0)
-                                goto errcopy;
-
-        return newtbl;
-
-errcopy:
-        for (i = 0; i <= newtbl->hash_mask; i++) {
-                hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
-                        tbl->free_node(p, 0);
+/**
+ * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
+ * @hdr:        802.11 frame header
+ * @fc:         frame control field
+ * @meshda:     destination address in the mesh
+ * @meshsa:     source address address in the mesh.  Same as TA, as frame is
+ *              locally originated.
+ *
+ * Return the length of the 802.11 (does not include a mesh control header)
+ */
+int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc, char
+                *meshda, char *meshsa) {
+        if (is_multicast_ether_addr(meshda)) {
+                *fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
+                /* DA TA SA */
+                memcpy(hdr->addr1, meshda, ETH_ALEN);
+                memcpy(hdr->addr2, meshsa, ETH_ALEN);
+                memcpy(hdr->addr3, meshsa, ETH_ALEN);
+                return 24;
+        } else {
+                *fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
+                                IEEE80211_FCTL_TODS);
+                /* RA TA DA SA */
+                memset(hdr->addr1, 0, ETH_ALEN);   /* RA is resolved later */
+                memcpy(hdr->addr2, meshsa, ETH_ALEN);
+                memcpy(hdr->addr3, meshda, ETH_ALEN);
+                memcpy(hdr->addr4, meshsa, ETH_ALEN);
+                return 30;
         }
-        __mesh_table_free(newtbl);
-endgrow:
-        return NULL;
 }
 
 /**
  * ieee80211_new_mesh_header - create a new mesh header
  * @meshhdr:    uninitialized mesh header
  * @sdata:      mesh interface to be used
+ * @addr4:      addr4 of the mesh frame (1st in ae header)
+ *              may be NULL
+ * @addr5:      addr5 of the mesh frame (1st or 2nd in ae header)
+ *              may be NULL unless addr6 is present
+ * @addr6:      addr6 of the mesh frame (2nd or 3rd in ae header)
+ *              may be NULL unless addr5 is present
  *
  * Return the header length.
  */
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
-                struct ieee80211_sub_if_data *sdata)
+                struct ieee80211_sub_if_data *sdata, char *addr4,
+                char *addr5, char *addr6)
 {
-        meshhdr->flags = 0;
+        int aelen = 0;
+        memset(meshhdr, 0, sizeof(meshhdr));
         meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
         put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
         sdata->u.mesh.mesh_seqnum++;
-
-        return 6;
+        if (addr4) {
+                meshhdr->flags |= MESH_FLAGS_AE_A4;
+                aelen += ETH_ALEN;
+                memcpy(meshhdr->eaddr1, addr4, ETH_ALEN);
+        }
+        if (addr5 && addr6) {
+                meshhdr->flags |= MESH_FLAGS_AE_A5_A6;
+                aelen += 2 * ETH_ALEN;
+                if (!addr4) {
+                        memcpy(meshhdr->eaddr1, addr5, ETH_ALEN);
+                        memcpy(meshhdr->eaddr2, addr6, ETH_ALEN);
+                } else {
+                        memcpy(meshhdr->eaddr2, addr5, ETH_ALEN);
+                        memcpy(meshhdr->eaddr3, addr6, ETH_ALEN);
+                }
+        }
+        return 6 + aelen;
 }
 
 static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
@@ -433,7 +425,6 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
         if (free_plinks != sdata->u.mesh.accepting_plinks)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 
-        ifmsh->housekeeping = false;
         mod_timer(&ifmsh->housekeeping_timer,
                   round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
 }
@@ -470,10 +461,12 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
 
-        ifmsh->housekeeping = true;
-        queue_work(local->hw.workqueue, &ifmsh->work);
+        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
+        sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
-                                                BSS_CHANGED_BEACON_ENABLED);
+                                                BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_BEACON_INT);
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
@@ -568,7 +561,7 @@ static void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
         ifmsh = &sdata->u.mesh;
 
-        rx_status = (struct ieee80211_rx_status *) skb->cb;
+        rx_status = IEEE80211_SKB_RXCB(skb);
         mgmt = (struct ieee80211_mgmt *) skb->data;
         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 
@@ -597,7 +590,7 @@ static void ieee80211_mesh_work(struct work_struct *work)
         if (!netif_running(sdata->dev))
                 return;
 
-        if (local->sw_scanning || local->hw_scanning)
+        if (local->scanning)
                 return;
 
         while ((skb = skb_dequeue(&ifmsh->skb_queue)))
@@ -608,7 +601,13 @@ static void ieee80211_mesh_work(struct work_struct *work)
                        ifmsh->last_preq + msecs_to_jiffies(ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval)))
                 mesh_path_start_discovery(sdata);
 
-        if (ifmsh->housekeeping)
+        if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
+                mesh_mpath_table_grow();
+
+        if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
+                mesh_mpp_table_grow();
+
+        if (test_and_clear_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags))
                 ieee80211_mesh_housekeeping(sdata, ifmsh);
 }
 
@@ -619,7 +618,7 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
                 if (ieee80211_vif_is_mesh(&sdata->vif))
-                        queue_work(local->hw.workqueue, &sdata->u.mesh.work);
+                        ieee80211_queue_work(&local->hw, &sdata->u.mesh.work);
         rcu_read_unlock();
 }
 
@@ -671,8 +670,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 }
 
 ieee80211_rx_result
-ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                       struct ieee80211_rx_status *rx_status)
+ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
@@ -686,12 +684,14 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         fc = le16_to_cpu(mgmt->frame_control);
 
         switch (fc & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_ACTION:
+                if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+                        return RX_DROP_MONITOR;
+                /* fall through */
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-        case IEEE80211_STYPE_ACTION:
-                memcpy(skb->cb, rx_status, sizeof(*rx_status));
                 skb_queue_tail(&ifmsh->skb_queue, skb);
-                queue_work(local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(&local->hw, &ifmsh->work);
                 return RX_QUEUED;
         }
 
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index c7d72819cdd2..eb23fc639b2b 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -44,6 +44,23 @@ enum mesh_path_flags {
 };
 
 /**
+ * enum mesh_deferred_task_flags - mac80211 mesh deferred tasks
+ *
+ *
+ *
+ * @MESH_WORK_HOUSEKEEPING: run the periodic mesh housekeeping tasks
+ * @MESH_WORK_GROW_MPATH_TABLE: the mesh path table is full and needs
+ * to grow.
+ * @MESH_WORK_GROW_MPP_TABLE: the mesh portals table is full and needs to
+ * grow
+ */
+enum mesh_deferred_task_flags {
+        MESH_WORK_HOUSEKEEPING,
+        MESH_WORK_GROW_MPATH_TABLE,
+        MESH_WORK_GROW_MPP_TABLE,
+};
+
+/**
  * struct mesh_path - mac80211 mesh path structure
  *
  * @dst: mesh path destination mac address
@@ -61,7 +78,7 @@ enum mesh_path_flags {
  *      retry
  * @discovery_retries: number of discovery retries
  * @flags: mesh path flags, as specified on &enum mesh_path_flags
- * @state_lock: mesh pat state lock
+ * @state_lock: mesh path state lock
  *
  *
  * The combination of dst and sdata is unique in the mesh path table. Since the
@@ -174,6 +191,7 @@ struct mesh_rmc {
  */
 #define MESH_PATH_REFRESH_TIME                  1000
 #define MESH_MIN_DISCOVERY_TIMEOUT (2 * MESH_DIAM_TRAVERSAL_TIME)
+#define MESH_DEFAULT_BEACON_INTERVAL            1000    /* in 1024 us units */
 
 #define MESH_MAX_PREQ_RETRIES 4
 #define MESH_PATH_EXPIRE (600 * HZ)
@@ -193,8 +211,11 @@ struct mesh_rmc {
 
 /* Public interfaces */
 /* Various */
+int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
+                char *da, char *sa);
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
-                struct ieee80211_sub_if_data *sdata);
+                struct ieee80211_sub_if_data *sdata, char *addr4,
+                char *addr5, char *addr6);
 int mesh_rmc_check(u8 *addr, struct ieee80211s_hdr *mesh_hdr,
                 struct ieee80211_sub_if_data *sdata);
 bool mesh_matches_local(struct ieee802_11_elems *ie,
@@ -208,8 +229,7 @@ void ieee80211s_init(void);
 void ieee80211s_stop(void);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
 ieee80211_rx_result
-ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                       struct ieee80211_rx_status *rx_status);
+ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
 
@@ -247,7 +267,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
 /* Mesh tables */
 struct mesh_table *mesh_table_alloc(int size_order);
 void mesh_table_free(struct mesh_table *tbl, bool free_leafs);
-struct mesh_table *mesh_table_grow(struct mesh_table *tbl);
+void mesh_mpath_table_grow(void);
+void mesh_mpp_table_grow(void);
 u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
                 struct mesh_table *tbl);
 /* Mesh paths */
@@ -266,6 +287,8 @@ void mesh_path_discard_frame(struct sk_buff *skb,
 void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
 void mesh_path_restart(struct ieee80211_sub_if_data *sdata);
 
+extern int mesh_paths_generation;
+
 #ifdef CONFIG_MAC80211_MESH
 extern int mesh_allocated;
 
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index f49ef288e2e2..ef1efd362691 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -397,7 +397,8 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
 static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
-                                    u8 *preq_elem, u32 metric) {
+                                    u8 *preq_elem, u32 metric)
+{
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
         u8 *dst_addr, *orig_addr;
@@ -430,7 +431,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                         if ((!(mpath->flags & MESH_PATH_DSN_VALID)) ||
                                         DSN_LT(mpath->dsn, dst_dsn)) {
                                 mpath->dsn = dst_dsn;
-                                mpath->flags &= MESH_PATH_DSN_VALID;
+                                mpath->flags |= MESH_PATH_DSN_VALID;
                         } else if ((!(dst_flags & MP_F_DO)) &&
                                         (mpath->flags & MESH_PATH_ACTIVE)) {
                                 reply = true;
@@ -660,14 +661,14 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
         spin_unlock(&ifmsh->mesh_preq_queue_lock);
 
         if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
-                queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(&sdata->local->hw, &ifmsh->work);
 
         else if (time_before(jiffies, ifmsh->last_preq)) {
                 /* avoid long wait if did not send preqs for a long time
                  * and jiffies wrapped around
                  */
                 ifmsh->last_preq = jiffies - min_preq_int_jiff(sdata) - 1;
-                queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(&sdata->local->hw, &ifmsh->work);
         } else
                 mod_timer(&ifmsh->mesh_path_timer, ifmsh->last_preq +
                                                 min_preq_int_jiff(sdata));
@@ -686,11 +687,11 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
         u8 ttl, dst_flags;
         u32 lifetime;
 
-        spin_lock(&ifmsh->mesh_preq_queue_lock);
+        spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
         if (!ifmsh->preq_queue_len ||
                 time_before(jiffies, ifmsh->last_preq +
                                 min_preq_int_jiff(sdata))) {
-                spin_unlock(&ifmsh->mesh_preq_queue_lock);
+                spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
                 return;
         }
 
@@ -698,7 +699,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
                         struct mesh_preq_queue, list);
         list_del(&preq_node->list);
         --ifmsh->preq_queue_len;
-        spin_unlock(&ifmsh->mesh_preq_queue_lock);
+        spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
 
         rcu_read_lock();
         mpath = mesh_path_lookup(preq_node->dst, sdata);
@@ -784,7 +785,6 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
                 mesh_path_add(dst_addr, sdata);
                 mpath = mesh_path_lookup(dst_addr, sdata);
                 if (!mpath) {
-                        dev_kfree_skb(skb);
                         sdata->u.mesh.mshstats.dropped_frames_no_route++;
                         err = -ENOSPC;
                         goto endlookup;
@@ -792,7 +792,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
         }
 
         if (mpath->flags & MESH_PATH_ACTIVE) {
-                if (time_after(jiffies, mpath->exp_time -
+                if (time_after(jiffies, mpath->exp_time +
                         msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time))
                                 && !memcmp(sdata->dev->dev_addr, hdr->addr4,
                                            ETH_ALEN)
@@ -804,17 +804,17 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
                 memcpy(hdr->addr1, mpath->next_hop->sta.addr,
                                 ETH_ALEN);
         } else {
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                 if (!(mpath->flags & MESH_PATH_RESOLVING)) {
                         /* Start discovery only if it is not running yet */
                         mesh_queue_preq(mpath, PREQ_Q_F_START);
                 }
 
                 if (skb_queue_len(&mpath->frame_queue) >=
-                                MESH_FRAME_QUEUE_LEN) {
-                        skb_to_free = mpath->frame_queue.next;
-                        skb_unlink(skb_to_free, &mpath->frame_queue);
-                }
+                                MESH_FRAME_QUEUE_LEN)
+                        skb_to_free = skb_dequeue(&mpath->frame_queue);
 
+                info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                 skb_queue_tail(&mpath->frame_queue, skb);
                 if (skb_to_free)
                         mesh_path_discard_frame(skb_to_free, sdata);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 479597e88583..751c4d0e2b36 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -38,6 +38,71 @@ struct mpath_node {
 static struct mesh_table *mesh_paths;
 static struct mesh_table *mpp_paths; /* Store paths for MPP&MAP */
 
+int mesh_paths_generation;
+static void __mesh_table_free(struct mesh_table *tbl)
+{
+        kfree(tbl->hash_buckets);
+        kfree(tbl->hashwlock);
+        kfree(tbl);
+}
+
+void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
+{
+        struct hlist_head *mesh_hash;
+        struct hlist_node *p, *q;
+        int i;
+
+        mesh_hash = tbl->hash_buckets;
+        for (i = 0; i <= tbl->hash_mask; i++) {
+                spin_lock(&tbl->hashwlock[i]);
+                hlist_for_each_safe(p, q, &mesh_hash[i]) {
+                        tbl->free_node(p, free_leafs);
+                        atomic_dec(&tbl->entries);
+                }
+                spin_unlock(&tbl->hashwlock[i]);
+        }
+        __mesh_table_free(tbl);
+}
+
+static struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
+{
+        struct mesh_table *newtbl;
+        struct hlist_head *oldhash;
+        struct hlist_node *p, *q;
+        int i;
+
+        if (atomic_read(&tbl->entries)
+                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
+                goto endgrow;
+
+        newtbl = mesh_table_alloc(tbl->size_order + 1);
+        if (!newtbl)
+                goto endgrow;
+
+        newtbl->free_node = tbl->free_node;
+        newtbl->mean_chain_len = tbl->mean_chain_len;
+        newtbl->copy_node = tbl->copy_node;
+        atomic_set(&newtbl->entries, atomic_read(&tbl->entries));
+
+        oldhash = tbl->hash_buckets;
+        for (i = 0; i <= tbl->hash_mask; i++)
+                hlist_for_each(p, &oldhash[i])
+                        if (tbl->copy_node(p, newtbl) < 0)
+                                goto errcopy;
+
+        return newtbl;
+
+errcopy:
+        for (i = 0; i <= newtbl->hash_mask; i++) {
+                hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
+                        tbl->free_node(p, 0);
+        }
+        __mesh_table_free(newtbl);
+endgrow:
+        return NULL;
+}
+
+
 /* This lock will have the grow table function as writer and add / delete nodes
  * as readers. When reading the table (i.e. doing lookups) we are well protected
  * by RCU
@@ -55,7 +120,25 @@ static DEFINE_RWLOCK(pathtbl_resize_lock);
  */
 void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
 {
+        struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
+        struct sk_buff_head tmpq;
+        unsigned long flags;
+
         rcu_assign_pointer(mpath->next_hop, sta);
+
+        __skb_queue_head_init(&tmpq);
+
+        spin_lock_irqsave(&mpath->frame_queue.lock, flags);
+
+        while ((skb = __skb_dequeue(&mpath->frame_queue)) != NULL) {
+                hdr = (struct ieee80211_hdr *) skb->data;
+                memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
+                __skb_queue_tail(&tmpq, skb);
+        }
+
+        skb_queue_splice(&tmpq, &mpath->frame_queue);
+        spin_unlock_irqrestore(&mpath->frame_queue.lock, flags);
 }
 
 
@@ -167,6 +250,8 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data
  */
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
@@ -175,8 +260,6 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        might_sleep();
-
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -188,11 +271,11 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
                 return -ENOSPC;
 
         err = -ENOMEM;
-        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_KERNEL);
+        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_ATOMIC);
         if (!new_mpath)
                 goto err_path_alloc;
 
-        new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
+        new_node = kmalloc(sizeof(struct mpath_node), GFP_ATOMIC);
         if (!new_node)
                 goto err_node_alloc;
 
@@ -225,23 +308,13 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
                 mesh_paths->mean_chain_len * (mesh_paths->hash_mask + 1))
                 grow = 1;
 
+        mesh_paths_generation++;
+
         spin_unlock(&mesh_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
         if (grow) {
-                struct mesh_table *oldtbl, *newtbl;
-
-                write_lock(&pathtbl_resize_lock);
-                oldtbl = mesh_paths;
-                newtbl = mesh_table_grow(mesh_paths);
-                if (!newtbl) {
-                        write_unlock(&pathtbl_resize_lock);
-                        return 0;
-                }
-                rcu_assign_pointer(mesh_paths, newtbl);
-                write_unlock(&pathtbl_resize_lock);
-
-                synchronize_rcu();
-                mesh_table_free(oldtbl, false);
+                set_bit(MESH_WORK_GROW_MPATH_TABLE,  &ifmsh->wrkq_flags);
+                ieee80211_queue_work(&local->hw, &ifmsh->work);
         }
         return 0;
 
@@ -256,9 +329,46 @@ err_path_alloc:
         return err;
 }
 
+void mesh_mpath_table_grow(void)
+{
+        struct mesh_table *oldtbl, *newtbl;
+
+        write_lock(&pathtbl_resize_lock);
+        oldtbl = mesh_paths;
+        newtbl = mesh_table_grow(mesh_paths);
+        if (!newtbl) {
+                write_unlock(&pathtbl_resize_lock);
+                return;
+        }
+        rcu_assign_pointer(mesh_paths, newtbl);
+        write_unlock(&pathtbl_resize_lock);
+
+        synchronize_rcu();
+        mesh_table_free(oldtbl, false);
+}
+
+void mesh_mpp_table_grow(void)
+{
+        struct mesh_table *oldtbl, *newtbl;
+
+        write_lock(&pathtbl_resize_lock);
+        oldtbl = mpp_paths;
+        newtbl = mesh_table_grow(mpp_paths);
+        if (!newtbl) {
+                write_unlock(&pathtbl_resize_lock);
+                return;
+        }
+        rcu_assign_pointer(mpp_paths, newtbl);
+        write_unlock(&pathtbl_resize_lock);
+
+        synchronize_rcu();
+        mesh_table_free(oldtbl, false);
+}
 
 int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
@@ -267,8 +377,6 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        might_sleep();
-
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -277,11 +385,11 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
                 return -ENOTSUPP;
 
         err = -ENOMEM;
-        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_KERNEL);
+        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_ATOMIC);
         if (!new_mpath)
                 goto err_path_alloc;
 
-        new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
+        new_node = kmalloc(sizeof(struct mpath_node), GFP_ATOMIC);
         if (!new_node)
                 goto err_node_alloc;
 
@@ -315,20 +423,8 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         spin_unlock(&mpp_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
         if (grow) {
-                struct mesh_table *oldtbl, *newtbl;
-
-                write_lock(&pathtbl_resize_lock);
-                oldtbl = mpp_paths;
-                newtbl = mesh_table_grow(mpp_paths);
-                if (!newtbl) {
-                        write_unlock(&pathtbl_resize_lock);
-                        return 0;
-                }
-                rcu_assign_pointer(mpp_paths, newtbl);
-                write_unlock(&pathtbl_resize_lock);
-
-                synchronize_rcu();
-                mesh_table_free(oldtbl, false);
+                set_bit(MESH_WORK_GROW_MPP_TABLE,  &ifmsh->wrkq_flags);
+                ieee80211_queue_work(&local->hw, &ifmsh->work);
         }
         return 0;
 
@@ -466,6 +562,7 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
 
         err = -ENXIO;
 enddel:
+        mesh_paths_generation++;
         spin_unlock(&mesh_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
         return err;
@@ -481,11 +578,9 @@ enddel:
  */
 void mesh_path_tx_pending(struct mesh_path *mpath)
 {
-        struct sk_buff *skb;
-
-        while ((skb = skb_dequeue(&mpath->frame_queue)) &&
-                        (mpath->flags & MESH_PATH_ACTIVE))
-                dev_queue_xmit(skb);
+        if (mpath->flags & MESH_PATH_ACTIVE)
+                ieee80211_add_pending_skbs(mpath->sdata->local,
+                                &mpath->frame_queue);
 }
 
 /**
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index cb14253587f1..ffcbad75e09b 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -409,7 +409,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt;
         if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) {
                 baseaddr += 4;
-                baselen -= 4;
+                baselen += 4;
         }
         ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
         if (!elems.peer_link) {
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 07e7e41816be..c374d2d73fa4 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -27,43 +27,99 @@
 #include "rate.h"
 #include "led.h"
 
-#define IEEE80211_ASSOC_SCANS_MAX_TRIES 2
 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
 #define IEEE80211_AUTH_MAX_TRIES 3
 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
 #define IEEE80211_ASSOC_MAX_TRIES 3
-#define IEEE80211_MONITORING_INTERVAL (2 * HZ)
-#define IEEE80211_PROBE_WAIT (HZ / 5)
-#define IEEE80211_PROBE_IDLE_TIME (60 * HZ)
-#define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
+#define IEEE80211_MAX_PROBE_TRIES 5
+
+/*
+ * beacon loss detection timeout
+ * XXX: should depend on beacon interval
+ */
+#define IEEE80211_BEACON_LOSS_TIME      (2 * HZ)
+/*
+ * Time the connection can be idle before we probe
+ * it to see if we can still talk to the AP.
+ */
+#define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
+/*
+ * Time we wait for a probe response after sending
+ * a probe request because of beacon loss or for
+ * checking the connection still works.
+ */
+#define IEEE80211_PROBE_WAIT            (HZ / 2)
 
 #define TMR_RUNNING_TIMER       0
 #define TMR_RUNNING_CHANSW      1
 
+/*
+ * All cfg80211 functions have to be called outside a locked
+ * section so that they can acquire a lock themselves... This
+ * is much simpler than queuing up things in cfg80211, but we
+ * do need some indirection for that here.
+ */
+enum rx_mgmt_action {
+        /* no action required */
+        RX_MGMT_NONE,
+
+        /* caller must call cfg80211_send_rx_auth() */
+        RX_MGMT_CFG80211_AUTH,
+
+        /* caller must call cfg80211_send_rx_assoc() */
+        RX_MGMT_CFG80211_ASSOC,
+
+        /* caller must call cfg80211_send_deauth() */
+        RX_MGMT_CFG80211_DEAUTH,
+
+        /* caller must call cfg80211_send_disassoc() */
+        RX_MGMT_CFG80211_DISASSOC,
+
+        /* caller must call cfg80211_auth_timeout() & free work */
+        RX_MGMT_CFG80211_AUTH_TO,
+
+        /* caller must call cfg80211_assoc_timeout() & free work */
+        RX_MGMT_CFG80211_ASSOC_TO,
+};
+
 /* utils */
-static int ecw2cw(int ecw)
+static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
 {
-        return (1 << ecw) - 1;
+        WARN_ON(!mutex_is_locked(&ifmgd->mtx));
 }
 
-static u8 *ieee80211_bss_get_ie(struct ieee80211_bss *bss, u8 ie)
+/*
+ * We can have multiple work items (and connection probing)
+ * scheduling this timer, but we need to take care to only
+ * reschedule it when it should fire _earlier_ than it was
+ * asked for before, or if it's not pending right now. This
+ * function ensures that. Note that it then is required to
+ * run this function for all timeouts after the first one
+ * has happened -- the work that runs from this timer will
+ * do that.
+ */
+static void run_again(struct ieee80211_if_managed *ifmgd,
+                             unsigned long timeout)
 {
-        u8 *end, *pos;
+        ASSERT_MGD_MTX(ifmgd);
 
-        pos = bss->cbss.information_elements;
-        if (pos == NULL)
-                return NULL;
-        end = pos + bss->cbss.len_information_elements;
+        if (!timer_pending(&ifmgd->timer) ||
+            time_before(timeout, ifmgd->timer.expires))
+                mod_timer(&ifmgd->timer, timeout);
+}
 
-        while (pos + 1 < end) {
-                if (pos + 2 + pos[1] > end)
-                        break;
-                if (pos[0] == ie)
-                        return pos;
-                pos += 2 + pos[1];
-        }
+static void mod_beacon_timer(struct ieee80211_sub_if_data *sdata)
+{
+        if (sdata->local->hw.flags & IEEE80211_HW_BEACON_FILTER)
+                return;
 
-        return NULL;
+        mod_timer(&sdata->u.mgd.bcn_mon_timer,
+                  round_jiffies_up(jiffies + IEEE80211_BEACON_LOSS_TIME));
+}
+
+static int ecw2cw(int ecw)
+{
+        return (1 << ecw) - 1;
 }
 
 static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
@@ -94,11 +150,10 @@ static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
  */
 static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                                struct ieee80211_ht_info *hti,
-                               u16 ap_ht_cap_flags)
+                               const u8 *bssid, u16 ap_ht_cap_flags)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct sta_info *sta;
         u32 changed = 0;
         u16 ht_opmode;
@@ -147,12 +202,10 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 ieee80211_hw_config(local, 0);
 
                 rcu_read_lock();
-
-                sta = sta_info_get(local, ifmgd->bssid);
+                sta = sta_info_get(local, bssid);
                 if (sta)
                         rate_control_rate_update(local, sband, sta,
                                                  IEEE80211_RC_HT_CHANGED);
-
                 rcu_read_unlock();
         }
 
@@ -175,23 +228,24 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 
 /* frame sending functions */
 
-static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
+                                 struct ieee80211_mgd_work *wk)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos, *ies, *ht_ie;
+        u8 *pos;
+        const u8 *ies, *ht_ie;
         int i, len, count, rates_len, supp_rates_len;
         u16 capab;
-        struct ieee80211_bss *bss;
         int wmm = 0;
         struct ieee80211_supported_band *sband;
         u32 rates = 0;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 200 + ifmgd->extra_ie_len +
-                            ifmgd->ssid_len);
+                            sizeof(*mgmt) + 200 + wk->ie_len +
+                            wk->ssid_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
                        "frame\n", sdata->dev->name);
@@ -210,45 +264,35 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
         }
 
-        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
-                                   local->hw.conf.channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-        if (bss) {
-                if (bss->cbss.capability & WLAN_CAPABILITY_PRIVACY)
-                        capab |= WLAN_CAPABILITY_PRIVACY;
-                if (bss->wmm_used)
-                        wmm = 1;
+        if (wk->bss->cbss.capability & WLAN_CAPABILITY_PRIVACY)
+                capab |= WLAN_CAPABILITY_PRIVACY;
+        if (wk->bss->wmm_used)
+                wmm = 1;
 
-                /* get all rates supported by the device and the AP as
-                 * some APs don't like getting a superset of their rates
-                 * in the association request (e.g. D-Link DAP 1353 in
-                 * b-only mode) */
-                rates_len = ieee80211_compatible_rates(bss, sband, &rates);
+        /* get all rates supported by the device and the AP as
+         * some APs don't like getting a superset of their rates
+         * in the association request (e.g. D-Link DAP 1353 in
+         * b-only mode) */
+        rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
 
-                if ((bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
-                    (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
-                        capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
-
-                ieee80211_rx_bss_put(local, bss);
-        } else {
-                rates = ~0;
-                rates_len = sband->n_bitrates;
-        }
+        if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+            (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
+                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
-        memcpy(mgmt->da, ifmgd->bssid, ETH_ALEN);
+        memcpy(mgmt->da, wk->bss->cbss.bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifmgd->bssid, ETH_ALEN);
+        memcpy(mgmt->bssid, wk->bss->cbss.bssid, ETH_ALEN);
 
-        if (ifmgd->flags & IEEE80211_STA_PREV_BSSID_SET) {
+        if (!is_zero_ether_addr(wk->prev_bssid)) {
                 skb_put(skb, 10);
                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                   IEEE80211_STYPE_REASSOC_REQ);
                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
                 mgmt->u.reassoc_req.listen_interval =
                                 cpu_to_le16(local->hw.conf.listen_interval);
-                memcpy(mgmt->u.reassoc_req.current_ap, ifmgd->prev_bssid,
+                memcpy(mgmt->u.reassoc_req.current_ap, wk->prev_bssid,
                        ETH_ALEN);
         } else {
                 skb_put(skb, 4);
@@ -260,10 +304,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         }
 
         /* SSID */
-        ies = pos = skb_put(skb, 2 + ifmgd->ssid_len);
+        ies = pos = skb_put(skb, 2 + wk->ssid_len);
         *pos++ = WLAN_EID_SSID;
-        *pos++ = ifmgd->ssid_len;
-        memcpy(pos, ifmgd->ssid, ifmgd->ssid_len);
+        *pos++ = wk->ssid_len;
+        memcpy(pos, wk->ssid, wk->ssid_len);
 
         /* add all rates which were marked to be used above */
         supp_rates_len = rates_len;
@@ -318,9 +362,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 }
         }
 
-        if (ifmgd->extra_ie) {
-                pos = skb_put(skb, ifmgd->extra_ie_len);
-                memcpy(pos, ifmgd->extra_ie, ifmgd->extra_ie_len);
+        if (wk->ie_len && wk->ie) {
+                pos = skb_put(skb, wk->ie_len);
+                memcpy(pos, wk->ie, wk->ie_len);
         }
 
         if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED)) {
@@ -345,9 +389,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
          */
         if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
             sband->ht_cap.ht_supported &&
-            (ht_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_INFORMATION)) &&
+            (ht_ie = ieee80211_bss_get_ie(&wk->bss->cbss, WLAN_EID_HT_INFORMATION)) &&
             ht_ie[1] >= sizeof(struct ieee80211_ht_info) &&
-            (!(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))) {
+            (!(ifmgd->flags & IEEE80211_STA_DISABLE_11N))) {
                 struct ieee80211_ht_info *ht_info =
                         (struct ieee80211_ht_info *)(ht_ie + 2);
                 u16 cap = sband->ht_cap.cap;
@@ -382,18 +426,13 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
         }
 
-        kfree(ifmgd->assocreq_ies);
-        ifmgd->assocreq_ies_len = (skb->data + skb->len) - ies;
-        ifmgd->assocreq_ies = kmalloc(ifmgd->assocreq_ies_len, GFP_KERNEL);
-        if (ifmgd->assocreq_ies)
-                memcpy(ifmgd->assocreq_ies, ies, ifmgd->assocreq_ies_len);
-
         ieee80211_tx_skb(sdata, skb, 0);
 }
 
 
 static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
-                                           u16 stype, u16 reason)
+                                           const u8 *bssid, u16 stype, u16 reason,
+                                           void *cookie)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -410,18 +449,18 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
-        memcpy(mgmt->da, ifmgd->bssid, ETH_ALEN);
+        memcpy(mgmt->da, bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifmgd->bssid, ETH_ALEN);
+        memcpy(mgmt->bssid, bssid, ETH_ALEN);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
         skb_put(skb, 2);
         /* u.deauth.reason_code == u.disassoc.reason_code */
         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 
         if (stype == IEEE80211_STYPE_DEAUTH)
-                cfg80211_send_deauth(sdata->dev, (u8 *) mgmt, skb->len);
+                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len, cookie);
         else
-                cfg80211_send_disassoc(sdata->dev, (u8 *) mgmt, skb->len);
+                cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len, cookie);
         ieee80211_tx_skb(sdata, skb, ifmgd->flags & IEEE80211_STA_MFP_ENABLED);
 }
 
@@ -494,28 +533,26 @@ static void ieee80211_chswitch_work(struct work_struct *work)
 {
         struct ieee80211_sub_if_data *sdata =
                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
-        struct ieee80211_bss *bss;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         if (!netif_running(sdata->dev))
                 return;
 
-        bss = ieee80211_rx_bss_get(sdata->local, ifmgd->bssid,
-                                   sdata->local->hw.conf.channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-        if (!bss)
-                goto exit;
+        mutex_lock(&ifmgd->mtx);
+        if (!ifmgd->associated)
+                goto out;
 
         sdata->local->oper_channel = sdata->local->csa_channel;
+        ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL);
+
         /* XXX: shouldn't really modify cfg80211-owned data! */
-        if (!ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL))
-                bss->cbss.channel = sdata->local->oper_channel;
+        ifmgd->associated->cbss.channel = sdata->local->oper_channel;
 
-        ieee80211_rx_bss_put(sdata->local, bss);
-exit:
-        ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
+ out:
+        ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        mutex_unlock(&ifmgd->mtx);
 }
 
 static void ieee80211_chswitch_timer(unsigned long data)
@@ -529,7 +566,7 @@ static void ieee80211_chswitch_timer(unsigned long data)
                 return;
         }
 
-        queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+        ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 }
 
 void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
@@ -540,10 +577,12 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
 
-        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATED)
+        ASSERT_MGD_MTX(ifmgd);
+
+        if (!ifmgd->associated)
                 return;
 
-        if (sdata->local->sw_scanning || sdata->local->hw_scanning)
+        if (sdata->local->scanning)
                 return;
 
         /* Disregard subsequent beacons if we are already running a timer
@@ -559,7 +598,7 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         sdata->local->csa_channel = new_ch;
 
         if (sw_elem->count <= 1) {
-                queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+                ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
         } else {
                 ieee80211_stop_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -601,7 +640,7 @@ static void ieee80211_enable_ps(struct ieee80211_local *local,
          * If we are scanning right now then the parameters will
          * take effect when scan finishes.
          */
-        if (local->hw_scanning || local->sw_scanning)
+        if (local->scanning)
                 return;
 
         if (conf->dynamic_ps_timeout > 0 &&
@@ -651,8 +690,9 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
         }
 
         if (count == 1 && found->u.mgd.powersave &&
-            (found->u.mgd.flags & IEEE80211_STA_ASSOCIATED) &&
-            !(found->u.mgd.flags & IEEE80211_STA_PROBEREQ_POLL)) {
+            found->u.mgd.associated && list_empty(&found->u.mgd.work_list) &&
+            !(found->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
+                                    IEEE80211_STA_CONNECTION_POLL))) {
                 s32 beaconint_us;
 
                 if (latency < 0)
@@ -724,7 +764,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
         if (local->quiescing || local->suspended)
                 return;
 
-        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
+        ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
 }
 
 /* MLME */
@@ -806,9 +846,6 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                            u16 capab, bool erp_valid, u8 erp)
 {
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-#endif
         u32 changed = 0;
         bool use_protection;
         bool use_short_preamble;
@@ -825,42 +862,16 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
 
         if (use_protection != bss_conf->use_cts_prot) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: CTS protection %s (BSSID=%pM)\n",
-                               sdata->dev->name,
-                               use_protection ? "enabled" : "disabled",
-                               ifmgd->bssid);
-                }
-#endif
                 bss_conf->use_cts_prot = use_protection;
                 changed |= BSS_CHANGED_ERP_CTS_PROT;
         }
 
         if (use_short_preamble != bss_conf->use_short_preamble) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: switched to %s barker preamble"
-                               " (BSSID=%pM)\n",
-                               sdata->dev->name,
-                               use_short_preamble ? "short" : "long",
-                               ifmgd->bssid);
-                }
-#endif
                 bss_conf->use_short_preamble = use_short_preamble;
                 changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
 
         if (use_short_slot != bss_conf->use_short_slot) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: switched to %s slot time"
-                               " (BSSID=%pM)\n",
-                               sdata->dev->name,
-                               use_short_slot ? "short" : "long",
-                               ifmgd->bssid);
-                }
-#endif
                 bss_conf->use_short_slot = use_short_slot;
                 changed |= BSS_CHANGED_ERP_SLOT;
         }
@@ -868,105 +879,31 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         return changed;
 }
 
-static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata)
-{
-        union iwreq_data wrqu;
-
-        memset(&wrqu, 0, sizeof(wrqu));
-        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED)
-                memcpy(wrqu.ap_addr.sa_data, sdata->u.mgd.bssid, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
-}
-
-static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        char *buf;
-        size_t len;
-        int i;
-        union iwreq_data wrqu;
-
-        if (!ifmgd->assocreq_ies && !ifmgd->assocresp_ies)
-                return;
-
-        buf = kmalloc(50 + 2 * (ifmgd->assocreq_ies_len +
-                                ifmgd->assocresp_ies_len), GFP_KERNEL);
-        if (!buf)
-                return;
-
-        len = sprintf(buf, "ASSOCINFO(");
-        if (ifmgd->assocreq_ies) {
-                len += sprintf(buf + len, "ReqIEs=");
-                for (i = 0; i < ifmgd->assocreq_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifmgd->assocreq_ies[i]);
-                }
-        }
-        if (ifmgd->assocresp_ies) {
-                if (ifmgd->assocreq_ies)
-                        len += sprintf(buf + len, " ");
-                len += sprintf(buf + len, "RespIEs=");
-                for (i = 0; i < ifmgd->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifmgd->assocresp_ies[i]);
-                }
-        }
-        len += sprintf(buf + len, ")");
-
-        if (len > IW_CUSTOM_MAX) {
-                len = sprintf(buf, "ASSOCRESPIE=");
-                for (i = 0; i < ifmgd->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifmgd->assocresp_ies[i]);
-                }
-        }
-
-        if (len <= IW_CUSTOM_MAX) {
-                memset(&wrqu, 0, sizeof(wrqu));
-                wrqu.data.length = len;
-                wireless_send_event(sdata->dev, IWEVCUSTOM, &wrqu, buf);
-        }
-
-        kfree(buf);
-}
-
-
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgd_work *wk,
                                      u32 bss_info_changed)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local_to_hw(local)->conf;
-
-        struct ieee80211_bss *bss;
+        struct ieee80211_bss *bss = wk->bss;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
-        ifmgd->flags |= IEEE80211_STA_ASSOCIATED;
+        /* set timing information */
+        sdata->vif.bss_conf.beacon_int = bss->cbss.beacon_interval;
+        sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
+        sdata->vif.bss_conf.dtim_period = bss->dtim_period;
 
-        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
-                                   conf->channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-        if (bss) {
-                /* set timing information */
-                sdata->vif.bss_conf.beacon_int = bss->cbss.beacon_interval;
-                sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
-                sdata->vif.bss_conf.dtim_period = bss->dtim_period;
+        bss_info_changed |= BSS_CHANGED_BEACON_INT;
+        bss_info_changed |= ieee80211_handle_bss_capability(sdata,
+                bss->cbss.capability, bss->has_erp_value, bss->erp_value);
 
-                bss_info_changed |= BSS_CHANGED_BEACON_INT;
-                bss_info_changed |= ieee80211_handle_bss_capability(sdata,
-                        bss->cbss.capability, bss->has_erp_value, bss->erp_value);
+        sdata->u.mgd.associated = bss;
+        sdata->u.mgd.old_associate_work = wk;
+        memcpy(sdata->u.mgd.bssid, bss->cbss.bssid, ETH_ALEN);
 
-                cfg80211_hold_bss(&bss->cbss);
+        /* just to be sure */
+        sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                                IEEE80211_STA_BEACON_POLL);
 
-                ieee80211_rx_bss_put(local, bss);
-        }
-
-        ifmgd->flags |= IEEE80211_STA_PREV_BSSID_SET;
-        memcpy(ifmgd->prev_bssid, sdata->u.mgd.bssid, ETH_ALEN);
-        ieee80211_sta_send_associnfo(sdata);
-
-        ifmgd->last_probe = jiffies;
         ieee80211_led_assoc(local, 1);
 
         sdata->vif.bss_conf.assoc = 1;
@@ -982,176 +919,157 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
-        /* will be same as sdata */
-        if (local->ps_sdata) {
-                mutex_lock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
-        }
+        mutex_lock(&local->iflist_mtx);
+        ieee80211_recalc_ps(local, -1);
+        mutex_unlock(&local->iflist_mtx);
 
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
-
-        ieee80211_sta_send_apinfo(sdata);
 }
 
-static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata)
+static enum rx_mgmt_action __must_check
+ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
+                       struct ieee80211_mgd_work *wk)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        ifmgd->direct_probe_tries++;
-        if (ifmgd->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
+        wk->tries++;
+        if (wk->tries > IEEE80211_AUTH_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
-                       sdata->dev->name, ifmgd->bssid);
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(local);
-                cfg80211_send_auth_timeout(sdata->dev, ifmgd->bssid);
+                       sdata->dev->name, wk->bss->cbss.bssid);
 
                 /*
                  * Most likely AP is not in the range so remove the
-                 * bss information associated to the AP
+                 * bss struct for that AP.
                  */
-                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
-                                sdata->local->hw.conf.channel->center_freq,
-                                ifmgd->ssid, ifmgd->ssid_len);
+                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
 
                 /*
                  * We might have a pending scan which had no chance to run yet
-                 * due to state == IEEE80211_STA_MLME_DIRECT_PROBE.
-                 * Hence, queue the STAs work again
+                 * due to work needing to be done. Hence, queue the STAs work
+                 * again for that.
                  */
-                queue_work(local->hw.workqueue, &ifmgd->work);
-                return;
+                ieee80211_queue_work(&local->hw, &ifmgd->work);
+                return RX_MGMT_CFG80211_AUTH_TO;
         }
 
-        printk(KERN_DEBUG "%s: direct probe to AP %pM try %d\n",
-                        sdata->dev->name, ifmgd->bssid,
-                        ifmgd->direct_probe_tries);
-
-        ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
+        printk(KERN_DEBUG "%s: direct probe to AP %pM (try %d)\n",
+                        sdata->dev->name, wk->bss->cbss.bssid,
+                        wk->tries);
 
-        /* Direct probe is sent to broadcast address as some APs
+        /*
+         * Direct probe is sent to broadcast address as some APs
          * will not answer to direct packet in unassociated state.
          */
-        ieee80211_send_probe_req(sdata, NULL,
-                                 ifmgd->ssid, ifmgd->ssid_len, NULL, 0);
+        ieee80211_send_probe_req(sdata, NULL, wk->ssid, wk->ssid_len, NULL, 0);
+
+        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+        run_again(ifmgd, wk->timeout);
 
-        mod_timer(&ifmgd->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
+        return RX_MGMT_NONE;
 }
 
 
-static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata)
+static enum rx_mgmt_action __must_check
+ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
+                       struct ieee80211_mgd_work *wk)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        u8 *ies;
-        size_t ies_len;
 
-        ifmgd->auth_tries++;
-        if (ifmgd->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
+        wk->tries++;
+        if (wk->tries > IEEE80211_AUTH_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: authentication with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, ifmgd->bssid);
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(local);
-                cfg80211_send_auth_timeout(sdata->dev, ifmgd->bssid);
-                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
-                                sdata->local->hw.conf.channel->center_freq,
-                                ifmgd->ssid, ifmgd->ssid_len);
+                       sdata->dev->name, wk->bss->cbss.bssid);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
 
                 /*
                  * We might have a pending scan which had no chance to run yet
-                 * due to state == IEEE80211_STA_MLME_AUTHENTICATE.
-                 * Hence, queue the STAs work again
+                 * due to work needing to be done. Hence, queue the STAs work
+                 * again for that.
                  */
-                queue_work(local->hw.workqueue, &ifmgd->work);
-                return;
+                ieee80211_queue_work(&local->hw, &ifmgd->work);
+                return RX_MGMT_CFG80211_AUTH_TO;
         }
 
-        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
-        printk(KERN_DEBUG "%s: authenticate with AP %pM\n",
-               sdata->dev->name, ifmgd->bssid);
+        printk(KERN_DEBUG "%s: authenticate with AP %pM (try %d)\n",
+               sdata->dev->name, wk->bss->cbss.bssid, wk->tries);
 
-        if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
-                ies = ifmgd->sme_auth_ie;
-                ies_len = ifmgd->sme_auth_ie_len;
-        } else {
-                ies = NULL;
-                ies_len = 0;
-        }
-        ieee80211_send_auth(sdata, 1, ifmgd->auth_alg, ies, ies_len,
-                            ifmgd->bssid, 0);
-        ifmgd->auth_transaction = 2;
+        ieee80211_send_auth(sdata, 1, wk->auth_alg, wk->ie, wk->ie_len,
+                            wk->bss->cbss.bssid, NULL, 0, 0);
+        wk->auth_transaction = 2;
 
-        mod_timer(&ifmgd->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
+        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+        run_again(ifmgd, wk->timeout);
+
+        return RX_MGMT_NONE;
 }
 
-/*
- * The disassoc 'reason' argument can be either our own reason
- * if self disconnected or a reason code from the AP.
- */
 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
-                                   bool deauth, bool self_disconnected,
-                                   u16 reason)
+                                   bool deauth)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local_to_hw(local)->conf;
-        struct ieee80211_bss *bss;
         struct sta_info *sta;
         u32 changed = 0, config_changed = 0;
+        u8 bssid[ETH_ALEN];
+
+        ASSERT_MGD_MTX(ifmgd);
+
+        if (WARN_ON(!ifmgd->associated))
+                return;
+
+        memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
+
+        ifmgd->associated = NULL;
+        memset(ifmgd->bssid, 0, ETH_ALEN);
 
         if (deauth) {
-                ifmgd->direct_probe_tries = 0;
-                ifmgd->auth_tries = 0;
+                kfree(ifmgd->old_associate_work);
+                ifmgd->old_associate_work = NULL;
+        } else {
+                struct ieee80211_mgd_work *wk = ifmgd->old_associate_work;
+
+                wk->state = IEEE80211_MGD_STATE_IDLE;
+                list_add(&wk->list, &ifmgd->work_list);
         }
-        ifmgd->assoc_scan_tries = 0;
-        ifmgd->assoc_tries = 0;
+
+        /*
+         * we need to commit the associated = NULL change because the
+         * scan code uses that to determine whether this iface should
+         * go to/wake up from powersave or not -- and could otherwise
+         * wake the queues erroneously.
+         */
+        smp_mb();
+
+        /*
+         * Thus, we can only afterwards stop the queues -- to account
+         * for the case where another CPU is finishing a scan at this
+         * time -- we don't want the scan code to enable queues.
+         */
 
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 
         rcu_read_lock();
-        sta = sta_info_get(local, ifmgd->bssid);
+        sta = sta_info_get(local, bssid);
         if (sta)
                 ieee80211_sta_tear_down_BA_sessions(sta);
         rcu_read_unlock();
 
-        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
-                                   conf->channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-
-        if (bss) {
-                cfg80211_unhold_bss(&bss->cbss);
-                ieee80211_rx_bss_put(local, bss);
-        }
-
-        if (self_disconnected) {
-                if (deauth)
-                        ieee80211_send_deauth_disassoc(sdata,
-                                IEEE80211_STYPE_DEAUTH, reason);
-                else
-                        ieee80211_send_deauth_disassoc(sdata,
-                                IEEE80211_STYPE_DISASSOC, reason);
-        }
-
-        ifmgd->flags &= ~IEEE80211_STA_ASSOCIATED;
         changed |= ieee80211_reset_erp_info(sdata);
 
         ieee80211_led_assoc(local, 0);
         changed |= BSS_CHANGED_ASSOC;
         sdata->vif.bss_conf.assoc = false;
 
-        ieee80211_sta_send_apinfo(sdata);
-
-        if (self_disconnected || reason == WLAN_REASON_DISASSOC_STA_HAS_LEFT) {
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
-                                sdata->local->hw.conf.channel->center_freq,
-                                ifmgd->ssid, ifmgd->ssid_len);
-        }
-
         ieee80211_set_wmm_default(sdata);
 
         ieee80211_recalc_idle(local);
@@ -1180,7 +1098,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ifmgd->bssid);
+        sta = sta_info_get(local, bssid);
         if (!sta) {
                 rcu_read_unlock();
                 return;
@@ -1193,83 +1111,42 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         sta_info_destroy(sta);
 }
 
-static int ieee80211_sta_wep_configured(struct ieee80211_sub_if_data *sdata)
-{
-        if (!sdata || !sdata->default_key ||
-            sdata->default_key->conf.alg != ALG_WEP)
-                return 0;
-        return 1;
-}
-
-static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss;
-        int bss_privacy;
-        int wep_privacy;
-        int privacy_invoked;
-
-        if (!ifmgd || (ifmgd->flags & IEEE80211_STA_EXT_SME))
-                return 0;
-
-        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
-                                   local->hw.conf.channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-        if (!bss)
-                return 0;
-
-        bss_privacy = !!(bss->cbss.capability & WLAN_CAPABILITY_PRIVACY);
-        wep_privacy = !!ieee80211_sta_wep_configured(sdata);
-        privacy_invoked = !!(ifmgd->flags & IEEE80211_STA_PRIVACY_INVOKED);
-
-        ieee80211_rx_bss_put(local, bss);
-
-        if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
-                return 0;
-
-        return 1;
-}
-
-static void ieee80211_associate(struct ieee80211_sub_if_data *sdata)
+static enum rx_mgmt_action __must_check
+ieee80211_associate(struct ieee80211_sub_if_data *sdata,
+                    struct ieee80211_mgd_work *wk)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        ifmgd->assoc_tries++;
-        if (ifmgd->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
+        wk->tries++;
+        if (wk->tries > IEEE80211_ASSOC_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: association with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, ifmgd->bssid);
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(local);
-                cfg80211_send_assoc_timeout(sdata->dev, ifmgd->bssid);
-                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
-                                sdata->local->hw.conf.channel->center_freq,
-                                ifmgd->ssid, ifmgd->ssid_len);
+                       sdata->dev->name, wk->bss->cbss.bssid);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
+
                 /*
                  * We might have a pending scan which had no chance to run yet
-                 * due to state == IEEE80211_STA_MLME_ASSOCIATE.
-                 * Hence, queue the STAs work again
+                 * due to work needing to be done. Hence, queue the STAs work
+                 * again for that.
                  */
-                queue_work(local->hw.workqueue, &ifmgd->work);
-                return;
+                ieee80211_queue_work(&local->hw, &ifmgd->work);
+                return RX_MGMT_CFG80211_ASSOC_TO;
         }
 
-        ifmgd->state = IEEE80211_STA_MLME_ASSOCIATE;
-        printk(KERN_DEBUG "%s: associate with AP %pM\n",
-               sdata->dev->name, ifmgd->bssid);
-        if (ieee80211_privacy_mismatch(sdata)) {
-                printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
-                       "mixed-cell disabled - abort association\n", sdata->dev->name);
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(local);
-                return;
-        }
+        printk(KERN_DEBUG "%s: associate with AP %pM (try %d)\n",
+               sdata->dev->name, wk->bss->cbss.bssid, wk->tries);
+        ieee80211_send_assoc(sdata, wk);
 
-        ieee80211_send_assoc(sdata);
+        wk->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
+        run_again(ifmgd, wk->timeout);
 
-        mod_timer(&ifmgd->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
+        return RX_MGMT_NONE;
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
@@ -1280,160 +1157,113 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
          * from AP because we know that the connection is working both ways
          * at that time. But multicast frames (and hence also beacons) must
          * be ignored here, because we need to trigger the timer during
-         * data idle periods for sending the periodical probe request to
-         * the AP.
-         */
-        if (!is_multicast_ether_addr(hdr->addr1))
-                mod_timer(&sdata->u.mgd.timer,
-                          jiffies + IEEE80211_MONITORING_INTERVAL);
-}
-
-void ieee80211_beacon_loss_work(struct work_struct *work)
-{
-        struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data,
-                             u.mgd.beacon_loss_work);
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-
-        /*
-         * The driver has already reported this event and we have
-         * already sent a probe request. Maybe the AP died and the
-         * driver keeps reporting until we disassociate... We have
-         * to ignore that because otherwise we would continually
-         * reset the timer and never check whether we received a
-         * probe response!
+         * data idle periods for sending the periodic probe request to the
+         * AP we're connected to.
          */
-        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL)
+        if (is_multicast_ether_addr(hdr->addr1))
                 return;
 
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        if (net_ratelimit()) {
-                printk(KERN_DEBUG "%s: driver reports beacon loss from AP %pM "
-                       "- sending probe request\n", sdata->dev->name,
-                       sdata->u.mgd.bssid);
-        }
-#endif
-
-        ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
-
-        mutex_lock(&sdata->local->iflist_mtx);
-        ieee80211_recalc_ps(sdata->local, -1);
-        mutex_unlock(&sdata->local->iflist_mtx);
-
-        ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
-                                 ifmgd->ssid_len, NULL, 0);
-
-        mod_timer(&ifmgd->timer, jiffies + IEEE80211_PROBE_WAIT);
+        mod_timer(&sdata->u.mgd.conn_mon_timer,
+                  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 }
 
-void ieee80211_beacon_loss(struct ieee80211_vif *vif)
+static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *ssid;
+
+        ssid = ieee80211_bss_get_ie(&ifmgd->associated->cbss, WLAN_EID_SSID);
+        ieee80211_send_probe_req(sdata, ifmgd->associated->cbss.bssid,
+                                 ssid + 2, ssid[1], NULL, 0);
 
-        queue_work(sdata->local->hw.workqueue,
-                   &sdata->u.mgd.beacon_loss_work);
+        ifmgd->probe_send_count++;
+        ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
+        run_again(ifmgd, ifmgd->probe_timeout);
 }
-EXPORT_SYMBOL(ieee80211_beacon_loss);
 
-static void ieee80211_associated(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
+                                   bool beacon)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        unsigned long last_rx;
-        bool disassoc = false;
+        bool already = false;
 
-        /* TODO: start monitoring current AP signal quality and number of
-         * missed beacons. Scan other channels every now and then and search
-         * for better APs. */
-        /* TODO: remove expired BSSes */
+        if (!netif_running(sdata->dev))
+                return;
 
-        ifmgd->state = IEEE80211_STA_MLME_ASSOCIATED;
+        if (sdata->local->scanning)
+                return;
 
-        rcu_read_lock();
+        mutex_lock(&ifmgd->mtx);
 
-        sta = sta_info_get(local, ifmgd->bssid);
-        if (!sta) {
-                printk(KERN_DEBUG "%s: No STA entry for own AP %pM\n",
-                       sdata->dev->name, ifmgd->bssid);
-                disassoc = true;
-                rcu_read_unlock();
+        if (!ifmgd->associated)
                 goto out;
-        }
-
-        last_rx = sta->last_rx;
-        rcu_read_unlock();
 
-        if ((ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) &&
-            time_after(jiffies, last_rx + IEEE80211_PROBE_WAIT)) {
-                printk(KERN_DEBUG "%s: no probe response from AP %pM "
-                       "- disassociating\n",
-                       sdata->dev->name, ifmgd->bssid);
-                disassoc = true;
-                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
-                goto out;
-        }
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        if (beacon && net_ratelimit())
+                printk(KERN_DEBUG "%s: detected beacon loss from AP "
+                       "- sending probe request\n", sdata->dev->name);
+#endif
 
         /*
-         * Beacon filtering is only enabled with power save and then the
-         * stack should not check for beacon loss.
+         * The driver/our work has already reported this event or the
+         * connection monitoring has kicked in and we have already sent
+         * a probe request. Or maybe the AP died and the driver keeps
+         * reporting until we disassociate...
+         *
+         * In either case we have to ignore the current call to this
+         * function (except for setting the correct probe reason bit)
+         * because otherwise we would reset the timer every time and
+         * never check whether we received a probe response!
          */
-        if (!((local->hw.flags & IEEE80211_HW_BEACON_FILTER) &&
-              (local->hw.conf.flags & IEEE80211_CONF_PS)) &&
-            time_after(jiffies,
-                       ifmgd->last_beacon + IEEE80211_MONITORING_INTERVAL)) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: beacon loss from AP %pM "
-                               "- sending probe request\n",
-                               sdata->dev->name, ifmgd->bssid);
-                }
-#endif
-                ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
-                mutex_lock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
-                ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
-                                         ifmgd->ssid_len, NULL, 0);
-                mod_timer(&ifmgd->timer, jiffies + IEEE80211_PROBE_WAIT);
+        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
+                            IEEE80211_STA_CONNECTION_POLL))
+                already = true;
+
+        if (beacon)
+                ifmgd->flags |= IEEE80211_STA_BEACON_POLL;
+        else
+                ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
+
+        if (already)
                 goto out;
-        }
 
-        if (time_after(jiffies, last_rx + IEEE80211_PROBE_IDLE_TIME)) {
-                ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
-                mutex_lock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
-                ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
-                                         ifmgd->ssid_len, NULL, 0);
-        }
+        mutex_lock(&sdata->local->iflist_mtx);
+        ieee80211_recalc_ps(sdata->local, -1);
+        mutex_unlock(&sdata->local->iflist_mtx);
 
+        ifmgd->probe_send_count = 0;
+        ieee80211_mgd_probe_ap_send(sdata);
  out:
-        if (!disassoc)
-                mod_timer(&ifmgd->timer,
-                          jiffies + IEEE80211_MONITORING_INTERVAL);
-        else
-                ieee80211_set_disassoc(sdata, true, true,
-                                        WLAN_REASON_PREV_AUTH_NOT_VALID);
+        mutex_unlock(&ifmgd->mtx);
 }
 
+void ieee80211_beacon_loss_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             u.mgd.beacon_loss_work);
+
+        ieee80211_mgd_probe_ap(sdata, true);
+}
 
-static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata)
+void ieee80211_beacon_loss(struct ieee80211_vif *vif)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.beacon_loss_work);
+}
+EXPORT_SYMBOL(ieee80211_beacon_loss);
+
+static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgd_work *wk)
+{
+        wk->state = IEEE80211_MGD_STATE_IDLE;
         printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
-        ifmgd->flags |= IEEE80211_STA_AUTHENTICATED;
-        if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
-                /* Wait for SME to request association */
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(sdata->local);
-        } else
-                ieee80211_associate(sdata);
 }
 
 
 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgd_work *wk,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
 {
@@ -1444,161 +1274,133 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
         if (!elems.challenge)
                 return;
-        ieee80211_send_auth(sdata, 3, sdata->u.mgd.auth_alg,
+        ieee80211_send_auth(sdata, 3, wk->auth_alg,
                             elems.challenge - 2, elems.challenge_len + 2,
-                            sdata->u.mgd.bssid, 1);
-        sdata->u.mgd.auth_transaction = 4;
+                            wk->bss->cbss.bssid,
+                            wk->key, wk->key_len, wk->key_idx);
+        wk->auth_transaction = 4;
 }
 
-static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_mgmt *mgmt,
-                                   size_t len)
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+                       struct ieee80211_mgd_work *wk,
+                       struct ieee80211_mgmt *mgmt, size_t len)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 auth_alg, auth_transaction, status_code;
 
-        if (ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE)
-                return;
+        if (wk->state != IEEE80211_MGD_STATE_AUTH)
+                return RX_MGMT_NONE;
 
         if (len < 24 + 6)
-                return;
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN) != 0)
-                return;
+        if (memcmp(wk->bss->cbss.bssid, mgmt->sa, ETH_ALEN) != 0)
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
-                return;
+        if (memcmp(wk->bss->cbss.bssid, mgmt->bssid, ETH_ALEN) != 0)
+                return RX_MGMT_NONE;
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
-        if (auth_alg != ifmgd->auth_alg ||
-            auth_transaction != ifmgd->auth_transaction)
-                return;
+        if (auth_alg != wk->auth_alg ||
+            auth_transaction != wk->auth_transaction)
+                return RX_MGMT_NONE;
 
         if (status_code != WLAN_STATUS_SUCCESS) {
-                if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
-                        u8 algs[3];
-                        const int num_algs = ARRAY_SIZE(algs);
-                        int i, pos;
-                        algs[0] = algs[1] = algs[2] = 0xff;
-                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_OPEN)
-                                algs[0] = WLAN_AUTH_OPEN;
-                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
-                                algs[1] = WLAN_AUTH_SHARED_KEY;
-                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_LEAP)
-                                algs[2] = WLAN_AUTH_LEAP;
-                        if (ifmgd->auth_alg == WLAN_AUTH_OPEN)
-                                pos = 0;
-                        else if (ifmgd->auth_alg == WLAN_AUTH_SHARED_KEY)
-                                pos = 1;
-                        else
-                                pos = 2;
-                        for (i = 0; i < num_algs; i++) {
-                                pos++;
-                                if (pos >= num_algs)
-                                        pos = 0;
-                                if (algs[pos] == ifmgd->auth_alg ||
-                                    algs[pos] == 0xff)
-                                        continue;
-                                if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
-                                    !ieee80211_sta_wep_configured(sdata))
-                                        continue;
-                                ifmgd->auth_alg = algs[pos];
-                                break;
-                        }
-                }
-                return;
+                list_del(&wk->list);
+                kfree(wk);
+                return RX_MGMT_CFG80211_AUTH;
         }
 
-        switch (ifmgd->auth_alg) {
+        switch (wk->auth_alg) {
         case WLAN_AUTH_OPEN:
         case WLAN_AUTH_LEAP:
         case WLAN_AUTH_FT:
-                ieee80211_auth_completed(sdata);
-                cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, len);
-                break;
+                ieee80211_auth_completed(sdata, wk);
+                return RX_MGMT_CFG80211_AUTH;
         case WLAN_AUTH_SHARED_KEY:
-                if (ifmgd->auth_transaction == 4) {
-                        ieee80211_auth_completed(sdata);
-                        cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, len);
+                if (wk->auth_transaction == 4) {
+                        ieee80211_auth_completed(sdata, wk);
+                        return RX_MGMT_CFG80211_AUTH;
                 } else
-                        ieee80211_auth_challenge(sdata, mgmt, len);
+                        ieee80211_auth_challenge(sdata, wk, mgmt, len);
                 break;
         }
+
+        return RX_MGMT_NONE;
 }
 
 
-static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len)
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
+                         struct ieee80211_mgd_work *wk,
+                         struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *bssid = NULL;
         u16 reason_code;
 
         if (len < 24 + 2)
-                return;
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN))
-                return;
+        ASSERT_MGD_MTX(ifmgd);
+
+        if (wk)
+                bssid = wk->bss->cbss.bssid;
+        else
+                bssid = ifmgd->associated->cbss.bssid;
 
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-        if (ifmgd->flags & IEEE80211_STA_AUTHENTICATED)
-                printk(KERN_DEBUG "%s: deauthenticated (Reason: %u)\n",
-                                sdata->dev->name, reason_code);
+        printk(KERN_DEBUG "%s: deauthenticated from %pM (Reason: %u)\n",
+                        sdata->dev->name, bssid, reason_code);
 
-        if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) &&
-            (ifmgd->state == IEEE80211_STA_MLME_AUTHENTICATE ||
-             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATE ||
-             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)) {
-                ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
-                mod_timer(&ifmgd->timer, jiffies +
-                                      IEEE80211_RETRY_AUTH_INTERVAL);
+        if (!wk) {
+                ieee80211_set_disassoc(sdata, true);
+        } else {
+                list_del(&wk->list);
+                kfree(wk);
         }
 
-        ieee80211_set_disassoc(sdata, true, false, 0);
-        ifmgd->flags &= ~IEEE80211_STA_AUTHENTICATED;
-        cfg80211_send_deauth(sdata->dev, (u8 *) mgmt, len);
+        return RX_MGMT_CFG80211_DEAUTH;
 }
 
 
-static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
-                                       struct ieee80211_mgmt *mgmt,
-                                       size_t len)
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
+                           struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 reason_code;
 
         if (len < 24 + 2)
-                return;
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN))
-                return;
+        ASSERT_MGD_MTX(ifmgd);
 
-        reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
+        if (WARN_ON(!ifmgd->associated))
+                return RX_MGMT_NONE;
 
-        if (ifmgd->flags & IEEE80211_STA_ASSOCIATED)
-                printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
-                                sdata->dev->name, reason_code);
+        if (WARN_ON(memcmp(ifmgd->associated->cbss.bssid, mgmt->sa, ETH_ALEN)))
+                return RX_MGMT_NONE;
 
-        if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) &&
-            ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED) {
-                ifmgd->state = IEEE80211_STA_MLME_ASSOCIATE;
-                mod_timer(&ifmgd->timer, jiffies +
-                                      IEEE80211_RETRY_AUTH_INTERVAL);
-        }
+        reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        ieee80211_set_disassoc(sdata, false, false, reason_code);
-        cfg80211_send_disassoc(sdata->dev, (u8 *) mgmt, len);
+        printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
+                        sdata->dev->name, reason_code);
+
+        ieee80211_set_disassoc(sdata, false);
+        return RX_MGMT_CFG80211_DISASSOC;
 }
 
 
-static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_mgmt *mgmt,
-                                         size_t len,
-                                         int reassoc)
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_mgd_work *wk,
+                             struct ieee80211_mgmt *mgmt, size_t len,
+                             bool reassoc)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
@@ -1614,17 +1416,16 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         bool have_higher_than_11mbit = false, newsta = false;
         u16 ap_ht_cap_flags;
 
-        /* AssocResp and ReassocResp have identical structure, so process both
-         * of them in this function. */
-
-        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE)
-                return;
+        /*
+         * AssocResp and ReassocResp have identical structure, so process both
+         * of them in this function.
+         */
 
         if (len < 24 + 6)
-                return;
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN) != 0)
-                return;
+        if (memcmp(wk->bss->cbss.bssid, mgmt->sa, ETH_ALEN) != 0)
+                return RX_MGMT_NONE;
 
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
@@ -1647,26 +1448,18 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 printk(KERN_DEBUG "%s: AP rejected association temporarily; "
                        "comeback duration %u TU (%u ms)\n",
                        sdata->dev->name, tu, ms);
+                wk->timeout = jiffies + msecs_to_jiffies(ms);
                 if (ms > IEEE80211_ASSOC_TIMEOUT)
-                        mod_timer(&ifmgd->timer,
-                                  jiffies + msecs_to_jiffies(ms));
-                return;
+                        run_again(ifmgd, jiffies + msecs_to_jiffies(ms));
+                return RX_MGMT_NONE;
         }
 
         if (status_code != WLAN_STATUS_SUCCESS) {
                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
                        sdata->dev->name, status_code);
-                /* if this was a reassociation, ensure we try a "full"
-                 * association next time. This works around some broken APs
-                 * which do not correctly reject reassociation requests. */
-                ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, len);
-                if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
-                        /* Wait for SME to decide what to do next */
-                        ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                        ieee80211_recalc_idle(local);
-                }
-                return;
+                list_del(&wk->list);
+                kfree(wk);
+                return RX_MGMT_CFG80211_ASSOC;
         }
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
@@ -1677,51 +1470,35 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (!elems.supp_rates) {
                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
                        sdata->dev->name);
-                return;
+                return RX_MGMT_NONE;
         }
 
         printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
         ifmgd->aid = aid;
-        ifmgd->ap_capab = capab_info;
-
-        kfree(ifmgd->assocresp_ies);
-        ifmgd->assocresp_ies_len = len - (pos - (u8 *) mgmt);
-        ifmgd->assocresp_ies = kmalloc(ifmgd->assocresp_ies_len, GFP_KERNEL);
-        if (ifmgd->assocresp_ies)
-                memcpy(ifmgd->assocresp_ies, pos, ifmgd->assocresp_ies_len);
 
         rcu_read_lock();
 
         /* Add STA entry for the AP */
-        sta = sta_info_get(local, ifmgd->bssid);
+        sta = sta_info_get(local, wk->bss->cbss.bssid);
         if (!sta) {
                 newsta = true;
 
-                sta = sta_info_alloc(sdata, ifmgd->bssid, GFP_ATOMIC);
+                rcu_read_unlock();
+
+                sta = sta_info_alloc(sdata, wk->bss->cbss.bssid, GFP_KERNEL);
                 if (!sta) {
                         printk(KERN_DEBUG "%s: failed to alloc STA entry for"
                                " the AP\n", sdata->dev->name);
-                        rcu_read_unlock();
-                        return;
+                        return RX_MGMT_NONE;
                 }
 
-                /* update new sta with its last rx activity */
-                sta->last_rx = jiffies;
-        }
+                set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC |
+                                   WLAN_STA_ASSOC_AP);
+                if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
+                        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
 
-        /*
-         * FIXME: Do we really need to update the sta_info's information here?
-         *        We already know about the AP (we found it in our list) so it
-         *        should already be filled with the right info, no?
-         *        As is stands, all this is racy because typically we assume
-         *        the information that is filled in here (except flags) doesn't
-         *        change while a STA structure is alive. As such, it should move
-         *        to between the sta_info_alloc() and sta_info_insert() above.
-         */
-
-        set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP);
-        if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
-                set_sta_flags(sta, WLAN_STA_AUTHORIZED);
+                rcu_read_lock();
+        }
 
         rates = 0;
         basic_rates = 0;
@@ -1771,8 +1548,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         else
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
-        /* If TKIP/WEP is used, no need to parse AP's HT capabilities */
-        if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))
+        if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
                                 elems.ht_cap_elem, &sta->sta.ht_cap);
 
@@ -1792,7 +1568,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                         printk(KERN_DEBUG "%s: failed to insert STA entry for"
                                " the AP (error %d)\n", sdata->dev->name, err);
                         rcu_read_unlock();
-                        return;
+                        return RX_MGMT_NONE;
                 }
         }
 
@@ -1806,24 +1582,29 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         if (elems.ht_info_elem && elems.wmm_param &&
             (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
-            !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))
+            !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
+                                               wk->bss->cbss.bssid,
                                                ap_ht_cap_flags);
 
+        /* delete work item -- must be before set_associated for PS */
+        list_del(&wk->list);
+
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        ieee80211_set_associated(sdata, changed);
+        /* this will take ownership of wk */
+        ieee80211_set_associated(sdata, wk, changed);
 
         /*
-         * initialise the time of last beacon to be the association time,
-         * otherwise beacon loss check will trigger immediately
+         * Start timer to probe the connection to the AP now.
+         * Also start the timer that will detect beacon loss.
          */
-        ifmgd->last_beacon = jiffies;
+        ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
+        mod_beacon_timer(sdata);
 
-        ieee80211_associated(sdata);
-        cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, len);
+        return RX_MGMT_CFG80211_ASSOC;
 }
 
 
@@ -1851,23 +1632,25 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
                                         channel, beacon);
-        if (!bss)
+        if (bss)
+                ieee80211_rx_bss_put(local, bss);
+
+        if (!sdata->u.mgd.associated)
                 return;
 
         if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
-            (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN) == 0)) {
+            (memcmp(mgmt->bssid, sdata->u.mgd.associated->cbss.bssid,
+                                                        ETH_ALEN) == 0)) {
                 struct ieee80211_channel_sw_ie *sw_elem =
                         (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
                 ieee80211_sta_process_chanswitch(sdata, sw_elem, bss);
         }
-
-        ieee80211_rx_bss_put(local, bss);
 }
 
 
 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_mgmt *mgmt,
-                                         size_t len,
+                                         struct ieee80211_mgd_work *wk,
+                                         struct ieee80211_mgmt *mgmt, size_t len,
                                          struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_if_managed *ifmgd;
@@ -1876,6 +1659,8 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         ifmgd = &sdata->u.mgd;
 
+        ASSERT_MGD_MTX(ifmgd);
+
         if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
                 return; /* ignore ProbeResp to foreign address */
 
@@ -1889,17 +1674,32 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
 
         /* direct probe may be part of the association flow */
-        if (ifmgd->state == IEEE80211_STA_MLME_DIRECT_PROBE) {
+        if (wk && wk->state == IEEE80211_MGD_STATE_PROBE) {
                 printk(KERN_DEBUG "%s direct probe responded\n",
                        sdata->dev->name);
-                ieee80211_authenticate(sdata);
+                wk->tries = 0;
+                wk->state = IEEE80211_MGD_STATE_AUTH;
+                WARN_ON(ieee80211_authenticate(sdata, wk) != RX_MGMT_NONE);
         }
 
-        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) {
-                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
+        if (ifmgd->associated &&
+            memcmp(mgmt->bssid, ifmgd->associated->cbss.bssid, ETH_ALEN) == 0 &&
+            ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
+                            IEEE80211_STA_CONNECTION_POLL)) {
+                ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                                  IEEE80211_STA_BEACON_POLL);
                 mutex_lock(&sdata->local->iflist_mtx);
                 ieee80211_recalc_ps(sdata->local, -1);
                 mutex_unlock(&sdata->local->iflist_mtx);
+                /*
+                 * We've received a probe response, but are not sure whether
+                 * we have or will be receiving any beacons or data, so let's
+                 * schedule the timers again, just in case.
+                 */
+                mod_beacon_timer(sdata);
+                mod_timer(&ifmgd->conn_mon_timer,
+                          round_jiffies_up(jiffies +
+                                           IEEE80211_CONNECTION_IDLE_TIME));
         }
 }
 
@@ -1937,6 +1737,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         bool erp_valid, directed_tim = false;
         u8 erp_value = 0;
         u32 ncrc;
+        u8 *bssid;
+
+        ASSERT_MGD_MTX(ifmgd);
 
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
@@ -1946,23 +1749,41 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (rx_status->freq != local->hw.conf.channel->center_freq)
                 return;
 
-        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED) ||
-            memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
+        /*
+         * We might have received a number of frames, among them a
+         * disassoc frame and a beacon...
+         */
+        if (!ifmgd->associated)
                 return;
 
-        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) {
+        bssid = ifmgd->associated->cbss.bssid;
+
+        /*
+         * And in theory even frames from a different AP we were just
+         * associated to a split-second ago!
+         */
+        if (memcmp(bssid, mgmt->bssid, ETH_ALEN) != 0)
+                return;
+
+        if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: cancelling probereq poll due "
                                "to a received beacon\n", sdata->dev->name);
                 }
 #endif
-                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
+                ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
                 mutex_lock(&local->iflist_mtx);
                 ieee80211_recalc_ps(local, -1);
                 mutex_unlock(&local->iflist_mtx);
         }
 
+        /*
+         * Push the beacon loss detection into the future since
+         * we are processing a beacon from the AP just now.
+         */
+        mod_beacon_timer(sdata);
+
         ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
         ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
                                           len - baselen, &elems,
@@ -2019,15 +1840,15 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
 
         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
-            !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED)) {
+            !(ifmgd->flags & IEEE80211_STA_DISABLE_11N)) {
                 struct sta_info *sta;
                 struct ieee80211_supported_band *sband;
                 u16 ap_ht_cap_flags;
 
                 rcu_read_lock();
 
-                sta = sta_info_get(local, ifmgd->bssid);
-                if (!sta) {
+                sta = sta_info_get(local, bssid);
+                if (WARN_ON(!sta)) {
                         rcu_read_unlock();
                         return;
                 }
@@ -2042,15 +1863,11 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 rcu_read_unlock();
 
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               ap_ht_cap_flags);
+                                               bssid, ap_ht_cap_flags);
         }
 
+        /* Note: country IE parsing is done for us by cfg80211 */
         if (elems.country_elem) {
-                /* Note we are only reviewing this on beacons
-                 * for the BSSID we are associated to */
-                regulatory_hint_11d(local->hw.wiphy,
-                        elems.country_elem, elems.country_elem_len);
-
                 /* TODO: IBSS also needs this */
                 if (elems.pwr_constr_elem)
                         ieee80211_handle_pwr_constr(sdata,
@@ -2063,8 +1880,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 }
 
 ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
-                                          struct sk_buff *skb,
-                                          struct ieee80211_rx_status *rx_status)
+                                          struct sk_buff *skb)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_mgmt *mgmt;
@@ -2080,14 +1896,14 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
         case IEEE80211_STYPE_PROBE_REQ:
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-                memcpy(skb->cb, rx_status, sizeof(*rx_status));
         case IEEE80211_STYPE_AUTH:
         case IEEE80211_STYPE_ASSOC_RESP:
         case IEEE80211_STYPE_REASSOC_RESP:
         case IEEE80211_STYPE_DEAUTH:
         case IEEE80211_STYPE_DISASSOC:
+        case IEEE80211_STYPE_ACTION:
                 skb_queue_tail(&sdata->u.mgd.skb_queue, skb);
-                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+                ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
                 return RX_QUEUED;
         }
 
@@ -2097,40 +1913,119 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                          struct sk_buff *skb)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
+        struct ieee80211_mgd_work *wk;
+        enum rx_mgmt_action rma = RX_MGMT_NONE;
         u16 fc;
 
         rx_status = (struct ieee80211_rx_status *) skb->cb;
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
-        switch (fc & IEEE80211_FCTL_STYPE) {
-        case IEEE80211_STYPE_PROBE_RESP:
-                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
-                                             rx_status);
-                break;
-        case IEEE80211_STYPE_BEACON:
-                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
-                                         rx_status);
-                break;
-        case IEEE80211_STYPE_AUTH:
-                ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
+        mutex_lock(&ifmgd->mtx);
+
+        if (ifmgd->associated &&
+            memcmp(ifmgd->associated->cbss.bssid, mgmt->bssid,
+                                                        ETH_ALEN) == 0) {
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_BEACON:
+                        ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                                 rx_status);
+                        break;
+                case IEEE80211_STYPE_PROBE_RESP:
+                        ieee80211_rx_mgmt_probe_resp(sdata, NULL, mgmt,
+                                                     skb->len, rx_status);
+                        break;
+                case IEEE80211_STYPE_DEAUTH:
+                        rma = ieee80211_rx_mgmt_deauth(sdata, NULL,
+                                                       mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_DISASSOC:
+                        rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_ACTION:
+                        /* XXX: differentiate, can only happen for CSA now! */
+                        ieee80211_sta_process_chanswitch(sdata,
+                                        &mgmt->u.action.u.chan_switch.sw_elem,
+                                        ifmgd->associated);
+                        break;
+                }
+                mutex_unlock(&ifmgd->mtx);
+
+                switch (rma) {
+                case RX_MGMT_NONE:
+                        /* no action */
+                        break;
+                case RX_MGMT_CFG80211_DEAUTH:
+                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len,
+                                             NULL);
+                        break;
+                case RX_MGMT_CFG80211_DISASSOC:
+                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len,
+                                               NULL);
+                        break;
+                default:
+                        WARN(1, "unexpected: %d", rma);
+                }
+                goto out;
+        }
+
+        list_for_each_entry(wk, &ifmgd->work_list, list) {
+                if (memcmp(wk->bss->cbss.bssid, mgmt->bssid, ETH_ALEN) != 0)
+                        continue;
+
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_PROBE_RESP:
+                        ieee80211_rx_mgmt_probe_resp(sdata, wk, mgmt, skb->len,
+                                                     rx_status);
+                        break;
+                case IEEE80211_STYPE_AUTH:
+                        rma = ieee80211_rx_mgmt_auth(sdata, wk, mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_ASSOC_RESP:
+                        rma = ieee80211_rx_mgmt_assoc_resp(sdata, wk, mgmt,
+                                                           skb->len, false);
+                        break;
+                case IEEE80211_STYPE_REASSOC_RESP:
+                        rma = ieee80211_rx_mgmt_assoc_resp(sdata, wk, mgmt,
+                                                           skb->len, true);
+                        break;
+                case IEEE80211_STYPE_DEAUTH:
+                        rma = ieee80211_rx_mgmt_deauth(sdata, wk, mgmt,
+                                                       skb->len);
+                        break;
+                }
+                /*
+                 * We've processed this frame for that work, so it can't
+                 * belong to another work struct.
+                 * NB: this is also required for correctness because the
+                 * called functions can free 'wk', and for 'rma'!
+                 */
                 break;
-        case IEEE80211_STYPE_ASSOC_RESP:
-                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, 0);
+        }
+
+        mutex_unlock(&ifmgd->mtx);
+
+        switch (rma) {
+        case RX_MGMT_NONE:
+                /* no action */
                 break;
-        case IEEE80211_STYPE_REASSOC_RESP:
-                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, 1);
+        case RX_MGMT_CFG80211_AUTH:
+                cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, skb->len);
                 break;
-        case IEEE80211_STYPE_DEAUTH:
-                ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
+        case RX_MGMT_CFG80211_ASSOC:
+                cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, skb->len);
                 break;
-        case IEEE80211_STYPE_DISASSOC:
-                ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
+        case RX_MGMT_CFG80211_DEAUTH:
+                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len, NULL);
                 break;
+        default:
+                WARN(1, "unexpected: %d", rma);
         }
 
+ out:
         kfree_skb(skb);
 }
 
@@ -2146,215 +2041,220 @@ static void ieee80211_sta_timer(unsigned long data)
                 return;
         }
 
-        set_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
-        queue_work(local->hw.workqueue, &ifmgd->work);
+        ieee80211_queue_work(&local->hw, &ifmgd->work);
 }
 
-static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_sta_work(struct work_struct *work)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data, u.mgd.work);
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd;
+        struct sk_buff *skb;
+        struct ieee80211_mgd_work *wk, *tmp;
+        LIST_HEAD(free_work);
+        enum rx_mgmt_action rma;
+        bool anybusy = false;
 
-        /* Reset own TSF to allow time synchronization work. */
-        drv_reset_tsf(local);
+        if (!netif_running(sdata->dev))
+                return;
 
-        ifmgd->wmm_last_param_set = -1; /* allow any WMM update */
+        if (local->scanning)
+                return;
 
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+                return;
 
-        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_OPEN)
-                ifmgd->auth_alg = WLAN_AUTH_OPEN;
-        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
-                ifmgd->auth_alg = WLAN_AUTH_SHARED_KEY;
-        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_LEAP)
-                ifmgd->auth_alg = WLAN_AUTH_LEAP;
-        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_FT)
-                ifmgd->auth_alg = WLAN_AUTH_FT;
-        else
-                ifmgd->auth_alg = WLAN_AUTH_OPEN;
-        ifmgd->auth_transaction = -1;
-        ifmgd->flags &= ~IEEE80211_STA_ASSOCIATED;
-        ifmgd->assoc_scan_tries = 0;
-        ifmgd->direct_probe_tries = 0;
-        ifmgd->auth_tries = 0;
-        ifmgd->assoc_tries = 0;
-        netif_tx_stop_all_queues(sdata->dev);
-        netif_carrier_off(sdata->dev);
-}
+        /*
+         * ieee80211_queue_work() should have picked up most cases,
+         * here we'll pick the the rest.
+         */
+        if (WARN(local->suspended, "STA MLME work scheduled while "
+                 "going to suspend\n"))
+                return;
 
-static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss;
-        u8 *bssid = ifmgd->bssid, *ssid = ifmgd->ssid;
-        u8 ssid_len = ifmgd->ssid_len;
-        u16 capa_mask = WLAN_CAPABILITY_ESS;
-        u16 capa_val = WLAN_CAPABILITY_ESS;
-        struct ieee80211_channel *chan = local->oper_channel;
+        ifmgd = &sdata->u.mgd;
 
-        if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) &&
-            ifmgd->flags & (IEEE80211_STA_AUTO_SSID_SEL |
-                            IEEE80211_STA_AUTO_BSSID_SEL |
-                            IEEE80211_STA_AUTO_CHANNEL_SEL)) {
-                capa_mask |= WLAN_CAPABILITY_PRIVACY;
-                if (sdata->default_key)
-                        capa_val |= WLAN_CAPABILITY_PRIVACY;
-        }
+        /* first process frames to avoid timing out while a frame is pending */
+        while ((skb = skb_dequeue(&ifmgd->skb_queue)))
+                ieee80211_sta_rx_queued_mgmt(sdata, skb);
 
-        if (ifmgd->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
-                chan = NULL;
+        /* then process the rest of the work */
+        mutex_lock(&ifmgd->mtx);
 
-        if (ifmgd->flags & IEEE80211_STA_AUTO_BSSID_SEL)
-                bssid = NULL;
+        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
+                            IEEE80211_STA_CONNECTION_POLL) &&
+            ifmgd->associated) {
+                u8 bssid[ETH_ALEN];
 
-        if (ifmgd->flags & IEEE80211_STA_AUTO_SSID_SEL) {
-                ssid = NULL;
-                ssid_len = 0;
+                memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
+                if (time_is_after_jiffies(ifmgd->probe_timeout))
+                        run_again(ifmgd, ifmgd->probe_timeout);
+
+                else if (ifmgd->probe_send_count < IEEE80211_MAX_PROBE_TRIES) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                        printk(KERN_DEBUG "No probe response from AP %pM"
+                                " after %dms, try %d\n", bssid,
+                                (1000 * IEEE80211_PROBE_WAIT)/HZ,
+                                ifmgd->probe_send_count);
+#endif
+                        ieee80211_mgd_probe_ap_send(sdata);
+                } else {
+                        /*
+                         * We actually lost the connection ... or did we?
+                         * Let's make sure!
+                         */
+                        ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                                          IEEE80211_STA_BEACON_POLL);
+                        printk(KERN_DEBUG "No probe response from AP %pM"
+                                " after %dms, disconnecting.\n",
+                                bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
+                        ieee80211_set_disassoc(sdata, true);
+                        mutex_unlock(&ifmgd->mtx);
+                        /*
+                         * must be outside lock due to cfg80211,
+                         * but that's not a problem.
+                         */
+                        ieee80211_send_deauth_disassoc(sdata, bssid,
+                                        IEEE80211_STYPE_DEAUTH,
+                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+                                        NULL);
+                        mutex_lock(&ifmgd->mtx);
+                }
         }
 
-        bss = (void *)cfg80211_get_bss(local->hw.wiphy, chan,
-                                       bssid, ssid, ssid_len,
-                                       capa_mask, capa_val);
+        list_for_each_entry(wk, &ifmgd->work_list, list) {
+                if (wk->state != IEEE80211_MGD_STATE_IDLE) {
+                        anybusy = true;
+                        break;
+                }
+        }
 
-        if (bss) {
-                local->oper_channel = bss->cbss.channel;
-                local->oper_channel_type = NL80211_CHAN_NO_HT;
-                ieee80211_hw_config(local, 0);
+        ieee80211_recalc_idle(local);
 
-                if (!(ifmgd->flags & IEEE80211_STA_SSID_SET))
-                        ieee80211_sta_set_ssid(sdata, bss->ssid,
-                                               bss->ssid_len);
-                ieee80211_sta_set_bssid(sdata, bss->cbss.bssid);
-                ieee80211_sta_def_wmm_params(sdata, bss->supp_rates_len,
-                                                    bss->supp_rates);
-                if (sdata->u.mgd.mfp == IEEE80211_MFP_REQUIRED)
-                        sdata->u.mgd.flags |= IEEE80211_STA_MFP_ENABLED;
-                else
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_MFP_ENABLED;
-
-                /* Send out direct probe if no probe resp was received or
-                 * the one we have is outdated
-                 */
-                if (!bss->last_probe_resp ||
-                    time_after(jiffies, bss->last_probe_resp
-                                        + IEEE80211_SCAN_RESULT_EXPIRE))
-                        ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
-                else
-                        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
+        if (!anybusy) {
+                mutex_unlock(&ifmgd->mtx);
 
-                ieee80211_rx_bss_put(local, bss);
-                ieee80211_sta_reset_auth(sdata);
-                return 0;
-        } else {
-                if (ifmgd->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
+                if (test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request))
+                        ieee80211_queue_delayed_work(&local->hw,
+                                                     &local->scan_work,
+                                                     round_jiffies_relative(0));
+                return;
+        }
 
-                        ifmgd->assoc_scan_tries++;
+        list_for_each_entry_safe(wk, tmp, &ifmgd->work_list, list) {
+                if (time_is_after_jiffies(wk->timeout)) {
+                        /*
+                         * This work item isn't supposed to be worked on
+                         * right now, but take care to adjust the timer
+                         * properly.
+                         */
+                        run_again(ifmgd, wk->timeout);
+                        continue;
+                }
 
-                        ieee80211_request_internal_scan(sdata, ifmgd->ssid,
-                                                        ssid_len);
+                switch (wk->state) {
+                default:
+                        WARN_ON(1);
+                        /* fall through */
+                case IEEE80211_MGD_STATE_IDLE:
+                        /* nothing */
+                        rma = RX_MGMT_NONE;
+                        break;
+                case IEEE80211_MGD_STATE_PROBE:
+                        rma = ieee80211_direct_probe(sdata, wk);
+                        break;
+                case IEEE80211_MGD_STATE_AUTH:
+                        rma = ieee80211_authenticate(sdata, wk);
+                        break;
+                case IEEE80211_MGD_STATE_ASSOC:
+                        rma = ieee80211_associate(sdata, wk);
+                        break;
+                }
 
-                        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
-                        set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
-                } else {
-                        ifmgd->assoc_scan_tries = 0;
-                        ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                        ieee80211_recalc_idle(local);
+                switch (rma) {
+                case RX_MGMT_NONE:
+                        /* no action required */
+                        break;
+                case RX_MGMT_CFG80211_AUTH_TO:
+                case RX_MGMT_CFG80211_ASSOC_TO:
+                        list_del(&wk->list);
+                        list_add(&wk->list, &free_work);
+                        wk->tries = rma; /* small abuse but only local */
+                        break;
+                default:
+                        WARN(1, "unexpected: %d", rma);
                 }
         }
-        return -1;
-}
 
+        mutex_unlock(&ifmgd->mtx);
 
-static void ieee80211_sta_work(struct work_struct *work)
-{
-        struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data, u.mgd.work);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_managed *ifmgd;
-        struct sk_buff *skb;
+        list_for_each_entry_safe(wk, tmp, &free_work, list) {
+                switch (wk->tries) {
+                case RX_MGMT_CFG80211_AUTH_TO:
+                        cfg80211_send_auth_timeout(sdata->dev,
+                                                   wk->bss->cbss.bssid);
+                        break;
+                case RX_MGMT_CFG80211_ASSOC_TO:
+                        cfg80211_send_assoc_timeout(sdata->dev,
+                                                    wk->bss->cbss.bssid);
+                        break;
+                default:
+                        WARN(1, "unexpected: %d", wk->tries);
+                }
 
-        if (!netif_running(sdata->dev))
-                return;
+                list_del(&wk->list);
+                kfree(wk);
+        }
 
-        if (local->sw_scanning || local->hw_scanning)
-                return;
+        ieee80211_recalc_idle(local);
+}
 
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
-                return;
+static void ieee80211_sta_bcn_mon_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_local *local = sdata->local;
 
-        /*
-         * Nothing should have been stuffed into the workqueue during
-         * the suspend->resume cycle. If this WARN is seen then there
-         * is a bug with either the driver suspend or something in
-         * mac80211 stuffing into the workqueue which we haven't yet
-         * cleared during mac80211's suspend cycle.
-         */
-        if (WARN_ON(local->suspended))
+        if (local->quiescing)
                 return;
 
-        ifmgd = &sdata->u.mgd;
-
-        while ((skb = skb_dequeue(&ifmgd->skb_queue)))
-                ieee80211_sta_rx_queued_mgmt(sdata, skb);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.beacon_loss_work);
+}
 
-        if (ifmgd->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
-            ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE &&
-            ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE &&
-            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request)) {
-                queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                                   round_jiffies_relative(0));
-                return;
-        }
+static void ieee80211_sta_conn_mon_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_local *local = sdata->local;
 
-        if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request)) {
-                if (ieee80211_sta_config_auth(sdata))
-                        return;
-                clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
-        } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request))
+        if (local->quiescing)
                 return;
 
-        ieee80211_recalc_idle(local);
-
-        switch (ifmgd->state) {
-        case IEEE80211_STA_MLME_DISABLED:
-                break;
-        case IEEE80211_STA_MLME_DIRECT_PROBE:
-                ieee80211_direct_probe(sdata);
-                break;
-        case IEEE80211_STA_MLME_AUTHENTICATE:
-                ieee80211_authenticate(sdata);
-                break;
-        case IEEE80211_STA_MLME_ASSOCIATE:
-                ieee80211_associate(sdata);
-                break;
-        case IEEE80211_STA_MLME_ASSOCIATED:
-                ieee80211_associated(sdata);
-                break;
-        default:
-                WARN_ON(1);
-                break;
-        }
+        ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
+}
 
-        if (ieee80211_privacy_mismatch(sdata)) {
-                printk(KERN_DEBUG "%s: privacy configuration mismatch and "
-                       "mixed-cell disabled - disassociate\n", sdata->dev->name);
+static void ieee80211_sta_monitor_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             u.mgd.monitor_work);
 
-                ieee80211_set_disassoc(sdata, false, true,
-                                        WLAN_REASON_UNSPECIFIED);
-        }
+        ieee80211_mgd_probe_ap(sdata, false);
 }
 
 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
 {
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                /*
-                 * Need to update last_beacon to avoid beacon loss
-                 * test to trigger.
-                 */
-                sdata->u.mgd.last_beacon = jiffies;
-
-
-                queue_work(sdata->local->hw.workqueue,
+                sdata->u.mgd.flags &= ~(IEEE80211_STA_BEACON_POLL |
+                                        IEEE80211_STA_CONNECTION_POLL);
+
+                /* let's probe the connection once */
+                ieee80211_queue_work(&sdata->local->hw,
+                           &sdata->u.mgd.monitor_work);
+                /* and do all the other regular work too */
+                ieee80211_queue_work(&sdata->local->hw,
                            &sdata->u.mgd.work);
         }
 }
@@ -2378,6 +2278,11 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
         cancel_work_sync(&ifmgd->chswitch_work);
         if (del_timer_sync(&ifmgd->chswitch_timer))
                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
+
+        cancel_work_sync(&ifmgd->monitor_work);
+        /* these will just be re-established on connection */
+        del_timer_sync(&ifmgd->conn_mon_timer);
+        del_timer_sync(&ifmgd->bcn_mon_timer);
 }
 
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
@@ -2395,210 +2300,277 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd;
-        u32 hw_flags;
 
         ifmgd = &sdata->u.mgd;
         INIT_WORK(&ifmgd->work, ieee80211_sta_work);
+        INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
         INIT_WORK(&ifmgd->beacon_loss_work, ieee80211_beacon_loss_work);
         setup_timer(&ifmgd->timer, ieee80211_sta_timer,
                     (unsigned long) sdata);
+        setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
+                    (unsigned long) sdata);
+        setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
+                    (unsigned long) sdata);
         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
                     (unsigned long) sdata);
         skb_queue_head_init(&ifmgd->skb_queue);
 
+        INIT_LIST_HEAD(&ifmgd->work_list);
+
         ifmgd->capab = WLAN_CAPABILITY_ESS;
-        ifmgd->auth_algs = IEEE80211_AUTH_ALG_OPEN |
-                IEEE80211_AUTH_ALG_SHARED_KEY;
-        ifmgd->flags |= IEEE80211_STA_CREATE_IBSS |
-                IEEE80211_STA_AUTO_BSSID_SEL |
-                IEEE80211_STA_AUTO_CHANNEL_SEL;
+        ifmgd->flags = 0;
         if (sdata->local->hw.queues >= 4)
                 ifmgd->flags |= IEEE80211_STA_WMM_ENABLED;
 
-        hw_flags = sdata->local->hw.flags;
-
-        if (hw_flags & IEEE80211_HW_SUPPORTS_PS) {
-                ifmgd->powersave = CONFIG_MAC80211_DEFAULT_PS_VALUE;
-                sdata->local->hw.conf.dynamic_ps_timeout = 500;
-        }
+        mutex_init(&ifmgd->mtx);
 }
 
-/* configuration hooks */
-void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata)
+/* scan finished notification */
+void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
-                return;
-
-        if ((ifmgd->flags & (IEEE80211_STA_BSSID_SET |
-                             IEEE80211_STA_AUTO_BSSID_SEL)) &&
-            (ifmgd->flags & (IEEE80211_STA_SSID_SET |
-                             IEEE80211_STA_AUTO_SSID_SEL))) {
-
-                if (ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)
-                        ieee80211_set_disassoc(sdata, true, true,
-                                               WLAN_REASON_DEAUTH_LEAVING);
-
-                if (ifmgd->ssid_len == 0) {
-                        /*
-                         * Only allow association to be started if a valid SSID
-                         * is configured.
-                         */
-                        return;
-                }
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
 
-                if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) ||
-                    ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE)
-                        set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
-                else if (ifmgd->flags & IEEE80211_STA_EXT_SME)
-                        set_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
-                queue_work(local->hw.workqueue, &ifmgd->work);
-        }
+        /* Restart STA timers */
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                ieee80211_restart_sta_timer(sdata);
+        rcu_read_unlock();
 }
 
-int ieee80211_sta_commit(struct ieee80211_sub_if_data *sdata)
+int ieee80211_max_network_latency(struct notifier_block *nb,
+                                  unsigned long data, void *dummy)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        s32 latency_usec = (s32) data;
+        struct ieee80211_local *local =
+                container_of(nb, struct ieee80211_local,
+                             network_latency_notifier);
 
-        if (ifmgd->ssid_len)
-                ifmgd->flags |= IEEE80211_STA_SSID_SET;
-        else
-                ifmgd->flags &= ~IEEE80211_STA_SSID_SET;
+        mutex_lock(&local->iflist_mtx);
+        ieee80211_recalc_ps(local, latency_usec);
+        mutex_unlock(&local->iflist_mtx);
 
         return 0;
 }
 
-int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
+/* config hooks */
+int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
+                       struct cfg80211_auth_request *req)
 {
-        struct ieee80211_if_managed *ifmgd;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *ssid;
+        struct ieee80211_mgd_work *wk;
+        u16 auth_alg;
 
-        if (len > IEEE80211_MAX_SSID_LEN)
-                return -EINVAL;
+        switch (req->auth_type) {
+        case NL80211_AUTHTYPE_OPEN_SYSTEM:
+                auth_alg = WLAN_AUTH_OPEN;
+                break;
+        case NL80211_AUTHTYPE_SHARED_KEY:
+                auth_alg = WLAN_AUTH_SHARED_KEY;
+                break;
+        case NL80211_AUTHTYPE_FT:
+                auth_alg = WLAN_AUTH_FT;
+                break;
+        case NL80211_AUTHTYPE_NETWORK_EAP:
+                auth_alg = WLAN_AUTH_LEAP;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
 
-        ifmgd = &sdata->u.mgd;
+        wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
+        if (!wk)
+                return -ENOMEM;
 
-        if (ifmgd->ssid_len != len || memcmp(ifmgd->ssid, ssid, len) != 0) {
-                if (ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)
-                        ieee80211_set_disassoc(sdata, true, true,
-                                               WLAN_REASON_DEAUTH_LEAVING);
+        wk->bss = (void *)req->bss;
 
-                /*
-                 * Do not use reassociation if SSID is changed (different ESS).
-                 */
-                ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                memset(ifmgd->ssid, 0, sizeof(ifmgd->ssid));
-                memcpy(ifmgd->ssid, ssid, len);
-                ifmgd->ssid_len = len;
+        if (req->ie && req->ie_len) {
+                memcpy(wk->ie, req->ie, req->ie_len);
+                wk->ie_len = req->ie_len;
         }
 
-        return ieee80211_sta_commit(sdata);
-}
+        if (req->key && req->key_len) {
+                wk->key_len = req->key_len;
+                wk->key_idx = req->key_idx;
+                memcpy(wk->key, req->key, req->key_len);
+        }
 
-int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        memcpy(ssid, ifmgd->ssid, ifmgd->ssid_len);
-        *len = ifmgd->ssid_len;
+        ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+        memcpy(wk->ssid, ssid + 2, ssid[1]);
+        wk->ssid_len = ssid[1];
+
+        wk->state = IEEE80211_MGD_STATE_PROBE;
+        wk->auth_alg = auth_alg;
+        wk->timeout = jiffies; /* run right away */
+
+        /*
+         * XXX: if still associated need to tell AP that we're going
+         *      to sleep and then change channel etc.
+         */
+        sdata->local->oper_channel = req->bss->channel;
+        ieee80211_hw_config(sdata->local, 0);
+
+        mutex_lock(&ifmgd->mtx);
+        list_add(&wk->list, &sdata->u.mgd.work_list);
+        mutex_unlock(&ifmgd->mtx);
+
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
         return 0;
 }
 
-int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
+int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_assoc_request *req)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_mgd_work *wk, *found = NULL;
+        int i, err;
 
-        if (compare_ether_addr(bssid, ifmgd->bssid) != 0 &&
-            ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)
-                ieee80211_set_disassoc(sdata, true, true,
-                                       WLAN_REASON_DEAUTH_LEAVING);
+        mutex_lock(&ifmgd->mtx);
 
-        if (is_valid_ether_addr(bssid)) {
-                memcpy(ifmgd->bssid, bssid, ETH_ALEN);
-                ifmgd->flags |= IEEE80211_STA_BSSID_SET;
-        } else {
-                memset(ifmgd->bssid, 0, ETH_ALEN);
-                ifmgd->flags &= ~IEEE80211_STA_BSSID_SET;
+        list_for_each_entry(wk, &ifmgd->work_list, list) {
+                if (&wk->bss->cbss == req->bss &&
+                    wk->state == IEEE80211_MGD_STATE_IDLE) {
+                        found = wk;
+                        break;
+                }
         }
 
-        return ieee80211_sta_commit(sdata);
-}
+        if (!found) {
+                err = -ENOLINK;
+                goto out;
+        }
 
-int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
-                               const char *ie, size_t len)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        list_del(&found->list);
 
-        if (len == 0 && ifmgd->extra_ie_len == 0)
-                return -EALREADY;
+        wk = krealloc(found, sizeof(*wk) + req->ie_len, GFP_KERNEL);
+        if (!wk) {
+                list_add(&found->list, &ifmgd->work_list);
+                err = -ENOMEM;
+                goto out;
+        }
 
-        if (len == ifmgd->extra_ie_len && ifmgd->extra_ie &&
-            memcmp(ifmgd->extra_ie, ie, len) == 0)
-                return -EALREADY;
+        list_add(&wk->list, &ifmgd->work_list);
 
-        kfree(ifmgd->extra_ie);
-        if (len == 0) {
-                ifmgd->extra_ie = NULL;
-                ifmgd->extra_ie_len = 0;
-                return 0;
-        }
-        ifmgd->extra_ie = kmalloc(len, GFP_KERNEL);
-        if (!ifmgd->extra_ie) {
-                ifmgd->extra_ie_len = 0;
-                return -ENOMEM;
+        ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
+
+        for (i = 0; i < req->crypto.n_ciphers_pairwise; i++)
+                if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
+                    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
+                    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104)
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+
+        sdata->local->oper_channel = req->bss->channel;
+        ieee80211_hw_config(sdata->local, 0);
+
+        if (req->ie && req->ie_len) {
+                memcpy(wk->ie, req->ie, req->ie_len);
+                wk->ie_len = req->ie_len;
+        } else
+                wk->ie_len = 0;
+
+        if (req->prev_bssid)
+                memcpy(wk->prev_bssid, req->prev_bssid, ETH_ALEN);
+
+        wk->state = IEEE80211_MGD_STATE_ASSOC;
+        wk->tries = 0;
+        wk->timeout = jiffies; /* run right away */
+
+        if (req->use_mfp) {
+                ifmgd->mfp = IEEE80211_MFP_REQUIRED;
+                ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
+        } else {
+                ifmgd->mfp = IEEE80211_MFP_DISABLED;
+                ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
         }
-        memcpy(ifmgd->extra_ie, ie, len);
-        ifmgd->extra_ie_len = len;
-        return 0;
-}
 
-int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason)
-{
-        printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
-               sdata->dev->name, reason);
+        if (req->crypto.control_port)
+                ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
+        else
+                ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
 
-        ieee80211_set_disassoc(sdata, true, true, reason);
-        return 0;
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
+
+        err = 0;
+
+ out:
+        mutex_unlock(&ifmgd->mtx);
+        return err;
 }
 
-int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
+int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+                         struct cfg80211_deauth_request *req,
+                         void *cookie)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_mgd_work *wk;
+        const u8 *bssid = NULL;
 
-        printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
-               sdata->dev->name, reason);
+        printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
+               sdata->dev->name, req->reason_code);
+
+        mutex_lock(&ifmgd->mtx);
+
+        if (ifmgd->associated && &ifmgd->associated->cbss == req->bss) {
+                bssid = req->bss->bssid;
+                ieee80211_set_disassoc(sdata, true);
+        } else list_for_each_entry(wk, &ifmgd->work_list, list) {
+                if (&wk->bss->cbss == req->bss) {
+                        bssid = req->bss->bssid;
+                        list_del(&wk->list);
+                        kfree(wk);
+                        break;
+                }
+        }
 
-        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED))
+        /*
+         * cfg80211 should catch this ... but it's racy since
+         * we can receive a deauth frame, process it, hand it
+         * to cfg80211 while that's in a locked section already
+         * trying to tell us that the user wants to disconnect.
+         */
+        if (!bssid) {
+                mutex_unlock(&ifmgd->mtx);
                 return -ENOLINK;
+        }
+
+        mutex_unlock(&ifmgd->mtx);
+
+        ieee80211_send_deauth_disassoc(sdata, bssid,
+                        IEEE80211_STYPE_DEAUTH, req->reason_code,
+                        cookie);
 
-        ieee80211_set_disassoc(sdata, false, true, reason);
         return 0;
 }
 
-/* scan finished notification */
-void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
+int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
+                           struct cfg80211_disassoc_request *req,
+                           void *cookie)
 {
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        /* Restart STA timers */
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                ieee80211_restart_sta_timer(sdata);
-        rcu_read_unlock();
-}
+        printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
+               sdata->dev->name, req->reason_code);
 
-int ieee80211_max_network_latency(struct notifier_block *nb,
-                                  unsigned long data, void *dummy)
-{
-        s32 latency_usec = (s32) data;
-        struct ieee80211_local *local =
-                container_of(nb, struct ieee80211_local,
-                             network_latency_notifier);
+        mutex_lock(&ifmgd->mtx);
 
-        mutex_lock(&local->iflist_mtx);
-        ieee80211_recalc_ps(local, latency_usec);
-        mutex_unlock(&local->iflist_mtx);
+        /*
+         * cfg80211 should catch this ... but it's racy since
+         * we can receive a disassoc frame, process it, hand it
+         * to cfg80211 while that's in a locked section already
+         * trying to tell us that the user wants to disconnect.
+         */
+        if (&ifmgd->associated->cbss != req->bss) {
+                mutex_unlock(&ifmgd->mtx);
+                return -ENOLINK;
+        }
+
+        ieee80211_set_disassoc(sdata, false);
+
+        mutex_unlock(&ifmgd->mtx);
 
+        ieee80211_send_deauth_disassoc(sdata, req->bss->bssid,
+                        IEEE80211_STYPE_DISASSOC, req->reason_code,
+                        cookie);
         return 0;
 }
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 5e3d476972f9..a5d2f1fb4417 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -26,7 +26,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         /* make quiescing visible to timers everywhere */
         mb();
 
-        flush_workqueue(local->hw.workqueue);
+        flush_workqueue(local->workqueue);
 
         /* Don't try to run timers while suspended. */
         del_timer_sync(&local->sta_cleanup);
@@ -96,6 +96,10 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                 if (!netif_running(sdata->dev))
                         continue;
 
+                /* disable beaconing */
+                ieee80211_bss_info_change_notify(sdata,
+                        BSS_CHANGED_BEACON_ENABLED);
+
                 conf.vif = &sdata->vif;
                 conf.type = sdata->vif.type;
                 conf.mac_addr = sdata->dev->dev_addr;
@@ -113,7 +117,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
          * shouldn't be doing (or cancel everything in the
          * stop callback) that but better safe than sorry.
          */
-        flush_workqueue(local->hw.workqueue);
+        flush_workqueue(local->workqueue);
 
         local->suspended = true;
         /* need suspended to be visible before quiescing is false */
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 4641f00a1e5c..b33efc4fc267 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -198,6 +198,35 @@ static void rate_control_release(struct kref *kref)
         kfree(ctrl_ref);
 }
 
+static bool rc_no_data_or_no_ack(struct ieee80211_tx_rate_control *txrc)
+{
+        struct sk_buff *skb = txrc->skb;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        __le16 fc;
+
+        fc = hdr->frame_control;
+
+        return ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc));
+}
+
+bool rate_control_send_low(struct ieee80211_sta *sta,
+                           void *priv_sta,
+                           struct ieee80211_tx_rate_control *txrc)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+
+        if (!sta || !priv_sta || rc_no_data_or_no_ack(txrc)) {
+                info->control.rates[0].idx = rate_lowest_index(txrc->sband, sta);
+                info->control.rates[0].count =
+                        (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
+                        1 : txrc->hw->max_rate_tries;
+                return true;
+        }
+        return false;
+}
+EXPORT_SYMBOL(rate_control_send_low);
+
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                            struct sta_info *sta,
                            struct ieee80211_tx_rate_control *txrc)
@@ -258,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
         struct rate_control_ref *ref, *old;
 
         ASSERT_RTNL();
-        if (local->open_count || netif_running(local->mdev))
+        if (local->open_count)
                 return -EBUSY;
 
         ref = rate_control_alloc(name, local);
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 37771abd8f5a..007164919e02 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -51,6 +51,7 @@
 #include <linux/random.h>
 #include <linux/ieee80211.h>
 #include <net/mac80211.h>
+#include "mesh.h"
 #include "rate.h"
 #include "rc80211_minstrel.h"
 
@@ -70,20 +71,6 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix)
         return i;
 }
 
-static inline bool
-use_low_rate(struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        u16 fc;
-
-        fc = le16_to_cpu(hdr->frame_control);
-
-        return ((info->flags & IEEE80211_TX_CTL_NO_ACK) ||
-                (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA);
-}
-
-
 static void
 minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
 {
@@ -169,12 +156,16 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
                    struct sk_buff *skb)
 {
         struct minstrel_sta_info *mi = priv_sta;
+        struct minstrel_priv *mp = (struct minstrel_priv *)priv;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_tx_rate *ar = info->status.rates;
+        struct ieee80211_local *local = hw_to_local(mp->hw);
+        struct sta_info *si;
         int i, ndx;
         int success;
 
         success = !!(info->flags & IEEE80211_TX_STAT_ACK);
+        si = sta_info_get(local, sta->addr);
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 if (ar[i].idx < 0)
@@ -186,8 +177,17 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
 
                 mi->r[ndx].attempts += ar[i].count;
 
-                if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
+                if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0)) {
                         mi->r[ndx].success += success;
+                        if (si) {
+                                si->fail_avg = (18050 - mi->r[ndx].probability)
+                                        / 180;
+                                WARN_ON(si->fail_avg > 100);
+                                if (si->fail_avg == 100 &&
+                                        ieee80211_vif_is_mesh(&si->sdata->vif))
+                                        mesh_plink_broken(si);
+                        }
+                }
         }
 
         if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && (i >= 0))
@@ -232,7 +232,6 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                   void *priv_sta, struct ieee80211_tx_rate_control *txrc)
 {
         struct sk_buff *skb = txrc->skb;
-        struct ieee80211_supported_band *sband = txrc->sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
@@ -245,14 +244,8 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
         int mrr_ndx[3];
         int sample_rate;
 
-        if (!sta || !mi || use_low_rate(skb)) {
-                ar[0].idx = rate_lowest_index(sband, sta);
-                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
-                        ar[0].count = 1;
-                else
-                        ar[0].count = mp->max_retry;
+        if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
-        }
 
         mrr = mp->has_mrr && !txrc->rts && !txrc->bss_conf->use_cts_prot;
 
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index a0bef767ceb5..8c053be9dc24 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -276,11 +276,9 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
 {
         struct sk_buff *skb = txrc->skb;
         struct ieee80211_supported_band *sband = txrc->sband;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct rc_pid_sta_info *spinfo = priv_sta;
         int rateidx;
-        u16 fc;
 
         if (txrc->rts)
                 info->control.rates[0].count =
@@ -290,16 +288,8 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
                         txrc->hw->conf.short_frame_max_tx_count;
 
         /* Send management frames and NO_ACK data using lowest rate. */
-        fc = le16_to_cpu(hdr->frame_control);
-        if (!sta || !spinfo ||
-            (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
-            info->flags & IEEE80211_TX_CTL_NO_ACK) {
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
-                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
-                        info->control.rates[0].count = 1;
-
+        if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
-        }
 
         rateidx = spinfo->txrate_idx;
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 0936fc24942d..4cd9e45b1443 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -30,7 +30,6 @@
 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                            struct tid_ampdu_rx *tid_agg_rx,
                                            struct sk_buff *skb,
-                                           struct ieee80211_rx_status *status,
                                            u16 mpdu_seq_num,
                                            int bar_req);
 /*
@@ -59,11 +58,11 @@ static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
         return skb;
 }
 
-static inline int should_drop_frame(struct ieee80211_rx_status *status,
-                                    struct sk_buff *skb,
+static inline int should_drop_frame(struct sk_buff *skb,
                                     int present_fcs_len,
                                     int radiotap_len)
 {
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
@@ -111,10 +110,10 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
 static void
 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                                  struct sk_buff *skb,
-                                 struct ieee80211_rx_status *status,
                                  struct ieee80211_rate *rate,
                                  int rtap_len)
 {
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_radiotap_header *rthdr;
         unsigned char *pos;
 
@@ -220,9 +219,9 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
  */
 static struct sk_buff *
 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
-                     struct ieee80211_rx_status *status,
                      struct ieee80211_rate *rate)
 {
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
         struct ieee80211_sub_if_data *sdata;
         int needed_headroom = 0;
         struct sk_buff *skb, *skb2;
@@ -248,8 +247,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 present_fcs_len = FCS_LEN;
 
         if (!local->monitors) {
-                if (should_drop_frame(status, origskb, present_fcs_len,
-                                      rtap_len)) {
+                if (should_drop_frame(origskb, present_fcs_len, rtap_len)) {
                         dev_kfree_skb(origskb);
                         return NULL;
                 }
@@ -257,7 +255,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 return remove_monitor_info(local, origskb, rtap_len);
         }
 
-        if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
+        if (should_drop_frame(origskb, present_fcs_len, rtap_len)) {
                 /* only need to expand headroom if necessary */
                 skb = origskb;
                 origskb = NULL;
@@ -289,7 +287,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 
         /* if necessary, prepend radiotap information */
         if (!(status->flag & RX_FLAG_RADIOTAP))
-                ieee80211_add_rx_radiotap_header(local, skb, status, rate,
+                ieee80211_add_rx_radiotap_header(local, skb, rate,
                                                  needed_headroom);
 
         skb_reset_mac_header(skb);
@@ -420,13 +418,13 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
         struct ieee80211_local *local = rx->local;
         struct sk_buff *skb = rx->skb;
 
-        if (unlikely(local->hw_scanning))
-                return ieee80211_scan_rx(rx->sdata, skb, rx->status);
+        if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning)))
+                return ieee80211_scan_rx(rx->sdata, skb);
 
-        if (unlikely(local->sw_scanning)) {
+        if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning) &&
+                     (rx->flags & IEEE80211_RX_IN_SCAN))) {
                 /* drop all the other packets during a software scan anyway */
-                if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
-                    != RX_QUEUED)
+                if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
                         dev_kfree_skb(skb);
                 return RX_QUEUED;
         }
@@ -491,12 +489,21 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        char *dev_addr = rx->dev->dev_addr;
 
         if (ieee80211_is_data(hdr->frame_control)) {
-                if (!ieee80211_has_a4(hdr->frame_control))
-                        return RX_DROP_MONITOR;
-                if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
-                        return RX_DROP_MONITOR;
+                if (is_multicast_ether_addr(hdr->addr1)) {
+                        if (ieee80211_has_tods(hdr->frame_control) ||
+                                !ieee80211_has_fromds(hdr->frame_control))
+                                return RX_DROP_MONITOR;
+                        if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
+                                return RX_DROP_MONITOR;
+                } else {
+                        if (!ieee80211_has_a4(hdr->frame_control))
+                                return RX_DROP_MONITOR;
+                        if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
+                                return RX_DROP_MONITOR;
+                }
         }
 
         /* If there is not an established peer link and this is not a peer link
@@ -529,7 +536,7 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
         if (ieee80211_is_data(hdr->frame_control) &&
             is_multicast_ether_addr(hdr->addr1) &&
-            mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
+            mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
                 return RX_DROP_MONITOR;
 #undef msh_h_get
 
@@ -785,7 +792,7 @@ static void ap_sta_ps_start(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
 
         atomic_inc(&sdata->bss->num_sta_ps);
-        set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
+        set_sta_flags(sta, WLAN_STA_PS);
         drv_sta_notify(local, &sdata->vif, STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
@@ -801,7 +808,7 @@ static int ap_sta_ps_end(struct sta_info *sta)
 
         atomic_dec(&sdata->bss->num_sta_ps);
 
-        clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
+        clear_sta_flags(sta, WLAN_STA_PS);
         drv_sta_notify(local, &sdata->vif, STA_NOTIFY_AWAKE, &sta->sta);
 
         if (!skb_queue_empty(&sta->ps_tx_buf))
@@ -836,28 +843,22 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         if (!sta)
                 return RX_CONTINUE;
 
-        /* Update last_rx only for IBSS packets which are for the current
-         * BSSID to avoid keeping the current IBSS network alive in cases where
-         * other STAs are using different BSSID. */
+        /*
+         * Update last_rx only for IBSS packets which are for the current
+         * BSSID to avoid keeping the current IBSS network alive in cases
+         * where other STAs start using different BSSID.
+         */
         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
                                                 NL80211_IFTYPE_ADHOC);
                 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
                         sta->last_rx = jiffies;
-        } else
-        if (!is_multicast_ether_addr(hdr->addr1) ||
-            rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
-                /* Update last_rx only for unicast frames in order to prevent
-                 * the Probe Request frames (the only broadcast frames from a
-                 * STA in infrastructure mode) from keeping a connection alive.
+        } else if (!is_multicast_ether_addr(hdr->addr1)) {
+                /*
                  * Mesh beacons will update last_rx when if they are found to
                  * match the current local configuration when processed.
                  */
-                if (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    ieee80211_is_beacon(hdr->frame_control)) {
-                        rx->sdata->u.mgd.last_beacon = jiffies;
-                } else
-                        sta->last_rx = jiffies;
+                sta->last_rx = jiffies;
         }
 
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
@@ -1125,14 +1126,15 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                 skb_queue_empty(&rx->sta->ps_tx_buf);
 
         if (skb) {
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                 struct ieee80211_hdr *hdr =
                         (struct ieee80211_hdr *) skb->data;
 
                 /*
-                 * Tell TX path to send one frame even though the STA may
+                 * Tell TX path to send this frame even though the STA may
                  * still remain is PS mode after this frame exchange.
                  */
-                set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
+                info->flags |= IEEE80211_TX_CTL_PSPOLL_RESPONSE;
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
@@ -1147,7 +1149,7 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                 else
                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
 
-                dev_queue_xmit(skb);
+                ieee80211_add_pending_skb(rx->local, skb);
 
                 if (no_pending_pkts)
                         sta_info_clear_tim_bit(rx->sta);
@@ -1487,10 +1489,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         struct ieee80211s_hdr *mesh_hdr;
         unsigned int hdrlen;
         struct sk_buff *skb = rx->skb, *fwd_skb;
+        struct ieee80211_local *local = rx->local;
+        struct ieee80211_sub_if_data *sdata;
 
         hdr = (struct ieee80211_hdr *) skb->data;
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+        sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
 
         if (!ieee80211_is_data(hdr->frame_control))
                 return RX_CONTINUE;
@@ -1499,11 +1504,10 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 /* illegal frame */
                 return RX_DROP_MONITOR;
 
-        if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
-                struct ieee80211_sub_if_data *sdata;
+        if (!is_multicast_ether_addr(hdr->addr1) &&
+                        (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6)) {
                 struct mesh_path *mppath;
 
-                sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
                 rcu_read_lock();
                 mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
                 if (!mppath) {
@@ -1518,7 +1522,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 rcu_read_unlock();
         }
 
-        if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
+        /* Frame has reached destination.  Don't forward */
+        if (!is_multicast_ether_addr(hdr->addr1) &&
+                        compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
                 return RX_CONTINUE;
 
         mesh_hdr->ttl--;
@@ -1529,6 +1535,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                                                      dropped_frames_ttl);
                 else {
                         struct ieee80211_hdr *fwd_hdr;
+                        struct ieee80211_tx_info *info;
+
                         fwd_skb = skb_copy(skb, GFP_ATOMIC);
 
                         if (!fwd_skb && net_ratelimit())
@@ -1536,19 +1544,34 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                                                    rx->dev->name);
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
-                        /*
-                         * Save TA to addr1 to send TA a path error if a
-                         * suitable next hop is not found
-                         */
-                        memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
                         memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
-                        fwd_skb->dev = rx->local->mdev;
-                        fwd_skb->iif = rx->dev->ifindex;
-                        dev_queue_xmit(fwd_skb);
+                        info = IEEE80211_SKB_CB(fwd_skb);
+                        memset(info, 0, sizeof(*info));
+                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+                        info->control.vif = &rx->sdata->vif;
+                        ieee80211_select_queue(local, fwd_skb);
+                        if (!is_multicast_ether_addr(fwd_hdr->addr1)) {
+                                int err;
+                                /*
+                                 * Save TA to addr1 to send TA a path error if a
+                                 * suitable next hop is not found
+                                 */
+                                memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
+                                                ETH_ALEN);
+                                err = mesh_nexthop_lookup(fwd_skb, sdata);
+                                /* Failed to immediately resolve next hop:
+                                 * fwded frame was dropped or will be added
+                                 * later to the pending skb queue.  */
+                                if (err)
+                                        return RX_DROP_MONITOR;
+                        }
+                        IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
+                                                     fwded_frames);
+                        ieee80211_add_pending_skb(local, fwd_skb);
                 }
         }
 
-        if (is_multicast_ether_addr(hdr->addr3) ||
+        if (is_multicast_ether_addr(hdr->addr1) ||
             rx->dev->flags & IFF_PROMISC)
                 return RX_CONTINUE;
         else
@@ -1620,7 +1643,7 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
                 /* manage reordering buffer according to requested */
                 /* sequence number */
                 rcu_read_lock();
-                ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL, NULL,
+                ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
                                                  start_seq_num, 1);
                 rcu_read_unlock();
                 return RX_DROP_UNUSABLE;
@@ -1644,12 +1667,7 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
 
         if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
             compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
-                /* Not from the current AP. */
-                return;
-        }
-
-        if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATE) {
-                /* Association in progress; ignore SA Query */
+                /* Not from the current AP or not associated yet. */
                 return;
         }
 
@@ -1686,7 +1704,6 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         struct ieee80211_local *local = rx->local;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
-        struct ieee80211_bss *bss;
         int len = rx->skb->len;
 
         if (!ieee80211_is_action(mgmt->frame_control))
@@ -1764,17 +1781,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
                                 return RX_DROP_MONITOR;
 
-                        bss = ieee80211_rx_bss_get(local, sdata->u.mgd.bssid,
-                                           local->hw.conf.channel->center_freq,
-                                           sdata->u.mgd.ssid,
-                                           sdata->u.mgd.ssid_len);
-                        if (!bss)
-                                return RX_DROP_MONITOR;
-
-                        ieee80211_sta_process_chanswitch(sdata,
-                                     &mgmt->u.action.u.chan_switch.sw_elem, bss);
-                        ieee80211_rx_bss_put(local, bss);
-                        break;
+                        return ieee80211_sta_rx_mgmt(sdata, rx->skb);
                 }
                 break;
         case WLAN_CATEGORY_SA_QUERY:
@@ -1817,19 +1824,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
                 return RX_DROP_MONITOR;
 
         if (ieee80211_vif_is_mesh(&sdata->vif))
-                return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
+                return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return ieee80211_ibss_rx_mgmt(sdata, rx->skb, rx->status);
+                return ieee80211_ibss_rx_mgmt(sdata, rx->skb);
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                return ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
+                return ieee80211_sta_rx_mgmt(sdata, rx->skb);
 
         return RX_DROP_MONITOR;
 }
 
-static void ieee80211_rx_michael_mic_report(struct net_device *dev,
-                                            struct ieee80211_hdr *hdr,
+static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
                                             struct ieee80211_rx_data *rx)
 {
         int keyidx;
@@ -1866,7 +1872,8 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
             !ieee80211_is_auth(hdr->frame_control))
                 goto ignore;
 
-        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL);
+        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
+                                        GFP_ATOMIC);
  ignore:
         dev_kfree_skb(rx->skb);
         rx->skb = NULL;
@@ -2028,13 +2035,8 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_STATION:
                 if (!bssid)
                         return 0;
-                if (!ieee80211_bssid_match(bssid, sdata->u.mgd.bssid)) {
-                        if (!(rx->flags & IEEE80211_RX_IN_SCAN))
-                                return 0;
-                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
-                } else if (!multicast &&
-                           compare_ether_addr(sdata->dev->dev_addr,
-                                              hdr->addr1) != 0) {
+                if (!multicast &&
+                    compare_ether_addr(sdata->dev->dev_addr, hdr->addr1) != 0) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -2114,9 +2116,9 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
  */
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                                          struct sk_buff *skb,
-                                         struct ieee80211_rx_status *status,
                                          struct ieee80211_rate *rate)
 {
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_hdr *hdr;
@@ -2143,11 +2145,12 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         }
 
         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
-                ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
+                ieee80211_rx_michael_mic_report(hdr, &rx);
                 return;
         }
 
-        if (unlikely(local->sw_scanning || local->hw_scanning))
+        if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
+                     test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
                 rx.flags |= IEEE80211_RX_IN_SCAN;
 
         ieee80211_parse_qos(&rx);
@@ -2227,20 +2230,21 @@ static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
 {
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *rate;
-        struct ieee80211_rx_status status;
+        struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
+        struct ieee80211_rx_status *status;
 
-        if (!tid_agg_rx->reorder_buf[index])
+        if (!skb)
                 goto no_frame;
 
+        status = IEEE80211_SKB_RXCB(skb);
+
         /* release the reordered frames to stack */
-        memcpy(&status, tid_agg_rx->reorder_buf[index]->cb, sizeof(status));
-        sband = hw->wiphy->bands[status.band];
-        if (status.flag & RX_FLAG_HT)
+        sband = hw->wiphy->bands[status->band];
+        if (status->flag & RX_FLAG_HT)
                 rate = sband->bitrates; /* TODO: HT rates */
         else
-                rate = &sband->bitrates[status.rate_idx];
-        __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
-                                     &status, rate);
+                rate = &sband->bitrates[status->rate_idx];
+        __ieee80211_rx_handle_packet(hw, skb, rate);
         tid_agg_rx->stored_mpdu_num--;
         tid_agg_rx->reorder_buf[index] = NULL;
 
@@ -2265,7 +2269,6 @@ no_frame:
 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                            struct tid_ampdu_rx *tid_agg_rx,
                                            struct sk_buff *skb,
-                                           struct ieee80211_rx_status *rxstatus,
                                            u16 mpdu_seq_num,
                                            int bar_req)
 {
@@ -2324,8 +2327,6 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         /* put the frame in the reordering buffer */
         tid_agg_rx->reorder_buf[index] = skb;
         tid_agg_rx->reorder_time[index] = jiffies;
-        memcpy(tid_agg_rx->reorder_buf[index]->cb, rxstatus,
-               sizeof(*rxstatus));
         tid_agg_rx->stored_mpdu_num++;
         /* release the buffer until next missing frame */
         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
@@ -2374,8 +2375,7 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
 }
 
 static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
-                                     struct sk_buff *skb,
-                                     struct ieee80211_rx_status *status)
+                                     struct sk_buff *skb)
 {
         struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -2424,7 +2424,7 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
 
         /* according to mpdu sequence number deal with reordering buffer */
         mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
-        ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, status,
+        ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
                                                 mpdu_seq_num, 0);
  end_reorder:
         return ret;
@@ -2434,12 +2434,12 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
  * This is the receive path handler. It is called by a low level driver when an
  * 802.11 MPDU is received from the hardware.
  */
-void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
-                    struct ieee80211_rx_status *status)
+void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rate *rate = NULL;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
         if (status->band < 0 ||
             status->band >= IEEE80211_NUM_BANDS) {
@@ -2494,7 +2494,7 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
          * if it was previously present.
          * Also, frames with less than 16 bytes are dropped.
          */
-        skb = ieee80211_rx_monitor(local, skb, status, rate);
+        skb = ieee80211_rx_monitor(local, skb, rate);
         if (!skb) {
                 rcu_read_unlock();
                 return;
@@ -2512,8 +2512,8 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
          * frames from other than operational channel), but that should not
          * happen in normal networks.
          */
-        if (!ieee80211_rx_reorder_ampdu(local, skb, status))
-                __ieee80211_rx_handle_packet(hw, skb, status, rate);
+        if (!ieee80211_rx_reorder_ampdu(local, skb))
+                __ieee80211_rx_handle_packet(hw, skb, rate);
 
         rcu_read_unlock();
 }
@@ -2521,16 +2521,12 @@ EXPORT_SYMBOL(__ieee80211_rx);
 
 /* This is a version of the rx handler that can be called from hard irq
  * context. Post the skb on the queue and schedule the tasklet */
-void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
-                          struct ieee80211_rx_status *status)
+void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
 
-        skb->dev = local->mdev;
-        /* copy status into skb->cb for use by tasklet */
-        memcpy(skb->cb, status, sizeof(*status));
         skb->pkt_type = IEEE80211_RX_MSG;
         skb_queue_tail(&local->skb_queue, skb);
         tasklet_schedule(&local->tasklet);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 2a8d09ad17ff..e091cbc3434f 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -18,7 +18,6 @@
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
 #include <net/mac80211.h>
-#include <net/iw_handler.h>
 
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -26,7 +25,7 @@
 
 #define IEEE80211_PROBE_DELAY (HZ / 33)
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
-#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
+#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 8)
 
 struct ieee80211_bss *
 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
@@ -121,23 +120,10 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         return bss;
 }
 
-void ieee80211_rx_bss_remove(struct ieee80211_sub_if_data *sdata, u8 *bssid,
-                             int freq, u8 *ssid, u8 ssid_len)
-{
-        struct ieee80211_bss *bss;
-        struct ieee80211_local *local = sdata->local;
-
-        bss = ieee80211_rx_bss_get(local, bssid, freq, ssid, ssid_len);
-        if (bss) {
-                cfg80211_unlink_bss(local->hw.wiphy, (void *)bss);
-                ieee80211_rx_bss_put(local, bss);
-        }
-}
-
 ieee80211_rx_result
-ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                  struct ieee80211_rx_status *rx_status)
+ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 {
+        struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_mgmt *mgmt;
         struct ieee80211_bss *bss;
         u8 *elements;
@@ -278,7 +264,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 
         mutex_lock(&local->scan_mtx);
 
-        if (WARN_ON(!local->hw_scanning && !local->sw_scanning)) {
+        if (WARN_ON(!local->scanning)) {
                 mutex_unlock(&local->scan_mtx);
                 return;
         }
@@ -288,16 +274,15 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
                 return;
         }
 
-        if (local->hw_scanning)
+        if (test_bit(SCAN_HW_SCANNING, &local->scanning))
                 ieee80211_restore_scan_ies(local);
 
-        if (local->scan_req != &local->int_scan_req)
+        if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
 
-        was_hw_scan = local->hw_scanning;
-        local->hw_scanning = false;
-        local->sw_scanning = false;
+        was_hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
+        local->scanning = 0;
         local->scan_channel = NULL;
 
         /* we only have to protect scan_req and hw/sw scan */
@@ -307,16 +292,13 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (was_hw_scan)
                 goto done;
 
-        netif_tx_lock_bh(local->mdev);
-        netif_addr_lock(local->mdev);
+        spin_lock_bh(&local->filter_lock);
         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
         drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
                              &local->filter_flags,
-                             local->mdev->mc_count,
-                             local->mdev->mc_list);
-
-        netif_addr_unlock(local->mdev);
-        netif_tx_unlock_bh(local->mdev);
+                             local->mc_count,
+                             local->mc_list);
+        spin_unlock_bh(&local->filter_lock);
 
         drv_sw_scan_complete(local);
 
@@ -327,7 +309,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 
                 /* Tell AP we're back */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
+                        if (sdata->u.mgd.associated) {
                                 ieee80211_scan_ps_disable(sdata);
                                 netif_tx_wake_all_queues(sdata->dev);
                         }
@@ -382,30 +364,30 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
                         ieee80211_bss_info_change_notify(
                                 sdata, BSS_CHANGED_BEACON_ENABLED);
 
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
-                                netif_tx_stop_all_queues(sdata->dev);
-                                ieee80211_scan_ps_enable(sdata);
-                        }
-                } else
+                /*
+                 * only handle non-STA interfaces here, STA interfaces
+                 * are handled in the scan state machine
+                 */
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         netif_tx_stop_all_queues(sdata->dev);
         }
         mutex_unlock(&local->iflist_mtx);
 
-        local->scan_state = SCAN_SET_CHANNEL;
+        local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
-        netif_addr_lock_bh(local->mdev);
+        spin_lock_bh(&local->filter_lock);
         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
         drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
                              &local->filter_flags,
-                             local->mdev->mc_count,
-                             local->mdev->mc_list);
-        netif_addr_unlock_bh(local->mdev);
+                             local->mc_count,
+                             local->mc_list);
+        spin_unlock_bh(&local->filter_lock);
 
         /* TODO: start scan as soon as all nullfunc frames are ACKed */
-        queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                           IEEE80211_CHANNEL_TIME);
+        ieee80211_queue_delayed_work(&local->hw,
+                                     &local->scan_work,
+                                     IEEE80211_CHANNEL_TIME);
 
         return 0;
 }
@@ -441,20 +423,18 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         local->scan_req = req;
         local->scan_sdata = sdata;
 
-        if (req != &local->int_scan_req &&
+        if (req != local->int_scan_req &&
             sdata->vif.type == NL80211_IFTYPE_STATION &&
-            (ifmgd->state == IEEE80211_STA_MLME_DIRECT_PROBE ||
-             ifmgd->state == IEEE80211_STA_MLME_AUTHENTICATE ||
-             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATE)) {
-                /* actually wait for the assoc to finish/time out */
+            !list_empty(&ifmgd->work_list)) {
+                /* actually wait for the work it's doing to finish/time out */
                 set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
                 return 0;
         }
 
         if (local->ops->hw_scan)
-                local->hw_scanning = true;
+                __set_bit(SCAN_HW_SCANNING, &local->scanning);
         else
-                local->sw_scanning = true;
+                __set_bit(SCAN_SW_SCANNING, &local->scanning);
         /*
          * Kicking off the scan need not be protected,
          * only the scan variable stuff, since now
@@ -477,11 +457,9 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         mutex_lock(&local->scan_mtx);
 
         if (rc) {
-                if (local->ops->hw_scan) {
-                        local->hw_scanning = false;
+                if (local->ops->hw_scan)
                         ieee80211_restore_scan_ies(local);
-                } else
-                        local->sw_scanning = false;
+                local->scanning = 0;
 
                 ieee80211_recalc_idle(local);
 
@@ -492,13 +470,195 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         return rc;
 }
 
+static int ieee80211_scan_state_decision(struct ieee80211_local *local,
+                                         unsigned long *next_delay)
+{
+        bool associated = false;
+        struct ieee80211_sub_if_data *sdata;
+
+        /* if no more bands/channels left, complete scan and advance to the idle state */
+        if (local->scan_channel_idx >= local->scan_req->n_channels) {
+                ieee80211_scan_completed(&local->hw, false);
+                return 1;
+        }
+
+        /* check if at least one STA interface is associated */
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (sdata->u.mgd.associated) {
+                                associated = true;
+                                break;
+                        }
+                }
+        }
+        mutex_unlock(&local->iflist_mtx);
+
+        if (local->scan_channel) {
+                /*
+                 * we're currently scanning a different channel, let's
+                 * switch back to the operating channel now if at least
+                 * one interface is associated. Otherwise just scan the
+                 * next channel
+                 */
+                if (associated)
+                        local->next_scan_state = SCAN_ENTER_OPER_CHANNEL;
+                else
+                        local->next_scan_state = SCAN_SET_CHANNEL;
+        } else {
+                /*
+                 * we're on the operating channel currently, let's
+                 * leave that channel now to scan another one
+                 */
+                local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
+        }
+
+        *next_delay = 0;
+        return 0;
+}
+
+static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
+                                                    unsigned long *next_delay)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        /*
+         * notify the AP about us leaving the channel and stop all STA interfaces
+         */
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        netif_tx_stop_all_queues(sdata->dev);
+                        if (sdata->u.mgd.associated)
+                                ieee80211_scan_ps_enable(sdata);
+                }
+        }
+        mutex_unlock(&local->iflist_mtx);
+
+        __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
+
+        /* advance to the next channel to be scanned */
+        *next_delay = HZ / 10;
+        local->next_scan_state = SCAN_SET_CHANNEL;
+}
+
+static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *local,
+                                                    unsigned long *next_delay)
+{
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+
+        /* switch back to the operating channel */
+        local->scan_channel = NULL;
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+
+        /*
+         * notify the AP about us being back and restart all STA interfaces
+         */
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                /* Tell AP we're back */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (sdata->u.mgd.associated)
+                                ieee80211_scan_ps_disable(sdata);
+                        netif_tx_wake_all_queues(sdata->dev);
+                }
+        }
+        mutex_unlock(&local->iflist_mtx);
+
+        __clear_bit(SCAN_OFF_CHANNEL, &local->scanning);
+
+        *next_delay = HZ / 5;
+        local->next_scan_state = SCAN_DECISION;
+}
+
+static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
+                                             unsigned long *next_delay)
+{
+        int skip;
+        struct ieee80211_channel *chan;
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+
+        skip = 0;
+        chan = local->scan_req->channels[local->scan_channel_idx];
+
+        if (chan->flags & IEEE80211_CHAN_DISABLED ||
+            (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+             chan->flags & IEEE80211_CHAN_NO_IBSS))
+                skip = 1;
+
+        if (!skip) {
+                local->scan_channel = chan;
+                if (ieee80211_hw_config(local,
+                                        IEEE80211_CONF_CHANGE_CHANNEL))
+                        skip = 1;
+        }
+
+        /* advance state machine to next channel/band */
+        local->scan_channel_idx++;
+
+        if (skip) {
+                /* if we skip this channel return to the decision state */
+                local->next_scan_state = SCAN_DECISION;
+                return;
+        }
+
+        /*
+         * Probe delay is used to update the NAV, cf. 11.1.3.2.2
+         * (which unfortunately doesn't say _why_ step a) is done,
+         * but it waits for the probe delay or until a frame is
+         * received - and the received frame would update the NAV).
+         * For now, we do not support waiting until a frame is
+         * received.
+         *
+         * In any case, it is not necessary for a passive scan.
+         */
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
+            !local->scan_req->n_ssids) {
+                *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
+                local->next_scan_state = SCAN_DECISION;
+                return;
+        }
+
+        /* active scan, send probes */
+        *next_delay = IEEE80211_PROBE_DELAY;
+        local->next_scan_state = SCAN_SEND_PROBE;
+}
+
+static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
+                                            unsigned long *next_delay)
+{
+        int i;
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+
+        for (i = 0; i < local->scan_req->n_ssids; i++)
+                ieee80211_send_probe_req(
+                        sdata, NULL,
+                        local->scan_req->ssids[i].ssid,
+                        local->scan_req->ssids[i].ssid_len,
+                        local->scan_req->ie, local->scan_req->ie_len);
+
+        /*
+         * After sending probe requests, wait for probe responses
+         * on the channel.
+         */
+        *next_delay = IEEE80211_CHANNEL_TIME;
+        local->next_scan_state = SCAN_DECISION;
+}
+
 void ieee80211_scan_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local, scan_work.work);
         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-        struct ieee80211_channel *chan;
-        int skip, i;
         unsigned long next_delay = 0;
 
         mutex_lock(&local->scan_mtx);
@@ -507,7 +667,7 @@ void ieee80211_scan_work(struct work_struct *work)
                 return;
         }
 
-        if (local->scan_req && !(local->sw_scanning || local->hw_scanning)) {
+        if (local->scan_req && !local->scanning) {
                 struct cfg80211_scan_request *req = local->scan_req;
                 int rc;
 
@@ -531,72 +691,32 @@ void ieee80211_scan_work(struct work_struct *work)
                 return;
         }
 
-        switch (local->scan_state) {
-        case SCAN_SET_CHANNEL:
-                /* if no more bands/channels left, complete scan */
-                if (local->scan_channel_idx >= local->scan_req->n_channels) {
-                        ieee80211_scan_completed(&local->hw, false);
-                        return;
-                }
-                skip = 0;
-                chan = local->scan_req->channels[local->scan_channel_idx];
-
-                if (chan->flags & IEEE80211_CHAN_DISABLED ||
-                    (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-                     chan->flags & IEEE80211_CHAN_NO_IBSS))
-                        skip = 1;
-
-                if (!skip) {
-                        local->scan_channel = chan;
-                        if (ieee80211_hw_config(local,
-                                                IEEE80211_CONF_CHANGE_CHANNEL))
-                                skip = 1;
-                }
-
-                /* advance state machine to next channel/band */
-                local->scan_channel_idx++;
-
-                if (skip)
+        /*
+         * as long as no delay is required advance immediately
+         * without scheduling a new work
+         */
+        do {
+                switch (local->next_scan_state) {
+                case SCAN_DECISION:
+                        if (ieee80211_scan_state_decision(local, &next_delay))
+                                return;
                         break;
-
-                /*
-                 * Probe delay is used to update the NAV, cf. 11.1.3.2.2
-                 * (which unfortunately doesn't say _why_ step a) is done,
-                 * but it waits for the probe delay or until a frame is
-                 * received - and the received frame would update the NAV).
-                 * For now, we do not support waiting until a frame is
-                 * received.
-                 *
-                 * In any case, it is not necessary for a passive scan.
-                 */
-                if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
-                    !local->scan_req->n_ssids) {
-                        next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
+                case SCAN_SET_CHANNEL:
+                        ieee80211_scan_state_set_channel(local, &next_delay);
+                        break;
+                case SCAN_SEND_PROBE:
+                        ieee80211_scan_state_send_probe(local, &next_delay);
+                        break;
+                case SCAN_LEAVE_OPER_CHANNEL:
+                        ieee80211_scan_state_leave_oper_channel(local, &next_delay);
+                        break;
+                case SCAN_ENTER_OPER_CHANNEL:
+                        ieee80211_scan_state_enter_oper_channel(local, &next_delay);
                         break;
                 }
+        } while (next_delay == 0);
 
-                next_delay = IEEE80211_PROBE_DELAY;
-                local->scan_state = SCAN_SEND_PROBE;
-                break;
-        case SCAN_SEND_PROBE:
-                for (i = 0; i < local->scan_req->n_ssids; i++)
-                        ieee80211_send_probe_req(
-                                sdata, NULL,
-                                local->scan_req->ssids[i].ssid,
-                                local->scan_req->ssids[i].ssid_len,
-                                local->scan_req->ie, local->scan_req->ie_len);
-
-                /*
-                 * After sending probe requests, wait for probe responses
-                 * on the channel.
-                 */
-                next_delay = IEEE80211_CHANNEL_TIME;
-                local->scan_state = SCAN_SET_CHANNEL;
-                break;
-        }
-
-        queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                           next_delay);
+        ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay);
 }
 
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
@@ -623,10 +743,10 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
         if (local->scan_req)
                 goto unlock;
 
-        memcpy(local->int_scan_req.ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
-        local->int_scan_req.ssids[0].ssid_len = ssid_len;
+        memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
+        local->int_scan_req->ssids[0].ssid_len = ssid_len;
 
-        ret = __ieee80211_start_scan(sdata, &sdata->local->int_scan_req);
+        ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
  unlock:
         mutex_unlock(&local->scan_mtx);
         return ret;
@@ -643,7 +763,7 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
          * queued -- mostly at suspend under RTNL.
          */
         mutex_lock(&local->scan_mtx);
-        swscan = local->sw_scanning;
+        swscan = test_bit(SCAN_SW_SCANNING, &local->scanning);
         mutex_unlock(&local->scan_mtx);
 
         if (swscan)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a360bceeba59..eec001491e66 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -349,6 +349,7 @@ int sta_info_insert(struct sta_info *sta)
                 goto out_free;
         }
         list_add(&sta->list, &local->sta_list);
+        local->sta_generation++;
         local->num_sta++;
         sta_info_hash_add(local, sta);
 
@@ -485,6 +486,7 @@ static void __sta_info_unlink(struct sta_info **sta)
         }
 
         local->num_sta--;
+        local->sta_generation++;
 
         if (local->ops->sta_notify) {
                 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 49a1a1f76511..ccc3adf962c7 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -30,7 +30,6 @@
  * @WLAN_STA_ASSOC_AP: We're associated to that station, it is an AP.
  * @WLAN_STA_WME: Station is a QoS-STA.
  * @WLAN_STA_WDS: Station is one of our WDS peers.
- * @WLAN_STA_PSPOLL: Station has just PS-polled us.
  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
  *      IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
  *      frame to this station is transmitted.
@@ -47,7 +46,6 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_ASSOC_AP       = 1<<5,
         WLAN_STA_WME            = 1<<6,
         WLAN_STA_WDS            = 1<<7,
-        WLAN_STA_PSPOLL         = 1<<8,
         WLAN_STA_CLEAR_PS_FILT  = 1<<9,
         WLAN_STA_MFP            = 1<<10,
         WLAN_STA_SUSPEND        = 1<<11
@@ -308,6 +306,23 @@ struct sta_info {
                 struct dentry *inactive_ms;
                 struct dentry *last_seq_ctrl;
                 struct dentry *agg_status;
+                struct dentry *aid;
+                struct dentry *dev;
+                struct dentry *rx_packets;
+                struct dentry *tx_packets;
+                struct dentry *rx_bytes;
+                struct dentry *tx_bytes;
+                struct dentry *rx_duplicates;
+                struct dentry *rx_fragments;
+                struct dentry *rx_dropped;
+                struct dentry *tx_fragments;
+                struct dentry *tx_filtered;
+                struct dentry *tx_retry_failed;
+                struct dentry *tx_retry_count;
+                struct dentry *last_signal;
+                struct dentry *last_qual;
+                struct dentry *last_noise;
+                struct dentry *wep_weak_iv_count;
                 bool add_has_run;
         } debugfs;
 #endif
@@ -342,17 +357,6 @@ static inline void clear_sta_flags(struct sta_info *sta, const u32 flags)
         spin_unlock_irqrestore(&sta->flaglock, irqfl);
 }
 
-static inline void set_and_clear_sta_flags(struct sta_info *sta,
-                                           const u32 set, const u32 clear)
-{
-        unsigned long irqfl;
-
-        spin_lock_irqsave(&sta->flaglock, irqfl);
-        sta->flags |= set;
-        sta->flags &= ~clear;
-        spin_unlock_irqrestore(&sta->flaglock, irqfl);
-}
-
 static inline u32 test_sta_flags(struct sta_info *sta, const u32 flags)
 {
         u32 ret;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3a8922cd1038..0c08d1e60cb5 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -192,7 +192,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
         if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
                 return TX_CONTINUE;
 
-        if (unlikely(tx->local->sw_scanning) &&
+        if (unlikely(test_bit(SCAN_OFF_CHANNEL, &tx->local->scanning)) &&
             !ieee80211_is_probe_req(hdr->frame_control) &&
             !ieee80211_is_nullfunc(hdr->frame_control))
                 /*
@@ -317,30 +317,30 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (!atomic_read(&tx->sdata->bss->num_sta_ps))
                 return TX_CONTINUE;
 
+        /* buffered in hardware */
+        if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING)) {
+                info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+
+                return TX_CONTINUE;
+        }
+
         /* buffered in mac80211 */
-        if (tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING) {
-                if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
-                        purge_old_ps_buffers(tx->local);
-                if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >=
-                    AP_MAX_BC_BUFFER) {
+        if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
+                purge_old_ps_buffers(tx->local);
+
+        if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >= AP_MAX_BC_BUFFER) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                        if (net_ratelimit()) {
-                                printk(KERN_DEBUG "%s: BC TX buffer full - "
-                                       "dropping the oldest frame\n",
-                                       tx->dev->name);
-                        }
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "%s: BC TX buffer full - dropping the oldest frame\n",
+                               tx->dev->name);
 #endif
-                        dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
-                } else
-                        tx->local->total_ps_buffered++;
-                skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
-                return TX_QUEUED;
-        }
+                dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
+        } else
+                tx->local->total_ps_buffered++;
 
-        /* buffered in hardware */
-        info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+        skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
 
-        return TX_CONTINUE;
+        return TX_QUEUED;
 }
 
 static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
@@ -373,7 +373,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         staflags = get_sta_flags(sta);
 
         if (unlikely((staflags & WLAN_STA_PS) &&
-                     !(staflags & WLAN_STA_PSPOLL))) {
+                     !(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE))) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries "
                        "before %d)\n",
@@ -400,6 +400,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                         sta_info_set_tim_bit(sta);
 
                 info->control.jiffies = jiffies;
+                info->control.vif = &tx->sdata->vif;
                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                 skb_queue_tail(&sta->ps_tx_buf, tx->skb);
                 return TX_QUEUED;
@@ -411,24 +412,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                        sta->sta.addr);
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-        if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL)) {
-                /*
-                 * The sleeping station with pending data is now snoozing.
-                 * It queried us for its buffered frames and will go back
-                 * to deep sleep once it got everything.
-                 *
-                 * inform the driver, in case the hardware does powersave
-                 * frame filtering and keeps a station  blacklist on its own
-                 * (e.g: p54), so that frames can be delivered unimpeded.
-                 *
-                 * Note: It should be safe to disable the filter now.
-                 * As, it is really unlikely that we still have any pending
-                 * frame for this station in the hw's buffers/fifos left,
-                 * that is not rejected with a unsuccessful tx_status yet.
-                 */
 
-                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
-        }
         return TX_CONTINUE;
 }
 
@@ -451,7 +435,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 
-        if (unlikely(tx->skb->do_not_encrypt))
+        if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
                 tx->key = NULL;
         else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
                 tx->key = key;
@@ -497,7 +481,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         }
 
         if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
-                tx->skb->do_not_encrypt = 1;
+                info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 
         return TX_CONTINUE;
 }
@@ -512,6 +496,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         int i, len;
         bool inval = false, rts = false, short_preamble = false;
         struct ieee80211_tx_rate_control txrc;
+        u32 sta_flags;
 
         memset(&txrc, 0, sizeof(txrc));
 
@@ -544,7 +529,26 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
              (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
                 txrc.short_preamble = short_preamble = true;
 
+        sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;
+
+        /*
+         * Lets not bother rate control if we're associated and cannot
+         * talk to the sta. This should not happen.
+         */
+        if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) &&
+                 (sta_flags & WLAN_STA_ASSOC) &&
+                 !rate_usable_index_exists(sband, &tx->sta->sta),
+                 "%s: Dropped data frame as no usable bitrate found while "
+                 "scanning and associated. Target station: "
+                 "%pM on %d GHz band\n",
+                 tx->dev->name, hdr->addr1,
+                 tx->channel->band ? 5 : 2))
+                return TX_DROP;
 
+        /*
+         * If we're associated with the sta at this point we know we can at
+         * least send the frame at the lowest bit rate.
+         */
         rate_control_get_rate(tx->sdata, tx->sta, &txrc);
 
         if (unlikely(info->control.rates[0].idx < 0))
@@ -676,7 +680,7 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
          * number, if we have no matching interface then we
          * neither assign one ourselves nor ask the driver to.
          */
-        if (unlikely(!info->control.vif))
+        if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
                 return TX_CONTINUE;
 
         if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
@@ -696,7 +700,6 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
                 /* for pure STA mode without beacons, we can do it */
                 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
                 tx->sdata->sequence_number += 0x10;
-                tx->sdata->sequence_number &= IEEE80211_SCTL_SEQ;
                 return TX_CONTINUE;
         }
 
@@ -754,9 +757,7 @@ static int ieee80211_fragment(struct ieee80211_local *local,
                 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
                 skb_copy_queue_mapping(tmp, skb);
                 tmp->priority = skb->priority;
-                tmp->do_not_encrypt = skb->do_not_encrypt;
                 tmp->dev = skb->dev;
-                tmp->iif = skb->iif;
 
                 /* copy header and data */
                 memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
@@ -784,7 +785,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 
         /*
          * Warn when submitting a fragmented A-MPDU frame and drop it.
-         * This scenario is handled in __ieee80211_tx_prepare but extra
+         * This scenario is handled in ieee80211_tx_prepare but extra
          * caution taken here as fragmented ampdu may cause Tx stop.
          */
         if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
@@ -842,6 +843,23 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 }
 
 static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
+{
+        struct sk_buff *skb = tx->skb;
+
+        if (!tx->sta)
+                return TX_CONTINUE;
+
+        tx->sta->tx_packets++;
+        do {
+                tx->sta->tx_fragments++;
+                tx->sta->tx_bytes += skb->len;
+        } while ((skb = skb->next));
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 {
         if (!tx->key)
@@ -885,23 +903,6 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
-static ieee80211_tx_result debug_noinline
-ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
-{
-        struct sk_buff *skb = tx->skb;
-
-        if (!tx->sta)
-                return TX_CONTINUE;
-
-        tx->sta->tx_packets++;
-        do {
-                tx->sta->tx_fragments++;
-                tx->sta->tx_bytes += skb->len;
-        } while ((skb = skb->next));
-
-        return TX_CONTINUE;
-}
-
 /* actual transmit path */
 
 /*
@@ -923,11 +924,12 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
         struct ieee80211_radiotap_header *rthdr =
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
 
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        skb->do_not_encrypt = 1;
+        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 
         /*
@@ -965,7 +967,7 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                 skb_trim(skb, skb->len - FCS_LEN);
                         }
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
-                                tx->skb->do_not_encrypt = 0;
+                                info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
                                 tx->flags |= IEEE80211_TX_FRAGMENTED;
                         break;
@@ -998,13 +1000,12 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
  * initialises @tx
  */
 static ieee80211_tx_result
-__ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
-                       struct sk_buff *skb,
-                       struct net_device *dev)
+ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
+                     struct ieee80211_tx_data *tx,
+                     struct sk_buff *skb)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_hdr *hdr;
-        struct ieee80211_sub_if_data *sdata;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int hdrlen, tid;
         u8 *qc, *state;
@@ -1012,9 +1013,9 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 
         memset(tx, 0, sizeof(*tx));
         tx->skb = skb;
-        tx->dev = dev; /* use original interface */
+        tx->dev = sdata->dev; /* use original interface */
         tx->local = local;
-        tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        tx->sdata = sdata;
         tx->channel = local->hw.conf.channel;
         /*
          * Set this flag (used below to indicate "automatic fragmentation"),
@@ -1023,7 +1024,6 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         tx->flags |= IEEE80211_TX_FRAGMENTED;
 
         /* process and remove the injection radiotap header */
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) {
                 if (!__ieee80211_parse_tx_radiotap(tx, skb))
                         return TX_DROP;
@@ -1075,6 +1075,7 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
                 } else if (*state != HT_AGG_STATE_IDLE) {
                         /* in progress */
                         queued = true;
+                        info->control.vif = &sdata->vif;
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                         __skb_queue_tail(&tid_tx->pending, skb);
                 }
@@ -1119,50 +1120,29 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         return TX_CONTINUE;
 }
 
-/*
- * NB: @tx is uninitialised when passed in here
- */
-static int ieee80211_tx_prepare(struct ieee80211_local *local,
-                                struct ieee80211_tx_data *tx,
-                                struct sk_buff *skb)
-{
-        struct net_device *dev;
-
-        dev = dev_get_by_index(&init_net, skb->iif);
-        if (unlikely(dev && !is_ieee80211_device(local, dev))) {
-                dev_put(dev);
-                dev = NULL;
-        }
-        if (unlikely(!dev))
-                return -ENODEV;
-        /*
-         * initialises tx with control
-         *
-         * return value is safe to ignore here because this function
-         * can only be invoked for multicast frames
-         *
-         * XXX: clean up
-         */
-        __ieee80211_tx_prepare(tx, skb, dev);
-        dev_put(dev);
-        return 0;
-}
-
 static int __ieee80211_tx(struct ieee80211_local *local,
                           struct sk_buff **skbp,
-                          struct sta_info *sta)
+                          struct sta_info *sta,
+                          bool txpending)
 {
         struct sk_buff *skb = *skbp, *next;
         struct ieee80211_tx_info *info;
+        struct ieee80211_sub_if_data *sdata;
+        unsigned long flags;
         int ret, len;
         bool fragm = false;
 
-        local->mdev->trans_start = jiffies;
-
         while (skb) {
-                if (ieee80211_queue_stopped(&local->hw,
-                                            skb_get_queue_mapping(skb)))
-                        return IEEE80211_TX_PENDING;
+                int q = skb_get_queue_mapping(skb);
+
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                ret = IEEE80211_TX_OK;
+                if (local->queue_stop_reasons[q] ||
+                    (!txpending && !skb_queue_empty(&local->pending[q])))
+                        ret = IEEE80211_TX_PENDING;
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+                if (ret != IEEE80211_TX_OK)
+                        return ret;
 
                 info = IEEE80211_SKB_CB(skb);
 
@@ -1172,13 +1152,35 @@ static int __ieee80211_tx(struct ieee80211_local *local,
 
                 next = skb->next;
                 len = skb->len;
+
+                if (next)
+                        info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
+
+                sdata = vif_to_sdata(info->control.vif);
+
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_MONITOR:
+                        info->control.vif = NULL;
+                        break;
+                case NL80211_IFTYPE_AP_VLAN:
+                        info->control.vif = &container_of(sdata->bss,
+                                struct ieee80211_sub_if_data, u.ap)->vif;
+                        break;
+                default:
+                        /* keep */
+                        break;
+                }
+
                 ret = drv_tx(local, skb);
                 if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
                         dev_kfree_skb(skb);
                         ret = NETDEV_TX_OK;
                 }
-                if (ret != NETDEV_TX_OK)
+                if (ret != NETDEV_TX_OK) {
+                        info->control.vif = &sdata->vif;
                         return IEEE80211_TX_AGAIN;
+                }
+
                 *skbp = skb = next;
                 ieee80211_led_tx(local, 1);
                 fragm = true;
@@ -1210,9 +1212,9 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         CALL_TXH(ieee80211_tx_h_sequence)
         CALL_TXH(ieee80211_tx_h_fragment)
         /* handlers after fragment must be aware of tx info fragmentation! */
+        CALL_TXH(ieee80211_tx_h_stats)
         CALL_TXH(ieee80211_tx_h_encrypt)
         CALL_TXH(ieee80211_tx_h_calculate_duration)
-        CALL_TXH(ieee80211_tx_h_stats)
 #undef CALL_TXH
 
  txh_done:
@@ -1234,10 +1236,10 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         return 0;
 }
 
-static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
-                         bool txpending)
+static void ieee80211_tx(struct ieee80211_sub_if_data *sdata,
+                         struct sk_buff *skb, bool txpending)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_data tx;
         ieee80211_tx_result res_prepare;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -1248,8 +1250,6 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
 
         queue = skb_get_queue_mapping(skb);
 
-        WARN_ON(!txpending && !skb_queue_empty(&local->pending[queue]));
-
         if (unlikely(skb->len < 10)) {
                 dev_kfree_skb(skb);
                 return;
@@ -1258,7 +1258,7 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         rcu_read_lock();
 
         /* initialises tx */
-        res_prepare = __ieee80211_tx_prepare(&tx, skb, dev);
+        res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
 
         if (unlikely(res_prepare == TX_DROP)) {
                 dev_kfree_skb(skb);
@@ -1277,7 +1277,7 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
 
         retries = 0;
  retry:
-        ret = __ieee80211_tx(local, &tx.skb, tx.sta);
+        ret = __ieee80211_tx(local, &tx.skb, tx.sta, txpending);
         switch (ret) {
         case IEEE80211_TX_OK:
                 break;
@@ -1295,34 +1295,35 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
 
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 
-                if (__netif_subqueue_stopped(local->mdev, queue)) {
+                if (local->queue_stop_reasons[queue] ||
+                    !skb_queue_empty(&local->pending[queue])) {
+                        /*
+                         * if queue is stopped, queue up frames for later
+                         * transmission from the tasklet
+                         */
                         do {
                                 next = skb->next;
                                 skb->next = NULL;
                                 if (unlikely(txpending))
-                                        skb_queue_head(&local->pending[queue],
-                                                       skb);
+                                        __skb_queue_head(&local->pending[queue],
+                                                         skb);
                                 else
-                                        skb_queue_tail(&local->pending[queue],
-                                                       skb);
+                                        __skb_queue_tail(&local->pending[queue],
+                                                         skb);
                         } while ((skb = next));
 
-                        /*
-                         * Make sure nobody will enable the queue on us
-                         * (without going through the tasklet) nor disable the
-                         * netdev queue underneath the pending handling code.
-                         */
-                        __set_bit(IEEE80211_QUEUE_STOP_REASON_PENDING,
-                                  &local->queue_stop_reasons[queue]);
-
                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
                                                flags);
                 } else {
+                        /*
+                         * otherwise retry, but this is a race condition or
+                         * a driver bug (which we warn about if it persists)
+                         */
                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
                                                flags);
 
                         retries++;
-                        if (WARN(retries > 10, "tx refused but queue active"))
+                        if (WARN(retries > 10, "tx refused but queue active\n"))
                                 goto drop;
                         goto retry;
                 }
@@ -1383,44 +1384,25 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
         return 0;
 }
 
-int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
+                           struct sk_buff *skb)
 {
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct net_device *odev = NULL;
-        struct ieee80211_sub_if_data *osdata;
+        struct ieee80211_sub_if_data *tmp_sdata;
         int headroom;
         bool may_encrypt;
-        enum {
-                NOT_MONITOR,
-                FOUND_SDATA,
-                UNKNOWN_ADDRESS,
-        } monitor_iface = NOT_MONITOR;
-
-        if (skb->iif)
-                odev = dev_get_by_index(&init_net, skb->iif);
-        if (unlikely(odev && !is_ieee80211_device(local, odev))) {
-                dev_put(odev);
-                odev = NULL;
-        }
-        if (unlikely(!odev)) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                printk(KERN_DEBUG "%s: Discarded packet with nonexistent "
-                       "originating device\n", dev->name);
-#endif
-                dev_kfree_skb(skb);
-                return NETDEV_TX_OK;
-        }
+
+        dev_hold(sdata->dev);
 
         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
             local->hw.conf.dynamic_ps_timeout > 0 &&
-            !local->sw_scanning && !local->hw_scanning && local->ps_sdata) {
+            !(local->scanning) && local->ps_sdata) {
                 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
                         ieee80211_stop_queues_by_reason(&local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_PS);
-                        queue_work(local->hw.workqueue,
+                        ieee80211_queue_work(&local->hw,
                                         &local->dynamic_ps_disable_work);
                 }
 
@@ -1428,31 +1410,13 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
         }
 
-        memset(info, 0, sizeof(*info));
-
         info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
-        osdata = IEEE80211_DEV_TO_SUB_IF(odev);
-
-        if (ieee80211_vif_is_mesh(&osdata->vif) &&
-            ieee80211_is_data(hdr->frame_control)) {
-                if (is_multicast_ether_addr(hdr->addr3))
-                        memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
-                else
-                        if (mesh_nexthop_lookup(skb, osdata)) {
-                                dev_put(odev);
-                                return NETDEV_TX_OK;
-                        }
-                if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
-                        IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.mesh,
-                                                            fwded_frames);
-        } else if (unlikely(osdata->vif.type == NL80211_IFTYPE_MONITOR)) {
-                struct ieee80211_sub_if_data *sdata;
+        if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
                 int hdrlen;
                 u16 len_rthdr;
 
                 info->flags |= IEEE80211_TX_CTL_INJECTED;
-                monitor_iface = UNKNOWN_ADDRESS;
 
                 len_rthdr = ieee80211_get_radiotap_len(skb->data);
                 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
@@ -1471,20 +1435,17 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                          */
 
                         rcu_read_lock();
-                        list_for_each_entry_rcu(sdata, &local->interfaces,
+                        list_for_each_entry_rcu(tmp_sdata, &local->interfaces,
                                                 list) {
-                                if (!netif_running(sdata->dev))
+                                if (!netif_running(tmp_sdata->dev))
                                         continue;
-                                if (sdata->vif.type != NL80211_IFTYPE_AP)
+                                if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
                                         continue;
-                                if (compare_ether_addr(sdata->dev->dev_addr,
+                                if (compare_ether_addr(tmp_sdata->dev->dev_addr,
                                                        hdr->addr2)) {
-                                        dev_hold(sdata->dev);
-                                        dev_put(odev);
-                                        osdata = sdata;
-                                        odev = osdata->dev;
-                                        skb->iif = sdata->dev->ifindex;
-                                        monitor_iface = FOUND_SDATA;
+                                        dev_hold(tmp_sdata->dev);
+                                        dev_put(sdata->dev);
+                                        sdata = tmp_sdata;
                                         break;
                                 }
                         }
@@ -1492,31 +1453,34 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
 
-        may_encrypt = !skb->do_not_encrypt;
+        may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
 
-        headroom = osdata->local->tx_headroom;
+        headroom = local->tx_headroom;
         if (may_encrypt)
                 headroom += IEEE80211_ENCRYPT_HEADROOM;
         headroom -= skb_headroom(skb);
         headroom = max_t(int, 0, headroom);
 
-        if (ieee80211_skb_resize(osdata->local, skb, headroom, may_encrypt)) {
+        if (ieee80211_skb_resize(local, skb, headroom, may_encrypt)) {
                 dev_kfree_skb(skb);
-                dev_put(odev);
-                return NETDEV_TX_OK;
+                dev_put(sdata->dev);
+                return;
         }
 
-        if (osdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                osdata = container_of(osdata->bss,
-                                      struct ieee80211_sub_if_data,
-                                      u.ap);
-        if (likely(monitor_iface != UNKNOWN_ADDRESS))
-                info->control.vif = &osdata->vif;
+        info->control.vif = &sdata->vif;
 
-        ieee80211_tx(odev, skb, false);
-        dev_put(odev);
+        if (ieee80211_vif_is_mesh(&sdata->vif) &&
+            ieee80211_is_data(hdr->frame_control) &&
+                !is_multicast_ether_addr(hdr->addr1))
+                        if (mesh_nexthop_lookup(skb, sdata)) {
+                                /* skb queued: don't free */
+                                dev_put(sdata->dev);
+                                return;
+                        }
 
-        return NETDEV_TX_OK;
+        ieee80211_select_queue(local, skb);
+        ieee80211_tx(sdata, skb, false);
+        dev_put(sdata->dev);
 }
 
 int ieee80211_monitor_start_xmit(struct sk_buff *skb,
@@ -1526,6 +1490,7 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
         struct ieee80211_channel *chan = local->hw.conf.channel;
         struct ieee80211_radiotap_header *prthdr =
                 (struct ieee80211_radiotap_header *)skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         u16 len_rthdr;
 
         /*
@@ -1563,15 +1528,6 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
         if (unlikely(skb->len < len_rthdr))
                 goto fail; /* skb too short for claimed rt header extent */
 
-        skb->dev = local->mdev;
-
-        /* needed because we set skb device to master */
-        skb->iif = dev->ifindex;
-
-        /* sometimes we do encrypt injected frames, will be fixed
-         * up in radiotap parser if not wanted */
-        skb->do_not_encrypt = 0;
-
         /*
          * fix up the pointers accounting for the radiotap
          * header still being in there.  We are being given
@@ -1586,8 +1542,10 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
         skb_set_network_header(skb, len_rthdr);
         skb_set_transport_header(skb, len_rthdr);
 
-        /* pass the radiotap header up to the next stage intact */
-        dev_queue_xmit(skb);
+        memset(info, 0, sizeof(*info));
+
+        /* pass the radiotap header up to xmit */
+        ieee80211_xmit(IEEE80211_DEV_TO_SUB_IF(dev), skb);
         return NETDEV_TX_OK;
 
 fail:
@@ -1615,6 +1573,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret = NETDEV_TX_BUSY, head_need;
         u16 ethertype, hdrlen,  meshhdrlen = 0;
         __le16 fc;
@@ -1627,7 +1586,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         u32 sta_flags = 0;
 
         if (unlikely(skb->len < ETH_HLEN)) {
-                ret = 0;
+                ret = NETDEV_TX_OK;
                 goto fail;
         }
 
@@ -1660,52 +1619,58 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
-                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
                         /* Do not send frames with mesh_ttl == 0 */
                         sdata->u.mesh.mshstats.dropped_frames_ttl++;
-                        ret = 0;
+                        ret = NETDEV_TX_OK;
                         goto fail;
                 }
-                memset(&mesh_hdr, 0, sizeof(mesh_hdr));
 
                 if (compare_ether_addr(dev->dev_addr,
                                           skb->data + ETH_ALEN) == 0) {
-                        /* RA TA DA SA */
-                        memset(hdr.addr1, 0, ETH_ALEN);
-                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
-                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
-                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
-                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata);
+                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
+                                        skb->data, skb->data + ETH_ALEN);
+                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
+                                        sdata, NULL, NULL, NULL);
                 } else {
                         /* packet from other interface */
                         struct mesh_path *mppath;
+                        int is_mesh_mcast = 1;
+                        char *mesh_da;
 
-                        memset(hdr.addr1, 0, ETH_ALEN);
-                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
-                        memcpy(hdr.addr4, dev->dev_addr, ETH_ALEN);
-
+                        rcu_read_lock();
                         if (is_multicast_ether_addr(skb->data))
-                                memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                                /* DA TA mSA AE:SA */
+                                mesh_da = skb->data;
                         else {
-                                rcu_read_lock();
                                 mppath = mpp_path_lookup(skb->data, sdata);
-                                if (mppath)
-                                        memcpy(hdr.addr3, mppath->mpp, ETH_ALEN);
-                                else
-                                        memset(hdr.addr3, 0xff, ETH_ALEN);
-                                rcu_read_unlock();
+                                if (mppath) {
+                                        /* RA TA mDA mSA AE:DA SA */
+                                        mesh_da = mppath->mpp;
+                                        is_mesh_mcast = 0;
+                                } else
+                                        /* DA TA mSA AE:SA */
+                                        mesh_da = dev->broadcast;
                         }
+                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
+                                        mesh_da, dev->dev_addr);
+                        rcu_read_unlock();
+                        if (is_mesh_mcast)
+                                meshhdrlen =
+                                        ieee80211_new_mesh_header(&mesh_hdr,
+                                                        sdata,
+                                                        skb->data + ETH_ALEN,
+                                                        NULL,
+                                                        NULL);
+                        else
+                                meshhdrlen =
+                                        ieee80211_new_mesh_header(&mesh_hdr,
+                                                        sdata,
+                                                        NULL,
+                                                        skb->data,
+                                                        skb->data + ETH_ALEN);
 
-                        mesh_hdr.flags |= MESH_FLAGS_AE_A5_A6;
-                        mesh_hdr.ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
-                        put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &mesh_hdr.seqnum);
-                        memcpy(mesh_hdr.eaddr1, skb->data, ETH_ALEN);
-                        memcpy(mesh_hdr.eaddr2, skb->data + ETH_ALEN, ETH_ALEN);
-                        sdata->u.mesh.mesh_seqnum++;
-                        meshhdrlen = 18;
                 }
-                hdrlen = 30;
                 break;
 #endif
         case NL80211_IFTYPE_STATION:
@@ -1724,7 +1689,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 hdrlen = 24;
                 break;
         default:
-                ret = 0;
+                ret = NETDEV_TX_OK;
                 goto fail;
         }
 
@@ -1766,7 +1731,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
 
                 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
 
-                ret = 0;
+                ret = NETDEV_TX_OK;
                 goto fail;
         }
 
@@ -1842,9 +1807,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         nh_pos += hdrlen;
         h_pos += hdrlen;
 
-        skb->iif = dev->ifindex;
-
-        skb->dev = local->mdev;
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
 
@@ -1855,13 +1817,15 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         skb_set_network_header(skb, nh_pos);
         skb_set_transport_header(skb, h_pos);
 
+        memset(info, 0, sizeof(*info));
+
         dev->trans_start = jiffies;
-        dev_queue_xmit(skb);
+        ieee80211_xmit(sdata, skb);
 
-        return 0;
+        return NETDEV_TX_OK;
 
  fail:
-        if (!ret)
+        if (ret == NETDEV_TX_OK)
                 dev_kfree_skb(skb);
 
         return ret;
@@ -1887,101 +1851,74 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
         struct ieee80211_hdr *hdr;
-        struct net_device *dev;
         int ret;
         bool result = true;
 
-        /* does interface still exist? */
-        dev = dev_get_by_index(&init_net, skb->iif);
-        if (!dev) {
-                dev_kfree_skb(skb);
-                return true;
-        }
-
-        /* validate info->control.vif against skb->iif */
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                sdata = container_of(sdata->bss,
-                                     struct ieee80211_sub_if_data,
-                                     u.ap);
-
-        if (unlikely(info->control.vif && info->control.vif != &sdata->vif)) {
-                dev_kfree_skb(skb);
-                result = true;
-                goto out;
-        }
+        sdata = vif_to_sdata(info->control.vif);
 
         if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
-                ieee80211_tx(dev, skb, true);
+                ieee80211_tx(sdata, skb, true);
         } else {
                 hdr = (struct ieee80211_hdr *)skb->data;
                 sta = sta_info_get(local, hdr->addr1);
 
-                ret = __ieee80211_tx(local, &skb, sta);
+                ret = __ieee80211_tx(local, &skb, sta, true);
                 if (ret != IEEE80211_TX_OK)
                         result = false;
         }
 
- out:
-        dev_put(dev);
-
         return result;
 }
 
 /*
- * Transmit all pending packets. Called from tasklet, locks master device
- * TX lock so that no new packets can come in.
+ * Transmit all pending packets. Called from tasklet.
  */
 void ieee80211_tx_pending(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *)data;
-        struct net_device *dev = local->mdev;
         unsigned long flags;
         int i;
-        bool next;
+        bool txok;
 
         rcu_read_lock();
-        netif_tx_lock_bh(dev);
 
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
         for (i = 0; i < local->hw.queues; i++) {
                 /*
                  * If queue is stopped by something other than due to pending
                  * frames, or we have no pending frames, proceed to next queue.
                  */
-                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                next = false;
-                if (local->queue_stop_reasons[i] !=
-                        BIT(IEEE80211_QUEUE_STOP_REASON_PENDING) ||
+                if (local->queue_stop_reasons[i] ||
                     skb_queue_empty(&local->pending[i]))
-                        next = true;
-                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-
-                if (next)
                         continue;
 
-                /*
-                 * start the queue now to allow processing our packets,
-                 * we're under the tx lock here anyway so nothing will
-                 * happen as a result of this
-                 */
-                netif_start_subqueue(local->mdev, i);
-
                 while (!skb_queue_empty(&local->pending[i])) {
-                        struct sk_buff *skb = skb_dequeue(&local->pending[i]);
+                        struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                        struct ieee80211_sub_if_data *sdata;
 
-                        if (!ieee80211_tx_pending_skb(local, skb)) {
-                                skb_queue_head(&local->pending[i], skb);
-                                break;
+                        if (WARN_ON(!info->control.vif)) {
+                                kfree_skb(skb);
+                                continue;
                         }
-                }
 
-                /* Start regular packet processing again. */
-                if (skb_queue_empty(&local->pending[i]))
-                        ieee80211_wake_queue_by_reason(&local->hw, i,
-                                        IEEE80211_QUEUE_STOP_REASON_PENDING);
+                        sdata = vif_to_sdata(info->control.vif);
+                        dev_hold(sdata->dev);
+                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
+                                                flags);
+
+                        txok = ieee80211_tx_pending_skb(local, skb);
+                        dev_put(sdata->dev);
+                        if (!txok)
+                                __skb_queue_head(&local->pending[i], skb);
+                        spin_lock_irqsave(&local->queue_stop_reason_lock,
+                                          flags);
+                        if (!txok)
+                                break;
+                }
         }
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
-        netif_tx_unlock_bh(dev);
         rcu_read_unlock();
 }
 
@@ -2156,8 +2093,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 
         info = IEEE80211_SKB_CB(skb);
 
-        skb->do_not_encrypt = 1;
-
+        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         info->band = band;
         /*
          * XXX: For now, always use the lowest rate
@@ -2228,9 +2164,6 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         sdata = vif_to_sdata(vif);
         bss = &sdata->u.ap;
 
-        if (!bss)
-                return NULL;
-
         rcu_read_lock();
         beacon = rcu_dereference(bss->beacon);
 
@@ -2256,7 +2189,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
-                if (!ieee80211_tx_prepare(local, &tx, skb))
+                if (!ieee80211_tx_prepare(sdata, &tx, skb))
                         break;
                 dev_kfree_skb_any(skb);
         }
@@ -2276,3 +2209,24 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         return skb;
 }
 EXPORT_SYMBOL(ieee80211_get_buffered_bc);
+
+void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                      int encrypt)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        skb_set_mac_header(skb, 0);
+        skb_set_network_header(skb, 0);
+        skb_set_transport_header(skb, 0);
+
+        if (!encrypt)
+                info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+
+        /*
+         * The other path calling ieee80211_xmit is from the tasklet,
+         * and while we can handle concurrent transmissions locking
+         * requirements are that we do not come into tx with bhs on.
+         */
+        local_bh_disable();
+        ieee80211_xmit(sdata, skb);
+        local_bh_enable();
+}
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 915e77769312..e55d57f559ec 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -31,6 +31,7 @@
 #include "mesh.h"
 #include "wme.h"
 #include "led.h"
+#include "wep.h"
 
 /* privid for wiphys to determine whether they belong to us or not */
 void *mac80211_wiphy_privid = &mac80211_wiphy_privid;
@@ -274,16 +275,12 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 
         __clear_bit(reason, &local->queue_stop_reasons[queue]);
 
-        if (!skb_queue_empty(&local->pending[queue]) &&
-            local->queue_stop_reasons[queue] ==
-                                BIT(IEEE80211_QUEUE_STOP_REASON_PENDING))
-                tasklet_schedule(&local->tx_pending_tasklet);
-
         if (local->queue_stop_reasons[queue] != 0)
                 /* someone still has this queue stopped */
                 return;
 
-        netif_wake_subqueue(local->mdev, queue);
+        if (!skb_queue_empty(&local->pending[queue]))
+                tasklet_schedule(&local->tx_pending_tasklet);
 }
 
 void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
@@ -312,14 +309,6 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
         if (WARN_ON(queue >= hw->queues))
                 return;
 
-        /*
-         * Only stop if it was previously running, this is necessary
-         * for correct pending packets handling because there we may
-         * start (but not wake) the queue and rely on that.
-         */
-        if (!local->queue_stop_reasons[queue])
-                netif_stop_subqueue(local->mdev, queue);
-
         __set_bit(reason, &local->queue_stop_reasons[queue]);
 }
 
@@ -347,11 +336,16 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         struct ieee80211_hw *hw = &local->hw;
         unsigned long flags;
         int queue = skb_get_queue_mapping(skb);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        if (WARN_ON(!info->control.vif)) {
+                kfree(skb);
+                return;
+        }
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
         __ieee80211_stop_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
-        __ieee80211_stop_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_PENDING);
-        skb_queue_tail(&local->pending[queue], skb);
+        __skb_queue_tail(&local->pending[queue], skb);
         __ieee80211_wake_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
@@ -370,18 +364,21 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
 
         while ((skb = skb_dequeue(skbs))) {
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+                if (WARN_ON(!info->control.vif)) {
+                        kfree(skb);
+                        continue;
+                }
+
                 ret++;
                 queue = skb_get_queue_mapping(skb);
-                skb_queue_tail(&local->pending[queue], skb);
+                __skb_queue_tail(&local->pending[queue], skb);
         }
 
-        for (i = 0; i < hw->queues; i++) {
-                if (ret)
-                        __ieee80211_stop_queue(hw, i,
-                                IEEE80211_QUEUE_STOP_REASON_PENDING);
+        for (i = 0; i < hw->queues; i++)
                 __ieee80211_wake_queue(hw, i,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
-        }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
         return ret;
@@ -412,11 +409,16 @@ EXPORT_SYMBOL(ieee80211_stop_queues);
 int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+        unsigned long flags;
+        int ret;
 
         if (WARN_ON(queue >= hw->queues))
                 return true;
 
-        return __netif_subqueue_stopped(local->mdev, queue);
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+        ret = !!local->queue_stop_reasons[queue];
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+        return ret;
 }
 EXPORT_SYMBOL(ieee80211_queue_stopped);
 
@@ -509,6 +511,46 @@ void ieee80211_iterate_active_interfaces_atomic(
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
 
+/*
+ * Nothing should have been stuffed into the workqueue during
+ * the suspend->resume cycle. If this WARN is seen then there
+ * is a bug with either the driver suspend or something in
+ * mac80211 stuffing into the workqueue which we haven't yet
+ * cleared during mac80211's suspend cycle.
+ */
+static bool ieee80211_can_queue_work(struct ieee80211_local *local)
+{
+        if (WARN(local->suspended, "queueing ieee80211 work while "
+                 "going to suspend\n"))
+                return false;
+
+        return true;
+}
+
+void ieee80211_queue_work(struct ieee80211_hw *hw, struct work_struct *work)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        if (!ieee80211_can_queue_work(local))
+                return;
+
+        queue_work(local->workqueue, work);
+}
+EXPORT_SYMBOL(ieee80211_queue_work);
+
+void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
+                                  struct delayed_work *dwork,
+                                  unsigned long delay)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        if (!ieee80211_can_queue_work(local))
+                return;
+
+        queue_delayed_work(local->workqueue, dwork, delay);
+}
+EXPORT_SYMBOL(ieee80211_queue_delayed_work);
+
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems)
 {
@@ -760,20 +802,6 @@ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
         ieee80211_set_wmm_default(sdata);
 }
 
-void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                      int encrypt)
-{
-        skb->dev = sdata->local->mdev;
-        skb_set_mac_header(skb, 0);
-        skb_set_network_header(skb, 0);
-        skb_set_transport_header(skb, 0);
-
-        skb->iif = sdata->dev->ifindex;
-        skb->do_not_encrypt = !encrypt;
-
-        dev_queue_xmit(skb);
-}
-
 u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
                               enum ieee80211_band band)
 {
@@ -804,12 +832,13 @@ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
-                         u8 *extra, size_t extra_len,
-                         const u8 *bssid, int encrypt)
+                         u8 *extra, size_t extra_len, const u8 *bssid,
+                         const u8 *key, u8 key_len, u8 key_idx)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
+        int err;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
                             sizeof(*mgmt) + 6 + extra_len);
@@ -824,8 +853,6 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         memset(mgmt, 0, 24 + 6);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_AUTH);
-        if (encrypt)
-                mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
         memcpy(mgmt->da, bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(mgmt->bssid, bssid, ETH_ALEN);
@@ -835,7 +862,13 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         if (extra)
                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 
-        ieee80211_tx_skb(sdata, skb, encrypt);
+        if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
+                mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+                err = ieee80211_wep_encrypt(local, skb, key, key_len, key_idx);
+                WARN_ON(err);
+        }
+
+        ieee80211_tx_skb(sdata, skb, 0);
 }
 
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
@@ -1043,9 +1076,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         /* reconfigure hardware */
         ieee80211_hw_config(local, ~0);
 
-        netif_addr_lock_bh(local->mdev);
+        spin_lock_bh(&local->filter_lock);
         ieee80211_configure_filter(local);
-        netif_addr_unlock_bh(local->mdev);
+        spin_unlock_bh(&local->filter_lock);
 
         /* Finally also reconfigure all the BSS information */
         list_for_each_entry(sdata, &local->interfaces, list) {
@@ -1121,3 +1154,4 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 #endif
         return 0;
 }
+
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index ef73105b3061..8a980f136941 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -67,10 +67,10 @@ static inline bool ieee80211_wep_weak_iv(u32 iv, int keylen)
 
 
 static void ieee80211_wep_get_iv(struct ieee80211_local *local,
-                                 struct ieee80211_key *key, u8 *iv)
+                                 int keylen, int keyidx, u8 *iv)
 {
         local->wep_iv++;
-        if (ieee80211_wep_weak_iv(local->wep_iv, key->conf.keylen))
+        if (ieee80211_wep_weak_iv(local->wep_iv, keylen))
                 local->wep_iv += 0x0100;
 
         if (!iv)
@@ -79,13 +79,13 @@ static void ieee80211_wep_get_iv(struct ieee80211_local *local,
         *iv++ = (local->wep_iv >> 16) & 0xff;
         *iv++ = (local->wep_iv >> 8) & 0xff;
         *iv++ = local->wep_iv & 0xff;
-        *iv++ = key->conf.keyidx << 6;
+        *iv++ = keyidx << 6;
 }
 
 
 static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
                                 struct sk_buff *skb,
-                                struct ieee80211_key *key)
+                                int keylen, int keyidx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         unsigned int hdrlen;
@@ -100,7 +100,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         newhdr = skb_push(skb, WEP_IV_LEN);
         memmove(newhdr, newhdr + WEP_IV_LEN, hdrlen);
-        ieee80211_wep_get_iv(local, key, newhdr + hdrlen);
+        ieee80211_wep_get_iv(local, keylen, keyidx, newhdr + hdrlen);
         return newhdr + hdrlen;
 }
 
@@ -144,26 +144,17 @@ void ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
  *
  * WEP frame payload: IV + TX key idx, RC4(data), ICV = RC4(CRC32(data))
  */
-int ieee80211_wep_encrypt(struct ieee80211_local *local, struct sk_buff *skb,
-                          struct ieee80211_key *key)
+int ieee80211_wep_encrypt(struct ieee80211_local *local,
+                          struct sk_buff *skb,
+                          const u8 *key, int keylen, int keyidx)
 {
-        u32 klen;
-        u8 *rc4key, *iv;
+        u8 *iv;
         size_t len;
+        u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
 
-        if (!key || key->conf.alg != ALG_WEP)
-                return -1;
-
-        klen = 3 + key->conf.keylen;
-        rc4key = kmalloc(klen, GFP_ATOMIC);
-        if (!rc4key)
-                return -1;
-
-        iv = ieee80211_wep_add_iv(local, skb, key);
-        if (!iv) {
-                kfree(rc4key);
+        iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
+        if (!iv)
                 return -1;
-        }
 
         len = skb->len - (iv + WEP_IV_LEN - skb->data);
 
@@ -171,16 +162,14 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, struct sk_buff *skb,
         memcpy(rc4key, iv, 3);
 
         /* Copy rest of the WEP key (the secret part) */
-        memcpy(rc4key + 3, key->conf.key, key->conf.keylen);
+        memcpy(rc4key + 3, key, keylen);
 
         /* Add room for ICV */
         skb_put(skb, WEP_ICV_LEN);
 
-        ieee80211_wep_encrypt_data(local->wep_tx_tfm, rc4key, klen,
+        ieee80211_wep_encrypt_data(local->wep_tx_tfm, rc4key, keylen + 3,
                                    iv + WEP_IV_LEN, len);
 
-        kfree(rc4key);
-
         return 0;
 }
 
@@ -216,8 +205,9 @@ int ieee80211_wep_decrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
  * failure. If frame is OK, IV and ICV will be removed, i.e., decrypted payload
  * is moved to the beginning of the skb and skb length will be reduced.
  */
-int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
-                          struct ieee80211_key *key)
+static int ieee80211_wep_decrypt(struct ieee80211_local *local,
+                                 struct sk_buff *skb,
+                                 struct ieee80211_key *key)
 {
         u32 klen;
         u8 *rc4key;
@@ -314,12 +304,16 @@ static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
-                if (ieee80211_wep_encrypt(tx->local, skb, tx->key))
+                if (ieee80211_wep_encrypt(tx->local, skb, tx->key->conf.key,
+                                          tx->key->conf.keylen,
+                                          tx->key->conf.keyidx))
                         return -1;
         } else {
                 info->control.hw_key = &tx->key->conf;
                 if (tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) {
-                        if (!ieee80211_wep_add_iv(tx->local, skb, tx->key))
+                        if (!ieee80211_wep_add_iv(tx->local, skb,
+                                                  tx->key->conf.keylen,
+                                                  tx->key->conf.keyidx))
                                 return -1;
                 }
         }
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index d3f0db48314e..fe29d7e5759f 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -20,12 +20,11 @@ int ieee80211_wep_init(struct ieee80211_local *local);
 void ieee80211_wep_free(struct ieee80211_local *local);
 void ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
                                 size_t klen, u8 *data, size_t data_len);
+int ieee80211_wep_encrypt(struct ieee80211_local *local,
+                          struct sk_buff *skb,
+                          const u8 *key, int keylen, int keyidx);
 int ieee80211_wep_decrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
                                size_t klen, u8 *data, size_t data_len);
-int ieee80211_wep_encrypt(struct ieee80211_local *local, struct sk_buff *skb,
-                          struct ieee80211_key *key);
-int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
-                          struct ieee80211_key *key);
 bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
 
 ieee80211_rx_result
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
deleted file mode 100644
index 1da81f456744..000000000000
--- a/net/mac80211/wext.c
+++ /dev/null
@@ -1,633 +0,0 @@
-/*
- * Copyright 2002-2005, Instant802 Networks, Inc.
- * Copyright 2005-2006, Devicescape Software, Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/netdevice.h>
-#include <linux/types.h>
-#include <linux/slab.h>
-#include <linux/skbuff.h>
-#include <linux/etherdevice.h>
-#include <linux/if_arp.h>
-#include <linux/wireless.h>
-#include <net/iw_handler.h>
-#include <asm/uaccess.h>
-
-#include <net/mac80211.h>
-#include "ieee80211_i.h"
-#include "led.h"
-#include "rate.h"
-#include "wpa.h"
-#include "aes_ccm.h"
-
-
-static int ieee80211_ioctl_siwgenie(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_point *data, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                int ret = ieee80211_sta_set_extra_ie(sdata, extra, data->length);
-                if (ret && ret != -EALREADY)
-                        return ret;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
-                if (ret != -EALREADY)
-                        ieee80211_sta_req_auth(sdata);
-                return 0;
-        }
-
-        return -EOPNOTSUPP;
-}
-
-static int ieee80211_ioctl_siwfreq(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_freq *freq, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_channel *chan;
-
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return cfg80211_ibss_wext_siwfreq(dev, info, freq, extra);
-        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
-
-        /* freq->e == 0: freq->m = channel; otherwise freq = m * 10^e */
-        if (freq->e == 0) {
-                if (freq->m < 0) {
-                        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                                sdata->u.mgd.flags |=
-                                        IEEE80211_STA_AUTO_CHANNEL_SEL;
-                        return 0;
-                } else
-                        chan = ieee80211_get_channel(local->hw.wiphy,
-                                ieee80211_channel_to_frequency(freq->m));
-        } else {
-                int i, div = 1000000;
-                for (i = 0; i < freq->e; i++)
-                        div /= 10;
-                if (div <= 0)
-                        return -EINVAL;
-                chan = ieee80211_get_channel(local->hw.wiphy, freq->m / div);
-        }
-
-        if (!chan)
-                return -EINVAL;
-
-        if (chan->flags & IEEE80211_CHAN_DISABLED)
-                return -EINVAL;
-
-        /*
-         * no change except maybe auto -> fixed, ignore the HT
-         * setting so you can fix a channel you're on already
-         */
-        if (local->oper_channel == chan)
-                return 0;
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                ieee80211_sta_req_auth(sdata);
-
-        local->oper_channel = chan;
-        local->oper_channel_type = NL80211_CHAN_NO_HT;
-        ieee80211_hw_config(local, 0);
-
-        return 0;
-}
-
-
-static int ieee80211_ioctl_giwfreq(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_freq *freq, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return cfg80211_ibss_wext_giwfreq(dev, info, freq, extra);
-
-        freq->m = local->oper_channel->center_freq;
-        freq->e = 6;
-
-        return 0;
-}
-
-
-static int ieee80211_ioctl_siwessid(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_point *data, char *ssid)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        size_t len = data->length;
-        int ret;
-
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return cfg80211_ibss_wext_siwessid(dev, info, data, ssid);
-
-        /* iwconfig uses nul termination in SSID.. */
-        if (len > 0 && ssid[len - 1] == '\0')
-                len--;
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                if (data->flags)
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
-                else
-                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_SSID_SEL;
-
-                ret = ieee80211_sta_set_ssid(sdata, ssid, len);
-                if (ret)
-                        return ret;
-
-                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
-                ieee80211_sta_req_auth(sdata);
-                return 0;
-        }
-
-        return -EOPNOTSUPP;
-}
-
-
-static int ieee80211_ioctl_giwessid(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_point *data, char *ssid)
-{
-        size_t len;
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                int res = ieee80211_sta_get_ssid(sdata, ssid, &len);
-                if (res == 0) {
-                        data->length = len;
-                        data->flags = 1;
-                } else
-                        data->flags = 0;
-                return res;
-        }
-
-        return -EOPNOTSUPP;
-}
-
-
-static int ieee80211_ioctl_siwap(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 struct sockaddr *ap_addr, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return cfg80211_ibss_wext_siwap(dev, info, ap_addr, extra);
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                int ret;
-
-                if (is_zero_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_BSSID_SEL |
-                                IEEE80211_STA_AUTO_CHANNEL_SEL;
-                else if (is_broadcast_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_BSSID_SEL;
-                else
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-                ret = ieee80211_sta_set_bssid(sdata, (u8 *) &ap_addr->sa_data);
-                if (ret)
-                        return ret;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
-                ieee80211_sta_req_auth(sdata);
-                return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
-                /*
-                 * If it is necessary to update the WDS peer address
-                 * while the interface is running, then we need to do
-                 * more work here, namely if it is running we need to
-                 * add a new and remove the old STA entry, this is
-                 * normally handled by _open() and _stop().
-                 */
-                if (netif_running(dev))
-                        return -EBUSY;
-
-                memcpy(&sdata->u.wds.remote_addr, (u8 *) &ap_addr->sa_data,
-                       ETH_ALEN);
-
-                return 0;
-        }
-
-        return -EOPNOTSUPP;
-}
-
-
-static int ieee80211_ioctl_giwap(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 struct sockaddr *ap_addr, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return cfg80211_ibss_wext_giwap(dev, info, ap_addr, extra);
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATED) {
-                        ap_addr->sa_family = ARPHRD_ETHER;
-                        memcpy(&ap_addr->sa_data, sdata->u.mgd.bssid, ETH_ALEN);
-                } else
-                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
-                return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
-                ap_addr->sa_family = ARPHRD_ETHER;
-                memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
-                return 0;
-        }
-
-        return -EOPNOTSUPP;
-}
-
-
-static int ieee80211_ioctl_siwrate(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  struct iw_param *rate, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int i, err = -EINVAL;
-        u32 target_rate = rate->value / 100000;
-        struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_supported_band *sband;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        /* target_rate = -1, rate->fixed = 0 means auto only, so use all rates
-         * target_rate = X, rate->fixed = 1 means only rate X
-         * target_rate = X, rate->fixed = 0 means all rates <= X */
-        sdata->max_ratectrl_rateidx = -1;
-        sdata->force_unicast_rateidx = -1;
-        if (rate->value < 0)
-                return 0;
-
-        for (i=0; i< sband->n_bitrates; i++) {
-                struct ieee80211_rate *brate = &sband->bitrates[i];
-                int this_rate = brate->bitrate;
-
-                if (target_rate == this_rate) {
-                        sdata->max_ratectrl_rateidx = i;
-                        if (rate->fixed)
-                                sdata->force_unicast_rateidx = i;
-                        err = 0;
-                        break;
-                }
-        }
-        return err;
-}
-
-static int ieee80211_ioctl_giwrate(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  struct iw_param *rate, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_supported_band *sband;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EOPNOTSUPP;
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, sdata->u.mgd.bssid);
-
-        if (sta && !(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS))
-                rate->value = sband->bitrates[sta->last_tx_rate.idx].bitrate;
-        else
-                rate->value = 0;
-
-        rcu_read_unlock();
-
-        if (!sta)
-                return -ENODEV;
-
-        rate->value *= 100000;
-
-        return 0;
-}
-
-static int ieee80211_ioctl_siwpower(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_param *wrq,
-                                    char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_conf *conf = &local->hw.conf;
-        int timeout = 0;
-        bool ps;
-
-        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
-                return -EOPNOTSUPP;
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EINVAL;
-
-        if (wrq->disabled) {
-                ps = false;
-                timeout = 0;
-                goto set;
-        }
-
-        switch (wrq->flags & IW_POWER_MODE) {
-        case IW_POWER_ON:       /* If not specified */
-        case IW_POWER_MODE:     /* If set all mask */
-        case IW_POWER_ALL_R:    /* If explicitely state all */
-                ps = true;
-                break;
-        default:                /* Otherwise we ignore */
-                return -EINVAL;
-        }
-
-        if (wrq->flags & ~(IW_POWER_MODE | IW_POWER_TIMEOUT))
-                return -EINVAL;
-
-        if (wrq->flags & IW_POWER_TIMEOUT)
-                timeout = wrq->value / 1000;
-
- set:
-        if (ps == sdata->u.mgd.powersave && timeout == conf->dynamic_ps_timeout)
-                return 0;
-
-        sdata->u.mgd.powersave = ps;
-        conf->dynamic_ps_timeout = timeout;
-
-        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-
-        ieee80211_recalc_ps(local, -1);
-
-        return 0;
-}
-
-static int ieee80211_ioctl_giwpower(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    union iwreq_data *wrqu,
-                                    char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        wrqu->power.disabled = !sdata->u.mgd.powersave;
-
-        return 0;
-}
-
-static int ieee80211_ioctl_siwauth(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_param *data, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        int ret = 0;
-
-        switch (data->flags & IW_AUTH_INDEX) {
-        case IW_AUTH_WPA_VERSION:
-        case IW_AUTH_CIPHER_GROUP:
-        case IW_AUTH_WPA_ENABLED:
-        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-        case IW_AUTH_KEY_MGMT:
-        case IW_AUTH_CIPHER_GROUP_MGMT:
-                break;
-        case IW_AUTH_CIPHER_PAIRWISE:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (data->value & (IW_AUTH_CIPHER_WEP40 |
-                            IW_AUTH_CIPHER_WEP104 | IW_AUTH_CIPHER_TKIP))
-                                sdata->u.mgd.flags |=
-                                        IEEE80211_STA_TKIP_WEP_USED;
-                        else
-                                sdata->u.mgd.flags &=
-                                        ~IEEE80211_STA_TKIP_WEP_USED;
-                }
-                break;
-        case IW_AUTH_DROP_UNENCRYPTED:
-                sdata->drop_unencrypted = !!data->value;
-                break;
-        case IW_AUTH_PRIVACY_INVOKED:
-                if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        ret = -EINVAL;
-                else {
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
-                        /*
-                         * Privacy invoked by wpa_supplicant, store the
-                         * value and allow associating to a protected
-                         * network without having a key up front.
-                         */
-                        if (data->value)
-                                sdata->u.mgd.flags |=
-                                        IEEE80211_STA_PRIVACY_INVOKED;
-                }
-                break;
-        case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                        sdata->u.mgd.auth_algs = data->value;
-                else
-                        ret = -EOPNOTSUPP;
-                break;
-        case IW_AUTH_MFP:
-                if (!(sdata->local->hw.flags & IEEE80211_HW_MFP_CAPABLE)) {
-                        ret = -EOPNOTSUPP;
-                        break;
-                }
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        switch (data->value) {
-                        case IW_AUTH_MFP_DISABLED:
-                                sdata->u.mgd.mfp = IEEE80211_MFP_DISABLED;
-                                break;
-                        case IW_AUTH_MFP_OPTIONAL:
-                                sdata->u.mgd.mfp = IEEE80211_MFP_OPTIONAL;
-                                break;
-                        case IW_AUTH_MFP_REQUIRED:
-                                sdata->u.mgd.mfp = IEEE80211_MFP_REQUIRED;
-                                break;
-                        default:
-                                ret = -EINVAL;
-                        }
-                } else
-                        ret = -EOPNOTSUPP;
-                break;
-        default:
-                ret = -EOPNOTSUPP;
-                break;
-        }
-        return ret;
-}
-
-/* Get wireless statistics.  Called by /proc/net/wireless and by SIOCGIWSTATS */
-static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct iw_statistics *wstats = &local->wstats;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct sta_info *sta = NULL;
-
-        rcu_read_lock();
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                sta = sta_info_get(local, sdata->u.mgd.bssid);
-
-        if (!sta) {
-                wstats->discard.fragment = 0;
-                wstats->discard.misc = 0;
-                wstats->qual.qual = 0;
-                wstats->qual.level = 0;
-                wstats->qual.noise = 0;
-                wstats->qual.updated = IW_QUAL_ALL_INVALID;
-        } else {
-                wstats->qual.updated = 0;
-                /*
-                 * mirror what cfg80211 does for iwrange/scan results,
-                 * otherwise userspace gets confused.
-                 */
-                if (local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
-                                       IEEE80211_HW_SIGNAL_DBM)) {
-                        wstats->qual.updated |= IW_QUAL_LEVEL_UPDATED;
-                        wstats->qual.updated |= IW_QUAL_QUAL_UPDATED;
-                } else {
-                        wstats->qual.updated |= IW_QUAL_LEVEL_INVALID;
-                        wstats->qual.updated |= IW_QUAL_QUAL_INVALID;
-                }
-
-                if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC) {
-                        wstats->qual.level = sta->last_signal;
-                        wstats->qual.qual = sta->last_signal;
-                } else if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
-                        int sig = sta->last_signal;
-
-                        wstats->qual.updated |= IW_QUAL_DBM;
-                        wstats->qual.level = sig;
-                        if (sig < -110)
-                                sig = -110;
-                        else if (sig > -40)
-                                sig = -40;
-                        wstats->qual.qual = sig + 110;
-                }
-
-                if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
-                        /*
-                         * This assumes that if driver reports noise, it also
-                         * reports signal in dBm.
-                         */
-                        wstats->qual.noise = sta->last_noise;
-                        wstats->qual.updated |= IW_QUAL_NOISE_UPDATED;
-                } else {
-                        wstats->qual.updated |= IW_QUAL_NOISE_INVALID;
-                }
-        }
-
-        rcu_read_unlock();
-
-        return wstats;
-}
-
-static int ieee80211_ioctl_giwauth(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_param *data, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        int ret = 0;
-
-        switch (data->flags & IW_AUTH_INDEX) {
-        case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                        data->value = sdata->u.mgd.auth_algs;
-                else
-                        ret = -EOPNOTSUPP;
-                break;
-        default:
-                ret = -EOPNOTSUPP;
-                break;
-        }
-        return ret;
-}
-
-
-/* Structures to export the Wireless Handlers */
-
-static const iw_handler ieee80211_handler[] =
-{
-        (iw_handler) NULL,                              /* SIOCSIWCOMMIT */
-        (iw_handler) cfg80211_wext_giwname,             /* SIOCGIWNAME */
-        (iw_handler) NULL,                              /* SIOCSIWNWID */
-        (iw_handler) NULL,                              /* SIOCGIWNWID */
-        (iw_handler) ieee80211_ioctl_siwfreq,           /* SIOCSIWFREQ */
-        (iw_handler) ieee80211_ioctl_giwfreq,           /* SIOCGIWFREQ */
-        (iw_handler) cfg80211_wext_siwmode,             /* SIOCSIWMODE */
-        (iw_handler) cfg80211_wext_giwmode,             /* SIOCGIWMODE */
-        (iw_handler) NULL,                              /* SIOCSIWSENS */
-        (iw_handler) NULL,                              /* SIOCGIWSENS */
-        (iw_handler) NULL /* not used */,               /* SIOCSIWRANGE */
-        (iw_handler) cfg80211_wext_giwrange,            /* SIOCGIWRANGE */
-        (iw_handler) NULL /* not used */,               /* SIOCSIWPRIV */
-        (iw_handler) NULL /* kernel code */,            /* SIOCGIWPRIV */
-        (iw_handler) NULL /* not used */,               /* SIOCSIWSTATS */
-        (iw_handler) NULL /* kernel code */,            /* SIOCGIWSTATS */
-        (iw_handler) NULL,                              /* SIOCSIWSPY */
-        (iw_handler) NULL,                              /* SIOCGIWSPY */
-        (iw_handler) NULL,                              /* SIOCSIWTHRSPY */
-        (iw_handler) NULL,                              /* SIOCGIWTHRSPY */
-        (iw_handler) ieee80211_ioctl_siwap,             /* SIOCSIWAP */
-        (iw_handler) ieee80211_ioctl_giwap,             /* SIOCGIWAP */
-        (iw_handler) cfg80211_wext_siwmlme,             /* SIOCSIWMLME */
-        (iw_handler) NULL,                              /* SIOCGIWAPLIST */
-        (iw_handler) cfg80211_wext_siwscan,             /* SIOCSIWSCAN */
-        (iw_handler) cfg80211_wext_giwscan,             /* SIOCGIWSCAN */
-        (iw_handler) ieee80211_ioctl_siwessid,          /* SIOCSIWESSID */
-        (iw_handler) ieee80211_ioctl_giwessid,          /* SIOCGIWESSID */
-        (iw_handler) NULL,                              /* SIOCSIWNICKN */
-        (iw_handler) NULL,                              /* SIOCGIWNICKN */
-        (iw_handler) NULL,                              /* -- hole -- */
-        (iw_handler) NULL,                              /* -- hole -- */
-        (iw_handler) ieee80211_ioctl_siwrate,           /* SIOCSIWRATE */
-        (iw_handler) ieee80211_ioctl_giwrate,           /* SIOCGIWRATE */
-        (iw_handler) cfg80211_wext_siwrts,              /* SIOCSIWRTS */
-        (iw_handler) cfg80211_wext_giwrts,              /* SIOCGIWRTS */
-        (iw_handler) cfg80211_wext_siwfrag,             /* SIOCSIWFRAG */
-        (iw_handler) cfg80211_wext_giwfrag,             /* SIOCGIWFRAG */
-        (iw_handler) cfg80211_wext_siwtxpower,          /* SIOCSIWTXPOW */
-        (iw_handler) cfg80211_wext_giwtxpower,          /* SIOCGIWTXPOW */
-        (iw_handler) cfg80211_wext_siwretry,            /* SIOCSIWRETRY */
-        (iw_handler) cfg80211_wext_giwretry,            /* SIOCGIWRETRY */
-        (iw_handler) cfg80211_wext_siwencode,           /* SIOCSIWENCODE */
-        (iw_handler) cfg80211_wext_giwencode,           /* SIOCGIWENCODE */
-        (iw_handler) ieee80211_ioctl_siwpower,          /* SIOCSIWPOWER */
-        (iw_handler) ieee80211_ioctl_giwpower,          /* SIOCGIWPOWER */
-        (iw_handler) NULL,                              /* -- hole -- */
-        (iw_handler) NULL,                              /* -- hole -- */
-        (iw_handler) ieee80211_ioctl_siwgenie,          /* SIOCSIWGENIE */
-        (iw_handler) NULL,                              /* SIOCGIWGENIE */
-        (iw_handler) ieee80211_ioctl_siwauth,           /* SIOCSIWAUTH */
-        (iw_handler) ieee80211_ioctl_giwauth,           /* SIOCGIWAUTH */
-        (iw_handler) cfg80211_wext_siwencodeext,        /* SIOCSIWENCODEEXT */
-        (iw_handler) NULL,                              /* SIOCGIWENCODEEXT */
-        (iw_handler) NULL,                              /* SIOCSIWPMKSA */
-        (iw_handler) NULL,                              /* -- hole -- */
-};
-
-const struct iw_handler_def ieee80211_iw_handler_def =
-{
-        .num_standard   = ARRAY_SIZE(ieee80211_handler),
-        .standard       = (iw_handler *) ieee80211_handler,
-        .get_wireless_stats = ieee80211_get_wireless_stats,
-};
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 116a923b14d6..b19b7696f3a2 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -85,10 +85,8 @@ static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
         return ieee802_1d_to_ac[skb->priority];
 }
 
-u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
+void ieee80211_select_queue(struct ieee80211_local *local, struct sk_buff *skb)
 {
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         u16 queue;
         u8 tid;
@@ -113,5 +111,5 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
                 *p = 0;
         }
 
-        return queue;
+        skb_set_queue_mapping(skb, queue);
 }
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 7520d2e014dc..d4fd87ca5118 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -20,6 +20,7 @@
 
 extern const int ieee802_1d_to_ac[8];
 
-u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb);
+void ieee80211_select_queue(struct ieee80211_local *local,
+                            struct sk_buff *skb);
 
 #endif /* _WME_H */
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index dcfae8884b86..70778694877b 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -122,7 +122,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
                         return RX_DROP_UNUSABLE;
 
                 mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
-                                                (void *) skb->data, NULL);
+                                                (void *) skb->data, NULL,
+                                                GFP_ATOMIC);
                 return RX_DROP_UNUSABLE;
         }
 
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 201b8ea3020d..3c7e42735b60 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -18,6 +18,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
@@ -262,12 +265,12 @@ static inline void vs_fix_seq(const struct ip_vs_seq *vseq, struct tcphdr *th)
         if (vseq->delta || vseq->previous_delta) {
                 if(after(seq, vseq->init_seq)) {
                         th->seq = htonl(seq + vseq->delta);
-                        IP_VS_DBG(9, "vs_fix_seq(): added delta (%d) to seq\n",
-                                  vseq->delta);
+                        IP_VS_DBG(9, "%s(): added delta (%d) to seq\n",
+                                  __func__, vseq->delta);
                 } else {
                         th->seq = htonl(seq + vseq->previous_delta);
-                        IP_VS_DBG(9, "vs_fix_seq(): added previous_delta "
-                                  "(%d) to seq\n", vseq->previous_delta);
+                        IP_VS_DBG(9, "%s(): added previous_delta (%d) to seq\n",
+                                  __func__, vseq->previous_delta);
                 }
         }
 }
@@ -291,14 +294,14 @@ vs_fix_ack_seq(const struct ip_vs_seq *vseq, struct tcphdr *th)
                    to receive next, so compare it with init_seq+delta */
                 if(after(ack_seq, vseq->init_seq+vseq->delta)) {
                         th->ack_seq = htonl(ack_seq - vseq->delta);
-                        IP_VS_DBG(9, "vs_fix_ack_seq(): subtracted delta "
-                                  "(%d) from ack_seq\n", vseq->delta);
+                        IP_VS_DBG(9, "%s(): subtracted delta "
+                                  "(%d) from ack_seq\n", __func__, vseq->delta);
 
                 } else {
                         th->ack_seq = htonl(ack_seq - vseq->previous_delta);
-                        IP_VS_DBG(9, "vs_fix_ack_seq(): subtracted "
+                        IP_VS_DBG(9, "%s(): subtracted "
                                   "previous_delta (%d) from ack_seq\n",
-                                  vseq->previous_delta);
+                                  __func__, vseq->previous_delta);
                 }
         }
 }
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 77bfdfeb966e..27c30cf933da 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -22,6 +22,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/interrupt.h>
 #include <linux/in.h>
 #include <linux/net.h>
@@ -150,8 +153,8 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
                 atomic_inc(&cp->refcnt);
                 ret = 1;
         } else {
-                IP_VS_ERR("ip_vs_conn_hash(): request for already hashed, "
-                          "called from %p\n", __builtin_return_address(0));
+                pr_err("%s(): request for already hashed, called from %pF\n",
+                       __func__, __builtin_return_address(0));
                 ret = 0;
         }
 
@@ -689,7 +692,7 @@ ip_vs_conn_new(int af, int proto, const union nf_inet_addr *caddr, __be16 cport,
 
         cp = kmem_cache_zalloc(ip_vs_conn_cachep, GFP_ATOMIC);
         if (cp == NULL) {
-                IP_VS_ERR_RL("ip_vs_conn_new: no memory available.\n");
+                IP_VS_ERR_RL("%s(): no memory\n", __func__);
                 return NULL;
         }
 
@@ -1073,10 +1076,10 @@ int __init ip_vs_conn_init(void)
                 return -ENOMEM;
         }
 
-        IP_VS_INFO("Connection hash table configured "
-                   "(size=%d, memory=%ldKbytes)\n",
-                   IP_VS_CONN_TAB_SIZE,
-                   (long)(IP_VS_CONN_TAB_SIZE*sizeof(struct list_head))/1024);
+        pr_info("Connection hash table configured "
+                "(size=%d, memory=%ldKbytes)\n",
+                IP_VS_CONN_TAB_SIZE,
+                (long)(IP_VS_CONN_TAB_SIZE*sizeof(struct list_head))/1024);
         IP_VS_DBG(0, "Each connection entry needs %Zd bytes at least\n",
                   sizeof(struct ip_vs_conn));
 
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 8dddb17a947a..b227750af752 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -24,6 +24,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/ip.h>
@@ -388,9 +391,9 @@ ip_vs_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
          */
         if (!svc->fwmark && pptr[1] != svc->port) {
                 if (!svc->port)
-                        IP_VS_ERR("Schedule: port zero only supported "
-                                  "in persistent services, "
-                                  "check your ipvs configuration\n");
+                        pr_err("Schedule: port zero only supported "
+                               "in persistent services, "
+                               "check your ipvs configuration\n");
                 return NULL;
         }
 
@@ -462,7 +465,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
                 ip_vs_service_put(svc);
 
                 /* create a new connection entry */
-                IP_VS_DBG(6, "ip_vs_leave: create a cache_bypass entry\n");
+                IP_VS_DBG(6, "%s(): create a cache_bypass entry\n", __func__);
                 cp = ip_vs_conn_new(svc->af, iph.protocol,
                                     &iph.saddr, pptr[0],
                                     &iph.daddr, pptr[1],
@@ -664,8 +667,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
         unsigned int verdict = NF_DROP;
 
         if (IP_VS_FWD_METHOD(cp) != 0) {
-                IP_VS_ERR("shouldn't reach here, because the box is on the "
-                          "half connection in the tun/dr module.\n");
+                pr_err("shouldn't reach here, because the box is on the "
+                       "half connection in the tun/dr module.\n");
         }
 
         /* Ensure the checksum is correct */
@@ -1487,7 +1490,7 @@ static int __init ip_vs_init(void)
 
         ret = ip_vs_control_init();
         if (ret < 0) {
-                IP_VS_ERR("can't setup control.\n");
+                pr_err("can't setup control.\n");
                 goto cleanup_estimator;
         }
 
@@ -1495,23 +1498,23 @@ static int __init ip_vs_init(void)
 
         ret = ip_vs_app_init();
         if (ret < 0) {
-                IP_VS_ERR("can't setup application helper.\n");
+                pr_err("can't setup application helper.\n");
                 goto cleanup_protocol;
         }
 
         ret = ip_vs_conn_init();
         if (ret < 0) {
-                IP_VS_ERR("can't setup connection table.\n");
+                pr_err("can't setup connection table.\n");
                 goto cleanup_app;
         }
 
         ret = nf_register_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
         if (ret < 0) {
-                IP_VS_ERR("can't register hooks.\n");
+                pr_err("can't register hooks.\n");
                 goto cleanup_conn;
         }
 
-        IP_VS_INFO("ipvs loaded.\n");
+        pr_info("ipvs loaded.\n");
         return ret;
 
   cleanup_conn:
@@ -1534,7 +1537,7 @@ static void __exit ip_vs_cleanup(void)
         ip_vs_protocol_cleanup();
         ip_vs_control_cleanup();
         ip_vs_estimator_cleanup();
-        IP_VS_INFO("ipvs unloaded.\n");
+        pr_info("ipvs unloaded.\n");
 }
 
 module_init(ip_vs_init);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 7c1333c67ff3..fba2892b99e1 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -18,6 +18,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/types.h>
@@ -340,8 +343,8 @@ static int ip_vs_svc_hash(struct ip_vs_service *svc)
         unsigned hash;
 
         if (svc->flags & IP_VS_SVC_F_HASHED) {
-                IP_VS_ERR("ip_vs_svc_hash(): request for already hashed, "
-                          "called from %p\n", __builtin_return_address(0));
+                pr_err("%s(): request for already hashed, called from %pF\n",
+                       __func__, __builtin_return_address(0));
                 return 0;
         }
 
@@ -374,8 +377,8 @@ static int ip_vs_svc_hash(struct ip_vs_service *svc)
 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 {
         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
-                IP_VS_ERR("ip_vs_svc_unhash(): request for unhash flagged, "
-                          "called from %p\n", __builtin_return_address(0));
+                pr_err("%s(): request for unhash flagged, called from %pF\n",
+                       __func__, __builtin_return_address(0));
                 return 0;
         }
 
@@ -841,7 +844,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 
         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_ATOMIC);
         if (dest == NULL) {
-                IP_VS_ERR("ip_vs_new_dest: kmalloc failed.\n");
+                pr_err("%s(): no memory.\n", __func__);
                 return -ENOMEM;
         }
 
@@ -885,13 +888,13 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
         EnterFunction(2);
 
         if (udest->weight < 0) {
-                IP_VS_ERR("ip_vs_add_dest(): server weight less than zero\n");
+                pr_err("%s(): server weight less than zero\n", __func__);
                 return -ERANGE;
         }
 
         if (udest->l_threshold > udest->u_threshold) {
-                IP_VS_ERR("ip_vs_add_dest(): lower threshold is higher than "
-                          "upper threshold\n");
+                pr_err("%s(): lower threshold is higher than upper threshold\n",
+                        __func__);
                 return -ERANGE;
         }
 
@@ -903,7 +906,7 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 
         if (dest != NULL) {
-                IP_VS_DBG(1, "ip_vs_add_dest(): dest already exists\n");
+                IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
                 return -EEXIST;
         }
 
@@ -997,13 +1000,13 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
         EnterFunction(2);
 
         if (udest->weight < 0) {
-                IP_VS_ERR("ip_vs_edit_dest(): server weight less than zero\n");
+                pr_err("%s(): server weight less than zero\n", __func__);
                 return -ERANGE;
         }
 
         if (udest->l_threshold > udest->u_threshold) {
-                IP_VS_ERR("ip_vs_edit_dest(): lower threshold is higher than "
-                          "upper threshold\n");
+                pr_err("%s(): lower threshold is higher than upper threshold\n",
+                        __func__);
                 return -ERANGE;
         }
 
@@ -1015,7 +1018,7 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 
         if (dest == NULL) {
-                IP_VS_DBG(1, "ip_vs_edit_dest(): dest doesn't exist\n");
+                IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
                 return -ENOENT;
         }
 
@@ -1115,7 +1118,7 @@ ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
 
         if (dest == NULL) {
-                IP_VS_DBG(1, "ip_vs_del_dest(): destination not found!\n");
+                IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
                 return -ENOENT;
         }
 
@@ -1161,8 +1164,7 @@ ip_vs_add_service(struct ip_vs_service_user_kern *u,
         /* Lookup the scheduler by 'u->sched_name' */
         sched = ip_vs_scheduler_get(u->sched_name);
         if (sched == NULL) {
-                IP_VS_INFO("Scheduler module ip_vs_%s not found\n",
-                           u->sched_name);
+                pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
                 ret = -ENOENT;
                 goto out_mod_dec;
         }
@@ -1176,7 +1178,7 @@ ip_vs_add_service(struct ip_vs_service_user_kern *u,
 
         svc = kzalloc(sizeof(struct ip_vs_service), GFP_ATOMIC);
         if (svc == NULL) {
-                IP_VS_DBG(1, "ip_vs_add_service: kmalloc failed.\n");
+                IP_VS_DBG(1, "%s(): no memory\n", __func__);
                 ret = -ENOMEM;
                 goto out_err;
         }
@@ -1259,8 +1261,7 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
          */
         sched = ip_vs_scheduler_get(u->sched_name);
         if (sched == NULL) {
-                IP_VS_INFO("Scheduler module ip_vs_%s not found\n",
-                           u->sched_name);
+                pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
                 return -ENOENT;
         }
         old_sched = sched;
@@ -2077,8 +2078,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                 return -EPERM;
 
         if (len != set_arglen[SET_CMDID(cmd)]) {
-                IP_VS_ERR("set_ctl: len %u != %u\n",
-                          len, set_arglen[SET_CMDID(cmd)]);
+                pr_err("set_ctl: len %u != %u\n",
+                       len, set_arglen[SET_CMDID(cmd)]);
                 return -EINVAL;
         }
 
@@ -2129,9 +2130,9 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 
         /* Check for valid protocol: TCP or UDP, even for fwmark!=0 */
         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP) {
-                IP_VS_ERR("set_ctl: invalid protocol: %d %pI4:%d %s\n",
-                          usvc.protocol, &usvc.addr.ip,
-                          ntohs(usvc.port), usvc.sched_name);
+                pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
+                       usvc.protocol, &usvc.addr.ip,
+                       ntohs(usvc.port), usvc.sched_name);
                 ret = -EFAULT;
                 goto out_unlock;
         }
@@ -2356,8 +2357,8 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
                 return -EPERM;
 
         if (*len < get_arglen[GET_CMDID(cmd)]) {
-                IP_VS_ERR("get_ctl: len %u < %u\n",
-                          *len, get_arglen[GET_CMDID(cmd)]);
+                pr_err("get_ctl: len %u < %u\n",
+                       *len, get_arglen[GET_CMDID(cmd)]);
                 return -EINVAL;
         }
 
@@ -2402,7 +2403,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
                 size = sizeof(*get) +
                         sizeof(struct ip_vs_service_entry) * get->num_services;
                 if (*len != size) {
-                        IP_VS_ERR("length: %u != %u\n", *len, size);
+                        pr_err("length: %u != %u\n", *len, size);
                         ret = -EINVAL;
                         goto out;
                 }
@@ -2442,7 +2443,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
                 size = sizeof(*get) +
                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
                 if (*len != size) {
-                        IP_VS_ERR("length: %u != %u\n", *len, size);
+                        pr_err("length: %u != %u\n", *len, size);
                         ret = -EINVAL;
                         goto out;
                 }
@@ -3170,7 +3171,7 @@ static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
         else if (cmd == IPVS_CMD_GET_CONFIG)
                 reply_cmd = IPVS_CMD_SET_CONFIG;
         else {
-                IP_VS_ERR("unknown Generic Netlink command\n");
+                pr_err("unknown Generic Netlink command\n");
                 return -EINVAL;
         }
 
@@ -3231,11 +3232,11 @@ static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
         }
 
         genlmsg_end(msg, reply);
-        ret = genlmsg_unicast(msg, info->snd_pid);
+        ret = genlmsg_reply(msg, info);
         goto out;
 
 nla_put_failure:
-        IP_VS_ERR("not enough space in Netlink message\n");
+        pr_err("not enough space in Netlink message\n");
         ret = -EMSGSIZE;
 
 out_err:
@@ -3366,13 +3367,13 @@ int __init ip_vs_control_init(void)
 
         ret = nf_register_sockopt(&ip_vs_sockopts);
         if (ret) {
-                IP_VS_ERR("cannot register sockopt.\n");
+                pr_err("cannot register sockopt.\n");
                 return ret;
         }
 
         ret = ip_vs_genl_register();
         if (ret) {
-                IP_VS_ERR("cannot register Generic Netlink interface.\n");
+                pr_err("cannot register Generic Netlink interface.\n");
                 nf_unregister_sockopt(&ip_vs_sockopts);
                 return ret;
         }
diff --git a/net/netfilter/ipvs/ip_vs_dh.c b/net/netfilter/ipvs/ip_vs_dh.c
index a9dac74bb13f..fe3e18834b91 100644
--- a/net/netfilter/ipvs/ip_vs_dh.c
+++ b/net/netfilter/ipvs/ip_vs_dh.c
@@ -35,6 +35,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -147,7 +150,7 @@ static int ip_vs_dh_init_svc(struct ip_vs_service *svc)
         tbl = kmalloc(sizeof(struct ip_vs_dh_bucket)*IP_VS_DH_TAB_SIZE,
                       GFP_ATOMIC);
         if (tbl == NULL) {
-                IP_VS_ERR("ip_vs_dh_init_svc(): no memory\n");
+                pr_err("%s(): no memory\n", __func__);
                 return -ENOMEM;
         }
         svc->sched_data = tbl;
@@ -214,7 +217,7 @@ ip_vs_dh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 
         ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 
-        IP_VS_DBG(6, "ip_vs_dh_schedule(): Scheduling...\n");
+        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         tbl = (struct ip_vs_dh_bucket *)svc->sched_data;
         dest = ip_vs_dh_get(svc->af, tbl, &iph.daddr);
diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
index 2eb2860dabb5..702b53ca937c 100644
--- a/net/netfilter/ipvs/ip_vs_est.c
+++ b/net/netfilter/ipvs/ip_vs_est.c
@@ -11,6 +11,10 @@
  * Changes:
  *
  */
+
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
 #include <linux/slab.h>
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 428edbf481cc..33e2c799cba7 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -22,6 +22,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
@@ -382,8 +385,8 @@ static int __init ip_vs_ftp_init(void)
                 ret = register_ip_vs_app_inc(app, app->protocol, ports[i]);
                 if (ret)
                         break;
-                IP_VS_INFO("%s: loaded support on port[%d] = %d\n",
-                           app->name, i, ports[i]);
+                pr_info("%s: loaded support on port[%d] = %d\n",
+                        app->name, i, ports[i]);
         }
 
         if (ret)
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 3eb5e2660c49..c1757f3620cd 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -39,6 +39,9 @@
  * me to write this module.
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -199,7 +202,7 @@ ip_vs_lblc_new(struct ip_vs_lblc_table *tbl, const union nf_inet_addr *daddr,
         if (!en) {
                 en = kmalloc(sizeof(*en), GFP_ATOMIC);
                 if (!en) {
-                        IP_VS_ERR("ip_vs_lblc_new(): no memory\n");
+                        pr_err("%s(): no memory\n", __func__);
                         return NULL;
                 }
 
@@ -332,7 +335,7 @@ static int ip_vs_lblc_init_svc(struct ip_vs_service *svc)
          */
         tbl = kmalloc(sizeof(*tbl), GFP_ATOMIC);
         if (tbl == NULL) {
-                IP_VS_ERR("ip_vs_lblc_init_svc(): no memory\n");
+                pr_err("%s(): no memory\n", __func__);
                 return -ENOMEM;
         }
         svc->sched_data = tbl;
@@ -477,7 +480,7 @@ ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 
         ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 
-        IP_VS_DBG(6, "ip_vs_lblc_schedule(): Scheduling...\n");
+        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         /* First look in our cache */
         read_lock(&svc->sched_lock);
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index c04ce56c7f0f..715b57f9540d 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -37,6 +37,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -108,7 +111,7 @@ ip_vs_dest_set_insert(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
 
         e = kmalloc(sizeof(*e), GFP_ATOMIC);
         if (e == NULL) {
-                IP_VS_ERR("ip_vs_dest_set_insert(): no memory\n");
+                pr_err("%s(): no memory\n", __func__);
                 return NULL;
         }
 
@@ -202,8 +205,9 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
                 }
         }
 
-        IP_VS_DBG_BUF(6, "ip_vs_dest_set_min: server %s:%d "
+        IP_VS_DBG_BUF(6, "%s(): server %s:%d "
                       "activeconns %d refcnt %d weight %d overhead %d\n",
+                      __func__,
                       IP_VS_DBG_ADDR(least->af, &least->addr),
                       ntohs(least->port),
                       atomic_read(&least->activeconns),
@@ -249,8 +253,9 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
                 }
         }
 
-        IP_VS_DBG_BUF(6, "ip_vs_dest_set_max: server %s:%d "
+        IP_VS_DBG_BUF(6, "%s(): server %s:%d "
                       "activeconns %d refcnt %d weight %d overhead %d\n",
+                      __func__,
                       IP_VS_DBG_ADDR(most->af, &most->addr), ntohs(most->port),
                       atomic_read(&most->activeconns),
                       atomic_read(&most->refcnt),
@@ -374,7 +379,7 @@ ip_vs_lblcr_new(struct ip_vs_lblcr_table *tbl, const union nf_inet_addr *daddr,
         if (!en) {
                 en = kmalloc(sizeof(*en), GFP_ATOMIC);
                 if (!en) {
-                        IP_VS_ERR("ip_vs_lblcr_new(): no memory\n");
+                        pr_err("%s(): no memory\n", __func__);
                         return NULL;
                 }
 
@@ -508,7 +513,7 @@ static int ip_vs_lblcr_init_svc(struct ip_vs_service *svc)
          */
         tbl = kmalloc(sizeof(*tbl), GFP_ATOMIC);
         if (tbl == NULL) {
-                IP_VS_ERR("ip_vs_lblcr_init_svc(): no memory\n");
+                pr_err("%s(): no memory\n", __func__);
                 return -ENOMEM;
         }
         svc->sched_data = tbl;
@@ -654,7 +659,7 @@ ip_vs_lblcr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 
         ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 
-        IP_VS_DBG(6, "ip_vs_lblcr_schedule(): Scheduling...\n");
+        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         /* First look in our cache */
         read_lock(&svc->sched_lock);
diff --git a/net/netfilter/ipvs/ip_vs_lc.c b/net/netfilter/ipvs/ip_vs_lc.c
index d0dadc8a65fd..4f69db1fac56 100644
--- a/net/netfilter/ipvs/ip_vs_lc.c
+++ b/net/netfilter/ipvs/ip_vs_lc.c
@@ -14,6 +14,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
@@ -44,7 +47,7 @@ ip_vs_lc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         struct ip_vs_dest *dest, *least = NULL;
         unsigned int loh = 0, doh;
 
-        IP_VS_DBG(6, "ip_vs_lc_schedule(): Scheduling...\n");
+        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         /*
          * Simply select the server with the least number of
diff --git a/net/netfilter/ipvs/ip_vs_nq.c b/net/netfilter/ipvs/ip_vs_nq.c
index 694952db5026..c413e1830823 100644
--- a/net/netfilter/ipvs/ip_vs_nq.c
+++ b/net/netfilter/ipvs/ip_vs_nq.c
@@ -31,6 +31,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
@@ -57,7 +60,7 @@ ip_vs_nq_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         struct ip_vs_dest *dest, *least = NULL;
         unsigned int loh = 0, doh;
 
-        IP_VS_DBG(6, "ip_vs_nq_schedule(): Scheduling...\n");
+        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         /*
          * We calculate the load of each dest server as follows:
diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c
index a01520e3d6b8..3e7671674549 100644
--- a/net/netfilter/ipvs/ip_vs_proto.c
+++ b/net/netfilter/ipvs/ip_vs_proto.c
@@ -13,6 +13,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
@@ -124,7 +127,8 @@ ip_vs_create_timeout_table(int *table, int size)
  *      Set timeout value for state specified by name
  */
 int
-ip_vs_set_state_timeout(int *table, int num, char **names, char *name, int to)
+ip_vs_set_state_timeout(int *table, int num, const char *const *names,
+                        const char *name, int to)
 {
         int i;
 
@@ -181,7 +185,7 @@ ip_vs_tcpudp_debug_packet_v4(struct ip_vs_protocol *pp,
                                 &ih->daddr, ntohs(pptr[1]));
         }
 
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+        pr_debug("%s: %s\n", msg, buf);
 }
 
 #ifdef CONFIG_IP_VS_IPV6
@@ -215,7 +219,7 @@ ip_vs_tcpudp_debug_packet_v6(struct ip_vs_protocol *pp,
                                 &ih->daddr, ntohs(pptr[1]));
         }
 
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+        pr_debug("%s: %s\n", msg, buf);
 }
 #endif
 
@@ -259,7 +263,7 @@ int __init ip_vs_protocol_init(void)
 #ifdef CONFIG_IP_VS_PROTO_ESP
         REGISTER_PROTOCOL(&ip_vs_protocol_esp);
 #endif
-        IP_VS_INFO("Registered protocols (%s)\n", &protocols[2]);
+        pr_info("Registered protocols (%s)\n", &protocols[2]);
 
         return 0;
 }
diff --git a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
index 79f56c1e7c19..c30b43c36cd7 100644
--- a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
@@ -10,6 +10,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/module.h>
@@ -138,7 +141,7 @@ ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb,
                 sprintf(buf, "%s %pI4->%pI4",
                         pp->name, &ih->saddr, &ih->daddr);
 
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+        pr_debug("%s: %s\n", msg, buf);
 }
 
 #ifdef CONFIG_IP_VS_IPV6
@@ -156,7 +159,7 @@ ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb,
                 sprintf(buf, "%s %pI6->%pI6",
                         pp->name, &ih->saddr, &ih->daddr);
 
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+        pr_debug("%s: %s\n", msg, buf);
 }
 #endif
 
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index 8cba41802850..91d28e073742 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -13,6 +13,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>                  /* for tcphdr */
@@ -374,7 +377,7 @@ static int tcp_timeouts[IP_VS_TCP_S_LAST+1] = {
         [IP_VS_TCP_S_LAST]              =       2*HZ,
 };
 
-static char * tcp_state_name_table[IP_VS_TCP_S_LAST+1] = {
+static const char *const tcp_state_name_table[IP_VS_TCP_S_LAST+1] = {
         [IP_VS_TCP_S_NONE]              =       "NONE",
         [IP_VS_TCP_S_ESTABLISHED]       =       "ESTABLISHED",
         [IP_VS_TCP_S_SYN_SENT]          =       "SYN_SENT",
@@ -661,7 +664,7 @@ tcp_app_conn_bind(struct ip_vs_conn *cp)
                                 break;
                         spin_unlock(&tcp_app_lock);
 
-                        IP_VS_DBG_BUF(9, "%s: Binding conn %s:%u->"
+                        IP_VS_DBG_BUF(9, "%s(): Binding conn %s:%u->"
                                       "%s:%u to app %s on port %u\n",
                                       __func__,
                                       IP_VS_DBG_ADDR(cp->af, &cp->caddr),
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index d2930a71084b..e7a6885e0167 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -13,6 +13,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/kernel.h>
@@ -442,7 +445,7 @@ static int udp_app_conn_bind(struct ip_vs_conn *cp)
                                 break;
                         spin_unlock(&udp_app_lock);
 
-                        IP_VS_DBG_BUF(9, "%s: Binding conn %s:%u->"
+                        IP_VS_DBG_BUF(9, "%s(): Binding conn %s:%u->"
                                       "%s:%u to app %s on port %u\n",
                                       __func__,
                                       IP_VS_DBG_ADDR(cp->af, &cp->caddr),
@@ -469,7 +472,7 @@ static int udp_timeouts[IP_VS_UDP_S_LAST+1] = {
         [IP_VS_UDP_S_LAST]              =       2*HZ,
 };
 
-static char * udp_state_name_table[IP_VS_UDP_S_LAST+1] = {
+static const char *const udp_state_name_table[IP_VS_UDP_S_LAST+1] = {
         [IP_VS_UDP_S_NORMAL]            =       "UDP",
         [IP_VS_UDP_S_LAST]              =       "BUG!",
 };
diff --git a/net/netfilter/ipvs/ip_vs_rr.c b/net/netfilter/ipvs/ip_vs_rr.c
index 2d16ab7f8c1e..e210f37d8ea2 100644
--- a/net/netfilter/ipvs/ip_vs_rr.c
+++ b/net/netfilter/ipvs/ip_vs_rr.c
@@ -19,6 +19,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
@@ -48,7 +51,7 @@ ip_vs_rr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         struct list_head *p, *q;
         struct ip_vs_dest *dest;
 
-        IP_VS_DBG(6, "ip_vs_rr_schedule(): Scheduling...\n");
+        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         write_lock(&svc->sched_lock);
         p = (struct list_head *)svc->sched_data;
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index a46ad9e35016..bbc1ac795952 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -17,6 +17,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
@@ -44,11 +47,11 @@ int ip_vs_bind_scheduler(struct ip_vs_service *svc,
         int ret;
 
         if (svc == NULL) {
-                IP_VS_ERR("ip_vs_bind_scheduler(): svc arg NULL\n");
+                pr_err("%s(): svc arg NULL\n", __func__);
                 return -EINVAL;
         }
         if (scheduler == NULL) {
-                IP_VS_ERR("ip_vs_bind_scheduler(): scheduler arg NULL\n");
+                pr_err("%s(): scheduler arg NULL\n", __func__);
                 return -EINVAL;
         }
 
@@ -57,7 +60,7 @@ int ip_vs_bind_scheduler(struct ip_vs_service *svc,
         if (scheduler->init_service) {
                 ret = scheduler->init_service(svc);
                 if (ret) {
-                        IP_VS_ERR("ip_vs_bind_scheduler(): init error\n");
+                        pr_err("%s(): init error\n", __func__);
                         return ret;
                 }
         }
@@ -74,19 +77,19 @@ int ip_vs_unbind_scheduler(struct ip_vs_service *svc)
         struct ip_vs_scheduler *sched;
 
         if (svc == NULL) {
-                IP_VS_ERR("ip_vs_unbind_scheduler(): svc arg NULL\n");
+                pr_err("%s(): svc arg NULL\n", __func__);
                 return -EINVAL;
         }
 
         sched = svc->scheduler;
         if (sched == NULL) {
-                IP_VS_ERR("ip_vs_unbind_scheduler(): svc isn't bound\n");
+                pr_err("%s(): svc isn't bound\n", __func__);
                 return -EINVAL;
         }
 
         if (sched->done_service) {
                 if (sched->done_service(svc) != 0) {
-                        IP_VS_ERR("ip_vs_unbind_scheduler(): done error\n");
+                        pr_err("%s(): done error\n", __func__);
                         return -EINVAL;
                 }
         }
@@ -103,8 +106,7 @@ static struct ip_vs_scheduler *ip_vs_sched_getbyname(const char *sched_name)
 {
         struct ip_vs_scheduler *sched;
 
-        IP_VS_DBG(2, "ip_vs_sched_getbyname(): sched_name \"%s\"\n",
-                  sched_name);
+        IP_VS_DBG(2, "%s(): sched_name \"%s\"\n", __func__, sched_name);
 
         read_lock_bh(&__ip_vs_sched_lock);
 
@@ -170,12 +172,12 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
         struct ip_vs_scheduler *sched;
 
         if (!scheduler) {
-                IP_VS_ERR("register_ip_vs_scheduler(): NULL arg\n");
+                pr_err("%s(): NULL arg\n", __func__);
                 return -EINVAL;
         }
 
         if (!scheduler->name) {
-                IP_VS_ERR("register_ip_vs_scheduler(): NULL scheduler_name\n");
+                pr_err("%s(): NULL scheduler_name\n", __func__);
                 return -EINVAL;
         }
 
@@ -187,8 +189,8 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
         if (!list_empty(&scheduler->n_list)) {
                 write_unlock_bh(&__ip_vs_sched_lock);
                 ip_vs_use_count_dec();
-                IP_VS_ERR("register_ip_vs_scheduler(): [%s] scheduler "
-                          "already linked\n", scheduler->name);
+                pr_err("%s(): [%s] scheduler already linked\n",
+                       __func__, scheduler->name);
                 return -EINVAL;
         }
 
@@ -200,9 +202,8 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
                 if (strcmp(scheduler->name, sched->name) == 0) {
                         write_unlock_bh(&__ip_vs_sched_lock);
                         ip_vs_use_count_dec();
-                        IP_VS_ERR("register_ip_vs_scheduler(): [%s] scheduler "
-                                        "already existed in the system\n",
-                                        scheduler->name);
+                        pr_err("%s(): [%s] scheduler already existed "
+                               "in the system\n", __func__, scheduler->name);
                         return -EINVAL;
                 }
         }
@@ -212,7 +213,7 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
         list_add(&scheduler->n_list, &ip_vs_schedulers);
         write_unlock_bh(&__ip_vs_sched_lock);
 
-        IP_VS_INFO("[%s] scheduler registered.\n", scheduler->name);
+        pr_info("[%s] scheduler registered.\n", scheduler->name);
 
         return 0;
 }
@@ -224,15 +225,15 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
 int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
 {
         if (!scheduler) {
-                IP_VS_ERR( "unregister_ip_vs_scheduler(): NULL arg\n");
+                pr_err("%s(): NULL arg\n", __func__);
                 return -EINVAL;
         }
 
         write_lock_bh(&__ip_vs_sched_lock);
         if (list_empty(&scheduler->n_list)) {
                 write_unlock_bh(&__ip_vs_sched_lock);
-                IP_VS_ERR("unregister_ip_vs_scheduler(): [%s] scheduler "
-                          "is not in the list. failed\n", scheduler->name);
+                pr_err("%s(): [%s] scheduler is not in the list. failed\n",
+                       __func__, scheduler->name);
                 return -EINVAL;
         }
 
@@ -245,7 +246,7 @@ int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
         /* decrease the module use count */
         ip_vs_use_count_dec();
 
-        IP_VS_INFO("[%s] scheduler unregistered.\n", scheduler->name);
+        pr_info("[%s] scheduler unregistered.\n", scheduler->name);
 
         return 0;
 }
diff --git a/net/netfilter/ipvs/ip_vs_sed.c b/net/netfilter/ipvs/ip_vs_sed.c
index 20e4657d2f3b..1ab75a9dc400 100644
--- a/net/netfilter/ipvs/ip_vs_sed.c
+++ b/net/netfilter/ipvs/ip_vs_sed.c
@@ -35,6 +35,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
@@ -61,7 +64,7 @@ ip_vs_sed_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         struct ip_vs_dest *dest, *least;
         unsigned int loh, doh;
 
-        IP_VS_DBG(6, "ip_vs_sed_schedule(): Scheduling...\n");
+        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         /*
          * We calculate the load of each dest server as follows:
diff --git a/net/netfilter/ipvs/ip_vs_sh.c b/net/netfilter/ipvs/ip_vs_sh.c
index 75709ebeb630..8e6cfd36e6f0 100644
--- a/net/netfilter/ipvs/ip_vs_sh.c
+++ b/net/netfilter/ipvs/ip_vs_sh.c
@@ -32,6 +32,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -144,7 +147,7 @@ static int ip_vs_sh_init_svc(struct ip_vs_service *svc)
         tbl = kmalloc(sizeof(struct ip_vs_sh_bucket)*IP_VS_SH_TAB_SIZE,
                       GFP_ATOMIC);
         if (tbl == NULL) {
-                IP_VS_ERR("ip_vs_sh_init_svc(): no memory\n");
+                pr_err("%s(): no memory\n", __func__);
                 return -ENOMEM;
         }
         svc->sched_data = tbl;
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 5c48378a852f..e177f0dc2084 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -17,6 +17,9 @@
  *      Justin Ossevoort        :       Fix endian problem on sync message size.
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/inetdevice.h>
@@ -243,7 +246,7 @@ void ip_vs_sync_conn(struct ip_vs_conn *cp)
         if (!curr_sb) {
                 if (!(curr_sb=ip_vs_sync_buff_create())) {
                         spin_unlock(&curr_sb_lock);
-                        IP_VS_ERR("ip_vs_sync_buff_create failed.\n");
+                        pr_err("ip_vs_sync_buff_create failed.\n");
                         return;
                 }
         }
@@ -409,7 +412,7 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
                         if (dest)
                                 atomic_dec(&dest->refcnt);
                         if (!cp) {
-                                IP_VS_ERR("ip_vs_conn_new failed\n");
+                                pr_err("ip_vs_conn_new failed\n");
                                 return;
                         }
                 } else if (!cp->dest) {
@@ -577,8 +580,8 @@ static int bind_mcastif_addr(struct socket *sock, char *ifname)
 
         addr = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);
         if (!addr)
-                IP_VS_ERR("You probably need to specify IP address on "
-                          "multicast interface.\n");
+                pr_err("You probably need to specify IP address on "
+                       "multicast interface.\n");
 
         IP_VS_DBG(7, "binding socket with (%s) %pI4\n",
                   ifname, &addr);
@@ -602,13 +605,13 @@ static struct socket * make_send_sock(void)
         /* First create a socket */
         result = sock_create_kern(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock);
         if (result < 0) {
-                IP_VS_ERR("Error during creation of socket; terminating\n");
+                pr_err("Error during creation of socket; terminating\n");
                 return ERR_PTR(result);
         }
 
         result = set_mcast_if(sock->sk, ip_vs_master_mcast_ifn);
         if (result < 0) {
-                IP_VS_ERR("Error setting outbound mcast interface\n");
+                pr_err("Error setting outbound mcast interface\n");
                 goto error;
         }
 
@@ -617,14 +620,14 @@ static struct socket * make_send_sock(void)
 
         result = bind_mcastif_addr(sock, ip_vs_master_mcast_ifn);
         if (result < 0) {
-                IP_VS_ERR("Error binding address of the mcast interface\n");
+                pr_err("Error binding address of the mcast interface\n");
                 goto error;
         }
 
         result = sock->ops->connect(sock, (struct sockaddr *) &mcast_addr,
                         sizeof(struct sockaddr), 0);
         if (result < 0) {
-                IP_VS_ERR("Error connecting to the multicast addr\n");
+                pr_err("Error connecting to the multicast addr\n");
                 goto error;
         }
 
@@ -647,7 +650,7 @@ static struct socket * make_receive_sock(void)
         /* First create a socket */
         result = sock_create_kern(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock);
         if (result < 0) {
-                IP_VS_ERR("Error during creation of socket; terminating\n");
+                pr_err("Error during creation of socket; terminating\n");
                 return ERR_PTR(result);
         }
 
@@ -657,7 +660,7 @@ static struct socket * make_receive_sock(void)
         result = sock->ops->bind(sock, (struct sockaddr *) &mcast_addr,
                         sizeof(struct sockaddr));
         if (result < 0) {
-                IP_VS_ERR("Error binding to the multicast addr\n");
+                pr_err("Error binding to the multicast addr\n");
                 goto error;
         }
 
@@ -666,7 +669,7 @@ static struct socket * make_receive_sock(void)
                         (struct in_addr *) &mcast_addr.sin_addr,
                         ip_vs_backup_mcast_ifn);
         if (result < 0) {
-                IP_VS_ERR("Error joining to the multicast group\n");
+                pr_err("Error joining to the multicast group\n");
                 goto error;
         }
 
@@ -706,7 +709,7 @@ ip_vs_send_sync_msg(struct socket *sock, struct ip_vs_sync_mesg *msg)
         msg->size = htons(msg->size);
 
         if (ip_vs_send_async(sock, (char *)msg, msize) != msize)
-                IP_VS_ERR("ip_vs_send_async error\n");
+                pr_err("ip_vs_send_async error\n");
 }
 
 static int
@@ -737,9 +740,9 @@ static int sync_thread_master(void *data)
         struct ip_vs_sync_thread_data *tinfo = data;
         struct ip_vs_sync_buff *sb;
 
-        IP_VS_INFO("sync thread started: state = MASTER, mcast_ifn = %s, "
-                   "syncid = %d\n",
-                   ip_vs_master_mcast_ifn, ip_vs_master_syncid);
+        pr_info("sync thread started: state = MASTER, mcast_ifn = %s, "
+                "syncid = %d\n",
+                ip_vs_master_mcast_ifn, ip_vs_master_syncid);
 
         while (!kthread_should_stop()) {
                 while ((sb = sb_dequeue())) {
@@ -780,9 +783,9 @@ static int sync_thread_backup(void *data)
         struct ip_vs_sync_thread_data *tinfo = data;
         int len;
 
-        IP_VS_INFO("sync thread started: state = BACKUP, mcast_ifn = %s, "
-                   "syncid = %d\n",
-                   ip_vs_backup_mcast_ifn, ip_vs_backup_syncid);
+        pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, "
+                "syncid = %d\n",
+                ip_vs_backup_mcast_ifn, ip_vs_backup_syncid);
 
         while (!kthread_should_stop()) {
                 wait_event_interruptible(*tinfo->sock->sk->sk_sleep,
@@ -794,7 +797,7 @@ static int sync_thread_backup(void *data)
                         len = ip_vs_receive(tinfo->sock, tinfo->buf,
                                         sync_recv_mesg_maxlen);
                         if (len <= 0) {
-                                IP_VS_ERR("receiving message error\n");
+                                pr_err("receiving message error\n");
                                 break;
                         }
 
@@ -824,7 +827,7 @@ int start_sync_thread(int state, char *mcast_ifn, __u8 syncid)
         int (*threadfn)(void *data);
         int result = -ENOMEM;
 
-        IP_VS_DBG(7, "%s: pid %d\n", __func__, task_pid_nr(current));
+        IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));
         IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %Zd bytes\n",
                   sizeof(struct ip_vs_sync_conn));
 
@@ -901,14 +904,14 @@ out:
 
 int stop_sync_thread(int state)
 {
-        IP_VS_DBG(7, "%s: pid %d\n", __func__, task_pid_nr(current));
+        IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));
 
         if (state == IP_VS_STATE_MASTER) {
                 if (!sync_master_thread)
                         return -ESRCH;
 
-                IP_VS_INFO("stopping master sync thread %d ...\n",
-                           task_pid_nr(sync_master_thread));
+                pr_info("stopping master sync thread %d ...\n",
+                        task_pid_nr(sync_master_thread));
 
                 /*
                  * The lock synchronizes with sb_queue_tail(), so that we don't
@@ -925,8 +928,8 @@ int stop_sync_thread(int state)
                 if (!sync_backup_thread)
                         return -ESRCH;
 
-                IP_VS_INFO("stopping backup sync thread %d ...\n",
-                           task_pid_nr(sync_backup_thread));
+                pr_info("stopping backup sync thread %d ...\n",
+                        task_pid_nr(sync_backup_thread));
 
                 ip_vs_sync_state &= ~IP_VS_STATE_BACKUP;
                 kthread_stop(sync_backup_thread);
diff --git a/net/netfilter/ipvs/ip_vs_wlc.c b/net/netfilter/ipvs/ip_vs_wlc.c
index 8e942565b47d..bbddfdb10db2 100644
--- a/net/netfilter/ipvs/ip_vs_wlc.c
+++ b/net/netfilter/ipvs/ip_vs_wlc.c
@@ -19,6 +19,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
diff --git a/net/netfilter/ipvs/ip_vs_wrr.c b/net/netfilter/ipvs/ip_vs_wrr.c
index f7d74ef1ecf9..70ff82cda57d 100644
--- a/net/netfilter/ipvs/ip_vs_wrr.c
+++ b/net/netfilter/ipvs/ip_vs_wrr.c
@@ -18,6 +18,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/net.h>
@@ -94,7 +97,7 @@ static int ip_vs_wrr_init_svc(struct ip_vs_service *svc)
          */
         mark = kmalloc(sizeof(struct ip_vs_wrr_mark), GFP_ATOMIC);
         if (mark == NULL) {
-                IP_VS_ERR("ip_vs_wrr_init_svc(): no memory\n");
+                pr_err("%s(): no memory\n", __func__);
                 return -ENOMEM;
         }
         mark->cl = &svc->destinations;
@@ -141,7 +144,7 @@ ip_vs_wrr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         struct ip_vs_wrr_mark *mark = svc->sched_data;
         struct list_head *p;
 
-        IP_VS_DBG(6, "ip_vs_wrr_schedule(): Scheduling...\n");
+        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         /*
          * This loop will always terminate, because mark->cw in (0, max_weight]
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 5874657af7f2..30b3189bd29c 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -13,6 +13,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/tcp.h>                  /* for tcphdr */
 #include <net/ip.h>
@@ -235,8 +238,8 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         EnterFunction(10);
 
         if (ip_route_output_key(&init_net, &rt, &fl)) {
-                IP_VS_DBG_RL("ip_vs_bypass_xmit(): ip_route_output error, dest: %pI4\n",
-                             &iph->daddr);
+                IP_VS_DBG_RL("%s(): ip_route_output error, dest: %pI4\n",
+                             __func__, &iph->daddr);
                 goto tx_error_icmp;
         }
 
@@ -245,7 +248,7 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF))) {
                 ip_rt_put(rt);
                 icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
-                IP_VS_DBG_RL("ip_vs_bypass_xmit(): frag needed\n");
+                IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
 
@@ -299,8 +302,8 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
         if (!rt) {
-                IP_VS_DBG_RL("ip_vs_bypass_xmit_v6(): ip6_route_output error, dest: %pI6\n",
-                             &iph->daddr);
+                IP_VS_DBG_RL("%s(): ip6_route_output error, dest: %pI6\n",
+                             __func__, &iph->daddr);
                 goto tx_error_icmp;
         }
 
@@ -309,7 +312,7 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         if (skb->len > mtu) {
                 dst_release(&rt->u.dst);
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
-                IP_VS_DBG_RL("ip_vs_bypass_xmit_v6(): frag needed\n");
+                IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
 
@@ -536,9 +539,9 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         EnterFunction(10);
 
         if (skb->protocol != htons(ETH_P_IP)) {
-                IP_VS_DBG_RL("ip_vs_tunnel_xmit(): protocol error, "
+                IP_VS_DBG_RL("%s(): protocol error, "
                              "ETH_P_IP: %d, skb protocol: %d\n",
-                             htons(ETH_P_IP), skb->protocol);
+                             __func__, htons(ETH_P_IP), skb->protocol);
                 goto tx_error;
         }
 
@@ -550,7 +553,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
         if (mtu < 68) {
                 ip_rt_put(rt);
-                IP_VS_DBG_RL("ip_vs_tunnel_xmit(): mtu less than 68\n");
+                IP_VS_DBG_RL("%s(): mtu less than 68\n", __func__);
                 goto tx_error;
         }
         if (skb_dst(skb))
@@ -562,7 +565,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
             && mtu < ntohs(old_iph->tot_len)) {
                 icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
                 ip_rt_put(rt);
-                IP_VS_DBG_RL("ip_vs_tunnel_xmit(): frag needed\n");
+                IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
 
@@ -578,7 +581,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                 if (!new_skb) {
                         ip_rt_put(rt);
                         kfree_skb(skb);
-                        IP_VS_ERR_RL("ip_vs_tunnel_xmit(): no memory\n");
+                        IP_VS_ERR_RL("%s(): no memory\n", __func__);
                         return NF_STOLEN;
                 }
                 kfree_skb(skb);
@@ -646,9 +649,9 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         EnterFunction(10);
 
         if (skb->protocol != htons(ETH_P_IPV6)) {
-                IP_VS_DBG_RL("ip_vs_tunnel_xmit_v6(): protocol error, "
+                IP_VS_DBG_RL("%s(): protocol error, "
                              "ETH_P_IPV6: %d, skb protocol: %d\n",
-                             htons(ETH_P_IPV6), skb->protocol);
+                             __func__, htons(ETH_P_IPV6), skb->protocol);
                 goto tx_error;
         }
 
@@ -662,7 +665,7 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         /* TODO IPv6: do we need this check in IPv6? */
         if (mtu < 1280) {
                 dst_release(&rt->u.dst);
-                IP_VS_DBG_RL("ip_vs_tunnel_xmit_v6(): mtu less than 1280\n");
+                IP_VS_DBG_RL("%s(): mtu less than 1280\n", __func__);
                 goto tx_error;
         }
         if (skb_dst(skb))
@@ -671,7 +674,7 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         if (mtu < ntohs(old_iph->payload_len) + sizeof(struct ipv6hdr)) {
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
                 dst_release(&rt->u.dst);
-                IP_VS_DBG_RL("ip_vs_tunnel_xmit_v6(): frag needed\n");
+                IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
 
@@ -687,7 +690,7 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
                 if (!new_skb) {
                         dst_release(&rt->u.dst);
                         kfree_skb(skb);
-                        IP_VS_ERR_RL("ip_vs_tunnel_xmit_v6(): no memory\n");
+                        IP_VS_ERR_RL("%s(): no memory\n", __func__);
                         return NF_STOLEN;
                 }
                 kfree_skb(skb);
@@ -760,7 +763,7 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu) {
                 icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
                 ip_rt_put(rt);
-                IP_VS_DBG_RL("ip_vs_dr_xmit(): frag needed\n");
+                IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
 
@@ -813,7 +816,7 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         if (skb->len > mtu) {
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
                 dst_release(&rt->u.dst);
-                IP_VS_DBG_RL("ip_vs_dr_xmit_v6(): frag needed\n");
+                IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
 
@@ -888,7 +891,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF))) {
                 ip_rt_put(rt);
                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
-                IP_VS_DBG_RL("ip_vs_in_icmp(): frag needed\n");
+                IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
 
@@ -963,7 +966,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         if (skb->len > mtu) {
                 dst_release(&rt->u.dst);
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
-                IP_VS_DBG_RL("ip_vs_in_icmp(): frag needed\n");
+                IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
 
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 16e6c4378ff1..6ce00205f342 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -185,8 +185,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
         return 0;
 
 cfg_unlbl_map_add_failure:
-        if (entry != NULL)
-                kfree(entry->domain);
+        kfree(entry->domain);
         kfree(entry);
         kfree(addrmap);
         kfree(map4);
@@ -385,8 +384,7 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
 
 cfg_cipsov4_map_add_failure:
         cipso_v4_doi_putdef(doi_def);
-        if (entry != NULL)
-                kfree(entry->domain);
+        kfree(entry->domain);
         kfree(entry);
         kfree(addrmap);
         kfree(addrinfo);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2936fa3b6dc8..da3163d15ef0 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -83,6 +83,11 @@ struct netlink_sock {
         struct module           *module;
 };
 
+struct listeners_rcu_head {
+        struct rcu_head rcu_head;
+        void *ptr;
+};
+
 #define NETLINK_KERNEL_SOCKET   0x1
 #define NETLINK_RECV_PKTINFO    0x2
 #define NETLINK_BROADCAST_SEND_ERROR    0x4
@@ -1356,7 +1361,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         struct netlink_sock *nlk = nlk_sk(sk);
         int noblock = flags&MSG_DONTWAIT;
         size_t copied;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *frag __maybe_unused = NULL;
         int err;
 
         if (flags&MSG_OOB)
@@ -1368,6 +1373,35 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         if (skb == NULL)
                 goto out;
 
+#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
+        if (unlikely(skb_shinfo(skb)->frag_list)) {
+                bool need_compat = !!(flags & MSG_CMSG_COMPAT);
+
+                /*
+                 * If this skb has a frag_list, then here that means that
+                 * we will have to use the frag_list skb for compat tasks
+                 * and the regular skb for non-compat tasks.
+                 *
+                 * The skb might (and likely will) be cloned, so we can't
+                 * just reset frag_list and go on with things -- we need to
+                 * keep that. For the compat case that's easy -- simply get
+                 * a reference to the compat skb and free the regular one
+                 * including the frag. For the non-compat case, we need to
+                 * avoid sending the frag to the user -- so assign NULL but
+                 * restore it below before freeing the skb.
+                 */
+                if (need_compat) {
+                        struct sk_buff *compskb = skb_shinfo(skb)->frag_list;
+                        skb_get(compskb);
+                        kfree_skb(skb);
+                        skb = compskb;
+                } else {
+                        frag = skb_shinfo(skb)->frag_list;
+                        skb_shinfo(skb)->frag_list = NULL;
+                }
+        }
+#endif
+
         msg->msg_namelen = 0;
 
         copied = skb->len;
@@ -1398,6 +1432,11 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         siocb->scm->creds = *NETLINK_CREDS(skb);
         if (flags & MSG_TRUNC)
                 copied = skb->len;
+
+#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
+        skb_shinfo(skb)->frag_list = frag;
+#endif
+
         skb_free_datagram(sk, skb);
 
         if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)
@@ -1453,7 +1492,8 @@ netlink_kernel_create(struct net *net, int unit, unsigned int groups,
         if (groups < 32)
                 groups = 32;
 
-        listeners = kzalloc(NLGRPSZ(groups), GFP_KERNEL);
+        listeners = kzalloc(NLGRPSZ(groups) + sizeof(struct listeners_rcu_head),
+                            GFP_KERNEL);
         if (!listeners)
                 goto out_sock_release;
 
@@ -1501,6 +1541,14 @@ netlink_kernel_release(struct sock *sk)
 EXPORT_SYMBOL(netlink_kernel_release);
 
 
+static void netlink_free_old_listeners(struct rcu_head *rcu_head)
+{
+        struct listeners_rcu_head *lrh;
+
+        lrh = container_of(rcu_head, struct listeners_rcu_head, rcu_head);
+        kfree(lrh->ptr);
+}
+
 /**
  * netlink_change_ngroups - change number of multicast groups
  *
@@ -1516,6 +1564,7 @@ EXPORT_SYMBOL(netlink_kernel_release);
 int netlink_change_ngroups(struct sock *sk, unsigned int groups)
 {
         unsigned long *listeners, *old = NULL;
+        struct listeners_rcu_head *old_rcu_head;
         struct netlink_table *tbl = &nl_table[sk->sk_protocol];
         int err = 0;
 
@@ -1524,7 +1573,9 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
 
         netlink_table_grab();
         if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
-                listeners = kzalloc(NLGRPSZ(groups), GFP_ATOMIC);
+                listeners = kzalloc(NLGRPSZ(groups) +
+                                    sizeof(struct listeners_rcu_head),
+                                    GFP_ATOMIC);
                 if (!listeners) {
                         err = -ENOMEM;
                         goto out_ungrab;
@@ -1532,16 +1583,24 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
                 old = tbl->listeners;
                 memcpy(listeners, old, NLGRPSZ(tbl->groups));
                 rcu_assign_pointer(tbl->listeners, listeners);
+                /*
+                 * Free the old memory after an RCU grace period so we
+                 * don't leak it. We use call_rcu() here in order to be
+                 * able to call this function from atomic contexts. The
+                 * allocation of this memory will have reserved enough
+                 * space for struct listeners_rcu_head at the end.
+                 */
+                old_rcu_head = (void *)(tbl->listeners +
+                                        NLGRPLONGS(tbl->groups));
+                old_rcu_head->ptr = old;
+                call_rcu(&old_rcu_head->rcu_head, netlink_free_old_listeners);
         }
         tbl->groups = groups;
 
  out_ungrab:
         netlink_table_ungrab();
-        synchronize_rcu();
-        kfree(old);
         return err;
 }
-EXPORT_SYMBOL(netlink_change_ngroups);
 
 /**
  * netlink_clear_multicast_users - kick off multicast listeners
@@ -1564,7 +1623,6 @@ void netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
 
         netlink_table_ungrab();
 }
-EXPORT_SYMBOL(netlink_clear_multicast_users);
 
 void netlink_set_nonroot(int protocol, unsigned int flags)
 {
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index eed4c6a8afc0..575c64341508 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -18,8 +18,6 @@
 #include <net/sock.h>
 #include <net/genetlink.h>
 
-struct sock *genl_sock = NULL;
-
 static DEFINE_MUTEX(genl_mutex); /* serialization of message processing */
 
 static inline void genl_lock(void)
@@ -175,10 +173,31 @@ int genl_register_mc_group(struct genl_family *family,
                 mc_groups_longs++;
         }
 
-        err = netlink_change_ngroups(genl_sock,
-                                     mc_groups_longs * BITS_PER_LONG);
-        if (err)
-                goto out;
+        if (family->netnsok) {
+                struct net *net;
+
+                rcu_read_lock();
+                for_each_net_rcu(net) {
+                        err = netlink_change_ngroups(net->genl_sock,
+                                        mc_groups_longs * BITS_PER_LONG);
+                        if (err) {
+                                /*
+                                 * No need to roll back, can only fail if
+                                 * memory allocation fails and then the
+                                 * number of _possible_ groups has been
+                                 * increased on some sockets which is ok.
+                                 */
+                                rcu_read_unlock();
+                                goto out;
+                        }
+                }
+                rcu_read_unlock();
+        } else {
+                err = netlink_change_ngroups(init_net.genl_sock,
+                                             mc_groups_longs * BITS_PER_LONG);
+                if (err)
+                        goto out;
+        }
 
         grp->id = id;
         set_bit(id, mc_groups);
@@ -195,8 +214,14 @@ EXPORT_SYMBOL(genl_register_mc_group);
 static void __genl_unregister_mc_group(struct genl_family *family,
                                        struct genl_multicast_group *grp)
 {
+        struct net *net;
         BUG_ON(grp->family != family);
-        netlink_clear_multicast_users(genl_sock, grp->id);
+
+        rcu_read_lock();
+        for_each_net_rcu(net)
+                netlink_clear_multicast_users(net->genl_sock, grp->id);
+        rcu_read_unlock();
+
         clear_bit(grp->id, mc_groups);
         list_del(&grp->list);
         genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, grp);
@@ -467,6 +492,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct genl_ops *ops;
         struct genl_family *family;
+        struct net *net = sock_net(skb->sk);
         struct genl_info info;
         struct genlmsghdr *hdr = nlmsg_data(nlh);
         int hdrlen, err;
@@ -475,6 +501,10 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (family == NULL)
                 return -ENOENT;
 
+        /* this family doesn't exist in this netns */
+        if (!family->netnsok && !net_eq(net, &init_net))
+                return -ENOENT;
+
         hdrlen = GENL_HDRLEN + family->hdrsize;
         if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
                 return -EINVAL;
@@ -492,7 +522,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         return -EOPNOTSUPP;
 
                 genl_unlock();
-                err = netlink_dump_start(genl_sock, skb, nlh,
+                err = netlink_dump_start(net->genl_sock, skb, nlh,
                                          ops->dumpit, ops->done);
                 genl_lock();
                 return err;
@@ -514,6 +544,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         info.genlhdr = nlmsg_data(nlh);
         info.userhdr = nlmsg_data(nlh) + GENL_HDRLEN;
         info.attrs = family->attrbuf;
+        genl_info_net_set(&info, net);
 
         return ops->doit(skb, &info);
 }
@@ -534,6 +565,7 @@ static struct genl_family genl_ctrl = {
         .name = "nlctrl",
         .version = 0x2,
         .maxattr = CTRL_ATTR_MAX,
+        .netnsok = true,
 };
 
 static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
@@ -650,6 +682,7 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
 
         int i, n = 0;
         struct genl_family *rt;
+        struct net *net = sock_net(skb->sk);
         int chains_to_skip = cb->args[0];
         int fams_to_skip = cb->args[1];
 
@@ -658,6 +691,8 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
                         continue;
                 n = 0;
                 list_for_each_entry(rt, genl_family_chain(i), family_list) {
+                        if (!rt->netnsok && !net_eq(net, &init_net))
+                                continue;
                         if (++n < fams_to_skip)
                                 continue;
                         if (ctrl_fill_info(rt, NETLINK_CB(cb->skb).pid,
@@ -729,6 +764,7 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[CTRL_ATTR_FAMILY_ID]) {
                 u16 id = nla_get_u16(info->attrs[CTRL_ATTR_FAMILY_ID]);
                 res = genl_family_find_byid(id);
+                err = -ENOENT;
         }
 
         if (info->attrs[CTRL_ATTR_FAMILY_NAME]) {
@@ -736,49 +772,61 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 
                 name = nla_data(info->attrs[CTRL_ATTR_FAMILY_NAME]);
                 res = genl_family_find_byname(name);
+                err = -ENOENT;
         }
 
-        if (res == NULL) {
-                err = -ENOENT;
-                goto errout;
+        if (res == NULL)
+                return err;
+
+        if (!res->netnsok && !net_eq(genl_info_net(info), &init_net)) {
+                /* family doesn't exist here */
+                return -ENOENT;
         }
 
         msg = ctrl_build_family_msg(res, info->snd_pid, info->snd_seq,
                                     CTRL_CMD_NEWFAMILY);
-        if (IS_ERR(msg)) {
-                err = PTR_ERR(msg);
-                goto errout;
-        }
+        if (IS_ERR(msg))
+                return PTR_ERR(msg);
 
-        err = genlmsg_reply(msg, info);
-errout:
-        return err;
+        return genlmsg_reply(msg, info);
 }
 
 static int genl_ctrl_event(int event, void *data)
 {
         struct sk_buff *msg;
+        struct genl_family *family;
+        struct genl_multicast_group *grp;
 
-        if (genl_sock == NULL)
+        /* genl is still initialising */
+        if (!init_net.genl_sock)
                 return 0;
 
         switch (event) {
         case CTRL_CMD_NEWFAMILY:
         case CTRL_CMD_DELFAMILY:
-                msg = ctrl_build_family_msg(data, 0, 0, event);
-                if (IS_ERR(msg))
-                        return PTR_ERR(msg);
-
-                genlmsg_multicast(msg, 0, GENL_ID_CTRL, GFP_KERNEL);
+                family = data;
+                msg = ctrl_build_family_msg(family, 0, 0, event);
                 break;
         case CTRL_CMD_NEWMCAST_GRP:
         case CTRL_CMD_DELMCAST_GRP:
+                grp = data;
+                family = grp->family;
                 msg = ctrl_build_mcgrp_msg(data, 0, 0, event);
-                if (IS_ERR(msg))
-                        return PTR_ERR(msg);
-
-                genlmsg_multicast(msg, 0, GENL_ID_CTRL, GFP_KERNEL);
                 break;
+        default:
+                return -EINVAL;
+        }
+
+        if (IS_ERR(msg))
+                return PTR_ERR(msg);
+
+        if (!family->netnsok) {
+                genlmsg_multicast_netns(&init_net, msg, 0,
+                                        GENL_ID_CTRL, GFP_KERNEL);
+        } else {
+                rcu_read_lock();
+                genlmsg_multicast_allns(msg, 0, GENL_ID_CTRL, GFP_ATOMIC);
+                rcu_read_unlock();
         }
 
         return 0;
@@ -795,6 +843,33 @@ static struct genl_multicast_group notify_grp = {
         .name           = "notify",
 };
 
+static int __net_init genl_pernet_init(struct net *net)
+{
+        /* we'll bump the group number right afterwards */
+        net->genl_sock = netlink_kernel_create(net, NETLINK_GENERIC, 0,
+                                               genl_rcv, &genl_mutex,
+                                               THIS_MODULE);
+
+        if (!net->genl_sock && net_eq(net, &init_net))
+                panic("GENL: Cannot initialize generic netlink\n");
+
+        if (!net->genl_sock)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static void __net_exit genl_pernet_exit(struct net *net)
+{
+        netlink_kernel_release(net->genl_sock);
+        net->genl_sock = NULL;
+}
+
+static struct pernet_operations genl_pernet_ops = {
+        .init = genl_pernet_init,
+        .exit = genl_pernet_exit,
+};
+
 static int __init genl_init(void)
 {
         int i, err;
@@ -804,36 +879,67 @@ static int __init genl_init(void)
 
         err = genl_register_family(&genl_ctrl);
         if (err < 0)
-                goto errout;
+                goto problem;
 
         err = genl_register_ops(&genl_ctrl, &genl_ctrl_ops);
         if (err < 0)
-                goto errout_register;
+                goto problem;
 
         netlink_set_nonroot(NETLINK_GENERIC, NL_NONROOT_RECV);
 
-        /* we'll bump the group number right afterwards */
-        genl_sock = netlink_kernel_create(&init_net, NETLINK_GENERIC, 0,
-                                          genl_rcv, &genl_mutex, THIS_MODULE);
-        if (genl_sock == NULL)
-                panic("GENL: Cannot initialize generic netlink\n");
+        err = register_pernet_subsys(&genl_pernet_ops);
+        if (err)
+                goto problem;
 
         err = genl_register_mc_group(&genl_ctrl, &notify_grp);
         if (err < 0)
-                goto errout_register;
+                goto problem;
 
         return 0;
 
-errout_register:
-        genl_unregister_family(&genl_ctrl);
-errout:
+problem:
         panic("GENL: Cannot register controller: %d\n", err);
 }
 
 subsys_initcall(genl_init);
 
-EXPORT_SYMBOL(genl_sock);
 EXPORT_SYMBOL(genl_register_ops);
 EXPORT_SYMBOL(genl_unregister_ops);
 EXPORT_SYMBOL(genl_register_family);
 EXPORT_SYMBOL(genl_unregister_family);
+
+static int genlmsg_mcast(struct sk_buff *skb, u32 pid, unsigned long group,
+                         gfp_t flags)
+{
+        struct sk_buff *tmp;
+        struct net *net, *prev = NULL;
+        int err;
+
+        for_each_net_rcu(net) {
+                if (prev) {
+                        tmp = skb_clone(skb, flags);
+                        if (!tmp) {
+                                err = -ENOMEM;
+                                goto error;
+                        }
+                        err = nlmsg_multicast(prev->genl_sock, tmp,
+                                              pid, group, flags);
+                        if (err)
+                                goto error;
+                }
+
+                prev = net;
+        }
+
+        return nlmsg_multicast(prev->genl_sock, skb, pid, group, flags);
+ error:
+        kfree_skb(skb);
+        return err;
+}
+
+int genlmsg_multicast_allns(struct sk_buff *skb, u32 pid, unsigned int group,
+                            gfp_t flags)
+{
+        return genlmsg_mcast(skb, pid, group, flags);
+}
+EXPORT_SYMBOL(genlmsg_multicast_allns);
diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c
index 351372463fed..c7b7838a0519 100644
--- a/net/netrom/nr_dev.c
+++ b/net/netrom/nr_dev.c
@@ -177,13 +177,13 @@ static int nr_xmit(struct sk_buff *skb, struct net_device *dev)
         if (!nr_route_frame(skb, NULL)) {
                 kfree_skb(skb);
                 stats->tx_errors++;
-                return 0;
+                return NETDEV_TX_OK;
         }
 
         stats->tx_packets++;
         stats->tx_bytes += len;
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct header_ops nr_header_ops = {
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ebe5718baa31..d3d52c66cdc2 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -137,8 +137,7 @@ dev->hard_header == NULL (ll header is added by device, we cannot control it)
 
 /* Private packet socket structures. */
 
-struct packet_mclist
-{
+struct packet_mclist {
         struct packet_mclist    *next;
         int                     ifindex;
         int                     count;
@@ -149,8 +148,7 @@ struct packet_mclist
 /* identical to struct packet_mreq except it has
  * a longer address field.
  */
-struct packet_mreq_max
-{
+struct packet_mreq_max {
         int             mr_ifindex;
         unsigned short  mr_type;
         unsigned short  mr_alen;
@@ -162,7 +160,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
                 int closing, int tx_ring);
 
 struct packet_ring_buffer {
-        char *                  *pg_vec;
+        char                    **pg_vec;
         unsigned int            head;
         unsigned int            frames_per_block;
         unsigned int            frame_size;
@@ -239,7 +237,7 @@ static void __packet_set_status(struct packet_sock *po, void *frame, int status)
                 flush_dcache_page(virt_to_page(&h.h2->tp_status));
                 break;
         default:
-                printk(KERN_ERR "TPACKET version not supported\n");
+                pr_err("TPACKET version not supported\n");
                 BUG();
         }
 
@@ -265,7 +263,7 @@ static int __packet_get_status(struct packet_sock *po, void *frame)
                 flush_dcache_page(virt_to_page(&h.h2->tp_status));
                 return h.h2->tp_status;
         default:
-                printk(KERN_ERR "TPACKET version not supported\n");
+                pr_err("TPACKET version not supported\n");
                 BUG();
                 return 0;
         }
@@ -327,7 +325,7 @@ static void packet_sock_destruct(struct sock *sk)
         WARN_ON(atomic_read(&sk->sk_wmem_alloc));
 
         if (!sock_flag(sk, SOCK_DEAD)) {
-                printk("Attempt to release alive packet socket: %p\n", sk);
+                pr_err("Attempt to release alive packet socket: %p\n", sk);
                 return;
         }
 
@@ -339,7 +337,8 @@ static const struct proto_ops packet_ops;
 
 static const struct proto_ops packet_ops_spkt;
 
-static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
+static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,
+                           struct packet_type *pt, struct net_device *orig_dev)
 {
         struct sock *sk;
         struct sockaddr_pkt *spkt;
@@ -368,7 +367,8 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct
         if (dev_net(dev) != sock_net(sk))
                 goto out;
 
-        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (skb == NULL)
                 goto oom;
 
         /* drop any routing info */
@@ -394,7 +394,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct
          *      to prevent sockets using all the memory up.
          */
 
-        if (sock_queue_rcv_skb(sk,skb) == 0)
+        if (sock_queue_rcv_skb(sk, skb) == 0)
                 return 0;
 
 out:
@@ -413,25 +413,23 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
                                struct msghdr *msg, size_t len)
 {
         struct sock *sk = sock->sk;
-        struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
+        struct sockaddr_pkt *saddr = (struct sockaddr_pkt *)msg->msg_name;
         struct sk_buff *skb;
         struct net_device *dev;
-        __be16 proto=0;
+        __be16 proto = 0;
         int err;
 
         /*
          *      Get and verify the address.
          */
 
-        if (saddr)
-        {
+        if (saddr) {
                 if (msg->msg_namelen < sizeof(struct sockaddr))
-                        return(-EINVAL);
-                if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
-                        proto=saddr->spkt_protocol;
-        }
-        else
-                return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
+                        return -EINVAL;
+                if (msg->msg_namelen == sizeof(struct sockaddr_pkt))
+                        proto = saddr->spkt_protocol;
+        } else
+                return -ENOTCONN;       /* SOCK_PACKET must be sent giving an address */
 
         /*
          *      Find the device first to size check it
@@ -448,8 +446,8 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
                 goto out_unlock;
 
         /*
-         *      You may not queue a frame bigger than the mtu. This is the lowest level
-         *      raw protocol and you must do your own fragmentation at this level.
+         * You may not queue a frame bigger than the mtu. This is the lowest level
+         * raw protocol and you must do your own fragmentation at this level.
          */
 
         err = -EMSGSIZE;
@@ -460,9 +458,9 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 
         /*
-         *      If the write buffer is full, then tough. At this level the user gets to
-         *      deal with the problem - do your own algorithmic backoffs. That's far
-         *      more flexible.
+         * If the write buffer is full, then tough. At this level the user
+         * gets to deal with the problem - do your own algorithmic backoffs.
+         * That's far more flexible.
          */
 
         if (skb == NULL)
@@ -488,7 +486,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         }
 
         /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
+        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
@@ -501,7 +499,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 
         dev_queue_xmit(skb);
         dev_put(dev);
-        return(len);
+        return len;
 
 out_free:
         kfree_skb(skb);
@@ -537,12 +535,13 @@ static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
    we will not harm anyone.
  */
 
-static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+                      struct packet_type *pt, struct net_device *orig_dev)
 {
         struct sock *sk;
         struct sockaddr_ll *sll;
         struct packet_sock *po;
-        u8 * skb_head = skb->data;
+        u8 *skb_head = skb->data;
         int skb_len = skb->len;
         unsigned int snaplen, res;
 
@@ -648,7 +647,8 @@ drop:
 }
 
 #ifdef CONFIG_PACKET_MMAP
-static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+                       struct packet_type *pt, struct net_device *orig_dev)
 {
         struct sock *sk;
         struct packet_sock *po;
@@ -658,7 +658,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 struct tpacket2_hdr *h2;
                 void *raw;
         } h;
-        u8 * skb_head = skb->data;
+        u8 *skb_head = skb->data;
         int skb_len = skb->len;
         unsigned int snaplen, res;
         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
@@ -821,7 +821,7 @@ ring_is_full:
 static void tpacket_destruct_skb(struct sk_buff *skb)
 {
         struct packet_sock *po = pkt_sk(skb->sk);
-        void * ph;
+        void *ph;
 
         BUG_ON(skb == NULL);
 
@@ -836,9 +836,9 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
         sock_wfree(skb);
 }
 
-static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff * skb,
-                void * frame, struct net_device *dev, int size_max,
-                __be16 proto, unsigned char * addr)
+static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
+                void *frame, struct net_device *dev, int size_max,
+                __be16 proto, unsigned char *addr)
 {
         union {
                 struct tpacket_hdr *h1;
@@ -867,8 +867,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff * skb,
                 break;
         }
         if (unlikely(tp_len > size_max)) {
-                printk(KERN_ERR "packet size is too long (%d > %d)\n",
-                                tp_len, size_max);
+                pr_err("packet size is too long (%d > %d)\n", tp_len, size_max);
                 return -EMSGSIZE;
         }
 
@@ -883,12 +882,11 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff * skb,
                                 NULL, tp_len);
                 if (unlikely(err < 0))
                         return -EINVAL;
-        } else if (dev->hard_header_len ) {
+        } else if (dev->hard_header_len) {
                 /* net device doesn't like empty head */
                 if (unlikely(tp_len <= dev->hard_header_len)) {
-                        printk(KERN_ERR "packet size is too short "
-                                        "(%d < %d)\n", tp_len,
-                                        dev->hard_header_len);
+                        pr_err("packet size is too short (%d < %d)\n",
+                               tp_len, dev->hard_header_len);
                         return -EINVAL;
                 }
 
@@ -917,9 +915,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff * skb,
                 nr_frags = skb_shinfo(skb)->nr_frags;
 
                 if (unlikely(nr_frags >= MAX_SKB_FRAGS)) {
-                        printk(KERN_ERR "Packet exceed the number "
-                                        "of skb frags(%lu)\n",
-                                        MAX_SKB_FRAGS);
+                        pr_err("Packet exceed the number of skb frags(%lu)\n",
+                               MAX_SKB_FRAGS);
                         return -EFAULT;
                 }
 
@@ -944,8 +941,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         struct net_device *dev;
         __be16 proto;
         int ifindex, err, reserve = 0;
-        void * ph;
-        struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
+        void *ph;
+        struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
         int tp_len, size_max;
         unsigned char *addr;
         int len_sum = 0;
@@ -1038,8 +1035,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                         goto out_xmit;
                 packet_increment_head(&po->tx_ring);
                 len_sum += tp_len;
-        }
-        while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT))
+        } while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT))
                                         && (atomic_read(&po->tx_ring.pending))))
               );
 
@@ -1064,7 +1060,7 @@ static int packet_snd(struct socket *sock,
                           struct msghdr *msg, size_t len)
 {
         struct sock *sk = sock->sk;
-        struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
+        struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
         struct sk_buff *skb;
         struct net_device *dev;
         __be16 proto;
@@ -1110,7 +1106,7 @@ static int packet_snd(struct socket *sock,
 
         skb = sock_alloc_send_skb(sk, len + LL_ALLOCATED_SPACE(dev),
                                 msg->msg_flags & MSG_DONTWAIT, &err);
-        if (skb==NULL)
+        if (skb == NULL)
                 goto out_unlock;
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
@@ -1122,7 +1118,7 @@ static int packet_snd(struct socket *sock,
                 goto out_free;
 
         /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
+        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
         if (err)
                 goto out_free;
 
@@ -1140,7 +1136,7 @@ static int packet_snd(struct socket *sock,
 
         dev_put(dev);
 
-        return(len);
+        return len;
 
 out_free:
         kfree_skb(skb);
@@ -1283,9 +1279,10 @@ out_unlock:
  *      Bind a packet socket to a device
  */
 
-static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
+                            int addr_len)
 {
-        struct sock *sk=sock->sk;
+        struct sock *sk = sock->sk;
         char name[15];
         struct net_device *dev;
         int err = -ENODEV;
@@ -1296,7 +1293,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int add
 
         if (addr_len != sizeof(struct sockaddr))
                 return -EINVAL;
-        strlcpy(name,uaddr->sa_data,sizeof(name));
+        strlcpy(name, uaddr->sa_data, sizeof(name));
 
         dev = dev_get_by_name(sock_net(sk), name);
         if (dev) {
@@ -1308,8 +1305,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int add
 
 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
-        struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
-        struct sock *sk=sock->sk;
+        struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
+        struct sock *sk = sock->sk;
         struct net_device *dev = NULL;
         int err;
 
@@ -1404,7 +1401,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
         sk_add_node(sk, &net->packet.sklist);
         sock_prot_inuse_add(net, &packet_proto, 1);
         write_unlock_bh(&net->packet.sklist_lock);
-        return(0);
+        return 0;
 out:
         return err;
 }
@@ -1441,7 +1438,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
          *      but then it will block.
          */
 
-        skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
+        skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
 
         /*
          *      An error occurred so return it. Because skb_recv_datagram()
@@ -1469,10 +1466,9 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
          */
 
         copied = skb->len;
-        if (copied > len)
-        {
-                copied=len;
-                msg->msg_flags|=MSG_TRUNC;
+        if (copied > len) {
+                copied = len;
+                msg->msg_flags |= MSG_TRUNC;
         }
 
         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
@@ -1539,7 +1535,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
         struct net_device *dev;
         struct sock *sk = sock->sk;
         struct packet_sock *po = pkt_sk(sk);
-        struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
+        struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
 
         if (peer)
                 return -EOPNOTSUPP;
@@ -1584,14 +1580,15 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
                 else
                         return dev_unicast_delete(dev, i->addr);
                 break;
-        default:;
+        default:
+                break;
         }
         return 0;
 }
 
 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
 {
-        for ( ; i; i=i->next) {
+        for ( ; i; i = i->next) {
                 if (i->ifindex == dev->ifindex)
                         packet_dev_mc(dev, i, what);
         }
@@ -1693,7 +1690,8 @@ static void packet_flush_mclist(struct sock *sk)
                 struct net_device *dev;
 
                 po->mclist = ml->next;
-                if ((dev = dev_get_by_index(sock_net(sk), ml->ifindex)) != NULL) {
+                dev = dev_get_by_index(sock_net(sk), ml->ifindex);
+                if (dev != NULL) {
                         packet_dev_mc(dev, ml, -1);
                         dev_put(dev);
                 }
@@ -1723,7 +1721,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                         return -EINVAL;
                 if (len > sizeof(mreq))
                         len = sizeof(mreq);
-                if (copy_from_user(&mreq,optval,len))
+                if (copy_from_user(&mreq, optval, len))
                         return -EFAULT;
                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
                         return -EINVAL;
@@ -1740,9 +1738,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
         {
                 struct tpacket_req req;
 
-                if (optlen<sizeof(req))
+                if (optlen < sizeof(req))
                         return -EINVAL;
-                if (copy_from_user(&req,optval,sizeof(req)))
+                if (copy_from_user(&req, optval, sizeof(req)))
                         return -EFAULT;
                 return packet_set_ring(sk, &req, 0, optname == PACKET_TX_RING);
         }
@@ -1750,9 +1748,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
         {
                 int val;
 
-                if (optlen!=sizeof(val))
+                if (optlen != sizeof(val))
                         return -EINVAL;
-                if (copy_from_user(&val,optval,sizeof(val)))
+                if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
 
                 pkt_sk(sk)->copy_thresh = val;
@@ -1985,51 +1983,51 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
         struct sock *sk = sock->sk;
 
         switch (cmd) {
-                case SIOCOUTQ:
-                {
-                        int amount = sk_wmem_alloc_get(sk);
+        case SIOCOUTQ:
+        {
+                int amount = sk_wmem_alloc_get(sk);
 
-                        return put_user(amount, (int __user *)arg);
-                }
-                case SIOCINQ:
-                {
-                        struct sk_buff *skb;
-                        int amount = 0;
-
-                        spin_lock_bh(&sk->sk_receive_queue.lock);
-                        skb = skb_peek(&sk->sk_receive_queue);
-                        if (skb)
-                                amount = skb->len;
-                        spin_unlock_bh(&sk->sk_receive_queue.lock);
-                        return put_user(amount, (int __user *)arg);
-                }
-                case SIOCGSTAMP:
-                        return sock_get_timestamp(sk, (struct timeval __user *)arg);
-                case SIOCGSTAMPNS:
-                        return sock_get_timestampns(sk, (struct timespec __user *)arg);
+                return put_user(amount, (int __user *)arg);
+        }
+        case SIOCINQ:
+        {
+                struct sk_buff *skb;
+                int amount = 0;
+
+                spin_lock_bh(&sk->sk_receive_queue.lock);
+                skb = skb_peek(&sk->sk_receive_queue);
+                if (skb)
+                        amount = skb->len;
+                spin_unlock_bh(&sk->sk_receive_queue.lock);
+                return put_user(amount, (int __user *)arg);
+        }
+        case SIOCGSTAMP:
+                return sock_get_timestamp(sk, (struct timeval __user *)arg);
+        case SIOCGSTAMPNS:
+                return sock_get_timestampns(sk, (struct timespec __user *)arg);
 
 #ifdef CONFIG_INET
-                case SIOCADDRT:
-                case SIOCDELRT:
-                case SIOCDARP:
-                case SIOCGARP:
-                case SIOCSARP:
-                case SIOCGIFADDR:
-                case SIOCSIFADDR:
-                case SIOCGIFBRDADDR:
-                case SIOCSIFBRDADDR:
-                case SIOCGIFNETMASK:
-                case SIOCSIFNETMASK:
-                case SIOCGIFDSTADDR:
-                case SIOCSIFDSTADDR:
-                case SIOCSIFFLAGS:
-                        if (!net_eq(sock_net(sk), &init_net))
-                                return -ENOIOCTLCMD;
-                        return inet_dgram_ops.ioctl(sock, cmd, arg);
+        case SIOCADDRT:
+        case SIOCDELRT:
+        case SIOCDARP:
+        case SIOCGARP:
+        case SIOCSARP:
+        case SIOCGIFADDR:
+        case SIOCSIFADDR:
+        case SIOCGIFBRDADDR:
+        case SIOCSIFBRDADDR:
+        case SIOCGIFNETMASK:
+        case SIOCSIFNETMASK:
+        case SIOCGIFDSTADDR:
+        case SIOCSIFDSTADDR:
+        case SIOCSIFFLAGS:
+                if (!net_eq(sock_net(sk), &init_net))
+                        return -ENOIOCTLCMD;
+                return inet_dgram_ops.ioctl(sock, cmd, arg);
 #endif
 
-                default:
-                        return -ENOIOCTLCMD;
+        default:
+                return -ENOIOCTLCMD;
         }
         return 0;
 }
@@ -2039,7 +2037,7 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
 #define packet_poll datagram_poll
 #else
 
-static unsigned int packet_poll(struct file * file, struct socket *sock,
+static unsigned int packet_poll(struct file *file, struct socket *sock,
                                 poll_table *wait)
 {
         struct sock *sk = sock->sk;
@@ -2069,7 +2067,7 @@ static unsigned int packet_poll(struct file * file, struct socket *sock,
 static void packet_mm_open(struct vm_area_struct *vma)
 {
         struct file *file = vma->vm_file;
-        struct socket * sock = file->private_data;
+        struct socket *sock = file->private_data;
         struct sock *sk = sock->sk;
 
         if (sk)
@@ -2079,7 +2077,7 @@ static void packet_mm_open(struct vm_area_struct *vma)
 static void packet_mm_close(struct vm_area_struct *vma)
 {
         struct file *file = vma->vm_file;
-        struct socket * sock = file->private_data;
+        struct socket *sock = file->private_data;
         struct sock *sk = sock->sk;
 
         if (sk)
@@ -2087,8 +2085,8 @@ static void packet_mm_close(struct vm_area_struct *vma)
 }
 
 static struct vm_operations_struct packet_mmap_ops = {
-        .open = packet_mm_open,
-        .close =packet_mm_close,
+        .open   =       packet_mm_open,
+        .close  =       packet_mm_close,
 };
 
 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
@@ -2239,8 +2237,8 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
                 skb_queue_purge(rb_queue);
 #undef XC
                 if (atomic_read(&po->mapped))
-                        printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n",
-                                                atomic_read(&po->mapped));
+                        pr_err("packet_mmap: vma is busy: %d\n",
+                               atomic_read(&po->mapped));
         }
         mutex_unlock(&po->pg_vec_lock);
 
@@ -2303,7 +2301,7 @@ static int packet_mmap(struct file *file, struct socket *sock,
                         int pg_num;
 
                         for (pg_num = 0; pg_num < rb->pg_vec_pages;
-                                        pg_num++,page++) {
+                                        pg_num++, page++) {
                                 err = vm_insert_page(vma, start, page);
                                 if (unlikely(err))
                                         goto out;
@@ -2372,7 +2370,7 @@ static struct net_proto_family packet_family_ops = {
 };
 
 static struct notifier_block packet_netdev_notifier = {
-        .notifier_call =packet_notifier,
+        .notifier_call =        packet_notifier,
 };
 
 #ifdef CONFIG_PROC_FS
@@ -2402,7 +2400,7 @@ static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         ++*pos;
         return  (v == SEQ_START_TOKEN)
                 ? sk_head(&net->packet.sklist)
-                : sk_next((struct sock*)v) ;
+                : sk_next((struct sock *)v) ;
 }
 
 static void packet_seq_stop(struct seq_file *seq, void *v)
@@ -2430,7 +2428,7 @@ static int packet_seq_show(struct seq_file *seq, void *v)
                            po->running,
                            atomic_read(&s->sk_rmem_alloc),
                            sock_i_uid(s),
-                           sock_i_ino(s) );
+                           sock_i_ino(s));
         }
 
         return 0;
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index e087862ed7e4..ef5c75c372e4 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -159,8 +159,11 @@ out_nofree:
 static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         int err = sock_queue_rcv_skb(sk, skb);
-        if (err < 0)
+        if (err < 0) {
                 kfree_skb(skb);
+                if (err == -ENOMEM)
+                        atomic_inc(&sk->sk_drops);
+        }
         return err ? NET_RX_DROP : NET_RX_SUCCESS;
 }
 
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 480839dfc560..4667af51ed71 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -195,7 +195,7 @@ static int gprs_xmit(struct sk_buff *skb, struct net_device *dev)
                 break;
         default:
                 dev_kfree_skb(skb);
-                return 0;
+                return NETDEV_TX_OK;
         }
 
         skb_orphan(skb);
@@ -215,7 +215,7 @@ static int gprs_xmit(struct sk_buff *skb, struct net_device *dev)
         netif_stop_queue(dev);
         if (pep_writeable(sk))
                 netif_wake_queue(dev);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int gprs_set_mtu(struct net_device *dev, int new_mtu)
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index eef833ea6d7b..b8252d289cd7 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -346,8 +346,10 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                 break;
 
         case PNS_PEP_CTRL_REQ:
-                if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX)
+                if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
+                        atomic_inc(&sk->sk_drops);
                         break;
+                }
                 __skb_pull(skb, 4);
                 queue = &pn->ctrlreq_queue;
                 goto queue;
@@ -358,10 +360,13 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                         err = sock_queue_rcv_skb(sk, skb);
                         if (!err)
                                 return 0;
+                        if (err == -ENOMEM)
+                                atomic_inc(&sk->sk_drops);
                         break;
                 }
 
                 if (pn->rx_credits == 0) {
+                        atomic_inc(&sk->sk_drops);
                         err = -ENOBUFS;
                         break;
                 }
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index c2b77a698695..5ae4c01e8388 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -27,6 +27,7 @@
 #include <linux/net.h>
 #include <linux/netdevice.h>
 #include <linux/phonet.h>
+#include <linux/proc_fs.h>
 #include <net/sock.h>
 #include <net/netns/generic.h>
 #include <net/phonet/pn_dev.h>
@@ -218,6 +219,11 @@ static int phonet_init_net(struct net *net)
         if (!pnn)
                 return -ENOMEM;
 
+        if (!proc_net_fops_create(net, "phonet", 0, &pn_sock_seq_fops)) {
+                kfree(pnn);
+                return -ENOMEM;
+        }
+
         INIT_LIST_HEAD(&pnn->pndevs.list);
         spin_lock_init(&pnn->pndevs.lock);
         net_assign_generic(net, phonet_net_id, pnn);
@@ -233,6 +239,8 @@ static void phonet_exit_net(struct net *net)
         for_each_netdev(net, dev)
                 phonet_device_destroy(dev);
         rtnl_unlock();
+
+        proc_net_remove(net, "phonet");
         kfree(pnn);
 }
 
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index ada2a35bf7a2..5f26c3711a1e 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -412,3 +412,100 @@ found:
         return 0;
 }
 EXPORT_SYMBOL(pn_sock_get_port);
+
+static struct sock *pn_sock_get_idx(struct seq_file *seq, loff_t pos)
+{
+        struct net *net = seq_file_net(seq);
+        struct hlist_node *node;
+        struct sock *sknode;
+
+        sk_for_each(sknode, node, &pnsocks.hlist) {
+                if (!net_eq(net, sock_net(sknode)))
+                        continue;
+                if (!pos)
+                        return sknode;
+                pos--;
+        }
+        return NULL;
+}
+
+static struct sock *pn_sock_get_next(struct seq_file *seq, struct sock *sk)
+{
+        struct net *net = seq_file_net(seq);
+
+        do
+                sk = sk_next(sk);
+        while (sk && !net_eq(net, sock_net(sk)));
+
+        return sk;
+}
+
+static void *pn_sock_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(pnsocks.lock)
+{
+        spin_lock_bh(&pnsocks.lock);
+        return *pos ? pn_sock_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
+}
+
+static void *pn_sock_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct sock *sk;
+
+        if (v == SEQ_START_TOKEN)
+                sk = pn_sock_get_idx(seq, 0);
+        else
+                sk = pn_sock_get_next(seq, v);
+        (*pos)++;
+        return sk;
+}
+
+static void pn_sock_seq_stop(struct seq_file *seq, void *v)
+        __releases(pnsocks.lock)
+{
+        spin_unlock_bh(&pnsocks.lock);
+}
+
+static int pn_sock_seq_show(struct seq_file *seq, void *v)
+{
+        int len;
+
+        if (v == SEQ_START_TOKEN)
+                seq_printf(seq, "%s%n", "pt  loc  rem rs st tx_queue rx_queue "
+                        "  uid inode ref pointer drops", &len);
+        else {
+                struct sock *sk = v;
+                struct pn_sock *pn = pn_sk(sk);
+
+                seq_printf(seq, "%2d %04X:%04X:%02X %02X %08X:%08X %5d %lu "
+                        "%d %p %d%n",
+                        sk->sk_protocol, pn->sobject, 0, pn->resource,
+                        sk->sk_state,
+                        sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
+                        sock_i_uid(sk), sock_i_ino(sk),
+                        atomic_read(&sk->sk_refcnt), sk,
+                        atomic_read(&sk->sk_drops), &len);
+        }
+        seq_printf(seq, "%*s\n", 127 - len, "");
+        return 0;
+}
+
+static const struct seq_operations pn_sock_seq_ops = {
+        .start = pn_sock_seq_start,
+        .next = pn_sock_seq_next,
+        .stop = pn_sock_seq_stop,
+        .show = pn_sock_seq_show,
+};
+
+static int pn_sock_open(struct inode *inode, struct file *file)
+{
+        return seq_open_net(inode, file, &pn_sock_seq_ops,
+                                sizeof(struct seq_net_private));
+}
+
+const struct file_operations pn_sock_seq_fops = {
+        .owner = THIS_MODULE,
+        .open = pn_sock_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = seq_release_net,
+};
diff --git a/net/rds/connection.c b/net/rds/connection.c
index d14445c48304..b420a20d84fd 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -126,7 +126,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
                                        struct rds_transport *trans, gfp_t gfp,
                                        int is_outgoing)
 {
-        struct rds_connection *conn, *tmp, *parent = NULL;
+        struct rds_connection *conn, *parent = NULL;
         struct hlist_head *head = rds_conn_bucket(laddr, faddr);
         unsigned long flags;
         int ret;
@@ -155,7 +155,6 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
         }
 
         INIT_HLIST_NODE(&conn->c_hash_node);
-        conn->c_version = RDS_PROTOCOL_3_0;
         conn->c_laddr = laddr;
         conn->c_faddr = faddr;
         spin_lock_init(&conn->c_lock);
@@ -211,26 +210,40 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
           trans->t_name ? trans->t_name : "[unknown]",
           is_outgoing ? "(outgoing)" : "");
 
+        /*
+         * Since we ran without holding the conn lock, someone could
+         * have created the same conn (either normal or passive) in the
+         * interim. We check while holding the lock. If we won, we complete
+         * init and return our conn. If we lost, we rollback and return the
+         * other one.
+         */
         spin_lock_irqsave(&rds_conn_lock, flags);
-        if (parent == NULL) {
-                tmp = rds_conn_lookup(head, laddr, faddr, trans);
-                if (tmp == NULL)
-                        hlist_add_head(&conn->c_hash_node, head);
-        } else {
-                tmp = parent->c_passive;
-                if (!tmp)
+        if (parent) {
+                /* Creating passive conn */
+                if (parent->c_passive) {
+                        trans->conn_free(conn->c_transport_data);
+                        kmem_cache_free(rds_conn_slab, conn);
+                        conn = parent->c_passive;
+                } else {
                         parent->c_passive = conn;
-        }
-
-        if (tmp) {
-                trans->conn_free(conn->c_transport_data);
-                kmem_cache_free(rds_conn_slab, conn);
-                conn = tmp;
+                        rds_cong_add_conn(conn);
+                        rds_conn_count++;
+                }
         } else {
-                rds_cong_add_conn(conn);
-                rds_conn_count++;
+                /* Creating normal conn */
+                struct rds_connection *found;
+
+                found = rds_conn_lookup(head, laddr, faddr, trans);
+                if (found) {
+                        trans->conn_free(conn->c_transport_data);
+                        kmem_cache_free(rds_conn_slab, conn);
+                        conn = found;
+                } else {
+                        hlist_add_head(&conn->c_hash_node, head);
+                        rds_cong_add_conn(conn);
+                        rds_conn_count++;
+                }
         }
-
         spin_unlock_irqrestore(&rds_conn_lock, flags);
 
 out:
diff --git a/net/rds/ib.c b/net/rds/ib.c
index b9bcd32431e1..868559ac42d7 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -43,11 +43,14 @@
 
 unsigned int fmr_pool_size = RDS_FMR_POOL_SIZE;
 unsigned int fmr_message_size = RDS_FMR_SIZE + 1; /* +1 allows for unaligned MRs */
+unsigned int rds_ib_retry_count = RDS_IB_DEFAULT_RETRY_COUNT;
 
 module_param(fmr_pool_size, int, 0444);
 MODULE_PARM_DESC(fmr_pool_size, " Max number of fmr per HCA");
 module_param(fmr_message_size, int, 0444);
 MODULE_PARM_DESC(fmr_message_size, " Max size of a RDMA transfer");
+module_param(rds_ib_retry_count, int, 0444);
+MODULE_PARM_DESC(rds_ib_retry_count, " Number of hw retries before reporting an error");
 
 struct list_head rds_ib_devices;
 
@@ -82,9 +85,6 @@ void rds_ib_add_one(struct ib_device *device)
         rds_ibdev->max_wrs = dev_attr->max_qp_wr;
         rds_ibdev->max_sge = min(dev_attr->max_sge, RDS_IB_MAX_SGE);
 
-        rds_ibdev->fmr_page_shift = max(9, ffs(dev_attr->page_size_cap) - 1);
-        rds_ibdev->fmr_page_size  = 1 << rds_ibdev->fmr_page_shift;
-        rds_ibdev->fmr_page_mask  = ~((u64) rds_ibdev->fmr_page_size - 1);
         rds_ibdev->fmr_max_remaps = dev_attr->max_map_per_fmr?: 32;
         rds_ibdev->max_fmrs = dev_attr->max_fmr ?
                         min_t(unsigned int, dev_attr->max_fmr, fmr_pool_size) :
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 455ae73047fe..1378b854cac0 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -15,6 +15,8 @@
 #define RDS_IB_DEFAULT_RECV_WR          1024
 #define RDS_IB_DEFAULT_SEND_WR          256
 
+#define RDS_IB_DEFAULT_RETRY_COUNT      2
+
 #define RDS_IB_SUPPORTED_PROTOCOLS      0x00000003      /* minor versions supported */
 
 extern struct list_head rds_ib_devices;
@@ -157,9 +159,6 @@ struct rds_ib_device {
         struct ib_pd            *pd;
         struct ib_mr            *mr;
         struct rds_ib_mr_pool   *mr_pool;
-        int                     fmr_page_shift;
-        int                     fmr_page_size;
-        u64                     fmr_page_mask;
         unsigned int            fmr_max_remaps;
         unsigned int            max_fmrs;
         int                     max_sge;
@@ -247,6 +246,7 @@ extern struct ib_client rds_ib_client;
 
 extern unsigned int fmr_pool_size;
 extern unsigned int fmr_message_size;
+extern unsigned int rds_ib_retry_count;
 
 extern spinlock_t ib_nodev_conns_lock;
 extern struct list_head ib_nodev_conns;
@@ -355,17 +355,25 @@ extern ctl_table rds_ib_sysctl_table[];
 /*
  * Helper functions for getting/setting the header and data SGEs in
  * RDS packets (not RDMA)
+ *
+ * From version 3.1 onwards, header is in front of data in the sge.
  */
 static inline struct ib_sge *
 rds_ib_header_sge(struct rds_ib_connection *ic, struct ib_sge *sge)
 {
-        return &sge[0];
+        if (ic->conn->c_version > RDS_PROTOCOL_3_0)
+                return &sge[0];
+        else
+                return &sge[1];
 }
 
 static inline struct ib_sge *
 rds_ib_data_sge(struct rds_ib_connection *ic, struct ib_sge *sge)
 {
-        return &sge[1];
+        if (ic->conn->c_version > RDS_PROTOCOL_3_0)
+                return &sge[1];
+        else
+                return &sge[0];
 }
 
 #endif
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index f8e40e1a6038..c2d372f13dbb 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -98,21 +98,34 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
         struct ib_qp_attr qp_attr;
         int err;
 
-        if (event->param.conn.private_data_len) {
+        if (event->param.conn.private_data_len >= sizeof(*dp)) {
                 dp = event->param.conn.private_data;
 
-                rds_ib_set_protocol(conn,
+                /* make sure it isn't empty data */
+                if (dp->dp_protocol_major) {
+                        rds_ib_set_protocol(conn,
                                 RDS_PROTOCOL(dp->dp_protocol_major,
-                                        dp->dp_protocol_minor));
-                rds_ib_set_flow_control(conn, be32_to_cpu(dp->dp_credit));
+                                dp->dp_protocol_minor));
+                        rds_ib_set_flow_control(conn, be32_to_cpu(dp->dp_credit));
+                }
         }
 
         printk(KERN_NOTICE "RDS/IB: connected to %pI4 version %u.%u%s\n",
-                        &conn->c_laddr,
+                        &conn->c_faddr,
                         RDS_PROTOCOL_MAJOR(conn->c_version),
                         RDS_PROTOCOL_MINOR(conn->c_version),
                         ic->i_flowctl ? ", flow control" : "");
 
+        /*
+         * Init rings and fill recv. this needs to wait until protocol negotiation
+         * is complete, since ring layout is different from 3.0 to 3.1.
+         */
+        rds_ib_send_init_ring(ic);
+        rds_ib_recv_init_ring(ic);
+        /* Post receive buffers - as a side effect, this will update
+         * the posted credit count. */
+        rds_ib_recv_refill(conn, GFP_KERNEL, GFP_HIGHUSER, 1);
+
         /* Tune RNR behavior */
         rds_ib_tune_rnr(ic, &qp_attr);
 
@@ -145,7 +158,7 @@ static void rds_ib_cm_fill_conn_param(struct rds_connection *conn,
         /* XXX tune these? */
         conn_param->responder_resources = 1;
         conn_param->initiator_depth = 1;
-        conn_param->retry_count = 7;
+        conn_param->retry_count = min_t(unsigned int, rds_ib_retry_count, 7);
         conn_param->rnr_retry_count = 7;
 
         if (dp) {
@@ -190,9 +203,9 @@ static void rds_ib_qp_event_handler(struct ib_event *event, void *data)
                 rdma_notify(ic->i_cm_id, IB_EVENT_COMM_EST);
                 break;
         default:
-                printk(KERN_WARNING "RDS/ib: unhandled QP event %u "
-                       "on connection to %pI4\n", event->event,
-                       &conn->c_faddr);
+                rds_ib_conn_error(conn, "RDS/IB: Fatal QP Event %u "
+                        "- connection %pI4->%pI4, reconnecting\n",
+                        event->event, &conn->c_laddr, &conn->c_faddr);
                 break;
         }
 }
@@ -321,7 +334,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 rdsdebug("send allocation failed\n");
                 goto out;
         }
-        rds_ib_send_init_ring(ic);
+        memset(ic->i_sends, 0, ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work));
 
         ic->i_recvs = vmalloc(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work));
         if (ic->i_recvs == NULL) {
@@ -329,14 +342,10 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 rdsdebug("recv allocation failed\n");
                 goto out;
         }
+        memset(ic->i_recvs, 0, ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work));
 
-        rds_ib_recv_init_ring(ic);
         rds_ib_recv_init_ack(ic);
 
-        /* Post receive buffers - as a side effect, this will update
-         * the posted credit count. */
-        rds_ib_recv_refill(conn, GFP_KERNEL, GFP_HIGHUSER, 1);
-
         rdsdebug("conn %p pd %p mr %p cq %p %p\n", conn, ic->i_pd, ic->i_mr,
                  ic->i_send_cq, ic->i_recv_cq);
 
@@ -344,19 +353,32 @@ out:
         return ret;
 }
 
-static u32 rds_ib_protocol_compatible(const struct rds_ib_connect_private *dp)
+static u32 rds_ib_protocol_compatible(struct rdma_cm_event *event)
 {
+        const struct rds_ib_connect_private *dp = event->param.conn.private_data;
         u16 common;
         u32 version = 0;
 
-        /* rdma_cm private data is odd - when there is any private data in the
+        /*
+         * rdma_cm private data is odd - when there is any private data in the
          * request, we will be given a pretty large buffer without telling us the
          * original size. The only way to tell the difference is by looking at
          * the contents, which are initialized to zero.
          * If the protocol version fields aren't set, this is a connection attempt
          * from an older version. This could could be 3.0 or 2.0 - we can't tell.
-         * We really should have changed this for OFED 1.3 :-( */
-        if (dp->dp_protocol_major == 0)
+         * We really should have changed this for OFED 1.3 :-(
+         */
+
+        /* Be paranoid. RDS always has privdata */
+        if (!event->param.conn.private_data_len) {
+                printk(KERN_NOTICE "RDS incoming connection has no private data, "
+                        "rejecting\n");
+                return 0;
+        }
+
+        /* Even if len is crap *now* I still want to check it. -ASG */
+        if (event->param.conn.private_data_len < sizeof (*dp)
+            || dp->dp_protocol_major == 0)
                 return RDS_PROTOCOL_3_0;
 
         common = be16_to_cpu(dp->dp_protocol_minor_mask) & RDS_IB_SUPPORTED_PROTOCOLS;
@@ -388,7 +410,7 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
         int err, destroy = 1;
 
         /* Check whether the remote protocol version matches ours. */
-        version = rds_ib_protocol_compatible(dp);
+        version = rds_ib_protocol_compatible(event);
         if (!version)
                 goto out;
 
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 81033af93020..ef3ab5b7283e 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -211,7 +211,7 @@ struct rds_ib_mr_pool *rds_ib_create_mr_pool(struct rds_ib_device *rds_ibdev)
 
         pool->fmr_attr.max_pages = fmr_message_size;
         pool->fmr_attr.max_maps = rds_ibdev->fmr_max_remaps;
-        pool->fmr_attr.page_shift = rds_ibdev->fmr_page_shift;
+        pool->fmr_attr.page_shift = PAGE_SHIFT;
         pool->max_free_pinned = rds_ibdev->max_fmrs * fmr_message_size / 4;
 
         /* We never allow more than max_items MRs to be allocated.
@@ -349,13 +349,13 @@ static int rds_ib_map_fmr(struct rds_ib_device *rds_ibdev, struct rds_ib_mr *ibm
                 unsigned int dma_len = ib_sg_dma_len(dev, &scat[i]);
                 u64 dma_addr = ib_sg_dma_address(dev, &scat[i]);
 
-                if (dma_addr & ~rds_ibdev->fmr_page_mask) {
+                if (dma_addr & ~PAGE_MASK) {
                         if (i > 0)
                                 return -EINVAL;
                         else
                                 ++page_cnt;
                 }
-                if ((dma_addr + dma_len) & ~rds_ibdev->fmr_page_mask) {
+                if ((dma_addr + dma_len) & ~PAGE_MASK) {
                         if (i < sg_dma_len - 1)
                                 return -EINVAL;
                         else
@@ -365,7 +365,7 @@ static int rds_ib_map_fmr(struct rds_ib_device *rds_ibdev, struct rds_ib_mr *ibm
                 len += dma_len;
         }
 
-        page_cnt += len >> rds_ibdev->fmr_page_shift;
+        page_cnt += len >> PAGE_SHIFT;
         if (page_cnt > fmr_message_size)
                 return -EINVAL;
 
@@ -378,9 +378,9 @@ static int rds_ib_map_fmr(struct rds_ib_device *rds_ibdev, struct rds_ib_mr *ibm
                 unsigned int dma_len = ib_sg_dma_len(dev, &scat[i]);
                 u64 dma_addr = ib_sg_dma_address(dev, &scat[i]);
 
-                for (j = 0; j < dma_len; j += rds_ibdev->fmr_page_size)
+                for (j = 0; j < dma_len; j += PAGE_SIZE)
                         dma_pages[page_cnt++] =
-                                (dma_addr & rds_ibdev->fmr_page_mask) + j;
+                                (dma_addr & PAGE_MASK) + j;
         }
 
         ret = ib_map_phys_fmr(ibmr->fmr,
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 5709bad28329..cd7a6cfcab03 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -555,6 +555,47 @@ u64 rds_ib_piggyb_ack(struct rds_ib_connection *ic)
         return rds_ib_get_ack(ic);
 }
 
+static struct rds_header *rds_ib_get_header(struct rds_connection *conn,
+                                            struct rds_ib_recv_work *recv,
+                                            u32 data_len)
+{
+        struct rds_ib_connection *ic = conn->c_transport_data;
+        void *hdr_buff = &ic->i_recv_hdrs[recv - ic->i_recvs];
+        void *addr;
+        u32 misplaced_hdr_bytes;
+
+        /*
+         * Support header at the front (RDS 3.1+) as well as header-at-end.
+         *
+         * Cases:
+         * 1) header all in header buff (great!)
+         * 2) header all in data page (copy all to header buff)
+         * 3) header split across hdr buf + data page
+         *    (move bit in hdr buff to end before copying other bit from data page)
+         */
+        if (conn->c_version > RDS_PROTOCOL_3_0 || data_len == RDS_FRAG_SIZE)
+                return hdr_buff;
+
+        if (data_len <= (RDS_FRAG_SIZE - sizeof(struct rds_header))) {
+                addr = kmap_atomic(recv->r_frag->f_page, KM_SOFTIRQ0);
+                memcpy(hdr_buff,
+                       addr + recv->r_frag->f_offset + data_len,
+                       sizeof(struct rds_header));
+                kunmap_atomic(addr, KM_SOFTIRQ0);
+                return hdr_buff;
+        }
+
+        misplaced_hdr_bytes = (sizeof(struct rds_header) - (RDS_FRAG_SIZE - data_len));
+
+        memmove(hdr_buff + misplaced_hdr_bytes, hdr_buff, misplaced_hdr_bytes);
+
+        addr = kmap_atomic(recv->r_frag->f_page, KM_SOFTIRQ0);
+        memcpy(hdr_buff, addr + recv->r_frag->f_offset + data_len,
+               sizeof(struct rds_header) - misplaced_hdr_bytes);
+        kunmap_atomic(addr, KM_SOFTIRQ0);
+        return hdr_buff;
+}
+
 /*
  * It's kind of lame that we're copying from the posted receive pages into
  * long-lived bitmaps.  We could have posted the bitmaps and rdma written into
@@ -645,7 +686,7 @@ struct rds_ib_ack_state {
 };
 
 static void rds_ib_process_recv(struct rds_connection *conn,
-                                struct rds_ib_recv_work *recv, u32 byte_len,
+                                struct rds_ib_recv_work *recv, u32 data_len,
                                 struct rds_ib_ack_state *state)
 {
         struct rds_ib_connection *ic = conn->c_transport_data;
@@ -655,9 +696,9 @@ static void rds_ib_process_recv(struct rds_connection *conn,
         /* XXX shut down the connection if port 0,0 are seen? */
 
         rdsdebug("ic %p ibinc %p recv %p byte len %u\n", ic, ibinc, recv,
-                 byte_len);
+                 data_len);
 
-        if (byte_len < sizeof(struct rds_header)) {
+        if (data_len < sizeof(struct rds_header)) {
                 rds_ib_conn_error(conn, "incoming message "
                        "from %pI4 didn't inclue a "
                        "header, disconnecting and "
@@ -665,9 +706,9 @@ static void rds_ib_process_recv(struct rds_connection *conn,
                        &conn->c_faddr);
                 return;
         }
-        byte_len -= sizeof(struct rds_header);
+        data_len -= sizeof(struct rds_header);
 
-        ihdr = &ic->i_recv_hdrs[recv - ic->i_recvs];
+        ihdr = rds_ib_get_header(conn, recv, data_len);
 
         /* Validate the checksum. */
         if (!rds_message_verify_checksum(ihdr)) {
@@ -687,7 +728,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
         if (ihdr->h_credit)
                 rds_ib_send_add_credits(conn, ihdr->h_credit);
 
-        if (ihdr->h_sport == 0 && ihdr->h_dport == 0 && byte_len == 0) {
+        if (ihdr->h_sport == 0 && ihdr->h_dport == 0 && data_len == 0) {
                 /* This is an ACK-only packet. The fact that it gets
                  * special treatment here is that historically, ACKs
                  * were rather special beasts.
diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
index 02e3e3d50d4a..8d8488306fe4 100644
--- a/net/rds/ib_stats.c
+++ b/net/rds/ib_stats.c
@@ -39,7 +39,7 @@
 
 DEFINE_PER_CPU(struct rds_ib_statistics, rds_ib_stats) ____cacheline_aligned;
 
-static char *rds_ib_stat_names[] = {
+static const char *const rds_ib_stat_names[] = {
         "ib_connect_raced",
         "ib_listen_closed_stale",
         "ib_tx_cq_call",
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index d87830db93a0..84b5ffcb280f 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -53,7 +53,17 @@ unsigned long rds_ib_sysctl_max_unsig_bytes = (16 << 20);
 static unsigned long rds_ib_sysctl_max_unsig_bytes_min = 1;
 static unsigned long rds_ib_sysctl_max_unsig_bytes_max = ~0UL;
 
-unsigned int rds_ib_sysctl_flow_control = 1;
+/*
+ * This sysctl does nothing.
+ *
+ * Backwards compatibility with RDS 3.0 wire protocol
+ * disables initial FC credit exchange.
+ * If it's ever possible to drop 3.0 support,
+ * setting this to 1 and moving init/refill of send/recv
+ * rings from ib_cm_connect_complete() back into ib_setup_qp()
+ * will cause credits to be added before protocol negotiation.
+ */
+unsigned int rds_ib_sysctl_flow_control = 0;
 
 ctl_table rds_ib_sysctl_table[] = {
         {
diff --git a/net/rds/iw.c b/net/rds/iw.c
index d16e1cbc8e83..f5e9a29a80a7 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -83,23 +83,16 @@ void rds_iw_add_one(struct ib_device *device)
         rds_iwdev->max_wrs = dev_attr->max_qp_wr;
         rds_iwdev->max_sge = min(dev_attr->max_sge, RDS_IW_MAX_SGE);
 
-        rds_iwdev->page_shift = max(PAGE_SHIFT, ffs(dev_attr->page_size_cap) - 1);
-
         rds_iwdev->dev = device;
         rds_iwdev->pd = ib_alloc_pd(device);
         if (IS_ERR(rds_iwdev->pd))
                 goto free_dev;
 
         if (!rds_iwdev->dma_local_lkey) {
-                if (device->node_type != RDMA_NODE_RNIC) {
-                        rds_iwdev->mr = ib_get_dma_mr(rds_iwdev->pd,
-                                                IB_ACCESS_LOCAL_WRITE);
-                } else {
-                        rds_iwdev->mr = ib_get_dma_mr(rds_iwdev->pd,
-                                                IB_ACCESS_REMOTE_READ |
-                                                IB_ACCESS_REMOTE_WRITE |
-                                                IB_ACCESS_LOCAL_WRITE);
-                }
+                rds_iwdev->mr = ib_get_dma_mr(rds_iwdev->pd,
+                                        IB_ACCESS_REMOTE_READ |
+                                        IB_ACCESS_REMOTE_WRITE |
+                                        IB_ACCESS_LOCAL_WRITE);
                 if (IS_ERR(rds_iwdev->mr))
                         goto err_pd;
         } else
diff --git a/net/rds/iw.h b/net/rds/iw.h
index 0715dde323e7..dd72b62bd506 100644
--- a/net/rds/iw.h
+++ b/net/rds/iw.h
@@ -181,7 +181,6 @@ struct rds_iw_device {
         struct ib_pd            *pd;
         struct ib_mr            *mr;
         struct rds_iw_mr_pool   *mr_pool;
-        int                     page_shift;
         int                     max_sge;
         unsigned int            max_wrs;
         unsigned int            dma_local_lkey:1;
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index dcdb37da80f2..de4a1b16bf7b 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -263,18 +263,12 @@ static void rds_iw_set_scatterlist(struct rds_iw_scatterlist *sg,
 }
 
 static u64 *rds_iw_map_scatterlist(struct rds_iw_device *rds_iwdev,
-                        struct rds_iw_scatterlist *sg,
-                        unsigned int dma_page_shift)
+                        struct rds_iw_scatterlist *sg)
 {
         struct ib_device *dev = rds_iwdev->dev;
         u64 *dma_pages = NULL;
-        u64 dma_mask;
-        unsigned int dma_page_size;
         int i, j, ret;
 
-        dma_page_size = 1 << dma_page_shift;
-        dma_mask = dma_page_size - 1;
-
         WARN_ON(sg->dma_len);
 
         sg->dma_len = ib_dma_map_sg(dev, sg->list, sg->len, DMA_BIDIRECTIONAL);
@@ -295,18 +289,18 @@ static u64 *rds_iw_map_scatterlist(struct rds_iw_device *rds_iwdev,
                 sg->bytes += dma_len;
 
                 end_addr = dma_addr + dma_len;
-                if (dma_addr & dma_mask) {
+                if (dma_addr & PAGE_MASK) {
                         if (i > 0)
                                 goto out_unmap;
-                        dma_addr &= ~dma_mask;
+                        dma_addr &= ~PAGE_MASK;
                 }
-                if (end_addr & dma_mask) {
+                if (end_addr & PAGE_MASK) {
                         if (i < sg->dma_len - 1)
                                 goto out_unmap;
-                        end_addr = (end_addr + dma_mask) & ~dma_mask;
+                        end_addr = (end_addr + PAGE_MASK) & ~PAGE_MASK;
                 }
 
-                sg->dma_npages += (end_addr - dma_addr) >> dma_page_shift;
+                sg->dma_npages += (end_addr - dma_addr) >> PAGE_SHIFT;
         }
 
         /* Now gather the dma addrs into one list */
@@ -325,8 +319,8 @@ static u64 *rds_iw_map_scatterlist(struct rds_iw_device *rds_iwdev,
                 u64 end_addr;
 
                 end_addr = dma_addr + dma_len;
-                dma_addr &= ~dma_mask;
-                for (; dma_addr < end_addr; dma_addr += dma_page_size)
+                dma_addr &= ~PAGE_MASK;
+                for (; dma_addr < end_addr; dma_addr += PAGE_SIZE)
                         dma_pages[j++] = dma_addr;
                 BUG_ON(j > sg->dma_npages);
         }
@@ -727,7 +721,7 @@ static int rds_iw_rdma_build_fastreg(struct rds_iw_mapping *mapping)
         f_wr.wr.fast_reg.rkey = mapping->m_rkey;
         f_wr.wr.fast_reg.page_list = ibmr->page_list;
         f_wr.wr.fast_reg.page_list_len = mapping->m_sg.dma_len;
-        f_wr.wr.fast_reg.page_shift = ibmr->device->page_shift;
+        f_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
         f_wr.wr.fast_reg.access_flags = IB_ACCESS_LOCAL_WRITE |
                                 IB_ACCESS_REMOTE_READ |
                                 IB_ACCESS_REMOTE_WRITE;
@@ -780,9 +774,7 @@ static int rds_iw_map_fastreg(struct rds_iw_mr_pool *pool,
 
         rds_iw_set_scatterlist(&mapping->m_sg, sg, sg_len);
 
-        dma_pages = rds_iw_map_scatterlist(rds_iwdev,
-                                &mapping->m_sg,
-                                rds_iwdev->page_shift);
+        dma_pages = rds_iw_map_scatterlist(rds_iwdev, &mapping->m_sg);
         if (IS_ERR(dma_pages)) {
                 ret = PTR_ERR(dma_pages);
                 dma_pages = NULL;
diff --git a/net/rds/iw_send.c b/net/rds/iw_send.c
index 44a6a0551f28..1f5abe3cf2b4 100644
--- a/net/rds/iw_send.c
+++ b/net/rds/iw_send.c
@@ -779,7 +779,7 @@ static void rds_iw_build_send_fastreg(struct rds_iw_device *rds_iwdev, struct rd
         send->s_wr.wr.fast_reg.rkey = send->s_mr->rkey;
         send->s_wr.wr.fast_reg.page_list = send->s_page_list;
         send->s_wr.wr.fast_reg.page_list_len = nent;
-        send->s_wr.wr.fast_reg.page_shift = rds_iwdev->page_shift;
+        send->s_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
         send->s_wr.wr.fast_reg.access_flags = IB_ACCESS_REMOTE_WRITE;
         send->s_wr.wr.fast_reg.iova_start = sg_addr;
 
diff --git a/net/rds/iw_stats.c b/net/rds/iw_stats.c
index ccc7e8f0bf0e..d33ea790484e 100644
--- a/net/rds/iw_stats.c
+++ b/net/rds/iw_stats.c
@@ -39,7 +39,7 @@
 
 DEFINE_PER_CPU(struct rds_iw_statistics, rds_iw_stats) ____cacheline_aligned;
 
-static char *rds_iw_stat_names[] = {
+static const char *const rds_iw_stat_names[] = {
         "iw_connect_raced",
         "iw_listen_closed_stale",
         "iw_tx_cq_call",
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 7d0f901c93d5..7a6c748cb56c 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -101,7 +101,7 @@ int rds_rdma_cm_event_handler(struct rdma_cm_id *cm_id,
                 break;
 
         case RDMA_CM_EVENT_DISCONNECTED:
-                printk(KERN_WARNING "RDS/IW: DISCONNECT event - dropping connection "
+                printk(KERN_WARNING "RDS/RDMA: DISCONNECT event - dropping connection "
                         "%pI4->%pI4\n", &conn->c_laddr,
                          &conn->c_faddr);
                 rds_conn_drop(conn);
@@ -132,12 +132,12 @@ static int __init rds_rdma_listen_init(void)
         cm_id = rdma_create_id(rds_rdma_cm_event_handler, NULL, RDMA_PS_TCP);
         if (IS_ERR(cm_id)) {
                 ret = PTR_ERR(cm_id);
-                printk(KERN_ERR "RDS/IW: failed to setup listener, "
+                printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
                        "rdma_create_id() returned %d\n", ret);
                 goto out;
         }
 
-        sin.sin_family = PF_INET,
+        sin.sin_family = AF_INET,
         sin.sin_addr.s_addr = (__force u32)htonl(INADDR_ANY);
         sin.sin_port = (__force u16)htons(RDS_PORT);
 
@@ -147,14 +147,14 @@ static int __init rds_rdma_listen_init(void)
          */
         ret = rdma_bind_addr(cm_id, (struct sockaddr *)&sin);
         if (ret) {
-                printk(KERN_ERR "RDS/IW: failed to setup listener, "
+                printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
                        "rdma_bind_addr() returned %d\n", ret);
                 goto out;
         }
 
         ret = rdma_listen(cm_id, 128);
         if (ret) {
-                printk(KERN_ERR "RDS/IW: failed to setup listener, "
+                printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
                        "rdma_listen() returned %d\n", ret);
                 goto out;
         }
diff --git a/net/rds/rds.h b/net/rds/rds.h
index dbe111236783..290566c69d28 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -652,7 +652,8 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct rds_statistics, rds_stats);
 int __init rds_stats_init(void);
 void rds_stats_exit(void);
 void rds_stats_info_copy(struct rds_info_iterator *iter,
-                         uint64_t *values, char **names, size_t nr);
+                         uint64_t *values, const char *const *names,
+                         size_t nr);
 
 /* sysctl.c */
 int __init rds_sysctl_init(void);
diff --git a/net/rds/recv.c b/net/rds/recv.c
index f2118c51cfa3..86bc1a06ebbd 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -409,18 +409,18 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (msg_flags & MSG_OOB)
                 goto out;
 
-        /* If there are pending notifications, do those - and nothing else */
-        if (!list_empty(&rs->rs_notify_queue)) {
-                ret = rds_notify_queue_get(rs, msg);
-                goto out;
-        }
+        while (1) {
+                /* If there are pending notifications, do those - and nothing else */
+                if (!list_empty(&rs->rs_notify_queue)) {
+                        ret = rds_notify_queue_get(rs, msg);
+                        break;
+                }
 
-        if (rs->rs_cong_notify) {
-                ret = rds_notify_cong(rs, msg);
-                goto out;
-        }
+                if (rs->rs_cong_notify) {
+                        ret = rds_notify_cong(rs, msg);
+                        break;
+                }
 
-        while (1) {
                 if (!rds_next_incoming(rs, &inc)) {
                         if (nonblock) {
                                 ret = -EAGAIN;
@@ -428,7 +428,9 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                         }
 
                         timeo = wait_event_interruptible_timeout(*sk->sk_sleep,
-                                                rds_next_incoming(rs, &inc),
+                                                (!list_empty(&rs->rs_notify_queue)
+                                                || rs->rs_cong_notify
+                                                || rds_next_incoming(rs, &inc)),
                                                 timeo);
                         rdsdebug("recvmsg woke inc %p timeo %ld\n", inc,
                                  timeo);
diff --git a/net/rds/stats.c b/net/rds/stats.c
index 637146893cf3..91d8c58b8335 100644
--- a/net/rds/stats.c
+++ b/net/rds/stats.c
@@ -40,7 +40,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_statistics, rds_stats);
 
 /* :.,$s/unsigned long\>.*\<s_\(.*\);/"\1",/g */
 
-static char *rds_stat_names[] = {
+static const char *const rds_stat_names[] = {
         "conn_reset",
         "recv_drop_bad_checksum",
         "recv_drop_old_seq",
@@ -77,7 +77,7 @@ static char *rds_stat_names[] = {
 };
 
 void rds_stats_info_copy(struct rds_info_iterator *iter,
-                         uint64_t *values, char **names, size_t nr)
+                         uint64_t *values, const char *const *names, size_t nr)
 {
         struct rds_info_counter ctr;
         size_t i;
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 2fc4a1724eb8..dbeaf2983822 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -589,11 +589,13 @@ static const char *rfkill_get_type_str(enum rfkill_type type)
                 return "wimax";
         case RFKILL_TYPE_WWAN:
                 return "wwan";
+        case RFKILL_TYPE_GPS:
+                return "gps";
         default:
                 BUG();
         }
 
-        BUILD_BUG_ON(NUM_RFKILL_TYPES != RFKILL_TYPE_WWAN + 1);
+        BUILD_BUG_ON(NUM_RFKILL_TYPES != RFKILL_TYPE_GPS + 1);
 }
 
 static ssize_t rfkill_type_show(struct device *dev,
@@ -1091,10 +1093,16 @@ static ssize_t rfkill_fop_write(struct file *file, const char __user *buf,
         struct rfkill_event ev;
 
         /* we don't need the 'hard' variable but accept it */
-        if (count < sizeof(ev) - 1)
+        if (count < RFKILL_EVENT_SIZE_V1 - 1)
                 return -EINVAL;
 
-        if (copy_from_user(&ev, buf, sizeof(ev) - 1))
+        /*
+         * Copy as much data as we can accept into our 'ev' buffer,
+         * but tell userspace how much we've copied so it can determine
+         * our API version even in a write() call, if it cares.
+         */
+        count = min(count, sizeof(ev));
+        if (copy_from_user(&ev, buf, count))
                 return -EFAULT;
 
         if (ev.op != RFKILL_OP_CHANGE && ev.op != RFKILL_OP_CHANGE_ALL)
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index 389d6e0d7740..c711e2edf5ce 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -141,7 +141,7 @@ static int rose_xmit(struct sk_buff *skb, struct net_device *dev)
         }
         dev_kfree_skb(skb);
         stats->tx_errors++;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct header_ops rose_header_ops = {
diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index 3ac1672e1070..c9f1f0a3a2ff 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -20,7 +20,7 @@
 
 static unsigned rxrpc_ack_defer = 1;
 
-static const char *rxrpc_acks[] = {
+static const char *const rxrpc_acks[] = {
         "---", "REQ", "DUP", "OOS", "WIN", "MEM", "PNG", "PNR", "DLY", "IDL",
         "-?-"
 };
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 27d03816ec3e..693df7ae33d8 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -37,15 +37,11 @@
  * - updates to tree and tree walking are only done under the rtnl mutex.
  */
 
-static inline int qdisc_qlen(struct Qdisc *q)
-{
-        return q->q.qlen;
-}
-
 static inline int dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 {
         q->gso_skb = skb;
         q->qstats.requeues++;
+        q->q.qlen++;    /* it's still part of the queue */
         __netif_schedule(q);
 
         return 0;
@@ -61,9 +57,11 @@ static inline struct sk_buff *dequeue_skb(struct Qdisc *q)
 
                 /* check the reason of requeuing without tx lock first */
                 txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
-                if (!netif_tx_queue_stopped(txq) && !netif_tx_queue_frozen(txq))
+                if (!netif_tx_queue_stopped(txq) &&
+                    !netif_tx_queue_frozen(txq)) {
                         q->gso_skb = NULL;
-                else
+                        q->q.qlen--;
+                } else
                         skb = NULL;
         } else {
                 skb = q->dequeue(q);
@@ -103,44 +101,23 @@ static inline int handle_dev_cpu_collision(struct sk_buff *skb,
 }
 
 /*
- * NOTE: Called under qdisc_lock(q) with locally disabled BH.
- *
- * __QDISC_STATE_RUNNING guarantees only one CPU can process
- * this qdisc at a time. qdisc_lock(q) serializes queue accesses for
- * this queue.
- *
- *  netif_tx_lock serializes accesses to device driver.
- *
- *  qdisc_lock(q) and netif_tx_lock are mutually exclusive,
- *  if one is grabbed, another must be free.
- *
- * Note, that this procedure can be called by a watchdog timer
+ * Transmit one skb, and handle the return status as required. Holding the
+ * __QDISC_STATE_RUNNING bit guarantees that only one CPU can execute this
+ * function.
  *
  * Returns to the caller:
  *                              0  - queue is empty or throttled.
  *                              >0 - queue is not empty.
- *
  */
-static inline int qdisc_restart(struct Qdisc *q)
+int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
+                    struct net_device *dev, struct netdev_queue *txq,
+                    spinlock_t *root_lock)
 {
-        struct netdev_queue *txq;
         int ret = NETDEV_TX_BUSY;
-        struct net_device *dev;
-        spinlock_t *root_lock;
-        struct sk_buff *skb;
-
-        /* Dequeue packet */
-        if (unlikely((skb = dequeue_skb(q)) == NULL))
-                return 0;
-
-        root_lock = qdisc_lock(q);
 
         /* And release qdisc */
         spin_unlock(root_lock);
 
-        dev = qdisc_dev(q);
-        txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
-
         HARD_TX_LOCK(dev, txq, smp_processor_id());
         if (!netif_tx_queue_stopped(txq) &&
             !netif_tx_queue_frozen(txq))
@@ -177,6 +154,44 @@ static inline int qdisc_restart(struct Qdisc *q)
         return ret;
 }
 
+/*
+ * NOTE: Called under qdisc_lock(q) with locally disabled BH.
+ *
+ * __QDISC_STATE_RUNNING guarantees only one CPU can process
+ * this qdisc at a time. qdisc_lock(q) serializes queue accesses for
+ * this queue.
+ *
+ *  netif_tx_lock serializes accesses to device driver.
+ *
+ *  qdisc_lock(q) and netif_tx_lock are mutually exclusive,
+ *  if one is grabbed, another must be free.
+ *
+ * Note, that this procedure can be called by a watchdog timer
+ *
+ * Returns to the caller:
+ *                              0  - queue is empty or throttled.
+ *                              >0 - queue is not empty.
+ *
+ */
+static inline int qdisc_restart(struct Qdisc *q)
+{
+        struct netdev_queue *txq;
+        struct net_device *dev;
+        spinlock_t *root_lock;
+        struct sk_buff *skb;
+
+        /* Dequeue packet */
+        skb = dequeue_skb(q);
+        if (unlikely(!skb))
+                return 0;
+
+        root_lock = qdisc_lock(q);
+        dev = qdisc_dev(q);
+        txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
+
+        return sch_direct_xmit(skb, q, dev, txq, root_lock);
+}
+
 void __qdisc_run(struct Qdisc *q)
 {
         unsigned long start_time = jiffies;
@@ -547,8 +562,11 @@ void qdisc_reset(struct Qdisc *qdisc)
         if (ops->reset)
                 ops->reset(qdisc);
 
-        kfree_skb(qdisc->gso_skb);
-        qdisc->gso_skb = NULL;
+        if (qdisc->gso_skb) {
+                kfree_skb(qdisc->gso_skb);
+                qdisc->gso_skb = NULL;
+                qdisc->q.qlen = 0;
+        }
 }
 EXPORT_SYMBOL(qdisc_reset);
 
@@ -605,6 +623,9 @@ static void attach_one_default_qdisc(struct net_device *dev,
                         printk(KERN_INFO "%s: activation failed\n", dev->name);
                         return;
                 }
+
+                /* Can by-pass the queue discipline for default qdisc */
+                qdisc->flags |= TCQ_F_CAN_BYPASS;
         } else {
                 qdisc =  &noqueue_qdisc;
         }
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 9c002b6e0533..12434b6c2042 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -314,7 +314,7 @@ restart:
                                         netif_wake_queue(dev);
                                         txq->tx_packets++;
                                         txq->tx_bytes += length;
-                                        return 0;
+                                        return NETDEV_TX_OK;
                                 }
                                 __netif_tx_unlock(slave_txq);
                         }
@@ -323,7 +323,7 @@ restart:
                         break;
                 case 1:
                         master->slaves = NEXT_SLAVE(q);
-                        return 0;
+                        return NETDEV_TX_OK;
                 default:
                         nores = 1;
                         break;
@@ -345,7 +345,7 @@ restart:
 drop:
         txq->tx_dropped++;
         dev_kfree_skb(skb);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int teql_master_open(struct net_device *dev)
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index 7ff548a30cfb..bf24fa697de2 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -52,7 +52,7 @@ int sctp_debug_flag = 1;	/* Initially enable DEBUG */
 #endif  /* SCTP_DEBUG */
 
 /* These are printable forms of Chunk ID's from section 3.1.  */
-static const char *sctp_cid_tbl[SCTP_NUM_BASE_CHUNK_TYPES] = {
+static const char *const sctp_cid_tbl[SCTP_NUM_BASE_CHUNK_TYPES] = {
         "DATA",
         "INIT",
         "INIT_ACK",
@@ -97,7 +97,7 @@ const char *sctp_cname(const sctp_subtype_t cid)
 }
 
 /* These are printable forms of the states.  */
-const char *sctp_state_tbl[SCTP_STATE_NUM_STATES] = {
+const char *const sctp_state_tbl[SCTP_STATE_NUM_STATES] = {
         "STATE_EMPTY",
         "STATE_CLOSED",
         "STATE_COOKIE_WAIT",
@@ -110,7 +110,7 @@ const char *sctp_state_tbl[SCTP_STATE_NUM_STATES] = {
 };
 
 /* Events that could change the state of an association.  */
-const char *sctp_evttype_tbl[] = {
+const char *const sctp_evttype_tbl[] = {
         "EVENT_T_unknown",
         "EVENT_T_CHUNK",
         "EVENT_T_TIMEOUT",
@@ -119,7 +119,7 @@ const char *sctp_evttype_tbl[] = {
 };
 
 /* Return value of a state function */
-const char *sctp_status_tbl[] = {
+const char *const sctp_status_tbl[] = {
         "DISPOSITION_DISCARD",
         "DISPOSITION_CONSUME",
         "DISPOSITION_NOMEM",
@@ -132,7 +132,7 @@ const char *sctp_status_tbl[] = {
 };
 
 /* Printable forms of primitives */
-static const char *sctp_primitive_tbl[SCTP_NUM_PRIMITIVE_TYPES] = {
+static const char *const sctp_primitive_tbl[SCTP_NUM_PRIMITIVE_TYPES] = {
         "PRIMITIVE_ASSOCIATE",
         "PRIMITIVE_SHUTDOWN",
         "PRIMITIVE_ABORT",
@@ -149,7 +149,7 @@ const char *sctp_pname(const sctp_subtype_t id)
         return "unknown_primitive";
 }
 
-static const char *sctp_other_tbl[] = {
+static const char *const sctp_other_tbl[] = {
         "NO_PENDING_TSN",
         "ICMP_PROTO_UNREACH",
 };
@@ -162,7 +162,7 @@ const char *sctp_oname(const sctp_subtype_t id)
         return "unknown 'other' event";
 }
 
-static const char *sctp_timer_tbl[] = {
+static const char *const sctp_timer_tbl[] = {
         "TIMEOUT_NONE",
         "TIMEOUT_T1_COOKIE",
         "TIMEOUT_T1_INIT",
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 3c57005e44d1..7bda8e3d1398 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -62,7 +62,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info)
                 rep_nlh = nlmsg_hdr(rep_buf);
                 memcpy(rep_nlh, req_nlh, hdr_space);
                 rep_nlh->nlmsg_len = rep_buf->len;
-                genlmsg_unicast(rep_buf, NETLINK_CB(skb).pid);
+                genlmsg_unicast(&init_net, rep_buf, NETLINK_CB(skb).pid);
         }
 
         return 0;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 1848693ebb82..e8254e809b79 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1748,6 +1748,12 @@ static int getsockopt(struct socket *sock,
                 value = jiffies_to_msecs(sk->sk_rcvtimeo);
                 /* no need to set "res", since already 0 at this point */
                 break;
+         case TIPC_NODE_RECVQ_DEPTH:
+                value = (u32)atomic_read(&tipc_queue_size);
+                break;
+         case TIPC_SOCK_RECVQ_DEPTH:
+                value = skb_queue_len(&sk->sk_receive_queue);
+                break;
         default:
                 res = -EINVAL;
         }
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 4428dd5e911d..c6031d5b135f 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -2,6 +2,21 @@ config CFG80211
         tristate "Improved wireless configuration API"
         depends on RFKILL || !RFKILL
 
+config NL80211_TESTMODE
+        bool "nl80211 testmode command"
+        depends on CFG80211
+        help
+          The nl80211 testmode command helps implementing things like
+          factory calibration or validation tools for wireless chips.
+
+          Select this option ONLY for kernels that are specifically
+          built for such purposes.
+
+          Debugging tools that are supposed to end up in the hands of
+          users should better be implemented with debugfs.
+
+          Say N.
+
 config CFG80211_REG_DEBUG
         bool "cfg80211 regulatory debugging"
         depends on CFG80211
@@ -11,6 +26,22 @@ config CFG80211_REG_DEBUG
 
           If unsure, say N.
 
+config CFG80211_DEFAULT_PS
+        bool "enable powersave by default"
+        depends on CFG80211
+        default y
+        help
+          This option enables powersave mode by default.
+
+          If this causes your applications to misbehave you should fix your
+          applications instead -- they need to register their network
+          latency requirement, see Documentation/power/pm_qos_interface.txt.
+
+config CFG80211_DEFAULT_PS_VALUE
+        int
+        default 1 if CFG80211_DEFAULT_PS
+        default 0
+
 config CFG80211_DEBUGFS
         bool "cfg80211 DebugFS entries"
         depends on CFG80211 && DEBUG_FS
@@ -35,19 +66,13 @@ config WIRELESS_OLD_REGULATORY
 
 config WIRELESS_EXT
         bool "Wireless extensions"
-        default n
+        default y
         ---help---
           This option enables the legacy wireless extensions
           (wireless network interface configuration via ioctls.)
 
-          Wireless extensions will be replaced by cfg80211 and
-          will be required only by legacy drivers that implement
-          wireless extension handlers. This option does not
-          affect the wireless-extension backward compatibility
-          code in cfg80211.
-
-          Say N (if you can) unless you know you need wireless
-          extensions for external modules.
+          Say Y unless you've upgraded all your userspace to use
+          nl80211 instead of wireless extensions.
 
 config WIRELESS_EXT_SYSFS
         bool "Wireless extensions sysfs files"
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index f78c4832a9ca..3ecaa9179977 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -5,8 +5,9 @@ obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
 
-cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o mlme.o ibss.o
+cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
+cfg80211-y += mlme.o ibss.o sme.o chan.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
-cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o
+cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o wext-sme.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
new file mode 100644
index 000000000000..a46ac6c9b365
--- /dev/null
+++ b/net/wireless/chan.c
@@ -0,0 +1,89 @@
+/*
+ * This file contains helper code to handle channel
+ * settings and keeping track of what is possible at
+ * any point in time.
+ *
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ */
+
+#include <net/cfg80211.h>
+#include "core.h"
+
+struct ieee80211_channel *
+rdev_fixed_channel(struct cfg80211_registered_device *rdev,
+                   struct wireless_dev *for_wdev)
+{
+        struct wireless_dev *wdev;
+        struct ieee80211_channel *result = NULL;
+
+        WARN_ON(!mutex_is_locked(&rdev->devlist_mtx));
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list) {
+                if (wdev == for_wdev)
+                        continue;
+
+                /*
+                 * Lock manually to tell lockdep about allowed
+                 * nesting here if for_wdev->mtx is held already.
+                 * This is ok as it's all under the rdev devlist
+                 * mutex and as such can only be done once at any
+                 * given time.
+                 */
+                mutex_lock_nested(&wdev->mtx, SINGLE_DEPTH_NESTING);
+                if (wdev->current_bss)
+                        result = wdev->current_bss->pub.channel;
+                wdev_unlock(wdev);
+
+                if (result)
+                        break;
+        }
+
+        return result;
+}
+
+int rdev_set_freq(struct cfg80211_registered_device *rdev,
+                  struct wireless_dev *for_wdev,
+                  int freq, enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *chan;
+        struct ieee80211_sta_ht_cap *ht_cap;
+        int result;
+
+        if (rdev_fixed_channel(rdev, for_wdev))
+                return -EBUSY;
+
+        if (!rdev->ops->set_channel)
+                return -EOPNOTSUPP;
+
+        chan = ieee80211_get_channel(&rdev->wiphy, freq);
+
+        /* Primary channel not allowed */
+        if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
+                return -EINVAL;
+
+        if (channel_type == NL80211_CHAN_HT40MINUS &&
+            chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                return -EINVAL;
+        else if (channel_type == NL80211_CHAN_HT40PLUS &&
+                 chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                return -EINVAL;
+
+        ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
+
+        if (channel_type != NL80211_CHAN_NO_HT) {
+                if (!ht_cap->ht_supported)
+                        return -EINVAL;
+
+                if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
+                    ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT)
+                        return -EINVAL;
+        }
+
+        result = rdev->ops->set_channel(&rdev->wiphy, chan, channel_type);
+        if (result)
+                return result;
+
+        rdev->channel = chan;
+
+        return 0;
+}
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d5850292b3df..bc99e4ec7463 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -19,6 +19,7 @@
 #include "core.h"
 #include "sysfs.h"
 #include "debugfs.h"
+#include "wext-compat.h"
 
 /* name for sysfs, %d is appended */
 #define PHY_NAME "phy"
@@ -30,12 +31,11 @@ MODULE_DESCRIPTION("wireless configuration support");
 /* RCU might be appropriate here since we usually
  * only read the list, and that can happen quite
  * often because we need to do it for each command */
-LIST_HEAD(cfg80211_drv_list);
+LIST_HEAD(cfg80211_rdev_list);
+int cfg80211_rdev_list_generation;
 
 /*
- * This is used to protect the cfg80211_drv_list, cfg80211_regdomain,
- * country_ie_regdomain, the reg_beacon_list and the the last regulatory
- * request receipt (last_request).
+ * This is used to protect the cfg80211_rdev_list
  */
 DEFINE_MUTEX(cfg80211_mutex);
 
@@ -43,18 +43,18 @@ DEFINE_MUTEX(cfg80211_mutex);
 static struct dentry *ieee80211_debugfs_dir;
 
 /* requires cfg80211_mutex to be held! */
-struct cfg80211_registered_device *cfg80211_drv_by_wiphy_idx(int wiphy_idx)
+struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 {
-        struct cfg80211_registered_device *result = NULL, *drv;
+        struct cfg80211_registered_device *result = NULL, *rdev;
 
         if (!wiphy_idx_valid(wiphy_idx))
                 return NULL;
 
         assert_cfg80211_lock();
 
-        list_for_each_entry(drv, &cfg80211_drv_list, list) {
-                if (drv->wiphy_idx == wiphy_idx) {
-                        result = drv;
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                if (rdev->wiphy_idx == wiphy_idx) {
+                        result = rdev;
                         break;
                 }
         }
@@ -64,32 +64,32 @@ struct cfg80211_registered_device *cfg80211_drv_by_wiphy_idx(int wiphy_idx)
 
 int get_wiphy_idx(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         if (!wiphy)
                 return WIPHY_IDX_STALE;
-        drv = wiphy_to_dev(wiphy);
-        return drv->wiphy_idx;
+        rdev = wiphy_to_dev(wiphy);
+        return rdev->wiphy_idx;
 }
 
-/* requires cfg80211_drv_mutex to be held! */
+/* requires cfg80211_rdev_mutex to be held! */
 struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
 
         if (!wiphy_idx_valid(wiphy_idx))
                 return NULL;
 
         assert_cfg80211_lock();
 
-        drv = cfg80211_drv_by_wiphy_idx(wiphy_idx);
-        if (!drv)
+        rdev = cfg80211_rdev_by_wiphy_idx(wiphy_idx);
+        if (!rdev)
                 return NULL;
-        return &drv->wiphy;
+        return &rdev->wiphy;
 }
 
 /* requires cfg80211_mutex to be held! */
 struct cfg80211_registered_device *
-__cfg80211_drv_from_info(struct genl_info *info)
+__cfg80211_rdev_from_info(struct genl_info *info)
 {
         int ifindex;
         struct cfg80211_registered_device *bywiphyidx = NULL, *byifidx = NULL;
@@ -99,14 +99,14 @@ __cfg80211_drv_from_info(struct genl_info *info)
         assert_cfg80211_lock();
 
         if (info->attrs[NL80211_ATTR_WIPHY]) {
-                bywiphyidx = cfg80211_drv_by_wiphy_idx(
+                bywiphyidx = cfg80211_rdev_by_wiphy_idx(
                                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY]));
                 err = -ENODEV;
         }
 
         if (info->attrs[NL80211_ATTR_IFINDEX]) {
                 ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
-                dev = dev_get_by_index(&init_net, ifindex);
+                dev = dev_get_by_index(genl_info_net(info), ifindex);
                 if (dev) {
                         if (dev->ieee80211_ptr)
                                 byifidx =
@@ -134,54 +134,48 @@ __cfg80211_drv_from_info(struct genl_info *info)
 struct cfg80211_registered_device *
 cfg80211_get_dev_from_info(struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
 
         mutex_lock(&cfg80211_mutex);
-        drv = __cfg80211_drv_from_info(info);
+        rdev = __cfg80211_rdev_from_info(info);
 
         /* if it is not an error we grab the lock on
          * it to assure it won't be going away while
          * we operate on it */
-        if (!IS_ERR(drv))
-                mutex_lock(&drv->mtx);
+        if (!IS_ERR(rdev))
+                mutex_lock(&rdev->mtx);
 
         mutex_unlock(&cfg80211_mutex);
 
-        return drv;
+        return rdev;
 }
 
 struct cfg80211_registered_device *
-cfg80211_get_dev_from_ifindex(int ifindex)
+cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
 {
-        struct cfg80211_registered_device *drv = ERR_PTR(-ENODEV);
+        struct cfg80211_registered_device *rdev = ERR_PTR(-ENODEV);
         struct net_device *dev;
 
         mutex_lock(&cfg80211_mutex);
-        dev = dev_get_by_index(&init_net, ifindex);
+        dev = dev_get_by_index(net, ifindex);
         if (!dev)
                 goto out;
         if (dev->ieee80211_ptr) {
-                drv = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
-                mutex_lock(&drv->mtx);
+                rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
+                mutex_lock(&rdev->mtx);
         } else
-                drv = ERR_PTR(-ENODEV);
+                rdev = ERR_PTR(-ENODEV);
         dev_put(dev);
  out:
         mutex_unlock(&cfg80211_mutex);
-        return drv;
-}
-
-void cfg80211_put_dev(struct cfg80211_registered_device *drv)
-{
-        BUG_ON(IS_ERR(drv));
-        mutex_unlock(&drv->mtx);
+        return rdev;
 }
 
 /* requires cfg80211_mutex to be held */
 int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                         char *newname)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev2;
         int wiphy_idx, taken = -1, result, digits;
 
         assert_cfg80211_lock();
@@ -207,8 +201,8 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                 return 0;
 
         /* Ensure another device does not already have this name. */
-        list_for_each_entry(drv, &cfg80211_drv_list, list)
-                if (strcmp(newname, dev_name(&drv->wiphy.dev)) == 0)
+        list_for_each_entry(rdev2, &cfg80211_rdev_list, list)
+                if (strcmp(newname, dev_name(&rdev2->wiphy.dev)) == 0)
                         return -EINVAL;
 
         result = device_rename(&rdev->wiphy.dev, newname);
@@ -228,28 +222,64 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
+int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
+                          struct net *net)
+{
+        struct wireless_dev *wdev;
+        int err = 0;
+
+        if (!rdev->wiphy.netnsok)
+                return -EOPNOTSUPP;
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list) {
+                wdev->netdev->features &= ~NETIF_F_NETNS_LOCAL;
+                err = dev_change_net_namespace(wdev->netdev, net, "wlan%d");
+                if (err)
+                        break;
+                wdev->netdev->features |= NETIF_F_NETNS_LOCAL;
+        }
+
+        if (err) {
+                /* failed -- clean up to old netns */
+                net = wiphy_net(&rdev->wiphy);
+
+                list_for_each_entry_continue_reverse(wdev, &rdev->netdev_list,
+                                                     list) {
+                        wdev->netdev->features &= ~NETIF_F_NETNS_LOCAL;
+                        err = dev_change_net_namespace(wdev->netdev, net,
+                                                        "wlan%d");
+                        WARN_ON(err);
+                        wdev->netdev->features |= NETIF_F_NETNS_LOCAL;
+                }
+        }
+
+        wiphy_net_set(&rdev->wiphy, net);
+
+        return err;
+}
+
 static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
 {
-        struct cfg80211_registered_device *drv = data;
+        struct cfg80211_registered_device *rdev = data;
 
-        drv->ops->rfkill_poll(&drv->wiphy);
+        rdev->ops->rfkill_poll(&rdev->wiphy);
 }
 
 static int cfg80211_rfkill_set_block(void *data, bool blocked)
 {
-        struct cfg80211_registered_device *drv = data;
+        struct cfg80211_registered_device *rdev = data;
         struct wireless_dev *wdev;
 
         if (!blocked)
                 return 0;
 
         rtnl_lock();
-        mutex_lock(&drv->devlist_mtx);
+        mutex_lock(&rdev->devlist_mtx);
 
-        list_for_each_entry(wdev, &drv->netdev_list, list)
+        list_for_each_entry(wdev, &rdev->netdev_list, list)
                 dev_close(wdev->netdev);
 
-        mutex_unlock(&drv->devlist_mtx);
+        mutex_unlock(&rdev->devlist_mtx);
         rtnl_unlock();
 
         return 0;
@@ -257,10 +287,76 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
 
 static void cfg80211_rfkill_sync_work(struct work_struct *work)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
+
+        rdev = container_of(work, struct cfg80211_registered_device, rfkill_sync);
+        cfg80211_rfkill_set_block(rdev, rfkill_blocked(rdev->rfkill));
+}
+
+static void cfg80211_process_events(struct wireless_dev *wdev)
+{
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        while (!list_empty(&wdev->event_list)) {
+                ev = list_first_entry(&wdev->event_list,
+                                      struct cfg80211_event, list);
+                list_del(&ev->list);
+                spin_unlock_irqrestore(&wdev->event_lock, flags);
+
+                wdev_lock(wdev);
+                switch (ev->type) {
+                case EVENT_CONNECT_RESULT:
+                        __cfg80211_connect_result(
+                                wdev->netdev, ev->cr.bssid,
+                                ev->cr.req_ie, ev->cr.req_ie_len,
+                                ev->cr.resp_ie, ev->cr.resp_ie_len,
+                                ev->cr.status,
+                                ev->cr.status == WLAN_STATUS_SUCCESS,
+                                NULL);
+                        break;
+                case EVENT_ROAMED:
+                        __cfg80211_roamed(wdev, ev->rm.bssid,
+                                          ev->rm.req_ie, ev->rm.req_ie_len,
+                                          ev->rm.resp_ie, ev->rm.resp_ie_len);
+                        break;
+                case EVENT_DISCONNECTED:
+                        __cfg80211_disconnected(wdev->netdev,
+                                                ev->dc.ie, ev->dc.ie_len,
+                                                ev->dc.reason, true);
+                        break;
+                case EVENT_IBSS_JOINED:
+                        __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid);
+                        break;
+                }
+                wdev_unlock(wdev);
+
+                kfree(ev);
+
+                spin_lock_irqsave(&wdev->event_lock, flags);
+        }
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+}
+
+static void cfg80211_event_work(struct work_struct *work)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+
+        rdev = container_of(work, struct cfg80211_registered_device,
+                            event_work);
+
+        rtnl_lock();
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list)
+                cfg80211_process_events(wdev);
 
-        drv = container_of(work, struct cfg80211_registered_device, rfkill_sync);
-        cfg80211_rfkill_set_block(drv, rfkill_blocked(drv->rfkill));
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
+        rtnl_unlock();
 }
 
 /* exported functions */
@@ -269,76 +365,88 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 {
         static int wiphy_counter;
 
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int alloc_size;
 
-        WARN_ON(!ops->add_key && ops->del_key);
-        WARN_ON(ops->add_key && !ops->del_key);
+        WARN_ON(ops->add_key && (!ops->del_key || !ops->set_default_key));
+        WARN_ON(ops->auth && (!ops->assoc || !ops->deauth || !ops->disassoc));
+        WARN_ON(ops->connect && !ops->disconnect);
+        WARN_ON(ops->join_ibss && !ops->leave_ibss);
+        WARN_ON(ops->add_virtual_intf && !ops->del_virtual_intf);
+        WARN_ON(ops->add_station && !ops->del_station);
+        WARN_ON(ops->add_mpath && !ops->del_mpath);
 
-        alloc_size = sizeof(*drv) + sizeof_priv;
+        alloc_size = sizeof(*rdev) + sizeof_priv;
 
-        drv = kzalloc(alloc_size, GFP_KERNEL);
-        if (!drv)
+        rdev = kzalloc(alloc_size, GFP_KERNEL);
+        if (!rdev)
                 return NULL;
 
-        drv->ops = ops;
+        rdev->ops = ops;
 
         mutex_lock(&cfg80211_mutex);
 
-        drv->wiphy_idx = wiphy_counter++;
+        rdev->wiphy_idx = wiphy_counter++;
 
-        if (unlikely(!wiphy_idx_valid(drv->wiphy_idx))) {
+        if (unlikely(!wiphy_idx_valid(rdev->wiphy_idx))) {
                 wiphy_counter--;
                 mutex_unlock(&cfg80211_mutex);
                 /* ugh, wrapped! */
-                kfree(drv);
+                kfree(rdev);
                 return NULL;
         }
 
         mutex_unlock(&cfg80211_mutex);
 
         /* give it a proper name */
-        dev_set_name(&drv->wiphy.dev, PHY_NAME "%d", drv->wiphy_idx);
+        dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
+
+        mutex_init(&rdev->mtx);
+        mutex_init(&rdev->devlist_mtx);
+        INIT_LIST_HEAD(&rdev->netdev_list);
+        spin_lock_init(&rdev->bss_lock);
+        INIT_LIST_HEAD(&rdev->bss_list);
+        INIT_WORK(&rdev->scan_done_wk, __cfg80211_scan_done);
 
-        mutex_init(&drv->mtx);
-        mutex_init(&drv->devlist_mtx);
-        INIT_LIST_HEAD(&drv->netdev_list);
-        spin_lock_init(&drv->bss_lock);
-        INIT_LIST_HEAD(&drv->bss_list);
+        device_initialize(&rdev->wiphy.dev);
+        rdev->wiphy.dev.class = &ieee80211_class;
+        rdev->wiphy.dev.platform_data = rdev;
 
-        device_initialize(&drv->wiphy.dev);
-        drv->wiphy.dev.class = &ieee80211_class;
-        drv->wiphy.dev.platform_data = drv;
+        rdev->wiphy.ps_default = CONFIG_CFG80211_DEFAULT_PS_VALUE;
 
-        drv->rfkill_ops.set_block = cfg80211_rfkill_set_block;
-        drv->rfkill = rfkill_alloc(dev_name(&drv->wiphy.dev),
-                                   &drv->wiphy.dev, RFKILL_TYPE_WLAN,
-                                   &drv->rfkill_ops, drv);
+        wiphy_net_set(&rdev->wiphy, &init_net);
 
-        if (!drv->rfkill) {
-                kfree(drv);
+        rdev->rfkill_ops.set_block = cfg80211_rfkill_set_block;
+        rdev->rfkill = rfkill_alloc(dev_name(&rdev->wiphy.dev),
+                                   &rdev->wiphy.dev, RFKILL_TYPE_WLAN,
+                                   &rdev->rfkill_ops, rdev);
+
+        if (!rdev->rfkill) {
+                kfree(rdev);
                 return NULL;
         }
 
-        INIT_WORK(&drv->rfkill_sync, cfg80211_rfkill_sync_work);
+        INIT_WORK(&rdev->rfkill_sync, cfg80211_rfkill_sync_work);
+        INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+        INIT_WORK(&rdev->event_work, cfg80211_event_work);
 
         /*
          * Initialize wiphy parameters to IEEE 802.11 MIB default values.
          * Fragmentation and RTS threshold are disabled by default with the
          * special -1 value.
          */
-        drv->wiphy.retry_short = 7;
-        drv->wiphy.retry_long = 4;
-        drv->wiphy.frag_threshold = (u32) -1;
-        drv->wiphy.rts_threshold = (u32) -1;
+        rdev->wiphy.retry_short = 7;
+        rdev->wiphy.retry_long = 4;
+        rdev->wiphy.frag_threshold = (u32) -1;
+        rdev->wiphy.rts_threshold = (u32) -1;
 
-        return &drv->wiphy;
+        return &rdev->wiphy;
 }
 EXPORT_SYMBOL(wiphy_new);
 
 int wiphy_register(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         int res;
         enum ieee80211_band band;
         struct ieee80211_supported_band *sband;
@@ -346,9 +454,6 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
-        if (WARN_ON(wiphy->max_scan_ssids < 1))
-                return -EINVAL;
-
         /* sanity check ifmodes */
         WARN_ON(!ifmodes);
         ifmodes &= ((1 << __NL80211_IFTYPE_AFTER_LAST) - 1) & ~1;
@@ -395,11 +500,11 @@ int wiphy_register(struct wiphy *wiphy)
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
-        res = device_add(&drv->wiphy.dev);
+        res = device_add(&rdev->wiphy.dev);
         if (res)
                 return res;
 
-        res = rfkill_register(drv->rfkill);
+        res = rfkill_register(rdev->rfkill);
         if (res)
                 goto out_rm_dev;
 
@@ -408,16 +513,17 @@ int wiphy_register(struct wiphy *wiphy)
         /* set up regulatory info */
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
 
-        list_add(&drv->list, &cfg80211_drv_list);
+        list_add(&rdev->list, &cfg80211_rdev_list);
+        cfg80211_rdev_list_generation++;
 
         mutex_unlock(&cfg80211_mutex);
 
         /* add to debugfs */
-        drv->wiphy.debugfsdir =
-                debugfs_create_dir(wiphy_name(&drv->wiphy),
+        rdev->wiphy.debugfsdir =
+                debugfs_create_dir(wiphy_name(&rdev->wiphy),
                                    ieee80211_debugfs_dir);
-        if (IS_ERR(drv->wiphy.debugfsdir))
-                drv->wiphy.debugfsdir = NULL;
+        if (IS_ERR(rdev->wiphy.debugfsdir))
+                rdev->wiphy.debugfsdir = NULL;
 
         if (wiphy->custom_regulatory) {
                 struct regulatory_request request;
@@ -430,48 +536,48 @@ int wiphy_register(struct wiphy *wiphy)
                 nl80211_send_reg_change_event(&request);
         }
 
-        cfg80211_debugfs_drv_add(drv);
+        cfg80211_debugfs_rdev_add(rdev);
 
         return 0;
 
  out_rm_dev:
-        device_del(&drv->wiphy.dev);
+        device_del(&rdev->wiphy.dev);
         return res;
 }
 EXPORT_SYMBOL(wiphy_register);
 
 void wiphy_rfkill_start_polling(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        if (!drv->ops->rfkill_poll)
+        if (!rdev->ops->rfkill_poll)
                 return;
-        drv->rfkill_ops.poll = cfg80211_rfkill_poll;
-        rfkill_resume_polling(drv->rfkill);
+        rdev->rfkill_ops.poll = cfg80211_rfkill_poll;
+        rfkill_resume_polling(rdev->rfkill);
 }
 EXPORT_SYMBOL(wiphy_rfkill_start_polling);
 
 void wiphy_rfkill_stop_polling(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        rfkill_pause_polling(drv->rfkill);
+        rfkill_pause_polling(rdev->rfkill);
 }
 EXPORT_SYMBOL(wiphy_rfkill_stop_polling);
 
 void wiphy_unregister(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        rfkill_unregister(drv->rfkill);
+        rfkill_unregister(rdev->rfkill);
 
         /* protect the device list */
         mutex_lock(&cfg80211_mutex);
 
-        BUG_ON(!list_empty(&drv->netdev_list));
+        BUG_ON(!list_empty(&rdev->netdev_list));
 
         /*
-         * Try to grab drv->mtx. If a command is still in progress,
+         * Try to grab rdev->mtx. If a command is still in progress,
          * hopefully the driver will refuse it since it's tearing
          * down the device already. We wait for this command to complete
          * before unlinking the item from the list.
@@ -480,33 +586,39 @@ void wiphy_unregister(struct wiphy *wiphy)
          * get to lock contention here if userspace issues a command
          * that identified the hardware by wiphy index.
          */
-        mutex_lock(&drv->mtx);
+        mutex_lock(&rdev->mtx);
         /* unlock again before freeing */
-        mutex_unlock(&drv->mtx);
+        mutex_unlock(&rdev->mtx);
 
-        cfg80211_debugfs_drv_del(drv);
+        cfg80211_debugfs_rdev_del(rdev);
 
         /* If this device got a regulatory hint tell core its
          * free to listen now to a new shiny device regulatory hint */
         reg_device_remove(wiphy);
 
-        list_del(&drv->list);
-        device_del(&drv->wiphy.dev);
-        debugfs_remove(drv->wiphy.debugfsdir);
+        list_del(&rdev->list);
+        cfg80211_rdev_list_generation++;
+        device_del(&rdev->wiphy.dev);
+        debugfs_remove(rdev->wiphy.debugfsdir);
 
         mutex_unlock(&cfg80211_mutex);
+
+        flush_work(&rdev->scan_done_wk);
+        cancel_work_sync(&rdev->conn_work);
+        kfree(rdev->scan_req);
+        flush_work(&rdev->event_work);
 }
 EXPORT_SYMBOL(wiphy_unregister);
 
-void cfg80211_dev_free(struct cfg80211_registered_device *drv)
+void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
 {
         struct cfg80211_internal_bss *scan, *tmp;
-        rfkill_destroy(drv->rfkill);
-        mutex_destroy(&drv->mtx);
-        mutex_destroy(&drv->devlist_mtx);
-        list_for_each_entry_safe(scan, tmp, &drv->bss_list, list)
+        rfkill_destroy(rdev->rfkill);
+        mutex_destroy(&rdev->mtx);
+        mutex_destroy(&rdev->devlist_mtx);
+        list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
                 cfg80211_put_bss(&scan->pub);
-        kfree(drv);
+        kfree(rdev);
 }
 
 void wiphy_free(struct wiphy *wiphy)
@@ -517,10 +629,10 @@ EXPORT_SYMBOL(wiphy_free);
 
 void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        if (rfkill_set_hw_state(drv->rfkill, blocked))
-                schedule_work(&drv->rfkill_sync);
+        if (rfkill_set_hw_state(rdev->rfkill, blocked))
+                schedule_work(&rdev->rfkill_sync);
 }
 EXPORT_SYMBOL(wiphy_rfkill_set_hw_state);
 
@@ -529,56 +641,125 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                                          void *ndev)
 {
         struct net_device *dev = ndev;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev;
 
-        if (!dev->ieee80211_ptr)
+        if (!wdev)
                 return NOTIFY_DONE;
 
-        rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
+        rdev = wiphy_to_dev(wdev->wiphy);
 
-        WARN_ON(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_UNSPECIFIED);
+        WARN_ON(wdev->iftype == NL80211_IFTYPE_UNSPECIFIED);
 
         switch (state) {
         case NETDEV_REGISTER:
+                mutex_init(&wdev->mtx);
+                INIT_LIST_HEAD(&wdev->event_list);
+                spin_lock_init(&wdev->event_lock);
                 mutex_lock(&rdev->devlist_mtx);
-                list_add(&dev->ieee80211_ptr->list, &rdev->netdev_list);
+                list_add(&wdev->list, &rdev->netdev_list);
+                rdev->devlist_generation++;
+                /* can only change netns with wiphy */
+                dev->features |= NETIF_F_NETNS_LOCAL;
+
                 if (sysfs_create_link(&dev->dev.kobj, &rdev->wiphy.dev.kobj,
                                       "phy80211")) {
                         printk(KERN_ERR "wireless: failed to add phy80211 "
                                 "symlink to netdev!\n");
                 }
-                dev->ieee80211_ptr->netdev = dev;
+                wdev->netdev = dev;
+                wdev->sme_state = CFG80211_SME_IDLE;
+                mutex_unlock(&rdev->devlist_mtx);
 #ifdef CONFIG_WIRELESS_EXT
-                dev->ieee80211_ptr->wext.default_key = -1;
-                dev->ieee80211_ptr->wext.default_mgmt_key = -1;
+                if (!dev->wireless_handlers)
+                        dev->wireless_handlers = &cfg80211_wext_handler;
+                wdev->wext.default_key = -1;
+                wdev->wext.default_mgmt_key = -1;
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+                wdev->wext.ps = wdev->wiphy->ps_default;
+                wdev->wext.ps_timeout = 100;
+                if (rdev->ops->set_power_mgmt)
+                        if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
+                                                      wdev->wext.ps,
+                                                      wdev->wext.ps_timeout)) {
+                                /* assume this means it's off */
+                                wdev->wext.ps = false;
+                        }
 #endif
-                mutex_unlock(&rdev->devlist_mtx);
                 break;
         case NETDEV_GOING_DOWN:
-                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
+                switch (wdev->iftype) {
+                case NL80211_IFTYPE_ADHOC:
+                        cfg80211_leave_ibss(rdev, dev, true);
                         break;
-                if (!dev->ieee80211_ptr->ssid_len)
+                case NL80211_IFTYPE_STATION:
+                        wdev_lock(wdev);
+#ifdef CONFIG_WIRELESS_EXT
+                        kfree(wdev->wext.ie);
+                        wdev->wext.ie = NULL;
+                        wdev->wext.ie_len = 0;
+                        wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+#endif
+                        __cfg80211_disconnect(rdev, dev,
+                                              WLAN_REASON_DEAUTH_LEAVING, true);
+                        cfg80211_mlme_down(rdev, dev);
+                        wdev_unlock(wdev);
+                        break;
+                default:
                         break;
-                cfg80211_leave_ibss(rdev, dev, true);
+                }
                 break;
         case NETDEV_UP:
 #ifdef CONFIG_WIRELESS_EXT
-                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
+                cfg80211_lock_rdev(rdev);
+                mutex_lock(&rdev->devlist_mtx);
+                wdev_lock(wdev);
+                switch (wdev->iftype) {
+                case NL80211_IFTYPE_ADHOC:
+                        cfg80211_ibss_wext_join(rdev, wdev);
                         break;
-                if (!dev->ieee80211_ptr->wext.ibss.ssid_len)
+                case NL80211_IFTYPE_STATION:
+                        cfg80211_mgd_wext_connect(rdev, wdev);
                         break;
-                cfg80211_join_ibss(rdev, dev, &dev->ieee80211_ptr->wext.ibss);
-                break;
+                default:
+                        break;
+                }
+                wdev_unlock(wdev);
+                mutex_unlock(&rdev->devlist_mtx);
+                cfg80211_unlock_rdev(rdev);
 #endif
+                break;
         case NETDEV_UNREGISTER:
+                cfg80211_lock_rdev(rdev);
+
+                if (WARN_ON(rdev->scan_req && rdev->scan_req->dev == dev)) {
+                        rdev->scan_req->aborted = true;
+                        ___cfg80211_scan_done(rdev);
+                }
+
                 mutex_lock(&rdev->devlist_mtx);
-                if (!list_empty(&dev->ieee80211_ptr->list)) {
+                /*
+                 * It is possible to get NETDEV_UNREGISTER
+                 * multiple times. To detect that, check
+                 * that the interface is still on the list
+                 * of registered interfaces, and only then
+                 * remove and clean it up.
+                 */
+                if (!list_empty(&wdev->list)) {
                         sysfs_remove_link(&dev->dev.kobj, "phy80211");
-                        list_del_init(&dev->ieee80211_ptr->list);
+                        list_del_init(&wdev->list);
+                        rdev->devlist_generation++;
+                        mutex_destroy(&wdev->mtx);
+#ifdef CONFIG_WIRELESS_EXT
+                        kfree(wdev->wext.keys);
+#endif
                 }
                 mutex_unlock(&rdev->devlist_mtx);
+                cfg80211_unlock_rdev(rdev);
                 break;
         case NETDEV_PRE_UP:
+                if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
+                        return notifier_from_errno(-EOPNOTSUPP);
                 if (rfkill_blocked(rdev->rfkill))
                         return notifier_from_errno(-ERFKILL);
                 break;
@@ -591,10 +772,32 @@ static struct notifier_block cfg80211_netdev_notifier = {
         .notifier_call = cfg80211_netdev_notifier_call,
 };
 
-static int cfg80211_init(void)
+static void __net_exit cfg80211_pernet_exit(struct net *net)
+{
+        struct cfg80211_registered_device *rdev;
+
+        rtnl_lock();
+        mutex_lock(&cfg80211_mutex);
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                if (net_eq(wiphy_net(&rdev->wiphy), net))
+                        WARN_ON(cfg80211_switch_netns(rdev, &init_net));
+        }
+        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
+}
+
+static struct pernet_operations cfg80211_pernet_ops = {
+        .exit = cfg80211_pernet_exit,
+};
+
+static int __init cfg80211_init(void)
 {
         int err;
 
+        err = register_pernet_device(&cfg80211_pernet_ops);
+        if (err)
+                goto out_fail_pernet;
+
         err = wiphy_sysfs_init();
         if (err)
                 goto out_fail_sysfs;
@@ -622,9 +825,10 @@ out_fail_nl80211:
 out_fail_notifier:
         wiphy_sysfs_exit();
 out_fail_sysfs:
+        unregister_pernet_device(&cfg80211_pernet_ops);
+out_fail_pernet:
         return err;
 }
-
 subsys_initcall(cfg80211_init);
 
 static void cfg80211_exit(void)
@@ -634,5 +838,6 @@ static void cfg80211_exit(void)
         unregister_netdevice_notifier(&cfg80211_netdev_notifier);
         wiphy_sysfs_exit();
         regulatory_exit();
+        unregister_pernet_device(&cfg80211_pernet_ops);
 }
 module_exit(cfg80211_exit);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index bfa340c7abb5..c603f5286326 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -49,6 +49,7 @@ struct cfg80211_registered_device {
         /* associate netdev list */
         struct mutex devlist_mtx;
         struct list_head netdev_list;
+        int devlist_generation;
 
         /* BSSes/scanning */
         spinlock_t bss_lock;
@@ -57,6 +58,17 @@ struct cfg80211_registered_device {
         u32 bss_generation;
         struct cfg80211_scan_request *scan_req; /* protected by RTNL */
         unsigned long suspend_at;
+        struct work_struct scan_done_wk;
+
+#ifdef CONFIG_NL80211_TESTMODE
+        struct genl_info *testmode_info;
+#endif
+
+        struct work_struct conn_work;
+        struct work_struct event_work;
+
+        /* current channel */
+        struct ieee80211_channel *channel;
 
 #ifdef CONFIG_CFG80211_DEBUGFS
         /* Debugfs entries */
@@ -89,13 +101,14 @@ bool wiphy_idx_valid(int wiphy_idx)
 }
 
 extern struct mutex cfg80211_mutex;
-extern struct list_head cfg80211_drv_list;
+extern struct list_head cfg80211_rdev_list;
+extern int cfg80211_rdev_list_generation;
 
 #define assert_cfg80211_lock() WARN_ON(!mutex_is_locked(&cfg80211_mutex))
 
 /*
  * You can use this to mark a wiphy_idx as not having an associated wiphy.
- * It guarantees cfg80211_drv_by_wiphy_idx(wiphy_idx) will return NULL
+ * It guarantees cfg80211_rdev_by_wiphy_idx(wiphy_idx) will return NULL
  */
 #define WIPHY_IDX_STALE -1
 
@@ -104,17 +117,40 @@ struct cfg80211_internal_bss {
         struct rb_node rbn;
         unsigned long ts;
         struct kref ref;
-        bool hold, ies_allocated;
+        atomic_t hold;
+        bool ies_allocated;
 
         /* must be last because of priv member */
         struct cfg80211_bss pub;
 };
 
-struct cfg80211_registered_device *cfg80211_drv_by_wiphy_idx(int wiphy_idx);
+static inline struct cfg80211_internal_bss *bss_from_pub(struct cfg80211_bss *pub)
+{
+        return container_of(pub, struct cfg80211_internal_bss, pub);
+}
+
+static inline void cfg80211_ref_bss(struct cfg80211_internal_bss *bss)
+{
+        kref_get(&bss->ref);
+}
+
+static inline void cfg80211_hold_bss(struct cfg80211_internal_bss *bss)
+{
+        atomic_inc(&bss->hold);
+}
+
+static inline void cfg80211_unhold_bss(struct cfg80211_internal_bss *bss)
+{
+        int r = atomic_dec_return(&bss->hold);
+        WARN_ON(r < 0);
+}
+
+
+struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx);
 int get_wiphy_idx(struct wiphy *wiphy);
 
 struct cfg80211_registered_device *
-__cfg80211_drv_from_info(struct genl_info *info);
+__cfg80211_rdev_from_info(struct genl_info *info);
 
 /*
  * This function returns a pointer to the driver
@@ -122,12 +158,12 @@ __cfg80211_drv_from_info(struct genl_info *info);
  * If successful, it returns non-NULL and also locks
  * the driver's mutex!
  *
- * This means that you need to call cfg80211_put_dev()
+ * This means that you need to call cfg80211_unlock_rdev()
  * before being allowed to acquire &cfg80211_mutex!
  *
  * This is necessary because we need to lock the global
  * mutex to get an item off the list safely, and then
- * we lock the drv mutex so it doesn't go away under us.
+ * we lock the rdev mutex so it doesn't go away under us.
  *
  * We don't want to keep cfg80211_mutex locked
  * for all the time in order to allow requests on
@@ -139,19 +175,93 @@ __cfg80211_drv_from_info(struct genl_info *info);
 extern struct cfg80211_registered_device *
 cfg80211_get_dev_from_info(struct genl_info *info);
 
-/* requires cfg80211_drv_mutex to be held! */
+/* requires cfg80211_rdev_mutex to be held! */
 struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx);
 
 /* identical to cfg80211_get_dev_from_info but only operate on ifindex */
 extern struct cfg80211_registered_device *
-cfg80211_get_dev_from_ifindex(int ifindex);
+cfg80211_get_dev_from_ifindex(struct net *net, int ifindex);
+
+int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
+                          struct net *net);
+
+static inline void cfg80211_lock_rdev(struct cfg80211_registered_device *rdev)
+{
+        mutex_lock(&rdev->mtx);
+}
+
+static inline void cfg80211_unlock_rdev(struct cfg80211_registered_device *rdev)
+{
+        BUG_ON(IS_ERR(rdev) || !rdev);
+        mutex_unlock(&rdev->mtx);
+}
+
+static inline void wdev_lock(struct wireless_dev *wdev)
+        __acquires(wdev)
+{
+        mutex_lock(&wdev->mtx);
+        __acquire(wdev->mtx);
+}
+
+static inline void wdev_unlock(struct wireless_dev *wdev)
+        __releases(wdev)
+{
+        __release(wdev->mtx);
+        mutex_unlock(&wdev->mtx);
+}
+
+#define ASSERT_RDEV_LOCK(rdev) WARN_ON(!mutex_is_locked(&(rdev)->mtx));
+#define ASSERT_WDEV_LOCK(wdev) WARN_ON(!mutex_is_locked(&(wdev)->mtx));
+
+enum cfg80211_event_type {
+        EVENT_CONNECT_RESULT,
+        EVENT_ROAMED,
+        EVENT_DISCONNECTED,
+        EVENT_IBSS_JOINED,
+};
+
+struct cfg80211_event {
+        struct list_head list;
+        enum cfg80211_event_type type;
+
+        union {
+                struct {
+                        u8 bssid[ETH_ALEN];
+                        const u8 *req_ie;
+                        const u8 *resp_ie;
+                        size_t req_ie_len;
+                        size_t resp_ie_len;
+                        u16 status;
+                } cr;
+                struct {
+                        u8 bssid[ETH_ALEN];
+                        const u8 *req_ie;
+                        const u8 *resp_ie;
+                        size_t req_ie_len;
+                        size_t resp_ie_len;
+                } rm;
+                struct {
+                        const u8 *ie;
+                        size_t ie_len;
+                        u16 reason;
+                } dc;
+                struct {
+                        u8 bssid[ETH_ALEN];
+                } ij;
+        };
+};
+
+struct cfg80211_cached_keys {
+        struct key_params params[6];
+        u8 data[6][WLAN_MAX_KEY_LEN];
+        int def, defmgmt;
+};
 
-extern void cfg80211_put_dev(struct cfg80211_registered_device *drv);
 
 /* free object */
-extern void cfg80211_dev_free(struct cfg80211_registered_device *drv);
+extern void cfg80211_dev_free(struct cfg80211_registered_device *rdev);
 
-extern int cfg80211_dev_rename(struct cfg80211_registered_device *drv,
+extern int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                                char *newname);
 
 void ieee80211_set_bitrate_flags(struct wiphy *wiphy);
@@ -163,15 +273,109 @@ void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                       unsigned long age_secs);
 
 /* IBSS */
+int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct cfg80211_ibss_params *params,
+                         struct cfg80211_cached_keys *connkeys);
 int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
-                       struct cfg80211_ibss_params *params);
+                       struct cfg80211_ibss_params *params,
+                       struct cfg80211_cached_keys *connkeys);
 void cfg80211_clear_ibss(struct net_device *dev, bool nowext);
 int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
                         struct net_device *dev, bool nowext);
+void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid);
+int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
+                            struct wireless_dev *wdev);
+
+/* MLME */
+int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_auth_type auth_type,
+                         const u8 *bssid,
+                         const u8 *ssid, int ssid_len,
+                         const u8 *ie, int ie_len,
+                         const u8 *key, int key_len, int key_idx);
+int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev, struct ieee80211_channel *chan,
+                       enum nl80211_auth_type auth_type, const u8 *bssid,
+                       const u8 *ssid, int ssid_len,
+                       const u8 *ie, int ie_len,
+                       const u8 *key, int key_len, int key_idx);
+int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev,
+                          struct ieee80211_channel *chan,
+                          const u8 *bssid, const u8 *prev_bssid,
+                          const u8 *ssid, int ssid_len,
+                          const u8 *ie, int ie_len, bool use_mfp,
+                          struct cfg80211_crypto_settings *crypt);
+int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, struct ieee80211_channel *chan,
+                        const u8 *bssid, const u8 *prev_bssid,
+                        const u8 *ssid, int ssid_len,
+                        const u8 *ie, int ie_len, bool use_mfp,
+                        struct cfg80211_crypto_settings *crypt);
+int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason);
+int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev, const u8 *bssid,
+                         const u8 *ie, int ie_len, u16 reason);
+int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason);
+void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev);
+void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
+                               const u8 *req_ie, size_t req_ie_len,
+                               const u8 *resp_ie, size_t resp_ie_len,
+                               u16 status, bool wextev,
+                               struct cfg80211_bss *bss);
+
+/* SME */
+int __cfg80211_connect(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_connect_params *connect,
+                       struct cfg80211_cached_keys *connkeys,
+                       const u8 *prev_bssid);
+int cfg80211_connect(struct cfg80211_registered_device *rdev,
+                     struct net_device *dev,
+                     struct cfg80211_connect_params *connect,
+                     struct cfg80211_cached_keys *connkeys);
+int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, u16 reason,
+                          bool wextev);
+int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, u16 reason,
+                        bool wextev);
+void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
+                       const u8 *req_ie, size_t req_ie_len,
+                       const u8 *resp_ie, size_t resp_ie_len);
+int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev);
+
+void cfg80211_conn_work(struct work_struct *work);
+bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev);
 
 /* internal helpers */
-int cfg80211_validate_key_settings(struct key_params *params, int key_idx,
+int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
+                                   struct key_params *params, int key_idx,
                                    const u8 *mac_addr);
+void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
+                             size_t ie_len, u16 reason, bool from_ap);
+void cfg80211_sme_scan_done(struct net_device *dev);
+void cfg80211_sme_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
+void cfg80211_sme_disassoc(struct net_device *dev, int idx);
+void __cfg80211_scan_done(struct work_struct *wk);
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev);
+void cfg80211_upload_connect_keys(struct wireless_dev *wdev);
+
+struct ieee80211_channel *
+rdev_fixed_channel(struct cfg80211_registered_device *rdev,
+                   struct wireless_dev *for_wdev);
+int rdev_set_freq(struct cfg80211_registered_device *rdev,
+                  struct wireless_dev *for_wdev,
+                  int freq, enum nl80211_channel_type channel_type);
 
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 679ddfcec1ee..13d93d84f902 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -104,15 +104,15 @@ static const struct file_operations ht40allow_map_ops = {
 };
 
 #define DEBUGFS_ADD(name)                                               \
-        drv->debugfs.name = debugfs_create_file(#name, S_IRUGO, phyd,   \
-                                                  &drv->wiphy, &name## _ops);
+        rdev->debugfs.name = debugfs_create_file(#name, S_IRUGO, phyd,  \
+                                                  &rdev->wiphy, &name## _ops);
 #define DEBUGFS_DEL(name)                                               \
-        debugfs_remove(drv->debugfs.name);                              \
-        drv->debugfs.name = NULL;
+        debugfs_remove(rdev->debugfs.name);                             \
+        rdev->debugfs.name = NULL;
 
-void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv)
+void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev)
 {
-        struct dentry *phyd = drv->wiphy.debugfsdir;
+        struct dentry *phyd = rdev->wiphy.debugfsdir;
 
         DEBUGFS_ADD(rts_threshold);
         DEBUGFS_ADD(fragmentation_threshold);
@@ -121,7 +121,7 @@ void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv)
         DEBUGFS_ADD(ht40allow_map);
 }
 
-void cfg80211_debugfs_drv_del(struct cfg80211_registered_device *drv)
+void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev)
 {
         DEBUGFS_DEL(rts_threshold);
         DEBUGFS_DEL(fragmentation_threshold);
diff --git a/net/wireless/debugfs.h b/net/wireless/debugfs.h
index c226983ae66b..6419b6d6ce3e 100644
--- a/net/wireless/debugfs.h
+++ b/net/wireless/debugfs.h
@@ -2,13 +2,13 @@
 #define __CFG80211_DEBUGFS_H
 
 #ifdef CONFIG_CFG80211_DEBUGFS
-void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv);
-void cfg80211_debugfs_drv_del(struct cfg80211_registered_device *drv);
+void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev);
+void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev);
 #else
 static inline
-void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv) {}
+void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev) {}
 static inline
-void cfg80211_debugfs_drv_del(struct cfg80211_registered_device *drv) {}
+void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev) {}
 #endif
 
 #endif /* __CFG80211_DEBUGFS_H */
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index a4a1c3498ff2..42840a01be74 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -7,10 +7,11 @@
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <net/cfg80211.h>
+#include "wext-compat.h"
 #include "nl80211.h"
 
 
-void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
+void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_bss *bss;
@@ -24,9 +25,6 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
         if (WARN_ON(!wdev->ssid_len))
                 return;
 
-        if (memcmp(bssid, wdev->bssid, ETH_ALEN) == 0)
-                return;
-
         bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
                                wdev->ssid, wdev->ssid_len,
                                WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
@@ -36,39 +34,74 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
         }
 
-        cfg80211_hold_bss(bss);
-        wdev->current_bss = bss;
-        memcpy(wdev->bssid, bssid, ETH_ALEN);
+        cfg80211_hold_bss(bss_from_pub(bss));
+        wdev->current_bss = bss_from_pub(bss);
 
-        nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid, gfp);
+        cfg80211_upload_connect_keys(wdev);
+
+        nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
+                                GFP_KERNEL);
 #ifdef CONFIG_WIRELESS_EXT
         memset(&wrqu, 0, sizeof(wrqu));
         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 #endif
 }
+
+void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        ev = kzalloc(sizeof(*ev), gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_IBSS_JOINED;
+        memcpy(ev->cr.bssid, bssid, ETH_ALEN);
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        schedule_work(&rdev->event_work);
+}
 EXPORT_SYMBOL(cfg80211_ibss_joined);
 
-int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev,
-                       struct cfg80211_ibss_params *params)
+int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct cfg80211_ibss_params *params,
+                         struct cfg80211_cached_keys *connkeys)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan;
         int err;
 
+        ASSERT_WDEV_LOCK(wdev);
+
+        chan = rdev_fixed_channel(rdev, wdev);
+        if (chan && chan != params->channel)
+                return -EBUSY;
+
         if (wdev->ssid_len)
                 return -EALREADY;
 
+        if (WARN_ON(wdev->connect_keys))
+                kfree(wdev->connect_keys);
+        wdev->connect_keys = connkeys;
+
 #ifdef CONFIG_WIRELESS_EXT
         wdev->wext.ibss.channel = params->channel;
 #endif
         err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
-
-        if (err)
+        if (err) {
+                wdev->connect_keys = NULL;
                 return err;
+        }
 
         memcpy(wdev->ssid, params->ssid, params->ssid_len);
         wdev->ssid_len = params->ssid_len;
@@ -76,45 +109,107 @@ int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
-void cfg80211_clear_ibss(struct net_device *dev, bool nowext)
+int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_ibss_params *params,
+                       struct cfg80211_cached_keys *connkeys)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        mutex_lock(&rdev->devlist_mtx);
+        wdev_lock(wdev);
+        err = __cfg80211_join_ibss(rdev, dev, params, connkeys);
+        wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
+
+        return err;
+}
+
+static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int i;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        kfree(wdev->connect_keys);
+        wdev->connect_keys = NULL;
+
+        /*
+         * Delete all the keys ... pairwise keys can't really
+         * exist any more anyway, but default keys might.
+         */
+        if (rdev->ops->del_key)
+                for (i = 0; i < 6; i++)
+                        rdev->ops->del_key(wdev->wiphy, dev, i, NULL);
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
         }
 
         wdev->current_bss = NULL;
         wdev->ssid_len = 0;
-        memset(wdev->bssid, 0, ETH_ALEN);
 #ifdef CONFIG_WIRELESS_EXT
         if (!nowext)
                 wdev->wext.ibss.ssid_len = 0;
 #endif
 }
 
-int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
-                        struct net_device *dev, bool nowext)
+void cfg80211_clear_ibss(struct net_device *dev, bool nowext)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        wdev_lock(wdev);
+        __cfg80211_clear_ibss(dev, nowext);
+        wdev_unlock(wdev);
+}
+
+static int __cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                                 struct net_device *dev, bool nowext)
 {
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!wdev->ssid_len)
+                return -ENOLINK;
+
         err = rdev->ops->leave_ibss(&rdev->wiphy, dev);
 
         if (err)
                 return err;
 
-        cfg80211_clear_ibss(dev, nowext);
+        __cfg80211_clear_ibss(dev, nowext);
 
         return 0;
 }
 
+int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, bool nowext)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_leave_ibss(rdev, dev, nowext);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
 #ifdef CONFIG_WIRELESS_EXT
-static int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
-                                   struct wireless_dev *wdev)
+int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
+                            struct wireless_dev *wdev)
 {
+        struct cfg80211_cached_keys *ck = NULL;
         enum ieee80211_band band;
-        int i;
+        int i, err;
+
+        ASSERT_WDEV_LOCK(wdev);
 
         if (!wdev->wext.ibss.beacon_interval)
                 wdev->wext.ibss.beacon_interval = 100;
@@ -154,43 +249,66 @@ static int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
         if (!netif_running(wdev->netdev))
                 return 0;
 
-        return cfg80211_join_ibss(wiphy_to_dev(wdev->wiphy),
-                                  wdev->netdev, &wdev->wext.ibss);
+        if (wdev->wext.keys)
+                wdev->wext.keys->def = wdev->wext.default_key;
+
+        wdev->wext.ibss.privacy = wdev->wext.default_key != -1;
+
+        if (wdev->wext.keys) {
+                ck = kmemdup(wdev->wext.keys, sizeof(*ck), GFP_KERNEL);
+                if (!ck)
+                        return -ENOMEM;
+                for (i = 0; i < 6; i++)
+                        ck->params[i].key = ck->data[i];
+        }
+        err = __cfg80211_join_ibss(rdev, wdev->netdev,
+                                   &wdev->wext.ibss, ck);
+        if (err)
+                kfree(ck);
+
+        return err;
 }
 
 int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                                struct iw_request_info *info,
-                               struct iw_freq *freq, char *extra)
+                               struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct ieee80211_channel *chan;
-        int err;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct ieee80211_channel *chan = NULL;
+        int err, freq;
 
         /* call only for ibss! */
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
-        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+        if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
-        chan = cfg80211_wext_freq(wdev->wiphy, freq);
-        if (chan && IS_ERR(chan))
-                return PTR_ERR(chan);
+        freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+        if (freq < 0)
+                return freq;
 
-        if (chan &&
-            (chan->flags & IEEE80211_CHAN_NO_IBSS ||
-             chan->flags & IEEE80211_CHAN_DISABLED))
-                return -EINVAL;
+        if (freq) {
+                chan = ieee80211_get_channel(wdev->wiphy, freq);
+                if (!chan)
+                        return -EINVAL;
+                if (chan->flags & IEEE80211_CHAN_NO_IBSS ||
+                    chan->flags & IEEE80211_CHAN_DISABLED)
+                        return -EINVAL;
+        }
 
         if (wdev->wext.ibss.channel == chan)
                 return 0;
 
-        if (wdev->ssid_len) {
-                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                          dev, true);
-                if (err)
-                        return err;
-        }
+        wdev_lock(wdev);
+        err = 0;
+        if (wdev->ssid_len)
+                err = __cfg80211_leave_ibss(rdev, dev, true);
+        wdev_unlock(wdev);
+
+        if (err)
+                return err;
 
         if (chan) {
                 wdev->wext.ibss.channel = chan;
@@ -200,10 +318,14 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                 wdev->wext.ibss.channel_fixed = false;
         }
 
-        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        mutex_lock(&rdev->devlist_mtx);
+        wdev_lock(wdev);
+        err = cfg80211_ibss_wext_join(rdev, wdev);
+        wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
+
+        return err;
 }
-/* temporary symbol - mark GPL - in the future the handler won't be */
-EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwfreq);
 
 int cfg80211_ibss_wext_giwfreq(struct net_device *dev,
                                struct iw_request_info *info,
@@ -216,10 +338,12 @@ int cfg80211_ibss_wext_giwfreq(struct net_device *dev,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
+        wdev_lock(wdev);
         if (wdev->current_bss)
-                chan = wdev->current_bss->channel;
+                chan = wdev->current_bss->pub.channel;
         else if (wdev->wext.ibss.channel)
                 chan = wdev->wext.ibss.channel;
+        wdev_unlock(wdev);
 
         if (chan) {
                 freq->m = chan->center_freq;
@@ -230,14 +354,13 @@ int cfg80211_ibss_wext_giwfreq(struct net_device *dev,
         /* no channel if not joining */
         return -EINVAL;
 }
-/* temporary symbol - mark GPL - in the future the handler won't be */
-EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_giwfreq);
 
 int cfg80211_ibss_wext_siwessid(struct net_device *dev,
                                 struct iw_request_info *info,
                                 struct iw_point *data, char *ssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         size_t len = data->length;
         int err;
 
@@ -245,15 +368,17 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
-        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+        if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
-        if (wdev->ssid_len) {
-                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                          dev, true);
-                if (err)
-                        return err;
-        }
+        wdev_lock(wdev);
+        err = 0;
+        if (wdev->ssid_len)
+                err = __cfg80211_leave_ibss(rdev, dev, true);
+        wdev_unlock(wdev);
+
+        if (err)
+                return err;
 
         /* iwconfig uses nul termination in SSID.. */
         if (len > 0 && ssid[len - 1] == '\0')
@@ -263,10 +388,14 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         memcpy(wdev->wext.ibss.ssid, ssid, len);
         wdev->wext.ibss.ssid_len = len;
 
-        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        mutex_lock(&rdev->devlist_mtx);
+        wdev_lock(wdev);
+        err = cfg80211_ibss_wext_join(rdev, wdev);
+        wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
+
+        return err;
 }
-/* temporary symbol - mark GPL - in the future the handler won't be */
-EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwessid);
 
 int cfg80211_ibss_wext_giwessid(struct net_device *dev,
                                 struct iw_request_info *info,
@@ -280,6 +409,7 @@ int cfg80211_ibss_wext_giwessid(struct net_device *dev,
 
         data->flags = 0;
 
+        wdev_lock(wdev);
         if (wdev->ssid_len) {
                 data->flags = 1;
                 data->length = wdev->ssid_len;
@@ -289,17 +419,17 @@ int cfg80211_ibss_wext_giwessid(struct net_device *dev,
                 data->length = wdev->wext.ibss.ssid_len;
                 memcpy(ssid, wdev->wext.ibss.ssid, data->length);
         }
+        wdev_unlock(wdev);
 
         return 0;
 }
-/* temporary symbol - mark GPL - in the future the handler won't be */
-EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_giwessid);
 
 int cfg80211_ibss_wext_siwap(struct net_device *dev,
                              struct iw_request_info *info,
                              struct sockaddr *ap_addr, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         u8 *bssid = ap_addr->sa_data;
         int err;
 
@@ -307,7 +437,7 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
-        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+        if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
         if (ap_addr->sa_family != ARPHRD_ETHER)
@@ -326,12 +456,14 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
             compare_ether_addr(bssid, wdev->wext.ibss.bssid) == 0)
                 return 0;
 
-        if (wdev->ssid_len) {
-                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                          dev, true);
-                if (err)
-                        return err;
-        }
+        wdev_lock(wdev);
+        err = 0;
+        if (wdev->ssid_len)
+                err = __cfg80211_leave_ibss(rdev, dev, true);
+        wdev_unlock(wdev);
+
+        if (err)
+                return err;
 
         if (bssid) {
                 memcpy(wdev->wext.bssid, bssid, ETH_ALEN);
@@ -339,10 +471,14 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         } else
                 wdev->wext.ibss.bssid = NULL;
 
-        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        mutex_lock(&rdev->devlist_mtx);
+        wdev_lock(wdev);
+        err = cfg80211_ibss_wext_join(rdev, wdev);
+        wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
+
+        return err;
 }
-/* temporary symbol - mark GPL - in the future the handler won't be */
-EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwap);
 
 int cfg80211_ibss_wext_giwap(struct net_device *dev,
                              struct iw_request_info *info,
@@ -356,14 +492,16 @@ int cfg80211_ibss_wext_giwap(struct net_device *dev,
 
         ap_addr->sa_family = ARPHRD_ETHER;
 
-        if (wdev->wext.ibss.bssid) {
+        wdev_lock(wdev);
+        if (wdev->current_bss)
+                memcpy(ap_addr->sa_data, wdev->current_bss->pub.bssid, ETH_ALEN);
+        else if (wdev->wext.ibss.bssid)
                 memcpy(ap_addr->sa_data, wdev->wext.ibss.bssid, ETH_ALEN);
-                return 0;
-        }
+        else
+                memset(ap_addr->sa_data, 0, ETH_ALEN);
+
+        wdev_unlock(wdev);
 
-        memcpy(ap_addr->sa_data, wdev->bssid, ETH_ALEN);
         return 0;
 }
-/* temporary symbol - mark GPL - in the future the handler won't be */
-EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_giwap);
 #endif
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 42184361a109..da64071ceb84 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -8,75 +8,643 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/nl80211.h>
+#include <linux/wireless.h>
 #include <net/cfg80211.h>
+#include <net/iw_handler.h>
 #include "core.h"
 #include "nl80211.h"
 
 void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_rx_auth(rdev, dev, buf, len);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        u8 *bssid = mgmt->bssid;
+        int i;
+        u16 status = le16_to_cpu(mgmt->u.auth.status_code);
+        bool done = false;
+
+        wdev_lock(wdev);
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
+                                                        ETH_ALEN) == 0) {
+                        if (status == WLAN_STATUS_SUCCESS) {
+                                wdev->auth_bsses[i] = wdev->authtry_bsses[i];
+                        } else {
+                                cfg80211_unhold_bss(wdev->authtry_bsses[i]);
+                                cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
+                        }
+                        wdev->authtry_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+        }
+
+        WARN_ON(!done);
+
+        nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
+        cfg80211_sme_rx_auth(dev, buf, len);
+
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_rx_auth);
 
 void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        u16 status_code;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_rx_assoc(rdev, dev, buf, len);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        u8 *ie = mgmt->u.assoc_resp.variable;
+        int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
+        struct cfg80211_internal_bss *bss = NULL;
+
+        wdev_lock(wdev);
+
+        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+
+        /*
+         * This is a bit of a hack, we don't notify userspace of
+         * a (re-)association reply if we tried to send a reassoc
+         * and got a reject -- we only try again with an assoc
+         * frame instead of reassoc.
+         */
+        if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
+            cfg80211_sme_failed_reassoc(wdev))
+                goto out;
+
+        nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
+
+        if (status_code == WLAN_STATUS_SUCCESS) {
+                for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                        if (!wdev->auth_bsses[i])
+                                continue;
+                        if (memcmp(wdev->auth_bsses[i]->pub.bssid, mgmt->bssid,
+                                   ETH_ALEN) == 0) {
+                                bss = wdev->auth_bsses[i];
+                                wdev->auth_bsses[i] = NULL;
+                                /* additional reference to drop hold */
+                                cfg80211_ref_bss(bss);
+                                break;
+                        }
+                }
+
+                WARN_ON(!bss);
+        }
+
+        /* this consumes one bss reference (unless bss is NULL) */
+        __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
+                                  status_code,
+                                  status_code == WLAN_STATUS_SUCCESS,
+                                  bss ? &bss->pub : NULL);
+        /* drop hold now, and also reference acquired above */
+        if (bss) {
+                cfg80211_unhold_bss(bss);
+                cfg80211_put_bss(&bss->pub);
+        }
+
+ out:
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
+static void __cfg80211_send_deauth(struct net_device *dev,
+                                   const u8 *buf, size_t len)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_deauth(rdev, dev, buf, len);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        const u8 *bssid = mgmt->bssid;
+        int i;
+        bool done = false;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
+
+        if (wdev->current_bss &&
+            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
+                done = true;
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+                wdev->current_bss = NULL;
+        } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->auth_bsses[i] &&
+                    memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
+                        cfg80211_unhold_bss(wdev->auth_bsses[i]);
+                        cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
+                        wdev->auth_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
+                        cfg80211_unhold_bss(wdev->authtry_bsses[i]);
+                        cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
+                        wdev->authtry_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+        }
+
+        WARN_ON(!done);
+
+        if (wdev->sme_state == CFG80211_SME_CONNECTED) {
+                u16 reason_code;
+                bool from_ap;
+
+                reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
+
+                from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
+                __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
+        } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
+                __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          false, NULL);
+        }
+}
+
+
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len,
+                          void *cookie)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        BUG_ON(cookie && wdev != cookie);
+
+        if (cookie) {
+                /* called within callback */
+                __cfg80211_send_deauth(dev, buf, len);
+        } else {
+                wdev_lock(wdev);
+                __cfg80211_send_deauth(dev, buf, len);
+                wdev_unlock(wdev);
+        }
 }
 EXPORT_SYMBOL(cfg80211_send_deauth);
 
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
+static void __cfg80211_send_disassoc(struct net_device *dev,
+                                     const u8 *buf, size_t len)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_disassoc(rdev, dev, buf, len);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        const u8 *bssid = mgmt->bssid;
+        int i;
+        u16 reason_code;
+        bool from_ap;
+        bool done = false;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
+
+        if (wdev->sme_state != CFG80211_SME_CONNECTED)
+                return;
+
+        if (wdev->current_bss &&
+            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
+                for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                        if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
+                                continue;
+                        wdev->auth_bsses[i] = wdev->current_bss;
+                        wdev->current_bss = NULL;
+                        done = true;
+                        cfg80211_sme_disassoc(dev, i);
+                        break;
+                }
+                WARN_ON(!done);
+        } else
+                WARN_ON(1);
+
+
+        reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
+
+        from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
+        __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 }
-EXPORT_SYMBOL(cfg80211_send_disassoc);
 
-static void cfg80211_wext_disconnected(struct net_device *dev)
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len,
+                            void *cookie)
 {
-#ifdef CONFIG_WIRELESS_EXT
-        union iwreq_data wrqu;
-        memset(&wrqu, 0, sizeof(wrqu));
-        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
-#endif
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        BUG_ON(cookie && wdev != cookie);
+
+        if (cookie) {
+                /* called within callback */
+                __cfg80211_send_disassoc(dev, buf, len);
+        } else {
+                wdev_lock(wdev);
+                __cfg80211_send_disassoc(dev, buf, len);
+                wdev_unlock(wdev);
+        }
 }
+EXPORT_SYMBOL(cfg80211_send_disassoc);
 
 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_auth_timeout(rdev, dev, addr);
-        cfg80211_wext_disconnected(dev);
+        int i;
+        bool done = false;
+
+        wdev_lock(wdev);
+
+        nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
+        if (wdev->sme_state == CFG80211_SME_CONNECTING)
+                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          false, NULL);
+
+        for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(wdev->authtry_bsses[i]->pub.bssid,
+                           addr, ETH_ALEN) == 0) {
+                        cfg80211_unhold_bss(wdev->authtry_bsses[i]);
+                        cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
+                        wdev->authtry_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+        }
+
+        WARN_ON(!done);
+
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_auth_timeout);
 
 void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_assoc_timeout(rdev, dev, addr);
-        cfg80211_wext_disconnected(dev);
+        int i;
+        bool done = false;
+
+        wdev_lock(wdev);
+
+        nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
+        if (wdev->sme_state == CFG80211_SME_CONNECTING)
+                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          false, NULL);
+
+        for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
+                if (wdev->auth_bsses[i] &&
+                    memcmp(wdev->auth_bsses[i]->pub.bssid,
+                           addr, ETH_ALEN) == 0) {
+                        cfg80211_unhold_bss(wdev->auth_bsses[i]);
+                        cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
+                        wdev->auth_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+        }
+
+        WARN_ON(!done);
+
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
 
 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
                                   enum nl80211_key_type key_type, int key_id,
-                                  const u8 *tsc)
+                                  const u8 *tsc, gfp_t gfp)
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc);
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+        char *buf = kmalloc(128, gfp);
+
+        if (buf) {
+                sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
+                        "keyid=%d %scast addr=%pM)", key_id,
+                        key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
+                        addr);
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = strlen(buf);
+                wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
+                kfree(buf);
+        }
+#endif
+
+        nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 }
 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
+
+/* some MLME handling for userspace SME */
+int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_auth_type auth_type,
+                         const u8 *bssid,
+                         const u8 *ssid, int ssid_len,
+                         const u8 *ie, int ie_len,
+                         const u8 *key, int key_len, int key_idx)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_auth_request req;
+        struct cfg80211_internal_bss *bss;
+        int i, err, slot = -1, nfree = 0;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
+                if (!key || !key_len || key_idx < 0 || key_idx > 4)
+                        return -EINVAL;
+
+        if (wdev->current_bss &&
+            memcmp(bssid, wdev->current_bss->pub.bssid, ETH_ALEN) == 0)
+                return -EALREADY;
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid,
+                                                ETH_ALEN) == 0)
+                        return -EALREADY;
+                if (wdev->auth_bsses[i] &&
+                    memcmp(bssid, wdev->auth_bsses[i]->pub.bssid,
+                                                ETH_ALEN) == 0)
+                        return -EALREADY;
+        }
+
+        memset(&req, 0, sizeof(req));
+
+        req.ie = ie;
+        req.ie_len = ie_len;
+        req.auth_type = auth_type;
+        req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
+                                   WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+        req.key = key;
+        req.key_len = key_len;
+        req.key_idx = key_idx;
+        if (!req.bss)
+                return -ENOENT;
+
+        bss = bss_from_pub(req.bss);
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (!wdev->auth_bsses[i] && !wdev->authtry_bsses[i]) {
+                        slot = i;
+                        nfree++;
+                }
+        }
+
+        /* we need one free slot for disassoc and one for this auth */
+        if (nfree < 2) {
+                err = -ENOSPC;
+                goto out;
+        }
+
+        wdev->authtry_bsses[slot] = bss;
+        cfg80211_hold_bss(bss);
+
+        err = rdev->ops->auth(&rdev->wiphy, dev, &req);
+        if (err) {
+                wdev->authtry_bsses[slot] = NULL;
+                cfg80211_unhold_bss(bss);
+        }
+
+ out:
+        if (err)
+                cfg80211_put_bss(req.bss);
+        return err;
+}
+
+int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev, struct ieee80211_channel *chan,
+                       enum nl80211_auth_type auth_type, const u8 *bssid,
+                       const u8 *ssid, int ssid_len,
+                       const u8 *ie, int ie_len,
+                       const u8 *key, int key_len, int key_idx)
+{
+        int err;
+
+        wdev_lock(dev->ieee80211_ptr);
+        err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
+                                   ssid, ssid_len, ie, ie_len,
+                                   key, key_len, key_idx);
+        wdev_unlock(dev->ieee80211_ptr);
+
+        return err;
+}
+
+int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev,
+                          struct ieee80211_channel *chan,
+                          const u8 *bssid, const u8 *prev_bssid,
+                          const u8 *ssid, int ssid_len,
+                          const u8 *ie, int ie_len, bool use_mfp,
+                          struct cfg80211_crypto_settings *crypt)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_assoc_request req;
+        struct cfg80211_internal_bss *bss;
+        int i, err, slot = -1;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        memset(&req, 0, sizeof(req));
+
+        if (wdev->current_bss)
+                return -EALREADY;
+
+        req.ie = ie;
+        req.ie_len = ie_len;
+        memcpy(&req.crypto, crypt, sizeof(req.crypto));
+        req.use_mfp = use_mfp;
+        req.prev_bssid = prev_bssid;
+        req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
+                                   WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+        if (!req.bss)
+                return -ENOENT;
+
+        bss = bss_from_pub(req.bss);
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (bss == wdev->auth_bsses[i]) {
+                        slot = i;
+                        break;
+                }
+        }
+
+        if (slot < 0) {
+                err = -ENOTCONN;
+                goto out;
+        }
+
+        err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
+ out:
+        /* still a reference in wdev->auth_bsses[slot] */
+        cfg80211_put_bss(req.bss);
+        return err;
+}
+
+int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        struct ieee80211_channel *chan,
+                        const u8 *bssid, const u8 *prev_bssid,
+                        const u8 *ssid, int ssid_len,
+                        const u8 *ie, int ie_len, bool use_mfp,
+                        struct cfg80211_crypto_settings *crypt)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
+                                    ssid, ssid_len, ie, ie_len, use_mfp, crypt);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
+int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_deauth_request req;
+        int i;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        memset(&req, 0, sizeof(req));
+        req.reason_code = reason;
+        req.ie = ie;
+        req.ie_len = ie_len;
+        if (wdev->current_bss &&
+            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
+                req.bss = &wdev->current_bss->pub;
+        } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->auth_bsses[i] &&
+                    memcmp(bssid, wdev->auth_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
+                        req.bss = &wdev->auth_bsses[i]->pub;
+                        break;
+                }
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
+                        req.bss = &wdev->authtry_bsses[i]->pub;
+                        break;
+                }
+        }
+
+        if (!req.bss)
+                return -ENOTCONN;
+
+        return rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
+}
+
+int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev, const u8 *bssid,
+                         const u8 *ie, int ie_len, u16 reason)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
+static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
+                                    struct net_device *dev, const u8 *bssid,
+                                    const u8 *ie, int ie_len, u16 reason)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_disassoc_request req;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (wdev->sme_state != CFG80211_SME_CONNECTED)
+                return -ENOTCONN;
+
+        if (WARN_ON(!wdev->current_bss))
+                return -ENOTCONN;
+
+        memset(&req, 0, sizeof(req));
+        req.reason_code = reason;
+        req.ie = ie;
+        req.ie_len = ie_len;
+        if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
+                req.bss = &wdev->current_bss->pub;
+        else
+                return -ENOTCONN;
+
+        return rdev->ops->disassoc(&rdev->wiphy, dev, &req, wdev);
+}
+
+int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
+void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_deauth_request req;
+        int i;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!rdev->ops->deauth)
+                return;
+
+        memset(&req, 0, sizeof(req));
+        req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
+        req.ie = NULL;
+        req.ie_len = 0;
+
+        if (wdev->current_bss) {
+                req.bss = &wdev->current_bss->pub;
+                rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
+                if (wdev->current_bss) {
+                        cfg80211_unhold_bss(wdev->current_bss);
+                        cfg80211_put_bss(&wdev->current_bss->pub);
+                        wdev->current_bss = NULL;
+                }
+        }
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->auth_bsses[i]) {
+                        req.bss = &wdev->auth_bsses[i]->pub;
+                        rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
+                        if (wdev->auth_bsses[i]) {
+                                cfg80211_unhold_bss(wdev->auth_bsses[i]);
+                                cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
+                                wdev->auth_bsses[i] = NULL;
+                        }
+                }
+                if (wdev->authtry_bsses[i]) {
+                        req.bss = &wdev->authtry_bsses[i]->pub;
+                        rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
+                        if (wdev->authtry_bsses[i]) {
+                                cfg80211_unhold_bss(wdev->authtry_bsses[i]);
+                                cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
+                                wdev->authtry_bsses[i] = NULL;
+                        }
+                }
+        }
+}
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 634496b3ed77..a8aaadeb6773 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -14,8 +14,10 @@
 #include <linux/rtnetlink.h>
 #include <linux/netlink.h>
 #include <linux/etherdevice.h>
+#include <net/net_namespace.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
+#include <net/sock.h>
 #include "core.h"
 #include "nl80211.h"
 #include "reg.h"
@@ -27,27 +29,29 @@ static struct genl_family nl80211_fam = {
         .hdrsize = 0,           /* no private header */
         .version = 1,           /* no particular meaning now */
         .maxattr = NL80211_ATTR_MAX,
+        .netnsok = true,
 };
 
-/* internal helper: get drv and dev */
-static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
-                                       struct cfg80211_registered_device **drv,
+/* internal helper: get rdev and dev */
+static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
+                                       struct cfg80211_registered_device **rdev,
                                        struct net_device **dev)
 {
+        struct nlattr **attrs = info->attrs;
         int ifindex;
 
         if (!attrs[NL80211_ATTR_IFINDEX])
                 return -EINVAL;
 
         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
-        *dev = dev_get_by_index(&init_net, ifindex);
+        *dev = dev_get_by_index(genl_info_net(info), ifindex);
         if (!*dev)
                 return -ENODEV;
 
-        *drv = cfg80211_get_dev_from_ifindex(ifindex);
-        if (IS_ERR(*drv)) {
+        *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
+        if (IS_ERR(*rdev)) {
                 dev_put(*dev);
-                return PTR_ERR(*drv);
+                return PTR_ERR(*rdev);
         }
 
         return 0;
@@ -71,7 +75,9 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 
         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
 
+        [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
                                     .len = WLAN_MAX_KEY_LEN },
         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
@@ -128,6 +134,21 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
                 .len = sizeof(struct nl80211_sta_flag_update),
         },
         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
+        [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
+        [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
+        [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
+        [NL80211_ATTR_PID] = { .type = NLA_U32 },
+};
+
+/* policy for the attributes */
+static struct nla_policy
+nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
+        [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
+        [NL80211_KEY_IDX] = { .type = NLA_U8 },
+        [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
+        [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
+        [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
+        [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 };
 
 /* IE validation */
@@ -194,6 +215,177 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
 
 /* netlink command implementations */
 
+struct key_parse {
+        struct key_params p;
+        int idx;
+        bool def, defmgmt;
+};
+
+static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
+{
+        struct nlattr *tb[NL80211_KEY_MAX + 1];
+        int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
+                                   nl80211_key_policy);
+        if (err)
+                return err;
+
+        k->def = !!tb[NL80211_KEY_DEFAULT];
+        k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
+
+        if (tb[NL80211_KEY_IDX])
+                k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
+
+        if (tb[NL80211_KEY_DATA]) {
+                k->p.key = nla_data(tb[NL80211_KEY_DATA]);
+                k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
+        }
+
+        if (tb[NL80211_KEY_SEQ]) {
+                k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
+                k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
+        }
+
+        if (tb[NL80211_KEY_CIPHER])
+                k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
+
+        return 0;
+}
+
+static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
+{
+        if (info->attrs[NL80211_ATTR_KEY_DATA]) {
+                k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
+                k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
+        }
+
+        if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
+                k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
+                k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
+        }
+
+        if (info->attrs[NL80211_ATTR_KEY_IDX])
+                k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
+
+        if (info->attrs[NL80211_ATTR_KEY_CIPHER])
+                k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
+
+        k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
+        k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
+
+        return 0;
+}
+
+static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
+{
+        int err;
+
+        memset(k, 0, sizeof(*k));
+        k->idx = -1;
+
+        if (info->attrs[NL80211_ATTR_KEY])
+                err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
+        else
+                err = nl80211_parse_key_old(info, k);
+
+        if (err)
+                return err;
+
+        if (k->def && k->defmgmt)
+                return -EINVAL;
+
+        if (k->idx != -1) {
+                if (k->defmgmt) {
+                        if (k->idx < 4 || k->idx > 5)
+                                return -EINVAL;
+                } else if (k->def) {
+                        if (k->idx < 0 || k->idx > 3)
+                                return -EINVAL;
+                } else {
+                        if (k->idx < 0 || k->idx > 5)
+                                return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+static struct cfg80211_cached_keys *
+nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
+                       struct nlattr *keys)
+{
+        struct key_parse parse;
+        struct nlattr *key;
+        struct cfg80211_cached_keys *result;
+        int rem, err, def = 0;
+
+        result = kzalloc(sizeof(*result), GFP_KERNEL);
+        if (!result)
+                return ERR_PTR(-ENOMEM);
+
+        result->def = -1;
+        result->defmgmt = -1;
+
+        nla_for_each_nested(key, keys, rem) {
+                memset(&parse, 0, sizeof(parse));
+                parse.idx = -1;
+
+                err = nl80211_parse_key_new(key, &parse);
+                if (err)
+                        goto error;
+                err = -EINVAL;
+                if (!parse.p.key)
+                        goto error;
+                if (parse.idx < 0 || parse.idx > 4)
+                        goto error;
+                if (parse.def) {
+                        if (def)
+                                goto error;
+                        def = 1;
+                        result->def = parse.idx;
+                } else if (parse.defmgmt)
+                        goto error;
+                err = cfg80211_validate_key_settings(rdev, &parse.p,
+                                                     parse.idx, NULL);
+                if (err)
+                        goto error;
+                result->params[parse.idx].cipher = parse.p.cipher;
+                result->params[parse.idx].key_len = parse.p.key_len;
+                result->params[parse.idx].key = result->data[parse.idx];
+                memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
+        }
+
+        return result;
+ error:
+        kfree(result);
+        return ERR_PTR(err);
+}
+
+static int nl80211_key_allowed(struct wireless_dev *wdev)
+{
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!netif_running(wdev->netdev))
+                return -ENETDOWN;
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                if (!wdev->current_bss)
+                        return -ENOLINK;
+                break;
+        case NL80211_IFTYPE_STATION:
+                if (wdev->sme_state != CFG80211_SME_CONNECTED)
+                        return -ENOLINK;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                               struct cfg80211_registered_device *dev)
 {
@@ -216,6 +408,9 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
+                    cfg80211_rdev_list_generation);
+
         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
                    dev->wiphy.retry_short);
         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
@@ -345,8 +540,23 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(deauth, DEAUTHENTICATE);
         CMD(disassoc, DISASSOCIATE);
         CMD(join_ibss, JOIN_IBSS);
+        if (dev->wiphy.netnsok) {
+                i++;
+                NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
+        }
 
 #undef CMD
+
+        if (dev->ops->connect || dev->ops->auth) {
+                i++;
+                NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
+        }
+
+        if (dev->ops->disconnect || dev->ops->deauth) {
+                i++;
+                NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
+        }
+
         nla_nest_end(msg, nl_cmds);
 
         return genlmsg_end(msg, hdr);
@@ -363,7 +573,9 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
         struct cfg80211_registered_device *dev;
 
         mutex_lock(&cfg80211_mutex);
-        list_for_each_entry(dev, &cfg80211_drv_list, list) {
+        list_for_each_entry(dev, &cfg80211_rdev_list, list) {
+                if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
+                        continue;
                 if (++idx <= start)
                         continue;
                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
@@ -396,14 +608,14 @@ static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
                 goto out_free;
 
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
 
-        return genlmsg_unicast(msg, info->snd_pid);
+        return genlmsg_reply(msg, info);
 
  out_free:
         nlmsg_free(msg);
  out_err:
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
         return -ENOBUFS;
 }
 
@@ -445,7 +657,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 
         mutex_lock(&cfg80211_mutex);
 
-        rdev = __cfg80211_drv_from_info(info);
+        rdev = __cfg80211_rdev_from_info(info);
         if (IS_ERR(rdev)) {
                 mutex_unlock(&cfg80211_mutex);
                 result = PTR_ERR(rdev);
@@ -492,15 +704,8 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 
         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
-                struct ieee80211_channel *chan;
-                struct ieee80211_sta_ht_cap *ht_cap;
                 u32 freq;
 
-                if (!rdev->ops->set_channel) {
-                        result = -EOPNOTSUPP;
-                        goto bad_res;
-                }
-
                 result = -EINVAL;
 
                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
@@ -514,38 +719,10 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 }
 
                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
-                chan = ieee80211_get_channel(&rdev->wiphy, freq);
 
-                /* Primary channel not allowed */
-                if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
-                        goto bad_res;
-
-                if (channel_type == NL80211_CHAN_HT40MINUS &&
-                    (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
-                        goto bad_res;
-                else if (channel_type == NL80211_CHAN_HT40PLUS &&
-                         (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
-                        goto bad_res;
-
-                /*
-                 * At this point we know if that if HT40 was requested
-                 * we are allowed to use it and the extension channel
-                 * exists.
-                 */
-
-                ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
-
-                /* no HT capabilities or intolerant */
-                if (channel_type != NL80211_CHAN_NO_HT) {
-                        if (!ht_cap->ht_supported)
-                                goto bad_res;
-                        if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
-                            (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
-                                goto bad_res;
-                }
-
-                result = rdev->ops->set_channel(&rdev->wiphy, chan,
-                                                channel_type);
+                mutex_lock(&rdev->devlist_mtx);
+                result = rdev_set_freq(rdev, NULL, freq, channel_type);
+                mutex_unlock(&rdev->devlist_mtx);
                 if (result)
                         goto bad_res;
         }
@@ -651,6 +828,11 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
+
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
+                    rdev->devlist_generation ^
+                        (cfg80211_rdev_list_generation << 2));
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -664,32 +846,34 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         int if_idx = 0;
         int wp_start = cb->args[0];
         int if_start = cb->args[1];
-        struct cfg80211_registered_device *dev;
+        struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
 
         mutex_lock(&cfg80211_mutex);
-        list_for_each_entry(dev, &cfg80211_drv_list, list) {
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
+                        continue;
                 if (wp_idx < wp_start) {
                         wp_idx++;
                         continue;
                 }
                 if_idx = 0;
 
-                mutex_lock(&dev->devlist_mtx);
-                list_for_each_entry(wdev, &dev->netdev_list, list) {
+                mutex_lock(&rdev->devlist_mtx);
+                list_for_each_entry(wdev, &rdev->netdev_list, list) {
                         if (if_idx < if_start) {
                                 if_idx++;
                                 continue;
                         }
                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                               dev, wdev->netdev) < 0) {
-                                mutex_unlock(&dev->devlist_mtx);
+                                               rdev, wdev->netdev) < 0) {
+                                mutex_unlock(&rdev->devlist_mtx);
                                 goto out;
                         }
                         if_idx++;
                 }
-                mutex_unlock(&dev->devlist_mtx);
+                mutex_unlock(&rdev->devlist_mtx);
 
                 wp_idx++;
         }
@@ -709,7 +893,7 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
         struct net_device *netdev;
         int err;
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
+        err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
         if (err)
                 return err;
 
@@ -722,15 +906,15 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
                 goto out_free;
 
         dev_put(netdev);
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
 
-        return genlmsg_unicast(msg, info->snd_pid);
+        return genlmsg_reply(msg, info);
 
  out_free:
         nlmsg_free(msg);
  out_err:
         dev_put(netdev);
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
         return -ENOBUFS;
 }
 
@@ -765,9 +949,9 @@ static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 
 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct vif_params params;
-        int err, ifindex;
+        int err;
         enum nl80211_iftype otype, ntype;
         struct net_device *dev;
         u32 _flags, *flags = NULL;
@@ -777,13 +961,11 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        ifindex = dev->ifindex;
         otype = ntype = dev->ieee80211_ptr->iftype;
-        dev_put(dev);
 
         if (info->attrs[NL80211_ATTR_IFTYPE]) {
                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
@@ -795,8 +977,8 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
-        if (!drv->ops->change_virtual_intf ||
-            !(drv->wiphy.interface_modes & (1 << ntype))) {
+        if (!rdev->ops->change_virtual_intf ||
+            !(rdev->wiphy.interface_modes & (1 << ntype))) {
                 err = -EOPNOTSUPP;
                 goto unlock;
         }
@@ -826,21 +1008,21 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         }
 
         if (change)
-                err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
+                err = rdev->ops->change_virtual_intf(&rdev->wiphy, dev,
                                                     ntype, flags, &params);
         else
                 err = 0;
 
-        dev = __dev_get_by_index(&init_net, ifindex);
-        WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
+        WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
 
-        if (dev && !err && (ntype != otype)) {
+        if (!err && (ntype != otype)) {
                 if (otype == NL80211_IFTYPE_ADHOC)
                         cfg80211_clear_ibss(dev, false);
         }
 
  unlock:
-        cfg80211_put_dev(drv);
+        dev_put(dev);
+        cfg80211_unlock_rdev(rdev);
  unlock_rtnl:
         rtnl_unlock();
         return err;
@@ -848,7 +1030,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct vif_params params;
         int err;
         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
@@ -867,14 +1049,14 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        drv = cfg80211_get_dev_from_info(info);
-        if (IS_ERR(drv)) {
-                err = PTR_ERR(drv);
+        rdev = cfg80211_get_dev_from_info(info);
+        if (IS_ERR(rdev)) {
+                err = PTR_ERR(rdev);
                 goto unlock_rtnl;
         }
 
-        if (!drv->ops->add_virtual_intf ||
-            !(drv->wiphy.interface_modes & (1 << type))) {
+        if (!rdev->ops->add_virtual_intf ||
+            !(rdev->wiphy.interface_modes & (1 << type))) {
                 err = -EOPNOTSUPP;
                 goto unlock;
         }
@@ -888,12 +1070,12 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
-        err = drv->ops->add_virtual_intf(&drv->wiphy,
+        err = rdev->ops->add_virtual_intf(&rdev->wiphy,
                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
                 type, err ? NULL : &flags, &params);
 
  unlock:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
  unlock_rtnl:
         rtnl_unlock();
         return err;
@@ -901,27 +1083,26 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
-        int ifindex, err;
+        struct cfg80211_registered_device *rdev;
+        int err;
         struct net_device *dev;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
-        ifindex = dev->ifindex;
-        dev_put(dev);
 
-        if (!drv->ops->del_virtual_intf) {
+        if (!rdev->ops->del_virtual_intf) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
+        err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
  unlock_rtnl:
         rtnl_unlock();
         return err;
@@ -930,10 +1111,12 @@ static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 struct get_key_cookie {
         struct sk_buff *msg;
         int error;
+        int idx;
 };
 
 static void get_key_callback(void *c, struct key_params *params)
 {
+        struct nlattr *key;
         struct get_key_cookie *cookie = c;
 
         if (params->key)
@@ -948,6 +1131,26 @@ static void get_key_callback(void *c, struct key_params *params)
                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
                             params->cipher);
 
+        key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
+        if (!key)
+                goto nla_put_failure;
+
+        if (params->key)
+                NLA_PUT(cookie->msg, NL80211_KEY_DATA,
+                        params->key_len, params->key);
+
+        if (params->seq)
+                NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
+                        params->seq_len, params->seq);
+
+        if (params->cipher)
+                NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
+                            params->cipher);
+
+        NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
+
+        nla_nest_end(cookie->msg, key);
+
         return;
  nla_put_failure:
         cookie->error = 1;
@@ -955,7 +1158,7 @@ static void get_key_callback(void *c, struct key_params *params)
 
 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 key_idx = 0;
@@ -977,11 +1180,11 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->get_key) {
+        if (!rdev->ops->get_key) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -1001,13 +1204,14 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
         }
 
         cookie.msg = msg;
+        cookie.idx = key_idx;
 
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
         if (mac_addr)
                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 
-        err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
+        err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
                                 &cookie, get_key_callback);
 
         if (err)
@@ -1017,7 +1221,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
                 goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
  nla_put_failure:
@@ -1025,7 +1229,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
  free_msg:
         nlmsg_free(msg);
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  unlock_rtnl:
         rtnl_unlock();
@@ -1035,57 +1239,57 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
+        struct key_parse key;
         int err;
         struct net_device *dev;
-        u8 key_idx;
         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
                     u8 key_index);
 
-        if (!info->attrs[NL80211_ATTR_KEY_IDX])
-                return -EINVAL;
-
-        key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
+        err = nl80211_parse_key(info, &key);
+        if (err)
+                return err;
 
-        if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
-                if (key_idx < 4 || key_idx > 5)
-                        return -EINVAL;
-        } else if (key_idx > 3)
+        if (key.idx < 0)
                 return -EINVAL;
 
-        /* currently only support setting default key */
-        if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
-            !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
+        /* only support setting default key */
+        if (!key.def && !key.defmgmt)
                 return -EINVAL;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
-                func = drv->ops->set_default_key;
+        if (key.def)
+                func = rdev->ops->set_default_key;
         else
-                func = drv->ops->set_default_mgmt_key;
+                func = rdev->ops->set_default_mgmt_key;
 
         if (!func) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = func(&drv->wiphy, dev, key_idx);
+        wdev_lock(dev->ieee80211_ptr);
+        err = nl80211_key_allowed(dev->ieee80211_ptr);
+        if (!err)
+                err = func(&rdev->wiphy, dev, key.idx);
+
 #ifdef CONFIG_WIRELESS_EXT
         if (!err) {
-                if (func == drv->ops->set_default_key)
-                        dev->ieee80211_ptr->wext.default_key = key_idx;
+                if (func == rdev->ops->set_default_key)
+                        dev->ieee80211_ptr->wext.default_key = key.idx;
                 else
-                        dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
+                        dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
         }
 #endif
+        wdev_unlock(dev->ieee80211_ptr);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 
  unlock_rtnl:
@@ -1096,62 +1300,47 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
-        int err, i;
+        struct cfg80211_registered_device *rdev;
+        int err;
         struct net_device *dev;
-        struct key_params params;
-        u8 key_idx = 0;
+        struct key_parse key;
         u8 *mac_addr = NULL;
 
-        memset(&params, 0, sizeof(params));
+        err = nl80211_parse_key(info, &key);
+        if (err)
+                return err;
 
-        if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
+        if (!key.p.key)
                 return -EINVAL;
 
-        if (info->attrs[NL80211_ATTR_KEY_DATA]) {
-                params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
-                params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
-        }
-
-        if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
-                params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
-                params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
-        }
-
-        if (info->attrs[NL80211_ATTR_KEY_IDX])
-                key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
-
-        params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
-
         if (info->attrs[NL80211_ATTR_MAC])
                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
-                return -EINVAL;
-
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
-                if (params.cipher == drv->wiphy.cipher_suites[i])
-                        break;
-        if (i == drv->wiphy.n_cipher_suites) {
-                err = -EINVAL;
+        if (!rdev->ops->add_key) {
+                err = -EOPNOTSUPP;
                 goto out;
         }
 
-        if (!drv->ops->add_key) {
-                err = -EOPNOTSUPP;
+        if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
+                err = -EINVAL;
                 goto out;
         }
 
-        err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
+        wdev_lock(dev->ieee80211_ptr);
+        err = nl80211_key_allowed(dev->ieee80211_ptr);
+        if (!err)
+                err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
+                                         mac_addr, &key.p);
+        wdev_unlock(dev->ieee80211_ptr);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  unlock_rtnl:
         rtnl_unlock();
@@ -1161,45 +1350,47 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
-        u8 key_idx = 0;
         u8 *mac_addr = NULL;
+        struct key_parse key;
 
-        if (info->attrs[NL80211_ATTR_KEY_IDX])
-                key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
-
-        if (key_idx > 5)
-                return -EINVAL;
+        err = nl80211_parse_key(info, &key);
+        if (err)
+                return err;
 
         if (info->attrs[NL80211_ATTR_MAC])
                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->del_key) {
+        if (!rdev->ops->del_key) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
+        wdev_lock(dev->ieee80211_ptr);
+        err = nl80211_key_allowed(dev->ieee80211_ptr);
+        if (!err)
+                err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
 
 #ifdef CONFIG_WIRELESS_EXT
         if (!err) {
-                if (key_idx == dev->ieee80211_ptr->wext.default_key)
+                if (key.idx == dev->ieee80211_ptr->wext.default_key)
                         dev->ieee80211_ptr->wext.default_key = -1;
-                else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
+                else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
         }
 #endif
+        wdev_unlock(dev->ieee80211_ptr);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 
  unlock_rtnl:
@@ -1212,7 +1403,7 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
 {
         int (*call)(struct wiphy *wiphy, struct net_device *dev,
                     struct beacon_parameters *info);
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct beacon_parameters params;
@@ -1223,7 +1414,7 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
@@ -1242,10 +1433,10 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
                         goto out;
                 }
 
-                call = drv->ops->add_beacon;
+                call = rdev->ops->add_beacon;
                 break;
         case NL80211_CMD_SET_BEACON:
-                call = drv->ops->set_beacon;
+                call = rdev->ops->set_beacon;
                 break;
         default:
                 WARN_ON(1);
@@ -1291,10 +1482,10 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = call(&drv->wiphy, dev, &params);
+        err = call(&rdev->wiphy, dev, &params);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  unlock_rtnl:
         rtnl_unlock();
@@ -1304,17 +1495,17 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->del_beacon) {
+        if (!rdev->ops->del_beacon) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -1323,10 +1514,10 @@ static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
                 err = -EOPNOTSUPP;
                 goto out;
         }
-        err = drv->ops->del_beacon(&drv->wiphy, dev);
+        err = rdev->ops->del_beacon(&rdev->wiphy, dev);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  unlock_rtnl:
         rtnl_unlock();
@@ -1433,6 +1624,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
+
         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
         if (!sinfoattr)
                 goto nla_put_failure;
@@ -1520,13 +1713,13 @@ static int nl80211_dump_station(struct sk_buff *skb,
 
         rtnl_lock();
 
-        netdev = __dev_get_by_index(&init_net, ifidx);
+        netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
         if (!netdev) {
                 err = -ENODEV;
                 goto out_rtnl;
         }
 
-        dev = cfg80211_get_dev_from_ifindex(ifidx);
+        dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
         if (IS_ERR(dev)) {
                 err = PTR_ERR(dev);
                 goto out_rtnl;
@@ -1560,7 +1753,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
         cb->args[1] = sta_idx;
         err = skb->len;
  out_err:
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
  out_rtnl:
         rtnl_unlock();
 
@@ -1569,7 +1762,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 
 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct station_info sinfo;
@@ -1585,16 +1778,16 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->get_station) {
+        if (!rdev->ops->get_station) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
+        err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
         if (err)
                 goto out;
 
@@ -1606,13 +1799,13 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
                                  dev, mac_addr, &sinfo) < 0)
                 goto out_free;
 
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
  out_free:
         nlmsg_free(msg);
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -1623,14 +1816,16 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 /*
  * Get vlan interface making sure it is on the right wiphy.
  */
-static int get_vlan(struct nlattr *vlanattr,
+static int get_vlan(struct genl_info *info,
                     struct cfg80211_registered_device *rdev,
                     struct net_device **vlan)
 {
+        struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
         *vlan = NULL;
 
         if (vlanattr) {
-                *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
+                *vlan = dev_get_by_index(genl_info_net(info),
+                                         nla_get_u32(vlanattr));
                 if (!*vlan)
                         return -ENODEV;
                 if (!(*vlan)->ieee80211_ptr)
@@ -1643,7 +1838,7 @@ static int get_vlan(struct nlattr *vlanattr,
 
 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct station_parameters params;
@@ -1685,11 +1880,11 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
+        err = get_vlan(info, rdev, &params.vlan);
         if (err)
                 goto out;
 
@@ -1738,17 +1933,17 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out;
 
-        if (!drv->ops->change_station) {
+        if (!rdev->ops->change_station) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
+        err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
 
  out:
         if (params.vlan)
                 dev_put(params.vlan);
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -1758,7 +1953,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct station_parameters params;
@@ -1798,11 +1993,11 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
+        err = get_vlan(info, rdev, &params.vlan);
         if (err)
                 goto out;
 
@@ -1838,7 +2033,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out;
 
-        if (!drv->ops->add_station) {
+        if (!rdev->ops->add_station) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -1848,12 +2043,12 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
+        err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
 
  out:
         if (params.vlan)
                 dev_put(params.vlan);
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -1863,7 +2058,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 *mac_addr = NULL;
@@ -1873,7 +2068,7 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
@@ -1884,15 +2079,15 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (!drv->ops->del_station) {
+        if (!rdev->ops->del_station) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
+        err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -1916,6 +2111,8 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
 
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
+
         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
         if (!pinfoattr)
                 goto nla_put_failure;
@@ -1979,13 +2176,13 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
 
         rtnl_lock();
 
-        netdev = __dev_get_by_index(&init_net, ifidx);
+        netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
         if (!netdev) {
                 err = -ENODEV;
                 goto out_rtnl;
         }
 
-        dev = cfg80211_get_dev_from_ifindex(ifidx);
+        dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
         if (IS_ERR(dev)) {
                 err = PTR_ERR(dev);
                 goto out_rtnl;
@@ -2023,7 +2220,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         cb->args[1] = path_idx;
         err = skb->len;
  out_err:
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
  out_rtnl:
         rtnl_unlock();
 
@@ -2032,7 +2229,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
 
 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct mpath_info pinfo;
@@ -2049,11 +2246,11 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->get_mpath) {
+        if (!rdev->ops->get_mpath) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2063,7 +2260,7 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
+        err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
         if (err)
                 goto out;
 
@@ -2075,13 +2272,13 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
                                  dev, dst, next_hop, &pinfo) < 0)
                 goto out_free;
 
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
  out_free:
         nlmsg_free(msg);
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2091,7 +2288,7 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 *dst = NULL;
@@ -2108,11 +2305,11 @@ static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->change_mpath) {
+        if (!rdev->ops->change_mpath) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2127,10 +2324,10 @@ static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
+        err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2139,7 +2336,7 @@ static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
 }
 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 *dst = NULL;
@@ -2156,11 +2353,11 @@ static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->add_mpath) {
+        if (!rdev->ops->add_mpath) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2175,10 +2372,10 @@ static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
+        err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2188,7 +2385,7 @@ static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 *dst = NULL;
@@ -2198,19 +2395,19 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->del_mpath) {
+        if (!rdev->ops->del_mpath) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
+        err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2220,7 +2417,7 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct bss_parameters params;
@@ -2249,11 +2446,11 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->change_bss) {
+        if (!rdev->ops->change_bss) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2263,10 +2460,10 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->change_bss(&drv->wiphy, dev, &params);
+        err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2357,7 +2554,7 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 static int nl80211_get_mesh_params(struct sk_buff *skb,
         struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct mesh_config cur_params;
         int err;
         struct net_device *dev;
@@ -2368,17 +2565,17 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
         rtnl_lock();
 
         /* Look up our device */
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->get_mesh_params) {
+        if (!rdev->ops->get_mesh_params) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
         /* Get the mesh params */
-        err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
+        err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
         if (err)
                 goto out;
 
@@ -2424,7 +2621,7 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
         nla_nest_end(msg, pinfoattr);
         genlmsg_end(msg, hdr);
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
  nla_put_failure:
@@ -2432,7 +2629,7 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
         err = -EMSGSIZE;
  out:
         /* Cleanup */
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2470,7 +2667,7 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         u32 mask;
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         struct mesh_config cfg;
         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
@@ -2485,11 +2682,11 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->set_mesh_params) {
+        if (!rdev->ops->set_mesh_params) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2534,11 +2731,11 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
                         nla_get_u16);
 
         /* Apply changes */
-        err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
+        err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
 
  out:
         /* cleanup */
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2612,7 +2809,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         nla_nest_end(msg, nl_reg_rules);
 
         genlmsg_end(msg, hdr);
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
 nla_put_failure:
@@ -2698,16 +2895,41 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
         return r;
 }
 
+static int validate_scan_freqs(struct nlattr *freqs)
+{
+        struct nlattr *attr1, *attr2;
+        int n_channels = 0, tmp1, tmp2;
+
+        nla_for_each_nested(attr1, freqs, tmp1) {
+                n_channels++;
+                /*
+                 * Some hardware has a limited channel list for
+                 * scanning, and it is pretty much nonsensical
+                 * to scan for a channel twice, so disallow that
+                 * and don't require drivers to check that the
+                 * channel list they get isn't longer than what
+                 * they can scan, as long as they can scan all
+                 * the channels they registered at once.
+                 */
+                nla_for_each_nested(attr2, freqs, tmp2)
+                        if (attr1 != attr2 &&
+                            nla_get_u32(attr1) == nla_get_u32(attr2))
+                                return 0;
+        }
+
+        return n_channels;
+}
+
 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         struct cfg80211_scan_request *request;
         struct cfg80211_ssid *ssid;
         struct ieee80211_channel *channel;
         struct nlattr *attr;
         struct wiphy *wiphy;
-        int err, tmp, n_ssids = 0, n_channels = 0, i;
+        int err, tmp, n_ssids = 0, n_channels, i;
         enum ieee80211_band band;
         size_t ie_len;
 
@@ -2716,13 +2938,13 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        wiphy = &drv->wiphy;
+        wiphy = &rdev->wiphy;
 
-        if (!drv->ops->scan) {
+        if (!rdev->ops->scan) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2732,19 +2954,21 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (drv->scan_req) {
+        if (rdev->scan_req) {
                 err = -EBUSY;
                 goto out;
         }
 
         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
-                nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
-                        n_channels++;
+                n_channels = validate_scan_freqs(
+                                info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
                 if (!n_channels) {
                         err = -EINVAL;
                         goto out;
                 }
         } else {
+                n_channels = 0;
+
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
                         if (wiphy->bands[band])
                                 n_channels += wiphy->bands[band]->n_channels;
@@ -2778,10 +3002,9 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        request->channels = (void *)((char *)request + sizeof(*request));
         request->n_channels = n_channels;
         if (n_ssids)
-                request->ssids = (void *)(request->channels + n_channels);
+                request->ssids = (void *)&request->channels[n_channels];
         request->n_ssids = n_ssids;
         if (ie_len) {
                 if (request->ssids)
@@ -2836,19 +3059,24 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                        request->ie_len);
         }
 
-        request->ifidx = dev->ifindex;
-        request->wiphy = &drv->wiphy;
+        request->dev = dev;
+        request->wiphy = &rdev->wiphy;
 
-        drv->scan_req = request;
-        err = drv->ops->scan(&drv->wiphy, dev, request);
+        rdev->scan_req = request;
+        err = rdev->ops->scan(&rdev->wiphy, dev, request);
+
+        if (!err) {
+                nl80211_send_scan_start(rdev, dev);
+                dev_hold(dev);
+        }
 
  out_free:
         if (err) {
-                drv->scan_req = NULL;
+                rdev->scan_req = NULL;
                 kfree(request);
         }
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2858,20 +3086,23 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                             struct cfg80211_registered_device *rdev,
-                            struct net_device *dev,
-                            struct cfg80211_bss *res)
+                            struct wireless_dev *wdev,
+                            struct cfg80211_internal_bss *intbss)
 {
+        struct cfg80211_bss *res = &intbss->pub;
         void *hdr;
         struct nlattr *bss;
+        int i;
+
+        ASSERT_WDEV_LOCK(wdev);
 
         hdr = nl80211hdr_put(msg, pid, seq, flags,
                              NL80211_CMD_NEW_SCAN_RESULTS);
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
-                    rdev->bss_generation);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
 
         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
         if (!bss)
@@ -2900,6 +3131,28 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 break;
         }
 
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+                if (intbss == wdev->current_bss)
+                        NLA_PUT_U32(msg, NL80211_BSS_STATUS,
+                                    NL80211_BSS_STATUS_ASSOCIATED);
+                else for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                        if (intbss != wdev->auth_bsses[i])
+                                continue;
+                        NLA_PUT_U32(msg, NL80211_BSS_STATUS,
+                                    NL80211_BSS_STATUS_AUTHENTICATED);
+                        break;
+                }
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                if (intbss == wdev->current_bss)
+                        NLA_PUT_U32(msg, NL80211_BSS_STATUS,
+                                    NL80211_BSS_STATUS_IBSS_JOINED);
+                break;
+        default:
+                break;
+        }
+
         nla_nest_end(msg, bss);
 
         return genlmsg_end(msg, hdr);
@@ -2912,9 +3165,10 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 static int nl80211_dump_scan(struct sk_buff *skb,
                              struct netlink_callback *cb)
 {
-        struct cfg80211_registered_device *dev;
-        struct net_device *netdev;
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
         struct cfg80211_internal_bss *scan;
+        struct wireless_dev *wdev;
         int ifidx = cb->args[0];
         int start = cb->args[1], idx = 0;
         int err;
@@ -2935,58 +3189,83 @@ static int nl80211_dump_scan(struct sk_buff *skb,
                 cb->args[0] = ifidx;
         }
 
-        netdev = dev_get_by_index(&init_net, ifidx);
-        if (!netdev)
+        dev = dev_get_by_index(sock_net(skb->sk), ifidx);
+        if (!dev)
                 return -ENODEV;
 
-        dev = cfg80211_get_dev_from_ifindex(ifidx);
-        if (IS_ERR(dev)) {
-                err = PTR_ERR(dev);
+        rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
+        if (IS_ERR(rdev)) {
+                err = PTR_ERR(rdev);
                 goto out_put_netdev;
         }
 
-        spin_lock_bh(&dev->bss_lock);
-        cfg80211_bss_expire(dev);
+        wdev = dev->ieee80211_ptr;
 
-        list_for_each_entry(scan, &dev->bss_list, list) {
+        wdev_lock(wdev);
+        spin_lock_bh(&rdev->bss_lock);
+        cfg80211_bss_expire(rdev);
+
+        list_for_each_entry(scan, &rdev->bss_list, list) {
                 if (++idx <= start)
                         continue;
                 if (nl80211_send_bss(skb,
                                 NETLINK_CB(cb->skb).pid,
                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                dev, netdev, &scan->pub) < 0) {
+                                rdev, wdev, scan) < 0) {
                         idx--;
                         goto out;
                 }
         }
 
  out:
-        spin_unlock_bh(&dev->bss_lock);
+        spin_unlock_bh(&rdev->bss_lock);
+        wdev_unlock(wdev);
 
         cb->args[1] = idx;
         err = skb->len;
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(rdev);
  out_put_netdev:
-        dev_put(netdev);
+        dev_put(dev);
 
         return err;
 }
 
 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
 {
-        return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
-                auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
-                auth_type == NL80211_AUTHTYPE_FT ||
-                auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
+        return auth_type <= NL80211_AUTHTYPE_MAX;
+}
+
+static bool nl80211_valid_wpa_versions(u32 wpa_versions)
+{
+        return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
+                                  NL80211_WPA_VERSION_2));
+}
+
+static bool nl80211_valid_akm_suite(u32 akm)
+{
+        return akm == WLAN_AKM_SUITE_8021X ||
+                akm == WLAN_AKM_SUITE_PSK;
 }
 
+static bool nl80211_valid_cipher_suite(u32 cipher)
+{
+        return cipher == WLAN_CIPHER_SUITE_WEP40 ||
+                cipher == WLAN_CIPHER_SUITE_WEP104 ||
+                cipher == WLAN_CIPHER_SUITE_TKIP ||
+                cipher == WLAN_CIPHER_SUITE_CCMP ||
+                cipher == WLAN_CIPHER_SUITE_AES_CMAC;
+}
+
+
 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
-        struct cfg80211_auth_request req;
-        struct wiphy *wiphy;
-        int err;
+        struct ieee80211_channel *chan;
+        const u8 *bssid, *ssid, *ie = NULL;
+        int err, ssid_len, ie_len = 0;
+        enum nl80211_auth_type auth_type;
+        struct key_parse key;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -2997,13 +3276,38 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
                 return -EINVAL;
 
+        if (!info->attrs[NL80211_ATTR_SSID])
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
+                return -EINVAL;
+
+        err = nl80211_parse_key(info, &key);
+        if (err)
+                return err;
+
+        if (key.idx >= 0) {
+                if (!key.p.key || !key.p.key_len)
+                        return -EINVAL;
+                if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
+                     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
+                    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
+                     key.p.key_len != WLAN_KEY_LEN_WEP104))
+                        return -EINVAL;
+                if (key.idx > 4)
+                        return -EINVAL;
+        } else {
+                key.p.key_len = 0;
+                key.p.key = NULL;
+        }
+
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->auth) {
+        if (!rdev->ops->auth) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3018,69 +3322,130 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
-        memset(&req, 0, sizeof(req));
-
-        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-
-        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
-                req.chan = ieee80211_get_channel(
-                        wiphy,
-                        nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
-                if (!req.chan) {
-                        err = -EINVAL;
-                        goto out;
-                }
+        bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        chan = ieee80211_get_channel(&rdev->wiphy,
+                nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
+        if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
+                err = -EINVAL;
+                goto out;
         }
 
-        if (info->attrs[NL80211_ATTR_SSID]) {
-                req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
-                req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
-        }
+        ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
+        ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
-                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
-        req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
-        if (!nl80211_valid_auth_type(req.auth_type)) {
+        auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
+        if (!nl80211_valid_auth_type(auth_type)) {
                 err = -EINVAL;
                 goto out;
         }
 
-        err = drv->ops->auth(&drv->wiphy, dev, &req);
+        err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
+                                 ssid, ssid_len, ie, ie_len,
+                                 key.p.key, key.p.key_len, key.idx);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
         rtnl_unlock();
         return err;
 }
 
+static int nl80211_crypto_settings(struct genl_info *info,
+                                   struct cfg80211_crypto_settings *settings,
+                                   int cipher_limit)
+{
+        memset(settings, 0, sizeof(*settings));
+
+        settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
+
+        if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
+                void *data;
+                int len, i;
+
+                data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
+                len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
+                settings->n_ciphers_pairwise = len / sizeof(u32);
+
+                if (len % sizeof(u32))
+                        return -EINVAL;
+
+                if (settings->n_ciphers_pairwise > cipher_limit)
+                        return -EINVAL;
+
+                memcpy(settings->ciphers_pairwise, data, len);
+
+                for (i = 0; i < settings->n_ciphers_pairwise; i++)
+                        if (!nl80211_valid_cipher_suite(
+                                        settings->ciphers_pairwise[i]))
+                                return -EINVAL;
+        }
+
+        if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
+                settings->cipher_group =
+                        nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
+                if (!nl80211_valid_cipher_suite(settings->cipher_group))
+                        return -EINVAL;
+        }
+
+        if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
+                settings->wpa_versions =
+                        nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
+                if (!nl80211_valid_wpa_versions(settings->wpa_versions))
+                        return -EINVAL;
+        }
+
+        if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
+                void *data;
+                int len, i;
+
+                data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
+                len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
+                settings->n_akm_suites = len / sizeof(u32);
+
+                if (len % sizeof(u32))
+                        return -EINVAL;
+
+                memcpy(settings->akm_suites, data, len);
+
+                for (i = 0; i < settings->n_ciphers_pairwise; i++)
+                        if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
+                                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
-        struct cfg80211_assoc_request req;
-        struct wiphy *wiphy;
-        int err;
+        struct cfg80211_crypto_settings crypto;
+        struct ieee80211_channel *chan, *fixedchan;
+        const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
+        int err, ssid_len, ie_len = 0;
+        bool use_mfp = false;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
 
         if (!info->attrs[NL80211_ATTR_MAC] ||
-            !info->attrs[NL80211_ATTR_SSID])
+            !info->attrs[NL80211_ATTR_SSID] ||
+            !info->attrs[NL80211_ATTR_WIPHY_FREQ])
                 return -EINVAL;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->assoc) {
+        if (!rdev->ops->assoc) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3095,46 +3460,54 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
-        memset(&req, 0, sizeof(req));
+        bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        chan = ieee80211_get_channel(&rdev->wiphy,
+                nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
+        if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
+                err = -EINVAL;
+                goto out;
+        }
 
-        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
-                req.chan = ieee80211_get_channel(
-                        wiphy,
-                        nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
-                if (!req.chan) {
-                        err = -EINVAL;
-                        goto out;
-                }
+        mutex_lock(&rdev->devlist_mtx);
+        fixedchan = rdev_fixed_channel(rdev, NULL);
+        if (fixedchan && chan != fixedchan) {
+                err = -EBUSY;
+                mutex_unlock(&rdev->devlist_mtx);
+                goto out;
         }
+        mutex_unlock(&rdev->devlist_mtx);
 
-        req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
-        req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
+        ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
+        ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
-                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
         if (info->attrs[NL80211_ATTR_USE_MFP]) {
-                enum nl80211_mfp use_mfp =
+                enum nl80211_mfp mfp =
                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
-                if (use_mfp == NL80211_MFP_REQUIRED)
-                        req.use_mfp = true;
-                else if (use_mfp != NL80211_MFP_NO) {
+                if (mfp == NL80211_MFP_REQUIRED)
+                        use_mfp = true;
+                else if (mfp != NL80211_MFP_NO) {
                         err = -EINVAL;
                         goto out;
                 }
         }
 
-        req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
+        if (info->attrs[NL80211_ATTR_PREV_BSSID])
+                prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
 
-        err = drv->ops->assoc(&drv->wiphy, dev, &req);
+        err = nl80211_crypto_settings(info, &crypto, 1);
+        if (!err)
+                err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
+                                          ssid, ssid_len, ie, ie_len, use_mfp,
+                                          &crypto);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
         rtnl_unlock();
@@ -3143,11 +3516,11 @@ unlock_rtnl:
 
 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
-        struct cfg80211_deauth_request req;
-        struct wiphy *wiphy;
-        int err;
+        const u8 *ie = NULL, *bssid;
+        int err, ie_len = 0;
+        u16 reason_code;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -3160,11 +3533,11 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->deauth) {
+        if (!rdev->ops->deauth) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3179,27 +3552,24 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
-        memset(&req, 0, sizeof(req));
-
-        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
-        if (req.reason_code == 0) {
+        reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+        if (reason_code == 0) {
                 /* Reason Code 0 is reserved */
                 err = -EINVAL;
                 goto out;
         }
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
-                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
-        err = drv->ops->deauth(&drv->wiphy, dev, &req);
+        err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
         rtnl_unlock();
@@ -3208,11 +3578,11 @@ unlock_rtnl:
 
 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
-        struct cfg80211_disassoc_request req;
-        struct wiphy *wiphy;
-        int err;
+        const u8 *ie = NULL, *bssid;
+        int err, ie_len = 0;
+        u16 reason_code;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -3225,11 +3595,11 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->disassoc) {
+        if (!rdev->ops->disassoc) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3244,27 +3614,24 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
-        memset(&req, 0, sizeof(req));
-
-        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
-        if (req.reason_code == 0) {
+        reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+        if (reason_code == 0) {
                 /* Reason Code 0 is reserved */
                 err = -EINVAL;
                 goto out;
         }
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
-                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
-        err = drv->ops->disassoc(&drv->wiphy, dev, &req);
+        err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
         rtnl_unlock();
@@ -3273,10 +3640,11 @@ unlock_rtnl:
 
 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         struct cfg80211_ibss_params ibss;
         struct wiphy *wiphy;
+        struct cfg80211_cached_keys *connkeys = NULL;
         int err;
 
         memset(&ibss, 0, sizeof(ibss));
@@ -3300,11 +3668,11 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->join_ibss) {
+        if (!rdev->ops->join_ibss) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3319,7 +3687,7 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
+        wiphy = &rdev->wiphy;
 
         if (info->attrs[NL80211_ATTR_MAC])
                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
@@ -3341,30 +3709,43 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
         }
 
         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
+        ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
+
+        if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
+                connkeys = nl80211_parse_connkeys(rdev,
+                                        info->attrs[NL80211_ATTR_KEYS]);
+                if (IS_ERR(connkeys)) {
+                        err = PTR_ERR(connkeys);
+                        connkeys = NULL;
+                        goto out;
+                }
+        }
 
-        err = cfg80211_join_ibss(drv, dev, &ibss);
+        err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
+        if (err)
+                kfree(connkeys);
         rtnl_unlock();
         return err;
 }
 
 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         int err;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->leave_ibss) {
+        if (!rdev->ops->leave_ibss) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3379,12 +3760,309 @@ static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = cfg80211_leave_ibss(drv, dev, false);
+        err = cfg80211_leave_ibss(rdev, dev, false);
+
+out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+#ifdef CONFIG_NL80211_TESTMODE
+static struct genl_multicast_group nl80211_testmode_mcgrp = {
+        .name = "testmode",
+};
+
+static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_TESTDATA])
+                return -EINVAL;
+
+        rtnl_lock();
+
+        rdev = cfg80211_get_dev_from_info(info);
+        if (IS_ERR(rdev)) {
+                err = PTR_ERR(rdev);
+                goto unlock_rtnl;
+        }
+
+        err = -EOPNOTSUPP;
+        if (rdev->ops->testmode_cmd) {
+                rdev->testmode_info = info;
+                err = rdev->ops->testmode_cmd(&rdev->wiphy,
+                                nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
+                                nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
+                rdev->testmode_info = NULL;
+        }
+
+        cfg80211_unlock_rdev(rdev);
+
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static struct sk_buff *
+__cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
+                              int approxlen, u32 pid, u32 seq, gfp_t gfp)
+{
+        struct sk_buff *skb;
+        void *hdr;
+        struct nlattr *data;
+
+        skb = nlmsg_new(approxlen + 100, gfp);
+        if (!skb)
+                return NULL;
+
+        hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
+        if (!hdr) {
+                kfree_skb(skb);
+                return NULL;
+        }
+
+        NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
+
+        ((void **)skb->cb)[0] = rdev;
+        ((void **)skb->cb)[1] = hdr;
+        ((void **)skb->cb)[2] = data;
+
+        return skb;
+
+ nla_put_failure:
+        kfree_skb(skb);
+        return NULL;
+}
+
+struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
+                                                  int approxlen)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        if (WARN_ON(!rdev->testmode_info))
+                return NULL;
+
+        return __cfg80211_testmode_alloc_skb(rdev, approxlen,
+                                rdev->testmode_info->snd_pid,
+                                rdev->testmode_info->snd_seq,
+                                GFP_KERNEL);
+}
+EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
+
+int cfg80211_testmode_reply(struct sk_buff *skb)
+{
+        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
+        void *hdr = ((void **)skb->cb)[1];
+        struct nlattr *data = ((void **)skb->cb)[2];
+
+        if (WARN_ON(!rdev->testmode_info)) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
+        nla_nest_end(skb, data);
+        genlmsg_end(skb, hdr);
+        return genlmsg_reply(skb, rdev->testmode_info);
+}
+EXPORT_SYMBOL(cfg80211_testmode_reply);
+
+struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
+                                                  int approxlen, gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
+}
+EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
+
+void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+{
+        void *hdr = ((void **)skb->cb)[1];
+        struct nlattr *data = ((void **)skb->cb)[2];
+
+        nla_nest_end(skb, data);
+        genlmsg_end(skb, hdr);
+        genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
+}
+EXPORT_SYMBOL(cfg80211_testmode_event);
+#endif
+
+static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        struct cfg80211_connect_params connect;
+        struct wiphy *wiphy;
+        struct cfg80211_cached_keys *connkeys = NULL;
+        int err;
+
+        memset(&connect, 0, sizeof(connect));
+
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_SSID] ||
+            !nla_len(info->attrs[NL80211_ATTR_SSID]))
+                return -EINVAL;
+
+        if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
+                connect.auth_type =
+                        nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
+                if (!nl80211_valid_auth_type(connect.auth_type))
+                        return -EINVAL;
+        } else
+                connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+
+        connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
+
+        err = nl80211_crypto_settings(info, &connect.crypto,
+                                      NL80211_MAX_NR_CIPHER_SUITES);
+        if (err)
+                return err;
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        wiphy = &rdev->wiphy;
+
+        if (info->attrs[NL80211_ATTR_MAC])
+                connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
+        connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
+
+        if (info->attrs[NL80211_ATTR_IE]) {
+                connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
+                connect.channel =
+                        ieee80211_get_channel(wiphy,
+                            nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
+                if (!connect.channel ||
+                    connect.channel->flags & IEEE80211_CHAN_DISABLED) {
+                        err = -EINVAL;
+                        goto out;
+                }
+        }
+
+        if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
+                connkeys = nl80211_parse_connkeys(rdev,
+                                        info->attrs[NL80211_ATTR_KEYS]);
+                if (IS_ERR(connkeys)) {
+                        err = PTR_ERR(connkeys);
+                        connkeys = NULL;
+                        goto out;
+                }
+        }
+
+        err = cfg80211_connect(rdev, dev, &connect, connkeys);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
+        if (err)
+                kfree(connkeys);
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        int err;
+        u16 reason;
+
+        if (!info->attrs[NL80211_ATTR_REASON_CODE])
+                reason = WLAN_REASON_DEAUTH_LEAVING;
+        else
+                reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+
+        if (reason == 0)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        err = cfg80211_disconnect(rdev, dev, reason, true);
+
+out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net *net;
+        int err;
+        u32 pid;
+
+        if (!info->attrs[NL80211_ATTR_PID])
+                return -EINVAL;
+
+        pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
+
+        rtnl_lock();
+
+        rdev = cfg80211_get_dev_from_info(info);
+        if (IS_ERR(rdev)) {
+                err = PTR_ERR(rdev);
+                goto out;
+        }
+
+        net = get_net_ns_by_pid(pid);
+        if (IS_ERR(net)) {
+                err = PTR_ERR(net);
+                goto out;
+        }
+
+        err = 0;
+
+        /* check if anything to do */
+        if (net_eq(wiphy_net(&rdev->wiphy), net))
+                goto out_put_net;
+
+        err = cfg80211_switch_netns(rdev, net);
+ out_put_net:
+        put_net(net);
+ out:
+        cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
         return err;
 }
@@ -3602,6 +4280,32 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+#ifdef CONFIG_NL80211_TESTMODE
+        {
+                .cmd = NL80211_CMD_TESTMODE,
+                .doit = nl80211_testmode_do,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+#endif
+        {
+                .cmd = NL80211_CMD_CONNECT,
+                .doit = nl80211_connect,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_DISCONNECT,
+                .doit = nl80211_disconnect,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_SET_WIPHY_NETNS,
+                .doit = nl80211_wiphy_netns,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
         .name = "mlme",
@@ -3633,7 +4337,8 @@ void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_config_mcgrp.id, GFP_KERNEL);
 }
 
 static int nl80211_add_scan_req(struct sk_buff *msg,
@@ -3643,6 +4348,8 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         struct nlattr *nest;
         int i;
 
+        ASSERT_RDEV_LOCK(rdev);
+
         if (WARN_ON(!req))
                 return 0;
 
@@ -3668,11 +4375,11 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         return -ENOBUFS;
 }
 
-static int nl80211_send_scan_donemsg(struct sk_buff *msg,
-                                     struct cfg80211_registered_device *rdev,
-                                     struct net_device *netdev,
-                                     u32 pid, u32 seq, int flags,
-                                     u32 cmd)
+static int nl80211_send_scan_msg(struct sk_buff *msg,
+                                 struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev,
+                                 u32 pid, u32 seq, int flags,
+                                 u32 cmd)
 {
         void *hdr;
 
@@ -3693,6 +4400,25 @@ static int nl80211_send_scan_donemsg(struct sk_buff *msg,
         return -EMSGSIZE;
 }
 
+void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev)
+{
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
+                                  NL80211_CMD_TRIGGER_SCAN) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+}
+
 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev)
 {
@@ -3702,13 +4428,14 @@ void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
         if (!msg)
                 return;
 
-        if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
-                                      NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
+        if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
+                                  NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
                 nlmsg_free(msg);
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_scan_mcgrp.id, GFP_KERNEL);
 }
 
 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
@@ -3720,13 +4447,14 @@ void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
         if (!msg)
                 return;
 
-        if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
-                                      NL80211_CMD_SCAN_ABORTED) < 0) {
+        if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
+                                  NL80211_CMD_SCAN_ABORTED) < 0) {
                 nlmsg_free(msg);
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_scan_mcgrp.id, GFP_KERNEL);
 }
 
 /*
@@ -3775,7 +4503,10 @@ void nl80211_send_reg_change_event(struct regulatory_request *request)
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
+        rcu_read_lock();
+        genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
+                                GFP_ATOMIC);
+        rcu_read_unlock();
 
         return;
 
@@ -3787,12 +4518,12 @@ nla_put_failure:
 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
                                     struct net_device *netdev,
                                     const u8 *buf, size_t len,
-                                    enum nl80211_commands cmd)
+                                    enum nl80211_commands cmd, gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
 
@@ -3811,7 +4542,8 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
@@ -3820,42 +4552,45 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
 }
 
 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
-                          struct net_device *netdev, const u8 *buf, size_t len)
+                          struct net_device *netdev, const u8 *buf,
+                          size_t len, gfp_t gfp)
 {
         nl80211_send_mlme_event(rdev, netdev, buf, len,
-                                NL80211_CMD_AUTHENTICATE);
+                                NL80211_CMD_AUTHENTICATE, gfp);
 }
 
 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
                            struct net_device *netdev, const u8 *buf,
-                           size_t len)
+                           size_t len, gfp_t gfp)
 {
-        nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
+        nl80211_send_mlme_event(rdev, netdev, buf, len,
+                                NL80211_CMD_ASSOCIATE, gfp);
 }
 
 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
-                         struct net_device *netdev, const u8 *buf, size_t len)
+                         struct net_device *netdev, const u8 *buf,
+                         size_t len, gfp_t gfp)
 {
         nl80211_send_mlme_event(rdev, netdev, buf, len,
-                                NL80211_CMD_DEAUTHENTICATE);
+                                NL80211_CMD_DEAUTHENTICATE, gfp);
 }
 
 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
                            struct net_device *netdev, const u8 *buf,
-                           size_t len)
+                           size_t len, gfp_t gfp)
 {
         nl80211_send_mlme_event(rdev, netdev, buf, len,
-                                NL80211_CMD_DISASSOCIATE);
+                                NL80211_CMD_DISASSOCIATE, gfp);
 }
 
 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
                                       struct net_device *netdev, int cmd,
-                                      const u8 *addr)
+                                      const u8 *addr, gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
 
@@ -3875,7 +4610,8 @@ static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
@@ -3884,16 +4620,145 @@ static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
 }
 
 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
-                               struct net_device *netdev, const u8 *addr)
+                               struct net_device *netdev, const u8 *addr,
+                               gfp_t gfp)
 {
         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
-                                  addr);
+                                  addr, gfp);
 }
 
 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
-                                struct net_device *netdev, const u8 *addr)
+                                struct net_device *netdev, const u8 *addr,
+                                gfp_t gfp)
 {
-        nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
+        nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
+                                  addr, gfp);
+}
+
+void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev, const u8 *bssid,
+                                 const u8 *req_ie, size_t req_ie_len,
+                                 const u8 *resp_ie, size_t resp_ie_len,
+                                 u16 status, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (bssid)
+                NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+        NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
+        if (req_ie)
+                NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
+        if (resp_ie)
+                NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+
+}
+
+void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
+                         struct net_device *netdev, const u8 *bssid,
+                         const u8 *req_ie, size_t req_ie_len,
+                         const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+        if (req_ie)
+                NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
+        if (resp_ie)
+                NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+
+}
+
+void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, u16 reason,
+                               const u8 *ie, size_t ie_len, bool from_ap)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (from_ap && reason)
+                NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
+        if (from_ap)
+                NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
+        if (ie)
+                NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, GFP_KERNEL);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+
 }
 
 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
@@ -3922,7 +4787,8 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
@@ -3933,12 +4799,12 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                                  struct net_device *netdev, const u8 *addr,
                                  enum nl80211_key_type key_type, int key_id,
-                                 const u8 *tsc)
+                                 const u8 *tsc, gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
 
@@ -3962,7 +4828,8 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
@@ -4015,7 +4882,10 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
+        rcu_read_lock();
+        genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
+                                GFP_ATOMIC);
+        rcu_read_unlock();
 
         return;
 
@@ -4051,6 +4921,12 @@ int nl80211_init(void)
         if (err)
                 goto err_out;
 
+#ifdef CONFIG_NL80211_TESTMODE
+        err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
+        if (err)
+                goto err_out;
+#endif
+
         return 0;
  err_out:
         genl_unregister_family(&nl80211_fam);
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 5c12ad13499b..44cc2a76a1b0 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -3,39 +3,54 @@
 
 #include "core.h"
 
-extern int nl80211_init(void);
-extern void nl80211_exit(void);
-extern void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);
-extern void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
-                                   struct net_device *netdev);
-extern void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
-                                      struct net_device *netdev);
-extern void nl80211_send_reg_change_event(struct regulatory_request *request);
-extern void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
-                                 struct net_device *netdev,
-                                 const u8 *buf, size_t len);
-extern void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
-                                  struct net_device *netdev,
-                                  const u8 *buf, size_t len);
-extern void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
+int nl80211_init(void);
+void nl80211_exit(void);
+void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);
+void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev);
+void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
+                            struct net_device *netdev);
+void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev);
+void nl80211_send_reg_change_event(struct regulatory_request *request);
+void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
+                          struct net_device *netdev,
+                          const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *netdev,
+                           const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
+                         struct net_device *netdev,
+                         const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *netdev,
+                           const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev,
+                               const u8 *addr, gfp_t gfp);
+void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev,
-                                const u8 *buf, size_t len);
-extern void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
-                                  struct net_device *netdev,
-                                  const u8 *buf, size_t len);
-extern void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
-                                      struct net_device *netdev,
-                                      const u8 *addr);
-extern void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
-                                       struct net_device *netdev,
-                                       const u8 *addr);
-extern void
+                                const u8 *addr, gfp_t gfp);
+void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev, const u8 *bssid,
+                                 const u8 *req_ie, size_t req_ie_len,
+                                 const u8 *resp_ie, size_t resp_ie_len,
+                                 u16 status, gfp_t gfp);
+void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
+                         struct net_device *netdev, const u8 *bssid,
+                         const u8 *req_ie, size_t req_ie_len,
+                         const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp);
+void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, u16 reason,
+                               const u8 *ie, size_t ie_len, bool from_ap);
+
+void
 nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev, const u8 *addr,
                             enum nl80211_key_type key_type,
-                            int key_id, const u8 *tsc);
+                            int key_id, const u8 *tsc, gfp_t gfp);
 
-extern void
+void
 nl80211_send_beacon_hint_event(struct wiphy *wiphy,
                                struct ieee80211_channel *channel_before,
                                struct ieee80211_channel *channel_after);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 75a406d33619..f256dfffbf46 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -62,6 +62,16 @@ const struct ieee80211_regdomain *cfg80211_regdomain;
  */
 static const struct ieee80211_regdomain *country_ie_regdomain;
 
+/*
+ * Protects static reg.c components:
+ *     - cfg80211_world_regdom
+ *     - cfg80211_regdom
+ *     - country_ie_regdomain
+ *     - last_request
+ */
+DEFINE_MUTEX(reg_mutex);
+#define assert_reg_lock() WARN_ON(!mutex_is_locked(&reg_mutex))
+
 /* Used to queue up regulatory hints */
 static LIST_HEAD(reg_requests_list);
 static spinlock_t reg_requests_lock;
@@ -113,11 +123,7 @@ static const struct ieee80211_regdomain world_regdom = {
 static const struct ieee80211_regdomain *cfg80211_world_regdom =
         &world_regdom;
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-static char *ieee80211_regdom = "US";
-#else
 static char *ieee80211_regdom = "00";
-#endif
 
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
@@ -1012,7 +1018,6 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                         map_regdom_flags(reg_rule->flags) | bw_flags;
                 chan->max_antenna_gain = chan->orig_mag =
                         (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-                chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
                 chan->max_power = chan->orig_mpwr =
                         (int) MBM_TO_DBM(power_rule->max_eirp);
                 return;
@@ -1021,7 +1026,6 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
         chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
-        chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
         if (chan->orig_mpwr)
                 chan->max_power = min(chan->orig_mpwr,
                         (int) MBM_TO_DBM(power_rule->max_eirp));
@@ -1061,10 +1065,10 @@ static bool ignore_reg_update(struct wiphy *wiphy,
 
 static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
 
-        list_for_each_entry(drv, &cfg80211_drv_list, list)
-                wiphy_update_regulatory(&drv->wiphy, initiator);
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list)
+                wiphy_update_regulatory(&rdev->wiphy, initiator);
 }
 
 static void handle_reg_beacon(struct wiphy *wiphy,
@@ -1298,7 +1302,7 @@ static void handle_channel_custom(struct wiphy *wiphy,
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
 
-        assert_cfg80211_lock();
+        assert_reg_lock();
 
         sband = wiphy->bands[band];
         BUG_ON(chan_idx >= sband->n_channels);
@@ -1323,7 +1327,6 @@ static void handle_channel_custom(struct wiphy *wiphy,
 
         chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
         chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-        chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
         chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
@@ -1347,14 +1350,14 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
         enum ieee80211_band band;
         unsigned int bands_set = 0;
 
-        mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (!wiphy->bands[band])
                         continue;
                 handle_band_custom(wiphy, band, regd);
                 bands_set++;
         }
-        mutex_unlock(&cfg80211_mutex);
+        mutex_unlock(&reg_mutex);
 
         /*
          * no point in calling this if it won't have any effect
@@ -1421,7 +1424,7 @@ static int ignore_request(struct wiphy *wiphy,
                         if (last_wiphy != wiphy) {
                                 /*
                                  * Two cards with two APs claiming different
-                                 * different Country IE alpha2s. We could
+                                 * Country IE alpha2s. We could
                                  * intersect them, but that seems unlikely
                                  * to be correct. Reject second one for now.
                                  */
@@ -1500,7 +1503,7 @@ static int ignore_request(struct wiphy *wiphy,
  * Returns zero if all went fine, %-EALREADY if a regulatory domain had
  * already been set or other standard error codes.
  *
- * Caller must hold &cfg80211_mutex
+ * Caller must hold &cfg80211_mutex and &reg_mutex
  */
 static int __regulatory_hint(struct wiphy *wiphy,
                              struct regulatory_request *pending_request)
@@ -1575,6 +1578,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
         BUG_ON(!reg_request->alpha2);
 
         mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
 
         if (wiphy_idx_valid(reg_request->wiphy_idx))
                 wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
@@ -1590,6 +1594,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
         if (r == -EALREADY && wiphy && wiphy->strict_regulatory)
                 wiphy_update_regulatory(wiphy, reg_request->initiator);
 out:
+        mutex_unlock(&reg_mutex);
         mutex_unlock(&cfg80211_mutex);
 }
 
@@ -1615,9 +1620,13 @@ static void reg_process_pending_hints(void)
 /* Processes beacon hints -- this has nothing to do with country IEs */
 static void reg_process_pending_beacon_hints(void)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct reg_beacon *pending_beacon, *tmp;
 
+        /*
+         * No need to hold the reg_mutex here as we just touch wiphys
+         * and do not read or access regulatory variables.
+         */
         mutex_lock(&cfg80211_mutex);
 
         /* This goes through the _pending_ beacon list */
@@ -1634,8 +1643,8 @@ static void reg_process_pending_beacon_hints(void)
                 list_del_init(&pending_beacon->list);
 
                 /* Applies the beacon hint to current wiphys */
-                list_for_each_entry(drv, &cfg80211_drv_list, list)
-                        wiphy_update_new_beacon(&drv->wiphy, pending_beacon);
+                list_for_each_entry(rdev, &cfg80211_rdev_list, list)
+                        wiphy_update_new_beacon(&rdev->wiphy, pending_beacon);
 
                 /* Remembers the beacon hint for new wiphys or reg changes */
                 list_add_tail(&pending_beacon->list, &reg_beacon_list);
@@ -1739,12 +1748,13 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 }
 EXPORT_SYMBOL(regulatory_hint);
 
+/* Caller must hold reg_mutex */
 static bool reg_same_country_ie_hint(struct wiphy *wiphy,
                         u32 country_ie_checksum)
 {
         struct wiphy *request_wiphy;
 
-        assert_cfg80211_lock();
+        assert_reg_lock();
 
         if (unlikely(last_request->initiator !=
             NL80211_REGDOM_SET_BY_COUNTRY_IE))
@@ -1767,6 +1777,10 @@ static bool reg_same_country_ie_hint(struct wiphy *wiphy,
         return false;
 }
 
+/*
+ * We hold wdev_lock() here so we cannot hold cfg80211_mutex() and
+ * therefore cannot iterate over the rdev list here.
+ */
 void regulatory_hint_11d(struct wiphy *wiphy,
                         u8 *country_ie,
                         u8 country_ie_len)
@@ -1777,12 +1791,10 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         enum environment_cap env = ENVIRON_ANY;
         struct regulatory_request *request;
 
-        mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
 
-        if (unlikely(!last_request)) {
-                mutex_unlock(&cfg80211_mutex);
-                return;
-        }
+        if (unlikely(!last_request))
+                goto out;
 
         /* IE len must be evenly divisible by 2 */
         if (country_ie_len & 0x01)
@@ -1808,54 +1820,14 @@ void regulatory_hint_11d(struct wiphy *wiphy,
                 env = ENVIRON_OUTDOOR;
 
         /*
-         * We will run this for *every* beacon processed for the BSSID, so
-         * we optimize an early check to exit out early if we don't have to
-         * do anything
+         * We will run this only upon a successful connection on cfg80211.
+         * We leave conflict resolution to the workqueue, where can hold
+         * cfg80211_mutex.
          */
         if (likely(last_request->initiator ==
             NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            wiphy_idx_valid(last_request->wiphy_idx))) {
-                struct cfg80211_registered_device *drv_last_ie;
-
-                drv_last_ie =
-                        cfg80211_drv_by_wiphy_idx(last_request->wiphy_idx);
-
-                /*
-                 * Lets keep this simple -- we trust the first AP
-                 * after we intersect with CRDA
-                 */
-                if (likely(&drv_last_ie->wiphy == wiphy)) {
-                        /*
-                         * Ignore IEs coming in on this wiphy with
-                         * the same alpha2 and environment cap
-                         */
-                        if (likely(alpha2_equal(drv_last_ie->country_ie_alpha2,
-                                  alpha2) &&
-                                  env == drv_last_ie->env)) {
-                                goto out;
-                        }
-                        /*
-                         * the wiphy moved on to another BSSID or the AP
-                         * was reconfigured. XXX: We need to deal with the
-                         * case where the user suspends and goes to goes
-                         * to another country, and then gets IEs from an
-                         * AP with different settings
-                         */
-                        goto out;
-                } else {
-                        /*
-                         * Ignore IEs coming in on two separate wiphys with
-                         * the same alpha2 and environment cap
-                         */
-                        if (likely(alpha2_equal(drv_last_ie->country_ie_alpha2,
-                                  alpha2) &&
-                                  env == drv_last_ie->env)) {
-                                goto out;
-                        }
-                        /* We could potentially intersect though */
-                        goto out;
-                }
-        }
+            wiphy_idx_valid(last_request->wiphy_idx)))
+                goto out;
 
         rd = country_ie_2_rd(country_ie, country_ie_len, &checksum);
         if (!rd)
@@ -1890,7 +1862,7 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         request->country_ie_checksum = checksum;
         request->country_ie_env = env;
 
-        mutex_unlock(&cfg80211_mutex);
+        mutex_unlock(&reg_mutex);
 
         queue_regulatory_request(request);
 
@@ -1899,9 +1871,8 @@ void regulatory_hint_11d(struct wiphy *wiphy,
 free_rd_out:
         kfree(rd);
 out:
-        mutex_unlock(&cfg80211_mutex);
+        mutex_unlock(&reg_mutex);
 }
-EXPORT_SYMBOL(regulatory_hint_11d);
 
 static bool freq_is_chan_12_13_14(u16 freq)
 {
@@ -1996,14 +1967,14 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
 
                 if (last_request->initiator ==
                     NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                        struct cfg80211_registered_device *drv;
-                        drv = cfg80211_drv_by_wiphy_idx(
+                        struct cfg80211_registered_device *rdev;
+                        rdev = cfg80211_rdev_by_wiphy_idx(
                                 last_request->wiphy_idx);
-                        if (drv) {
+                        if (rdev) {
                                 printk(KERN_INFO "cfg80211: Current regulatory "
                                         "domain updated by AP to: %c%c\n",
-                                        drv->country_ie_alpha2[0],
-                                        drv->country_ie_alpha2[1]);
+                                        rdev->country_ie_alpha2[0],
+                                        rdev->country_ie_alpha2[1]);
                         } else
                                 printk(KERN_INFO "cfg80211: Current regulatory "
                                         "domain intersected: \n");
@@ -2064,7 +2035,7 @@ static inline void reg_country_ie_process_debug(
 static int __set_regdom(const struct ieee80211_regdomain *rd)
 {
         const struct ieee80211_regdomain *intersected_rd = NULL;
-        struct cfg80211_registered_device *drv = NULL;
+        struct cfg80211_registered_device *rdev = NULL;
         struct wiphy *request_wiphy;
         /* Some basic sanity checks first */
 
@@ -2203,11 +2174,11 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         if (!intersected_rd)
                 return -EINVAL;
 
-        drv = wiphy_to_dev(request_wiphy);
+        rdev = wiphy_to_dev(request_wiphy);
 
-        drv->country_ie_alpha2[0] = rd->alpha2[0];
-        drv->country_ie_alpha2[1] = rd->alpha2[1];
-        drv->env = last_request->country_ie_env;
+        rdev->country_ie_alpha2[0] = rd->alpha2[0];
+        rdev->country_ie_alpha2[1] = rd->alpha2[1];
+        rdev->env = last_request->country_ie_env;
 
         BUG_ON(intersected_rd == rd);
 
@@ -2232,10 +2203,13 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 
         assert_cfg80211_lock();
 
+        mutex_lock(&reg_mutex);
+
         /* Note that this doesn't update the wiphys, this is done below */
         r = __set_regdom(rd);
         if (r) {
                 kfree(rd);
+                mutex_unlock(&reg_mutex);
                 return r;
         }
 
@@ -2250,6 +2224,8 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 
         nl80211_send_reg_change_event(last_request);
 
+        mutex_unlock(&reg_mutex);
+
         return r;
 }
 
@@ -2260,16 +2236,20 @@ void reg_device_remove(struct wiphy *wiphy)
 
         assert_cfg80211_lock();
 
+        mutex_lock(&reg_mutex);
+
         kfree(wiphy->regd);
 
         if (last_request)
                 request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
 
         if (!request_wiphy || request_wiphy != wiphy)
-                return;
+                goto out;
 
         last_request->wiphy_idx = WIPHY_IDX_STALE;
         last_request->country_ie_env = ENVIRON_ANY;
+out:
+        mutex_unlock(&reg_mutex);
 }
 
 int regulatory_init(void)
@@ -2288,22 +2268,12 @@ int regulatory_init(void)
 
         printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
         print_regdomain_info(cfg80211_regdomain);
-        /*
-         * The old code still requests for a new regdomain and if
-         * you have CRDA you get it updated, otherwise you get
-         * stuck with the static values. Since "EU" is not a valid
-         * ISO / IEC 3166 alpha2 code we can't expect userpace to
-         * give us a regulatory domain for it. We need last_request
-         * iniitalized though so lets just send a request which we
-         * know will be ignored... this crap will be removed once
-         * OLD_REG dies.
-         */
-        err = regulatory_hint_core(ieee80211_regdom);
 #else
         cfg80211_regdomain = cfg80211_world_regdom;
 
-        err = regulatory_hint_core(ieee80211_regdom);
 #endif
+        /* We always try to get an update for the static regdomain */
+        err = regulatory_hint_core(cfg80211_regdomain->alpha2);
         if (err) {
                 if (err == -ENOMEM)
                         return err;
@@ -2322,6 +2292,13 @@ int regulatory_init(void)
 #endif
         }
 
+        /*
+         * Finally, if the user set the module parameter treat it
+         * as a user hint.
+         */
+        if (!is_world_regdom(ieee80211_regdom))
+                regulatory_hint_user(ieee80211_regdom);
+
         return 0;
 }
 
@@ -2333,6 +2310,7 @@ void regulatory_exit(void)
         cancel_work_sync(&reg_work);
 
         mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
 
         reset_regdomains();
 
@@ -2371,5 +2349,6 @@ void regulatory_exit(void)
         }
         spin_unlock(&reg_requests_lock);
 
+        mutex_unlock(&reg_mutex);
         mutex_unlock(&cfg80211_mutex);
 }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 4e167a8e11be..3362c7c069b2 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -37,4 +37,19 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                         struct ieee80211_channel *beacon_chan,
                                         gfp_t gfp);
 
+/**
+ * regulatory_hint_11d - hints a country IE as a regulatory domain
+ * @wiphy: the wireless device giving the hint (used only for reporting
+ *      conflicts)
+ * @country_ie: pointer to the country IE
+ * @country_ie_len: length of the country IE
+ *
+ * We will intersect the rd with the what CRDA tells us should apply
+ * for the alpha2 this country IE belongs to, this prevents APs from
+ * sending us incorrect or outdated information against a country.
+ */
+void regulatory_hint_11d(struct wiphy *wiphy,
+                         u8 *country_ie,
+                         u8 country_ie_len);
+
 #endif  /* __NET_WIRELESS_REG_H */
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 7e595ce24eeb..fe575a24c95c 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -14,29 +14,36 @@
 #include <net/iw_handler.h>
 #include "core.h"
 #include "nl80211.h"
+#include "wext-compat.h"
 
-#define IEEE80211_SCAN_RESULT_EXPIRE    (10 * HZ)
+#define IEEE80211_SCAN_RESULT_EXPIRE    (15 * HZ)
 
-void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
 {
+        struct cfg80211_scan_request *request;
         struct net_device *dev;
 #ifdef CONFIG_WIRELESS_EXT
         union iwreq_data wrqu;
 #endif
 
-        dev = dev_get_by_index(&init_net, request->ifidx);
-        if (!dev)
-                goto out;
+        request = rdev->scan_req;
 
-        WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
+        dev = request->dev;
+
+        /*
+         * This must be before sending the other events!
+         * Otherwise, wpa_supplicant gets completely confused with
+         * wext events.
+         */
+        cfg80211_sme_scan_done(dev);
 
-        if (aborted)
-                nl80211_send_scan_aborted(wiphy_to_dev(request->wiphy), dev);
+        if (request->aborted)
+                nl80211_send_scan_aborted(rdev, dev);
         else
-                nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
+                nl80211_send_scan_done(rdev, dev);
 
 #ifdef CONFIG_WIRELESS_EXT
-        if (!aborted) {
+        if (!request->aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
 
                 wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
@@ -45,10 +52,29 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
 
         dev_put(dev);
 
- out:
-        wiphy_to_dev(request->wiphy)->scan_req = NULL;
+        rdev->scan_req = NULL;
         kfree(request);
 }
+
+void __cfg80211_scan_done(struct work_struct *wk)
+{
+        struct cfg80211_registered_device *rdev;
+
+        rdev = container_of(wk, struct cfg80211_registered_device,
+                            scan_done_wk);
+
+        cfg80211_lock_rdev(rdev);
+        ___cfg80211_scan_done(rdev);
+        cfg80211_unlock_rdev(rdev);
+}
+
+void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
+{
+        WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
+
+        request->aborted = aborted;
+        schedule_work(&wiphy_to_dev(request->wiphy)->scan_done_wk);
+}
 EXPORT_SYMBOL(cfg80211_scan_done);
 
 static void bss_release(struct kref *ref)
@@ -62,6 +88,8 @@ static void bss_release(struct kref *ref)
         if (bss->ies_allocated)
                 kfree(bss->pub.information_elements);
 
+        BUG_ON(atomic_read(&bss->hold));
+
         kfree(bss);
 }
 
@@ -84,8 +112,9 @@ void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
         bool expired = false;
 
         list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
-                if (bss->hold ||
-                    !time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
+                if (atomic_read(&bss->hold))
+                        continue;
+                if (!time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
                         continue;
                 list_del(&bss->list);
                 rb_erase(&bss->rbn, &dev->bss_tree);
@@ -539,6 +568,7 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
         spin_lock_bh(&dev->bss_lock);
 
         list_del(&bss->list);
+        dev->bss_generation++;
         rb_erase(&bss->rbn, &dev->bss_tree);
 
         spin_unlock_bh(&dev->bss_lock);
@@ -547,30 +577,6 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 }
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
-void cfg80211_hold_bss(struct cfg80211_bss *pub)
-{
-        struct cfg80211_internal_bss *bss;
-
-        if (!pub)
-                return;
-
-        bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        bss->hold = true;
-}
-EXPORT_SYMBOL(cfg80211_hold_bss);
-
-void cfg80211_unhold_bss(struct cfg80211_bss *pub)
-{
-        struct cfg80211_internal_bss *bss;
-
-        if (!pub)
-                return;
-
-        bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        bss->hold = false;
-}
-EXPORT_SYMBOL(cfg80211_unhold_bss);
-
 #ifdef CONFIG_WIRELESS_EXT
 int cfg80211_wext_siwscan(struct net_device *dev,
                           struct iw_request_info *info,
@@ -586,7 +592,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (!netif_running(dev))
                 return -ENETDOWN;
 
-        rdev = cfg80211_get_dev_from_ifindex(dev->ifindex);
+        rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
 
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
@@ -611,9 +617,9 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         }
 
         creq->wiphy = wiphy;
-        creq->ifidx = dev->ifindex;
-        creq->ssids = (void *)(creq + 1);
-        creq->channels = (void *)(creq->ssids + 1);
+        creq->dev = dev;
+        /* SSIDs come after channels */
+        creq->ssids = (void *)&creq->channels[n_channels];
         creq->n_channels = n_channels;
         creq->n_ssids = 1;
 
@@ -648,9 +654,12 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (err) {
                 rdev->scan_req = NULL;
                 kfree(creq);
+        } else {
+                nl80211_send_scan_start(rdev, dev);
+                dev_hold(dev);
         }
  out:
-        cfg80211_put_dev(rdev);
+        cfg80211_unlock_rdev(rdev);
         return err;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
@@ -941,7 +950,7 @@ int cfg80211_wext_giwscan(struct net_device *dev,
         if (!netif_running(dev))
                 return -ENETDOWN;
 
-        rdev = cfg80211_get_dev_from_ifindex(dev->ifindex);
+        rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
 
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
@@ -959,7 +968,7 @@ int cfg80211_wext_giwscan(struct net_device *dev,
         }
 
  out:
-        cfg80211_put_dev(rdev);
+        cfg80211_unlock_rdev(rdev);
         return res;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
new file mode 100644
index 000000000000..8e2ef54ea714
--- /dev/null
+++ b/net/wireless/sme.c
@@ -0,0 +1,932 @@
+/*
+ * SME code for cfg80211's connect emulation.
+ *
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ * Copyright (C) 2009   Intel Corporation. All rights reserved.
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <linux/workqueue.h>
+#include <linux/wireless.h>
+#include <net/iw_handler.h>
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+#include "nl80211.h"
+#include "reg.h"
+
+struct cfg80211_conn {
+        struct cfg80211_connect_params params;
+        /* these are sub-states of the _CONNECTING sme_state */
+        enum {
+                CFG80211_CONN_IDLE,
+                CFG80211_CONN_SCANNING,
+                CFG80211_CONN_SCAN_AGAIN,
+                CFG80211_CONN_AUTHENTICATE_NEXT,
+                CFG80211_CONN_AUTHENTICATING,
+                CFG80211_CONN_ASSOCIATE_NEXT,
+                CFG80211_CONN_ASSOCIATING,
+        } state;
+        u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
+        u8 *ie;
+        size_t ie_len;
+        bool auto_auth, prev_bssid_valid;
+};
+
+
+static int cfg80211_conn_scan(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_scan_request *request;
+        int n_channels, err;
+
+        ASSERT_RTNL();
+        ASSERT_RDEV_LOCK(rdev);
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (rdev->scan_req)
+                return -EBUSY;
+
+        if (wdev->conn->params.channel) {
+                n_channels = 1;
+        } else {
+                enum ieee80211_band band;
+                n_channels = 0;
+
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        if (!wdev->wiphy->bands[band])
+                                continue;
+                        n_channels += wdev->wiphy->bands[band]->n_channels;
+                }
+        }
+        request = kzalloc(sizeof(*request) + sizeof(request->ssids[0]) +
+                          sizeof(request->channels[0]) * n_channels,
+                          GFP_KERNEL);
+        if (!request)
+                return -ENOMEM;
+
+        if (wdev->conn->params.channel)
+                request->channels[0] = wdev->conn->params.channel;
+        else {
+                int i = 0, j;
+                enum ieee80211_band band;
+
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        if (!wdev->wiphy->bands[band])
+                                continue;
+                        for (j = 0; j < wdev->wiphy->bands[band]->n_channels;
+                             i++, j++)
+                                request->channels[i] =
+                                        &wdev->wiphy->bands[band]->channels[j];
+                }
+        }
+        request->n_channels = n_channels;
+        request->ssids = (void *)&request->channels[n_channels];
+        request->n_ssids = 1;
+
+        memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
+                wdev->conn->params.ssid_len);
+        request->ssids[0].ssid_len = wdev->conn->params.ssid_len;
+
+        request->dev = wdev->netdev;
+        request->wiphy = &rdev->wiphy;
+
+        rdev->scan_req = request;
+
+        err = rdev->ops->scan(wdev->wiphy, wdev->netdev, request);
+        if (!err) {
+                wdev->conn->state = CFG80211_CONN_SCANNING;
+                nl80211_send_scan_start(rdev, wdev->netdev);
+                dev_hold(wdev->netdev);
+        } else {
+                rdev->scan_req = NULL;
+                kfree(request);
+        }
+        return err;
+}
+
+static int cfg80211_conn_do_work(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_connect_params *params;
+        const u8 *prev_bssid = NULL;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!wdev->conn)
+                return 0;
+
+        params = &wdev->conn->params;
+
+        switch (wdev->conn->state) {
+        case CFG80211_CONN_SCAN_AGAIN:
+                return cfg80211_conn_scan(wdev);
+        case CFG80211_CONN_AUTHENTICATE_NEXT:
+                BUG_ON(!rdev->ops->auth);
+                wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
+                return __cfg80211_mlme_auth(rdev, wdev->netdev,
+                                            params->channel, params->auth_type,
+                                            params->bssid,
+                                            params->ssid, params->ssid_len,
+                                            NULL, 0,
+                                            params->key, params->key_len,
+                                            params->key_idx);
+        case CFG80211_CONN_ASSOCIATE_NEXT:
+                BUG_ON(!rdev->ops->assoc);
+                wdev->conn->state = CFG80211_CONN_ASSOCIATING;
+                if (wdev->conn->prev_bssid_valid)
+                        prev_bssid = wdev->conn->prev_bssid;
+                err = __cfg80211_mlme_assoc(rdev, wdev->netdev,
+                                            params->channel, params->bssid,
+                                            prev_bssid,
+                                            params->ssid, params->ssid_len,
+                                            params->ie, params->ie_len,
+                                            false, &params->crypto);
+                if (err)
+                        __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                               NULL, 0,
+                                               WLAN_REASON_DEAUTH_LEAVING);
+                return err;
+        default:
+                return 0;
+        }
+}
+
+void cfg80211_conn_work(struct work_struct *work)
+{
+        struct cfg80211_registered_device *rdev =
+                container_of(work, struct cfg80211_registered_device, conn_work);
+        struct wireless_dev *wdev;
+
+        rtnl_lock();
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list) {
+                wdev_lock(wdev);
+                if (!netif_running(wdev->netdev)) {
+                        wdev_unlock(wdev);
+                        continue;
+                }
+                if (wdev->sme_state != CFG80211_SME_CONNECTING) {
+                        wdev_unlock(wdev);
+                        continue;
+                }
+                if (cfg80211_conn_do_work(wdev))
+                        __cfg80211_connect_result(
+                                        wdev->netdev,
+                                        wdev->conn->params.bssid,
+                                        NULL, 0, NULL, 0,
+                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                        false, NULL);
+                wdev_unlock(wdev);
+        }
+
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
+        rtnl_unlock();
+}
+
+static bool cfg80211_get_conn_bss(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_bss *bss;
+        u16 capa = WLAN_CAPABILITY_ESS;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (wdev->conn->params.privacy)
+                capa |= WLAN_CAPABILITY_PRIVACY;
+
+        bss = cfg80211_get_bss(wdev->wiphy, NULL, wdev->conn->params.bssid,
+                               wdev->conn->params.ssid,
+                               wdev->conn->params.ssid_len,
+                               WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_PRIVACY,
+                               capa);
+        if (!bss)
+                return false;
+
+        memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN);
+        wdev->conn->params.bssid = wdev->conn->bssid;
+        wdev->conn->params.channel = bss->channel;
+        wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
+        schedule_work(&rdev->conn_work);
+
+        cfg80211_put_bss(bss);
+        return true;
+}
+
+static void __cfg80211_sme_scan_done(struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (wdev->sme_state != CFG80211_SME_CONNECTING)
+                return;
+
+        if (!wdev->conn)
+                return;
+
+        if (wdev->conn->state != CFG80211_CONN_SCANNING &&
+            wdev->conn->state != CFG80211_CONN_SCAN_AGAIN)
+                return;
+
+        if (!cfg80211_get_conn_bss(wdev)) {
+                /* not found */
+                if (wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)
+                        schedule_work(&rdev->conn_work);
+                else
+                        __cfg80211_connect_result(
+                                        wdev->netdev,
+                                        wdev->conn->params.bssid,
+                                        NULL, 0, NULL, 0,
+                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                        false, NULL);
+        }
+}
+
+void cfg80211_sme_scan_done(struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        mutex_lock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
+        wdev_lock(wdev);
+        __cfg80211_sme_scan_done(dev);
+        wdev_unlock(wdev);
+        mutex_unlock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
+}
+
+void cfg80211_sme_rx_auth(struct net_device *dev,
+                          const u8 *buf, size_t len)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        u16 status_code = le16_to_cpu(mgmt->u.auth.status_code);
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        /* should only RX auth frames when connecting */
+        if (wdev->sme_state != CFG80211_SME_CONNECTING)
+                return;
+
+        if (WARN_ON(!wdev->conn))
+                return;
+
+        if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG &&
+            wdev->conn->auto_auth &&
+            wdev->conn->params.auth_type != NL80211_AUTHTYPE_NETWORK_EAP) {
+                /* select automatically between only open, shared, leap */
+                switch (wdev->conn->params.auth_type) {
+                case NL80211_AUTHTYPE_OPEN_SYSTEM:
+                        if (wdev->connect_keys)
+                                wdev->conn->params.auth_type =
+                                        NL80211_AUTHTYPE_SHARED_KEY;
+                        else
+                                wdev->conn->params.auth_type =
+                                        NL80211_AUTHTYPE_NETWORK_EAP;
+                        break;
+                case NL80211_AUTHTYPE_SHARED_KEY:
+                        wdev->conn->params.auth_type =
+                                NL80211_AUTHTYPE_NETWORK_EAP;
+                        break;
+                default:
+                        /* huh? */
+                        wdev->conn->params.auth_type =
+                                NL80211_AUTHTYPE_OPEN_SYSTEM;
+                        break;
+                }
+                wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
+                schedule_work(&rdev->conn_work);
+        } else if (status_code != WLAN_STATUS_SUCCESS) {
+                __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
+                                          status_code, false, NULL);
+        } else if (wdev->sme_state == CFG80211_SME_CONNECTING &&
+                 wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
+                wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
+                schedule_work(&rdev->conn_work);
+        }
+}
+
+bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev)
+{
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        if (WARN_ON(!wdev->conn))
+                return false;
+
+        if (!wdev->conn->prev_bssid_valid)
+                return false;
+
+        /*
+         * Some stupid APs don't accept reassoc, so we
+         * need to fall back to trying regular assoc.
+         */
+        wdev->conn->prev_bssid_valid = false;
+        wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
+        schedule_work(&rdev->conn_work);
+
+        return true;
+}
+
+void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
+                               const u8 *req_ie, size_t req_ie_len,
+                               const u8 *resp_ie, size_t resp_ie_len,
+                               u16 status, bool wextev,
+                               struct cfg80211_bss *bss)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        u8 *country_ie;
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+#endif
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return;
+
+        if (wdev->sme_state == CFG80211_SME_CONNECTED)
+                nl80211_send_roamed(wiphy_to_dev(wdev->wiphy), dev,
+                                    bssid, req_ie, req_ie_len,
+                                    resp_ie, resp_ie_len, GFP_KERNEL);
+        else
+                nl80211_send_connect_result(wiphy_to_dev(wdev->wiphy), dev,
+                                            bssid, req_ie, req_ie_len,
+                                            resp_ie, resp_ie_len,
+                                            status, GFP_KERNEL);
+
+#ifdef CONFIG_WIRELESS_EXT
+        if (wextev) {
+                if (req_ie && status == WLAN_STATUS_SUCCESS) {
+                        memset(&wrqu, 0, sizeof(wrqu));
+                        wrqu.data.length = req_ie_len;
+                        wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, req_ie);
+                }
+
+                if (resp_ie && status == WLAN_STATUS_SUCCESS) {
+                        memset(&wrqu, 0, sizeof(wrqu));
+                        wrqu.data.length = resp_ie_len;
+                        wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, resp_ie);
+                }
+
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                if (bssid && status == WLAN_STATUS_SUCCESS) {
+                        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+                        memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
+                        wdev->wext.prev_bssid_valid = true;
+                }
+                wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+        }
+#endif
+
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+                wdev->current_bss = NULL;
+        }
+
+        if (status == WLAN_STATUS_SUCCESS &&
+            wdev->sme_state == CFG80211_SME_IDLE)
+                goto success;
+
+        if (wdev->sme_state != CFG80211_SME_CONNECTING)
+                return;
+
+        if (wdev->conn)
+                wdev->conn->state = CFG80211_CONN_IDLE;
+
+        if (status != WLAN_STATUS_SUCCESS) {
+                wdev->sme_state = CFG80211_SME_IDLE;
+                kfree(wdev->conn);
+                wdev->conn = NULL;
+                kfree(wdev->connect_keys);
+                wdev->connect_keys = NULL;
+                wdev->ssid_len = 0;
+                return;
+        }
+
+ success:
+        if (!bss)
+                bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                                       wdev->ssid, wdev->ssid_len,
+                                       WLAN_CAPABILITY_ESS,
+                                       WLAN_CAPABILITY_ESS);
+
+        if (WARN_ON(!bss))
+                return;
+
+        cfg80211_hold_bss(bss_from_pub(bss));
+        wdev->current_bss = bss_from_pub(bss);
+
+        wdev->sme_state = CFG80211_SME_CONNECTED;
+        cfg80211_upload_connect_keys(wdev);
+
+        country_ie = (u8 *) ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
+
+        if (!country_ie)
+                return;
+
+        /*
+         * ieee80211_bss_get_ie() ensures we can access:
+         * - country_ie + 2, the start of the country ie data, and
+         * - and country_ie[1] which is the IE length
+         */
+        regulatory_hint_11d(wdev->wiphy,
+                            country_ie + 2,
+                            country_ie[1]);
+}
+
+void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
+                             const u8 *req_ie, size_t req_ie_len,
+                             const u8 *resp_ie, size_t resp_ie_len,
+                             u16 status, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_CONNECT_RESULT;
+        memcpy(ev->cr.bssid, bssid, ETH_ALEN);
+        ev->cr.req_ie = ((u8 *)ev) + sizeof(*ev);
+        ev->cr.req_ie_len = req_ie_len;
+        memcpy((void *)ev->cr.req_ie, req_ie, req_ie_len);
+        ev->cr.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
+        ev->cr.resp_ie_len = resp_ie_len;
+        memcpy((void *)ev->cr.resp_ie, resp_ie, resp_ie_len);
+        ev->cr.status = status;
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        schedule_work(&rdev->event_work);
+}
+EXPORT_SYMBOL(cfg80211_connect_result);
+
+void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
+                       const u8 *req_ie, size_t req_ie_len,
+                       const u8 *resp_ie, size_t resp_ie_len)
+{
+        struct cfg80211_bss *bss;
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+#endif
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return;
+
+        if (WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED))
+                return;
+
+        /* internal error -- how did we get to CONNECTED w/o BSS? */
+        if (WARN_ON(!wdev->current_bss)) {
+                return;
+        }
+
+        cfg80211_unhold_bss(wdev->current_bss);
+        cfg80211_put_bss(&wdev->current_bss->pub);
+        wdev->current_bss = NULL;
+
+        bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                               wdev->ssid, wdev->ssid_len,
+                               WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+
+        if (WARN_ON(!bss))
+                return;
+
+        cfg80211_hold_bss(bss_from_pub(bss));
+        wdev->current_bss = bss_from_pub(bss);
+
+        nl80211_send_roamed(wiphy_to_dev(wdev->wiphy), wdev->netdev, bssid,
+                            req_ie, req_ie_len, resp_ie, resp_ie_len,
+                            GFP_KERNEL);
+
+#ifdef CONFIG_WIRELESS_EXT
+        if (req_ie) {
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = req_ie_len;
+                wireless_send_event(wdev->netdev, IWEVASSOCREQIE,
+                                    &wrqu, req_ie);
+        }
+
+        if (resp_ie) {
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = resp_ie_len;
+                wireless_send_event(wdev->netdev, IWEVASSOCRESPIE,
+                                    &wrqu, resp_ie);
+        }
+
+        memset(&wrqu, 0, sizeof(wrqu));
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
+        wdev->wext.prev_bssid_valid = true;
+        wireless_send_event(wdev->netdev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+
+void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
+                     const u8 *req_ie, size_t req_ie_len,
+                     const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_ROAMED;
+        memcpy(ev->rm.bssid, bssid, ETH_ALEN);
+        ev->rm.req_ie = ((u8 *)ev) + sizeof(*ev);
+        ev->rm.req_ie_len = req_ie_len;
+        memcpy((void *)ev->rm.req_ie, req_ie, req_ie_len);
+        ev->rm.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
+        ev->rm.resp_ie_len = resp_ie_len;
+        memcpy((void *)ev->rm.resp_ie, resp_ie, resp_ie_len);
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        schedule_work(&rdev->event_work);
+}
+EXPORT_SYMBOL(cfg80211_roamed);
+
+void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
+                             size_t ie_len, u16 reason, bool from_ap)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int i;
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+#endif
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return;
+
+        if (WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED))
+                return;
+
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+        }
+
+        wdev->current_bss = NULL;
+        wdev->sme_state = CFG80211_SME_IDLE;
+        wdev->ssid_len = 0;
+
+        if (wdev->conn) {
+                const u8 *bssid;
+                int ret;
+
+                kfree(wdev->conn->ie);
+                wdev->conn->ie = NULL;
+                kfree(wdev->conn);
+                wdev->conn = NULL;
+
+                /*
+                 * If this disconnect was due to a disassoc, we
+                 * we might still have an auth BSS around. For
+                 * the userspace SME that's currently expected,
+                 * but for the kernel SME (nl80211 CONNECT or
+                 * wireless extensions) we want to clear up all
+                 * state.
+                 */
+                for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                        if (!wdev->auth_bsses[i])
+                                continue;
+                        bssid = wdev->auth_bsses[i]->pub.bssid;
+                        ret = __cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
+                                                WLAN_REASON_DEAUTH_LEAVING);
+                        WARN(ret, "deauth failed: %d\n", ret);
+                }
+        }
+
+        nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
+
+        /*
+         * Delete all the keys ... pairwise keys can't really
+         * exist any more anyway, but default keys might.
+         */
+        if (rdev->ops->del_key)
+                for (i = 0; i < 6; i++)
+                        rdev->ops->del_key(wdev->wiphy, dev, i, NULL);
+
+#ifdef CONFIG_WIRELESS_EXT
+        memset(&wrqu, 0, sizeof(wrqu));
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+
+void cfg80211_disconnected(struct net_device *dev, u16 reason,
+                           u8 *ie, size_t ie_len, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        ev = kzalloc(sizeof(*ev) + ie_len, gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_DISCONNECTED;
+        ev->dc.ie = ((u8 *)ev) + sizeof(*ev);
+        ev->dc.ie_len = ie_len;
+        memcpy((void *)ev->dc.ie, ie, ie_len);
+        ev->dc.reason = reason;
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        schedule_work(&rdev->event_work);
+}
+EXPORT_SYMBOL(cfg80211_disconnected);
+
+int __cfg80211_connect(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_connect_params *connect,
+                       struct cfg80211_cached_keys *connkeys,
+                       const u8 *prev_bssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (wdev->sme_state != CFG80211_SME_IDLE)
+                return -EALREADY;
+
+        chan = rdev_fixed_channel(rdev, wdev);
+        if (chan && chan != connect->channel)
+                return -EBUSY;
+
+        if (WARN_ON(wdev->connect_keys)) {
+                kfree(wdev->connect_keys);
+                wdev->connect_keys = NULL;
+        }
+
+        if (connkeys && connkeys->def >= 0) {
+                int idx;
+                u32 cipher;
+
+                idx = connkeys->def;
+                cipher = connkeys->params[idx].cipher;
+                /* If given a WEP key we may need it for shared key auth */
+                if (cipher == WLAN_CIPHER_SUITE_WEP40 ||
+                    cipher == WLAN_CIPHER_SUITE_WEP104) {
+                        connect->key_idx = idx;
+                        connect->key = connkeys->params[idx].key;
+                        connect->key_len = connkeys->params[idx].key_len;
+
+                        /*
+                         * If ciphers are not set (e.g. when going through
+                         * iwconfig), we have to set them appropriately here.
+                         */
+                        if (connect->crypto.cipher_group == 0)
+                                connect->crypto.cipher_group = cipher;
+
+                        if (connect->crypto.n_ciphers_pairwise == 0) {
+                                connect->crypto.n_ciphers_pairwise = 1;
+                                connect->crypto.ciphers_pairwise[0] = cipher;
+                        }
+                }
+        }
+
+        if (!rdev->ops->connect) {
+                if (!rdev->ops->auth || !rdev->ops->assoc)
+                        return -EOPNOTSUPP;
+
+                if (WARN_ON(wdev->conn))
+                        return -EINPROGRESS;
+
+                wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
+                if (!wdev->conn)
+                        return -ENOMEM;
+
+                /*
+                 * Copy all parameters, and treat explicitly IEs, BSSID, SSID.
+                 */
+                memcpy(&wdev->conn->params, connect, sizeof(*connect));
+                if (connect->bssid) {
+                        wdev->conn->params.bssid = wdev->conn->bssid;
+                        memcpy(wdev->conn->bssid, connect->bssid, ETH_ALEN);
+                }
+
+                if (connect->ie) {
+                        wdev->conn->ie = kmemdup(connect->ie, connect->ie_len,
+                                                GFP_KERNEL);
+                        wdev->conn->params.ie = wdev->conn->ie;
+                        if (!wdev->conn->ie) {
+                                kfree(wdev->conn);
+                                wdev->conn = NULL;
+                                return -ENOMEM;
+                        }
+                }
+
+                if (connect->auth_type == NL80211_AUTHTYPE_AUTOMATIC) {
+                        wdev->conn->auto_auth = true;
+                        /* start with open system ... should mostly work */
+                        wdev->conn->params.auth_type =
+                                NL80211_AUTHTYPE_OPEN_SYSTEM;
+                } else {
+                        wdev->conn->auto_auth = false;
+                }
+
+                memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
+                wdev->ssid_len = connect->ssid_len;
+                wdev->conn->params.ssid = wdev->ssid;
+                wdev->conn->params.ssid_len = connect->ssid_len;
+
+                /* don't care about result -- but fill bssid & channel */
+                if (!wdev->conn->params.bssid || !wdev->conn->params.channel)
+                        cfg80211_get_conn_bss(wdev);
+
+                wdev->sme_state = CFG80211_SME_CONNECTING;
+                wdev->connect_keys = connkeys;
+
+                if (prev_bssid) {
+                        memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
+                        wdev->conn->prev_bssid_valid = true;
+                }
+
+                /* we're good if we have both BSSID and channel */
+                if (wdev->conn->params.bssid && wdev->conn->params.channel) {
+                        wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
+                        err = cfg80211_conn_do_work(wdev);
+                } else {
+                        /* otherwise we'll need to scan for the AP first */
+                        err = cfg80211_conn_scan(wdev);
+                        /*
+                         * If we can't scan right now, then we need to scan again
+                         * after the current scan finished, since the parameters
+                         * changed (unless we find a good AP anyway).
+                         */
+                        if (err == -EBUSY) {
+                                err = 0;
+                                wdev->conn->state = CFG80211_CONN_SCAN_AGAIN;
+                        }
+                }
+                if (err) {
+                        kfree(wdev->conn);
+                        wdev->conn = NULL;
+                        wdev->sme_state = CFG80211_SME_IDLE;
+                        wdev->connect_keys = NULL;
+                        wdev->ssid_len = 0;
+                }
+
+                return err;
+        } else {
+                wdev->sme_state = CFG80211_SME_CONNECTING;
+                wdev->connect_keys = connkeys;
+                err = rdev->ops->connect(&rdev->wiphy, dev, connect);
+                if (err) {
+                        wdev->connect_keys = NULL;
+                        wdev->sme_state = CFG80211_SME_IDLE;
+                        return err;
+                }
+
+                memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
+                wdev->ssid_len = connect->ssid_len;
+
+                return 0;
+        }
+}
+
+int cfg80211_connect(struct cfg80211_registered_device *rdev,
+                     struct net_device *dev,
+                     struct cfg80211_connect_params *connect,
+                     struct cfg80211_cached_keys *connkeys)
+{
+        int err;
+
+        mutex_lock(&rdev->devlist_mtx);
+        wdev_lock(dev->ieee80211_ptr);
+        err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
+        wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->devlist_mtx);
+
+        return err;
+}
+
+int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, u16 reason, bool wextev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (wdev->sme_state == CFG80211_SME_IDLE)
+                return -EINVAL;
+
+        kfree(wdev->connect_keys);
+        wdev->connect_keys = NULL;
+
+        if (!rdev->ops->disconnect) {
+                if (!rdev->ops->deauth)
+                        return -EOPNOTSUPP;
+
+                /* was it connected by userspace SME? */
+                if (!wdev->conn) {
+                        cfg80211_mlme_down(rdev, dev);
+                        return 0;
+                }
+
+                if (wdev->sme_state == CFG80211_SME_CONNECTING &&
+                    (wdev->conn->state == CFG80211_CONN_SCANNING ||
+                     wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)) {
+                        wdev->sme_state = CFG80211_SME_IDLE;
+                        kfree(wdev->conn);
+                        wdev->conn = NULL;
+                        wdev->ssid_len = 0;
+                        return 0;
+                }
+
+                /* wdev->conn->params.bssid must be set if > SCANNING */
+                err = __cfg80211_mlme_deauth(rdev, dev,
+                                             wdev->conn->params.bssid,
+                                             NULL, 0, reason);
+                if (err)
+                        return err;
+        } else {
+                err = rdev->ops->disconnect(&rdev->wiphy, dev, reason);
+                if (err)
+                        return err;
+        }
+
+        if (wdev->sme_state == CFG80211_SME_CONNECTED)
+                __cfg80211_disconnected(dev, NULL, 0, 0, false);
+        else if (wdev->sme_state == CFG80211_SME_CONNECTING)
+                __cfg80211_connect_result(dev, NULL, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          wextev, NULL);
+
+        return 0;
+}
+
+int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        u16 reason, bool wextev)
+{
+        int err;
+
+        wdev_lock(dev->ieee80211_ptr);
+        err = __cfg80211_disconnect(rdev, dev, reason, wextev);
+        wdev_unlock(dev->ieee80211_ptr);
+
+        return err;
+}
+
+void cfg80211_sme_disassoc(struct net_device *dev, int idx)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u8 bssid[ETH_ALEN];
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!wdev->conn)
+                return;
+
+        if (wdev->conn->state == CFG80211_CONN_IDLE)
+                return;
+
+        /*
+         * Ok, so the association was made by this SME -- we don't
+         * want it any more so deauthenticate too.
+         */
+
+        if (!wdev->auth_bsses[idx])
+                return;
+
+        memcpy(bssid, wdev->auth_bsses[idx]->pub.bssid, ETH_ALEN);
+        if (__cfg80211_mlme_deauth(rdev, dev, bssid,
+                                   NULL, 0, WLAN_REASON_DEAUTH_LEAVING)) {
+                /* whatever -- assume gone anyway */
+                cfg80211_unhold_bss(wdev->auth_bsses[idx]);
+                cfg80211_put_bss(&wdev->auth_bsses[idx]->pub);
+                wdev->auth_bsses[idx] = NULL;
+        }
+}
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 25550692dda6..693275a16a26 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -141,9 +141,12 @@ void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
                         set_mandatory_flags_band(wiphy->bands[band], band);
 }
 
-int cfg80211_validate_key_settings(struct key_params *params, int key_idx,
+int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
+                                   struct key_params *params, int key_idx,
                                    const u8 *mac_addr)
 {
+        int i;
+
         if (key_idx > 5)
                 return -EINVAL;
 
@@ -197,6 +200,12 @@ int cfg80211_validate_key_settings(struct key_params *params, int key_idx,
                 }
         }
 
+        for (i = 0; i < rdev->wiphy.n_cipher_suites; i++)
+                if (params->cipher == rdev->wiphy.cipher_suites[i])
+                        break;
+        if (i == rdev->wiphy.n_cipher_suites)
+                return -EINVAL;
+
         return 0;
 }
 
@@ -265,11 +274,11 @@ static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
         switch (ae) {
         case 0:
                 return 6;
-        case 1:
+        case MESH_FLAGS_AE_A4:
                 return 12;
-        case 2:
+        case MESH_FLAGS_AE_A5_A6:
                 return 18;
-        case 3:
+        case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6):
                 return 24;
         default:
                 return 6;
@@ -324,10 +333,18 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
                 }
                 break;
         case cpu_to_le16(IEEE80211_FCTL_FROMDS):
-                if (iftype != NL80211_IFTYPE_STATION ||
+                if ((iftype != NL80211_IFTYPE_STATION &&
+                    iftype != NL80211_IFTYPE_MESH_POINT) ||
                     (is_multicast_ether_addr(dst) &&
                      !compare_ether_addr(src, addr)))
                         return -1;
+                if (iftype == NL80211_IFTYPE_MESH_POINT) {
+                        struct ieee80211s_hdr *meshdr =
+                                (struct ieee80211s_hdr *) (skb->data + hdrlen);
+                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                        if (meshdr->flags & MESH_FLAGS_AE_A4)
+                                memcpy(src, meshdr->eaddr1, ETH_ALEN);
+                }
                 break;
         case cpu_to_le16(0):
                 if (iftype != NL80211_IFTYPE_ADHOC)
@@ -502,3 +519,58 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb)
         return dscp >> 5;
 }
 EXPORT_SYMBOL(cfg80211_classify8021d);
+
+const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie)
+{
+        u8 *end, *pos;
+
+        pos = bss->information_elements;
+        if (pos == NULL)
+                return NULL;
+        end = pos + bss->len_information_elements;
+
+        while (pos + 1 < end) {
+                if (pos + 2 + pos[1] > end)
+                        break;
+                if (pos[0] == ie)
+                        return pos;
+                pos += 2 + pos[1];
+        }
+
+        return NULL;
+}
+EXPORT_SYMBOL(ieee80211_bss_get_ie);
+
+void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct net_device *dev = wdev->netdev;
+        int i;
+
+        if (!wdev->connect_keys)
+                return;
+
+        for (i = 0; i < 6; i++) {
+                if (!wdev->connect_keys->params[i].cipher)
+                        continue;
+                if (rdev->ops->add_key(wdev->wiphy, dev, i, NULL,
+                                        &wdev->connect_keys->params[i])) {
+                        printk(KERN_ERR "%s: failed to set key %d\n",
+                                dev->name, i);
+                        continue;
+                }
+                if (wdev->connect_keys->def == i)
+                        if (rdev->ops->set_default_key(wdev->wiphy, dev, i)) {
+                                printk(KERN_ERR "%s: failed to set defkey %d\n",
+                                        dev->name, i);
+                                continue;
+                        }
+                if (wdev->connect_keys->defmgmt == i)
+                        if (rdev->ops->set_default_mgmt_key(wdev->wiphy, dev, i))
+                                printk(KERN_ERR "%s: failed to set mgtdef %d\n",
+                                        dev->name, i);
+        }
+
+        kfree(wdev->connect_keys);
+        wdev->connect_keys = NULL;
+}
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index d030c5315672..c44917492210 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -14,6 +14,7 @@
 #include <linux/etherdevice.h>
 #include <net/iw_handler.h>
 #include <net/cfg80211.h>
+#include "wext-compat.h"
 #include "core.h"
 
 int cfg80211_wext_giwname(struct net_device *dev,
@@ -103,7 +104,7 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
 
         memset(&vifparams, 0, sizeof(vifparams));
 
-        ret = rdev->ops->change_virtual_intf(wdev->wiphy, dev->ifindex, type,
+        ret = rdev->ops->change_virtual_intf(wdev->wiphy, dev, type,
                                              NULL, &vifparams);
         WARN_ON(!ret && wdev->iftype != type);
 
@@ -154,7 +155,7 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct iw_range *range = (struct iw_range *) extra;
         enum ieee80211_band band;
-        int c = 0;
+        int i, c = 0;
 
         if (!wdev)
                 return -EOPNOTSUPP;
@@ -173,9 +174,6 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         range->min_frag = 256;
         range->max_frag = 2346;
 
-        range->encoding_size[0] = 5;
-        range->encoding_size[1] = 13;
-        range->num_encoding_sizes = 2;
         range->max_encoding_tokens = 4;
 
         range->max_qual.updated = IW_QUAL_NOISE_INVALID;
@@ -204,11 +202,31 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         range->avg_qual.noise = range->max_qual.noise / 2;
         range->avg_qual.updated = range->max_qual.updated;
 
-        range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
-                          IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
+        for (i = 0; i < wdev->wiphy->n_cipher_suites; i++) {
+                switch (wdev->wiphy->cipher_suites[i]) {
+                case WLAN_CIPHER_SUITE_TKIP:
+                        range->enc_capa |= (IW_ENC_CAPA_CIPHER_TKIP |
+                                            IW_ENC_CAPA_WPA);
+                        break;
+
+                case WLAN_CIPHER_SUITE_CCMP:
+                        range->enc_capa |= (IW_ENC_CAPA_CIPHER_CCMP |
+                                            IW_ENC_CAPA_WPA2);
+                        break;
+
+                case WLAN_CIPHER_SUITE_WEP40:
+                        range->encoding_size[range->num_encoding_sizes++] =
+                                WLAN_KEY_LEN_WEP40;
+                        break;
+
+                case WLAN_CIPHER_SUITE_WEP104:
+                        range->encoding_size[range->num_encoding_sizes++] =
+                                WLAN_KEY_LEN_WEP104;
+                        break;
+                }
+        }
 
         for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
-                int i;
                 struct ieee80211_supported_band *sband;
 
                 sband = wdev->wiphy->bands[band];
@@ -236,97 +254,40 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
 
-        range->scan_capa |= IW_SCAN_CAPA_ESSID;
+        if (wdev->wiphy->max_scan_ssids > 0)
+                range->scan_capa |= IW_SCAN_CAPA_ESSID;
 
         return 0;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwrange);
 
-int cfg80211_wext_siwmlme(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_point *data, char *extra)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct iw_mlme *mlme = (struct iw_mlme *)extra;
-        struct cfg80211_registered_device *rdev;
-        union {
-                struct cfg80211_disassoc_request disassoc;
-                struct cfg80211_deauth_request deauth;
-        } cmd;
-
-        if (!wdev)
-                return -EOPNOTSUPP;
-
-        rdev = wiphy_to_dev(wdev->wiphy);
-
-        if (wdev->iftype != NL80211_IFTYPE_STATION)
-                return -EINVAL;
-
-        if (mlme->addr.sa_family != ARPHRD_ETHER)
-                return -EINVAL;
-
-        memset(&cmd, 0, sizeof(cmd));
-
-        switch (mlme->cmd) {
-        case IW_MLME_DEAUTH:
-                if (!rdev->ops->deauth)
-                        return -EOPNOTSUPP;
-                cmd.deauth.peer_addr = mlme->addr.sa_data;
-                cmd.deauth.reason_code = mlme->reason_code;
-                return rdev->ops->deauth(wdev->wiphy, dev, &cmd.deauth);
-        case IW_MLME_DISASSOC:
-                if (!rdev->ops->disassoc)
-                        return -EOPNOTSUPP;
-                cmd.disassoc.peer_addr = mlme->addr.sa_data;
-                cmd.disassoc.reason_code = mlme->reason_code;
-                return rdev->ops->disassoc(wdev->wiphy, dev, &cmd.disassoc);
-        default:
-                return -EOPNOTSUPP;
-        }
-}
-EXPORT_SYMBOL_GPL(cfg80211_wext_siwmlme);
-
 
 /**
  * cfg80211_wext_freq - get wext frequency for non-"auto"
  * @wiphy: the wiphy
  * @freq: the wext freq encoding
  *
- * Returns a channel, %NULL for auto, or an ERR_PTR for errors!
+ * Returns a frequency, or a negative error code, or 0 for auto.
  */
-struct ieee80211_channel *cfg80211_wext_freq(struct wiphy *wiphy,
-                                             struct iw_freq *freq)
+int cfg80211_wext_freq(struct wiphy *wiphy, struct iw_freq *freq)
 {
-        struct ieee80211_channel *chan;
-        int f;
-
         /*
-         * Parse frequency - return NULL for auto and
+         * Parse frequency - return 0 for auto and
          * -EINVAL for impossible things.
          */
         if (freq->e == 0) {
                 if (freq->m < 0)
-                        return NULL;
-                f = ieee80211_channel_to_frequency(freq->m);
+                        return 0;
+                return ieee80211_channel_to_frequency(freq->m);
         } else {
                 int i, div = 1000000;
                 for (i = 0; i < freq->e; i++)
                         div /= 10;
                 if (div <= 0)
-                        return ERR_PTR(-EINVAL);
-                f = freq->m / div;
+                        return -EINVAL;
+                return freq->m / div;
         }
-
-        /*
-         * Look up channel struct and return -EINVAL when
-         * it cannot be found.
-         */
-        chan = ieee80211_get_channel(wiphy, f);
-        if (!chan)
-                return ERR_PTR(-EINVAL);
-        return chan;
 }
-EXPORT_SYMBOL_GPL(cfg80211_wext_freq);
 
 int cfg80211_wext_siwrts(struct net_device *dev,
                          struct iw_request_info *info,
@@ -479,15 +440,32 @@ int cfg80211_wext_giwretry(struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwretry);
 
-static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
-                                   struct net_device *dev, const u8 *addr,
-                                   bool remove, bool tx_key, int idx,
-                                   struct key_params *params)
+static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
+                                     struct net_device *dev, const u8 *addr,
+                                     bool remove, bool tx_key, int idx,
+                                     struct key_params *params)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
+        int err, i;
+
+        if (!wdev->wext.keys) {
+                wdev->wext.keys = kzalloc(sizeof(*wdev->wext.keys),
+                                              GFP_KERNEL);
+                if (!wdev->wext.keys)
+                        return -ENOMEM;
+                for (i = 0; i < 6; i++)
+                        wdev->wext.keys->params[i].key =
+                                wdev->wext.keys->data[i];
+        }
+
+        if (wdev->iftype != NL80211_IFTYPE_ADHOC &&
+            wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
 
         if (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC) {
+                if (!wdev->current_bss)
+                        return -ENOLINK;
+
                 if (!rdev->ops->set_default_mgmt_key)
                         return -EOPNOTSUPP;
 
@@ -497,8 +475,14 @@ static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
                 return -EINVAL;
 
         if (remove) {
-                err = rdev->ops->del_key(&rdev->wiphy, dev, idx, addr);
+                err = 0;
+                if (wdev->current_bss)
+                        err = rdev->ops->del_key(&rdev->wiphy, dev, idx, addr);
                 if (!err) {
+                        if (!addr) {
+                                wdev->wext.keys->params[idx].key_len = 0;
+                                wdev->wext.keys->params[idx].cipher = 0;
+                        }
                         if (idx == wdev->wext.default_key)
                                 wdev->wext.default_key = -1;
                         else if (idx == wdev->wext.default_mgmt_key)
@@ -512,36 +496,65 @@ static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
                         return 0;
 
                 return err;
-        } else {
-                if (addr)
-                        tx_key = false;
+        }
 
-                if (cfg80211_validate_key_settings(params, idx, addr))
-                        return -EINVAL;
+        if (addr)
+                tx_key = false;
 
+        if (cfg80211_validate_key_settings(rdev, params, idx, addr))
+                return -EINVAL;
+
+        err = 0;
+        if (wdev->current_bss)
                 err = rdev->ops->add_key(&rdev->wiphy, dev, idx, addr, params);
-                if (err)
-                        return err;
+        if (err)
+                return err;
+
+        if (!addr) {
+                wdev->wext.keys->params[idx] = *params;
+                memcpy(wdev->wext.keys->data[idx],
+                        params->key, params->key_len);
+                wdev->wext.keys->params[idx].key =
+                        wdev->wext.keys->data[idx];
+        }
 
-                if (tx_key || (!addr && wdev->wext.default_key == -1)) {
+        if ((params->cipher == WLAN_CIPHER_SUITE_WEP40 ||
+             params->cipher == WLAN_CIPHER_SUITE_WEP104) &&
+            (tx_key || (!addr && wdev->wext.default_key == -1))) {
+                if (wdev->current_bss)
                         err = rdev->ops->set_default_key(&rdev->wiphy,
                                                          dev, idx);
-                        if (!err)
-                                wdev->wext.default_key = idx;
-                        return err;
-                }
+                if (!err)
+                        wdev->wext.default_key = idx;
+                return err;
+        }
 
-                if (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC &&
-                    (tx_key || (!addr && wdev->wext.default_mgmt_key == -1))) {
+        if (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC &&
+            (tx_key || (!addr && wdev->wext.default_mgmt_key == -1))) {
+                if (wdev->current_bss)
                         err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
                                                               dev, idx);
-                        if (!err)
-                                wdev->wext.default_mgmt_key = idx;
-                        return err;
-                }
-
-                return 0;
+                if (!err)
+                        wdev->wext.default_mgmt_key = idx;
+                return err;
         }
+
+        return 0;
+}
+
+static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
+                                   struct net_device *dev, const u8 *addr,
+                                   bool remove, bool tx_key, int idx,
+                                   struct key_params *params)
+{
+        int err;
+
+        wdev_lock(dev->ieee80211_ptr);
+        err = __cfg80211_set_encryption(rdev, dev, addr, remove,
+                                        tx_key, idx, params);
+        wdev_unlock(dev->ieee80211_ptr);
+
+        return err;
 }
 
 int cfg80211_wext_siwencode(struct net_device *dev,
@@ -554,6 +567,10 @@ int cfg80211_wext_siwencode(struct net_device *dev,
         bool remove = false;
         struct key_params params;
 
+        if (wdev->iftype != NL80211_IFTYPE_STATION &&
+            wdev->iftype != NL80211_IFTYPE_ADHOC)
+                return -EOPNOTSUPP;
+
         /* no use -- only MFP (set_default_mgmt_key) is optional */
         if (!rdev->ops->del_key ||
             !rdev->ops->add_key ||
@@ -574,9 +591,14 @@ int cfg80211_wext_siwencode(struct net_device *dev,
                 remove = true;
         else if (erq->length == 0) {
                 /* No key data - just set the default TX key index */
-                err = rdev->ops->set_default_key(&rdev->wiphy, dev, idx);
+                err = 0;
+                wdev_lock(wdev);
+                if (wdev->current_bss)
+                        err = rdev->ops->set_default_key(&rdev->wiphy,
+                                                         dev, idx);
                 if (!err)
                         wdev->wext.default_key = idx;
+                wdev_unlock(wdev);
                 return err;
         }
 
@@ -609,6 +631,10 @@ int cfg80211_wext_siwencodeext(struct net_device *dev,
         struct key_params params;
         u32 cipher;
 
+        if (wdev->iftype != NL80211_IFTYPE_STATION &&
+            wdev->iftype != NL80211_IFTYPE_ADHOC)
+                return -EOPNOTSUPP;
+
         /* no use -- only MFP (set_default_mgmt_key) is optional */
         if (!rdev->ops->del_key ||
             !rdev->ops->add_key ||
@@ -682,37 +708,15 @@ int cfg80211_wext_siwencodeext(struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwencodeext);
 
-struct giwencode_cookie {
-        size_t buflen;
-        char *keybuf;
-};
-
-static void giwencode_get_key_cb(void *cookie, struct key_params *params)
-{
-        struct giwencode_cookie *data = cookie;
-
-        if (!params->key) {
-                data->buflen = 0;
-                return;
-        }
-
-        data->buflen = min_t(size_t, data->buflen, params->key_len);
-        memcpy(data->keybuf, params->key, data->buflen);
-}
-
 int cfg80211_wext_giwencode(struct net_device *dev,
                             struct iw_request_info *info,
                             struct iw_point *erq, char *keybuf)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        int idx, err;
-        struct giwencode_cookie data = {
-                .keybuf = keybuf,
-                .buflen = erq->length,
-        };
+        int idx;
 
-        if (!rdev->ops->get_key)
+        if (wdev->iftype != NL80211_IFTYPE_STATION &&
+            wdev->iftype != NL80211_IFTYPE_ADHOC)
                 return -EOPNOTSUPP;
 
         idx = erq->flags & IW_ENCODE_INDEX;
@@ -727,24 +731,69 @@ int cfg80211_wext_giwencode(struct net_device *dev,
 
         erq->flags = idx + 1;
 
-        err = rdev->ops->get_key(&rdev->wiphy, dev, idx, NULL, &data,
-                                 giwencode_get_key_cb);
-        if (!err) {
-                erq->length = data.buflen;
-                erq->flags |= IW_ENCODE_ENABLED;
-                return 0;
-        }
-
-        if (err == -ENOENT) {
+        if (!wdev->wext.keys || !wdev->wext.keys->params[idx].cipher) {
                 erq->flags |= IW_ENCODE_DISABLED;
                 erq->length = 0;
                 return 0;
         }
 
-        return err;
+        erq->length = min_t(size_t, erq->length,
+                            wdev->wext.keys->params[idx].key_len);
+        memcpy(keybuf, wdev->wext.keys->params[idx].key, erq->length);
+        erq->flags |= IW_ENCODE_ENABLED;
+
+        return 0;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwencode);
 
+int cfg80211_wext_siwfreq(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_freq *wextfreq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int freq, err;
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+                return cfg80211_mgd_wext_siwfreq(dev, info, wextfreq, extra);
+        case NL80211_IFTYPE_ADHOC:
+                return cfg80211_ibss_wext_siwfreq(dev, info, wextfreq, extra);
+        default:
+                freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+                if (freq < 0)
+                        return freq;
+                if (freq == 0)
+                        return -EINVAL;
+                mutex_lock(&rdev->devlist_mtx);
+                err = rdev_set_freq(rdev, NULL, freq, NL80211_CHAN_NO_HT);
+                mutex_unlock(&rdev->devlist_mtx);
+                return err;
+        }
+}
+
+int cfg80211_wext_giwfreq(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_freq *freq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+                return cfg80211_mgd_wext_giwfreq(dev, info, freq, extra);
+        case NL80211_IFTYPE_ADHOC:
+                return cfg80211_ibss_wext_giwfreq(dev, info, freq, extra);
+        default:
+                if (!rdev->channel)
+                        return -EINVAL;
+                freq->m = rdev->channel->center_freq;
+                freq->e = 6;
+                return 0;
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwfreq);
+
 int cfg80211_wext_siwtxpower(struct net_device *dev,
                              struct iw_request_info *info,
                              union iwreq_data *data, char *extra)
@@ -827,3 +876,547 @@ int cfg80211_wext_giwtxpower(struct net_device *dev,
         return 0;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwtxpower);
+
+static int cfg80211_set_auth_alg(struct wireless_dev *wdev,
+                                 s32 auth_alg)
+{
+        int nr_alg = 0;
+
+        if (!auth_alg)
+                return -EINVAL;
+
+        if (auth_alg & ~(IW_AUTH_ALG_OPEN_SYSTEM |
+                         IW_AUTH_ALG_SHARED_KEY |
+                         IW_AUTH_ALG_LEAP))
+                return -EINVAL;
+
+        if (auth_alg & IW_AUTH_ALG_OPEN_SYSTEM) {
+                nr_alg++;
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_OPEN_SYSTEM;
+        }
+
+        if (auth_alg & IW_AUTH_ALG_SHARED_KEY) {
+                nr_alg++;
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_SHARED_KEY;
+        }
+
+        if (auth_alg & IW_AUTH_ALG_LEAP) {
+                nr_alg++;
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_NETWORK_EAP;
+        }
+
+        if (nr_alg > 1)
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+
+        return 0;
+}
+
+static int cfg80211_set_wpa_version(struct wireless_dev *wdev, u32 wpa_versions)
+{
+        wdev->wext.connect.crypto.wpa_versions = 0;
+
+        if (wpa_versions & ~(IW_AUTH_WPA_VERSION_WPA |
+                             IW_AUTH_WPA_VERSION_WPA2|
+                             IW_AUTH_WPA_VERSION_DISABLED))
+                return -EINVAL;
+
+        if ((wpa_versions & IW_AUTH_WPA_VERSION_DISABLED) &&
+            (wpa_versions & (IW_AUTH_WPA_VERSION_WPA|
+                             IW_AUTH_WPA_VERSION_WPA2)))
+                return -EINVAL;
+
+        if (wpa_versions & IW_AUTH_WPA_VERSION_DISABLED)
+                wdev->wext.connect.crypto.wpa_versions &=
+                        ~(NL80211_WPA_VERSION_1|NL80211_WPA_VERSION_2);
+
+        if (wpa_versions & IW_AUTH_WPA_VERSION_WPA)
+                wdev->wext.connect.crypto.wpa_versions |=
+                        NL80211_WPA_VERSION_1;
+
+        if (wpa_versions & IW_AUTH_WPA_VERSION_WPA2)
+                wdev->wext.connect.crypto.wpa_versions |=
+                        NL80211_WPA_VERSION_2;
+
+        return 0;
+}
+
+static int cfg80211_set_cipher_group(struct wireless_dev *wdev, u32 cipher)
+{
+        wdev->wext.connect.crypto.cipher_group = 0;
+
+        if (cipher & IW_AUTH_CIPHER_WEP40)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_WEP40;
+        else if (cipher & IW_AUTH_CIPHER_WEP104)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_WEP104;
+        else if (cipher & IW_AUTH_CIPHER_TKIP)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_TKIP;
+        else if (cipher & IW_AUTH_CIPHER_CCMP)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_CCMP;
+        else if (cipher & IW_AUTH_CIPHER_AES_CMAC)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_AES_CMAC;
+        else
+                return -EINVAL;
+
+        return 0;
+}
+
+static int cfg80211_set_cipher_pairwise(struct wireless_dev *wdev, u32 cipher)
+{
+        int nr_ciphers = 0;
+        u32 *ciphers_pairwise = wdev->wext.connect.crypto.ciphers_pairwise;
+
+        if (cipher & IW_AUTH_CIPHER_WEP40) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_WEP40;
+                nr_ciphers++;
+        }
+
+        if (cipher & IW_AUTH_CIPHER_WEP104) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_WEP104;
+                nr_ciphers++;
+        }
+
+        if (cipher & IW_AUTH_CIPHER_TKIP) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_TKIP;
+                nr_ciphers++;
+        }
+
+        if (cipher & IW_AUTH_CIPHER_CCMP) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_CCMP;
+                nr_ciphers++;
+        }
+
+        if (cipher & IW_AUTH_CIPHER_AES_CMAC) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_AES_CMAC;
+                nr_ciphers++;
+        }
+
+        BUILD_BUG_ON(NL80211_MAX_NR_CIPHER_SUITES < 5);
+
+        wdev->wext.connect.crypto.n_ciphers_pairwise = nr_ciphers;
+
+        return 0;
+}
+
+
+static int cfg80211_set_key_mgt(struct wireless_dev *wdev, u32 key_mgt)
+{
+        int nr_akm_suites = 0;
+
+        if (key_mgt & ~(IW_AUTH_KEY_MGMT_802_1X |
+                        IW_AUTH_KEY_MGMT_PSK))
+                return -EINVAL;
+
+        if (key_mgt & IW_AUTH_KEY_MGMT_802_1X) {
+                wdev->wext.connect.crypto.akm_suites[nr_akm_suites] =
+                        WLAN_AKM_SUITE_8021X;
+                nr_akm_suites++;
+        }
+
+        if (key_mgt & IW_AUTH_KEY_MGMT_PSK) {
+                wdev->wext.connect.crypto.akm_suites[nr_akm_suites] =
+                        WLAN_AKM_SUITE_PSK;
+                nr_akm_suites++;
+        }
+
+        wdev->wext.connect.crypto.n_akm_suites = nr_akm_suites;
+
+        return 0;
+}
+
+int cfg80211_wext_siwauth(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        switch (data->flags & IW_AUTH_INDEX) {
+        case IW_AUTH_PRIVACY_INVOKED:
+                wdev->wext.connect.privacy = data->value;
+                return 0;
+        case IW_AUTH_WPA_VERSION:
+                return cfg80211_set_wpa_version(wdev, data->value);
+        case IW_AUTH_CIPHER_GROUP:
+                return cfg80211_set_cipher_group(wdev, data->value);
+        case IW_AUTH_KEY_MGMT:
+                return cfg80211_set_key_mgt(wdev, data->value);
+        case IW_AUTH_CIPHER_PAIRWISE:
+                return cfg80211_set_cipher_pairwise(wdev, data->value);
+        case IW_AUTH_80211_AUTH_ALG:
+                return cfg80211_set_auth_alg(wdev, data->value);
+        case IW_AUTH_WPA_ENABLED:
+        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+        case IW_AUTH_DROP_UNENCRYPTED:
+        case IW_AUTH_MFP:
+                return 0;
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwauth);
+
+int cfg80211_wext_giwauth(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *data, char *extra)
+{
+        /* XXX: what do we need? */
+
+        return -EOPNOTSUPP;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwauth);
+
+int cfg80211_wext_siwpower(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *wrq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        bool ps = wdev->wext.ps;
+        int timeout = wdev->wext.ps_timeout;
+        int err;
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+        if (!rdev->ops->set_power_mgmt)
+                return -EOPNOTSUPP;
+
+        if (wrq->disabled) {
+                ps = false;
+        } else {
+                switch (wrq->flags & IW_POWER_MODE) {
+                case IW_POWER_ON:       /* If not specified */
+                case IW_POWER_MODE:     /* If set all mask */
+                case IW_POWER_ALL_R:    /* If explicitely state all */
+                        ps = true;
+                        break;
+                default:                /* Otherwise we ignore */
+                        return -EINVAL;
+                }
+
+                if (wrq->flags & ~(IW_POWER_MODE | IW_POWER_TIMEOUT))
+                        return -EINVAL;
+
+                if (wrq->flags & IW_POWER_TIMEOUT)
+                        timeout = wrq->value / 1000;
+        }
+
+        err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, ps, timeout);
+        if (err)
+                return err;
+
+        wdev->wext.ps = ps;
+        wdev->wext.ps_timeout = timeout;
+
+        return 0;
+
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwpower);
+
+int cfg80211_wext_giwpower(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *wrq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        wrq->disabled = !wdev->wext.ps;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwpower);
+
+static int cfg80211_wds_wext_siwap(struct net_device *dev,
+                                   struct iw_request_info *info,
+                                   struct sockaddr *addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int err;
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_WDS))
+                return -EINVAL;
+
+        if (addr->sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+
+        if (netif_running(dev))
+                return -EBUSY;
+
+        if (!rdev->ops->set_wds_peer)
+                return -EOPNOTSUPP;
+
+        err = rdev->ops->set_wds_peer(wdev->wiphy, dev, (u8 *) &addr->sa_data);
+        if (err)
+                return err;
+
+        memcpy(&wdev->wext.bssid, (u8 *) &addr->sa_data, ETH_ALEN);
+
+        return 0;
+}
+
+static int cfg80211_wds_wext_giwap(struct net_device *dev,
+                                   struct iw_request_info *info,
+                                   struct sockaddr *addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_WDS))
+                return -EINVAL;
+
+        addr->sa_family = ARPHRD_ETHER;
+        memcpy(&addr->sa_data, wdev->wext.bssid, ETH_ALEN);
+
+        return 0;
+}
+
+int cfg80211_wext_siwrate(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *rate, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_bitrate_mask mask;
+
+        if (!rdev->ops->set_bitrate_mask)
+                return -EOPNOTSUPP;
+
+        mask.fixed = 0;
+        mask.maxrate = 0;
+
+        if (rate->value < 0) {
+                /* nothing */
+        } else if (rate->fixed) {
+                mask.fixed = rate->value / 1000; /* kbps */
+        } else {
+                mask.maxrate = rate->value / 1000; /* kbps */
+        }
+
+        return rdev->ops->set_bitrate_mask(wdev->wiphy, dev, NULL, &mask);
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwrate);
+
+int cfg80211_wext_giwrate(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *rate, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        /* we are under RTNL - globally locked - so can use a static struct */
+        static struct station_info sinfo;
+        u8 addr[ETH_ALEN];
+        int err;
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        if (!rdev->ops->get_station)
+                return -EOPNOTSUPP;
+
+        err = 0;
+        wdev_lock(wdev);
+        if (wdev->current_bss)
+                memcpy(addr, wdev->current_bss->pub.bssid, ETH_ALEN);
+        else
+                err = -EOPNOTSUPP;
+        wdev_unlock(wdev);
+        if (err)
+                return err;
+
+        err = rdev->ops->get_station(&rdev->wiphy, dev, addr, &sinfo);
+        if (err)
+                return err;
+
+        if (!(sinfo.filled & STATION_INFO_TX_BITRATE))
+                return -EOPNOTSUPP;
+
+        rate->value = 0;
+
+        if (!(sinfo.txrate.flags & RATE_INFO_FLAGS_MCS))
+                rate->value = 100000 * sinfo.txrate.legacy;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwrate);
+
+/* Get wireless statistics.  Called by /proc/net/wireless and by SIOCGIWSTATS */
+struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        /* we are under RTNL - globally locked - so can use static structs */
+        static struct iw_statistics wstats;
+        static struct station_info sinfo;
+        u8 bssid[ETH_ALEN];
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION)
+                return NULL;
+
+        if (!rdev->ops->get_station)
+                return NULL;
+
+        /* Grab BSSID of current BSS, if any */
+        wdev_lock(wdev);
+        if (!wdev->current_bss) {
+                wdev_unlock(wdev);
+                return NULL;
+        }
+        memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
+        wdev_unlock(wdev);
+
+        if (rdev->ops->get_station(&rdev->wiphy, dev, bssid, &sinfo))
+                return NULL;
+
+        memset(&wstats, 0, sizeof(wstats));
+
+        switch (rdev->wiphy.signal_type) {
+        case CFG80211_SIGNAL_TYPE_MBM:
+                if (sinfo.filled & STATION_INFO_SIGNAL) {
+                        int sig = sinfo.signal;
+                        wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
+                        wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
+                        wstats.qual.updated |= IW_QUAL_DBM;
+                        wstats.qual.level = sig;
+                        if (sig < -110)
+                                sig = -110;
+                        else if (sig > -40)
+                                sig = -40;
+                        wstats.qual.qual = sig + 110;
+                        break;
+                }
+        case CFG80211_SIGNAL_TYPE_UNSPEC:
+                if (sinfo.filled & STATION_INFO_SIGNAL) {
+                        wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
+                        wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
+                        wstats.qual.level = sinfo.signal;
+                        wstats.qual.qual = sinfo.signal;
+                        break;
+                }
+        default:
+                wstats.qual.updated |= IW_QUAL_LEVEL_INVALID;
+                wstats.qual.updated |= IW_QUAL_QUAL_INVALID;
+        }
+
+        wstats.qual.updated |= IW_QUAL_NOISE_INVALID;
+
+        return &wstats;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wireless_stats);
+
+int cfg80211_wext_siwap(struct net_device *dev,
+                        struct iw_request_info *info,
+                        struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_ADHOC:
+                return cfg80211_ibss_wext_siwap(dev, info, ap_addr, extra);
+        case NL80211_IFTYPE_STATION:
+                return cfg80211_mgd_wext_siwap(dev, info, ap_addr, extra);
+        case NL80211_IFTYPE_WDS:
+                return cfg80211_wds_wext_siwap(dev, info, ap_addr, extra);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwap);
+
+int cfg80211_wext_giwap(struct net_device *dev,
+                        struct iw_request_info *info,
+                        struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_ADHOC:
+                return cfg80211_ibss_wext_giwap(dev, info, ap_addr, extra);
+        case NL80211_IFTYPE_STATION:
+                return cfg80211_mgd_wext_giwap(dev, info, ap_addr, extra);
+        case NL80211_IFTYPE_WDS:
+                return cfg80211_wds_wext_giwap(dev, info, ap_addr, extra);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwap);
+
+int cfg80211_wext_siwessid(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_ADHOC:
+                return cfg80211_ibss_wext_siwessid(dev, info, data, ssid);
+        case NL80211_IFTYPE_STATION:
+                return cfg80211_mgd_wext_siwessid(dev, info, data, ssid);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwessid);
+
+int cfg80211_wext_giwessid(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_ADHOC:
+                return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);
+        case NL80211_IFTYPE_STATION:
+                return cfg80211_mgd_wext_giwessid(dev, info, data, ssid);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwessid);
+
+static const iw_handler cfg80211_handlers[] = {
+        [IW_IOCTL_IDX(SIOCGIWNAME)]     = (iw_handler) cfg80211_wext_giwname,
+        [IW_IOCTL_IDX(SIOCSIWFREQ)]     = (iw_handler) cfg80211_wext_siwfreq,
+        [IW_IOCTL_IDX(SIOCGIWFREQ)]     = (iw_handler) cfg80211_wext_giwfreq,
+        [IW_IOCTL_IDX(SIOCSIWMODE)]     = (iw_handler) cfg80211_wext_siwmode,
+        [IW_IOCTL_IDX(SIOCGIWMODE)]     = (iw_handler) cfg80211_wext_giwmode,
+        [IW_IOCTL_IDX(SIOCGIWRANGE)]    = (iw_handler) cfg80211_wext_giwrange,
+        [IW_IOCTL_IDX(SIOCSIWAP)]       = (iw_handler) cfg80211_wext_siwap,
+        [IW_IOCTL_IDX(SIOCGIWAP)]       = (iw_handler) cfg80211_wext_giwap,
+        [IW_IOCTL_IDX(SIOCSIWMLME)]     = (iw_handler) cfg80211_wext_siwmlme,
+        [IW_IOCTL_IDX(SIOCSIWSCAN)]     = (iw_handler) cfg80211_wext_siwscan,
+        [IW_IOCTL_IDX(SIOCGIWSCAN)]     = (iw_handler) cfg80211_wext_giwscan,
+        [IW_IOCTL_IDX(SIOCSIWESSID)]    = (iw_handler) cfg80211_wext_siwessid,
+        [IW_IOCTL_IDX(SIOCGIWESSID)]    = (iw_handler) cfg80211_wext_giwessid,
+        [IW_IOCTL_IDX(SIOCSIWRATE)]     = (iw_handler) cfg80211_wext_siwrate,
+        [IW_IOCTL_IDX(SIOCGIWRATE)]     = (iw_handler) cfg80211_wext_giwrate,
+        [IW_IOCTL_IDX(SIOCSIWRTS)]      = (iw_handler) cfg80211_wext_siwrts,
+        [IW_IOCTL_IDX(SIOCGIWRTS)]      = (iw_handler) cfg80211_wext_giwrts,
+        [IW_IOCTL_IDX(SIOCSIWFRAG)]     = (iw_handler) cfg80211_wext_siwfrag,
+        [IW_IOCTL_IDX(SIOCGIWFRAG)]     = (iw_handler) cfg80211_wext_giwfrag,
+        [IW_IOCTL_IDX(SIOCSIWTXPOW)]    = (iw_handler) cfg80211_wext_siwtxpower,
+        [IW_IOCTL_IDX(SIOCGIWTXPOW)]    = (iw_handler) cfg80211_wext_giwtxpower,
+        [IW_IOCTL_IDX(SIOCSIWRETRY)]    = (iw_handler) cfg80211_wext_siwretry,
+        [IW_IOCTL_IDX(SIOCGIWRETRY)]    = (iw_handler) cfg80211_wext_giwretry,
+        [IW_IOCTL_IDX(SIOCSIWENCODE)]   = (iw_handler) cfg80211_wext_siwencode,
+        [IW_IOCTL_IDX(SIOCGIWENCODE)]   = (iw_handler) cfg80211_wext_giwencode,
+        [IW_IOCTL_IDX(SIOCSIWPOWER)]    = (iw_handler) cfg80211_wext_siwpower,
+        [IW_IOCTL_IDX(SIOCGIWPOWER)]    = (iw_handler) cfg80211_wext_giwpower,
+        [IW_IOCTL_IDX(SIOCSIWGENIE)]    = (iw_handler) cfg80211_wext_siwgenie,
+        [IW_IOCTL_IDX(SIOCSIWAUTH)]     = (iw_handler) cfg80211_wext_siwauth,
+        [IW_IOCTL_IDX(SIOCGIWAUTH)]     = (iw_handler) cfg80211_wext_giwauth,
+        [IW_IOCTL_IDX(SIOCSIWENCODEEXT)]= (iw_handler) cfg80211_wext_siwencodeext,
+};
+
+const struct iw_handler_def cfg80211_wext_handler = {
+        .num_standard           = ARRAY_SIZE(cfg80211_handlers),
+        .standard               = cfg80211_handlers,
+        .get_wireless_stats = cfg80211_wireless_stats,
+};
diff --git a/net/wireless/wext-compat.h b/net/wireless/wext-compat.h
new file mode 100644
index 000000000000..20b3daef6964
--- /dev/null
+++ b/net/wireless/wext-compat.h
@@ -0,0 +1,49 @@
+#ifndef __WEXT_COMPAT
+#define __WEXT_COMPAT
+
+#include <net/iw_handler.h>
+#include <linux/wireless.h>
+
+int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_freq *freq, char *extra);
+int cfg80211_ibss_wext_giwfreq(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_freq *freq, char *extra);
+int cfg80211_ibss_wext_siwap(struct net_device *dev,
+                             struct iw_request_info *info,
+                             struct sockaddr *ap_addr, char *extra);
+int cfg80211_ibss_wext_giwap(struct net_device *dev,
+                             struct iw_request_info *info,
+                             struct sockaddr *ap_addr, char *extra);
+int cfg80211_ibss_wext_siwessid(struct net_device *dev,
+                                struct iw_request_info *info,
+                                struct iw_point *data, char *ssid);
+int cfg80211_ibss_wext_giwessid(struct net_device *dev,
+                                struct iw_request_info *info,
+                                struct iw_point *data, char *ssid);
+
+int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
+                              struct iw_request_info *info,
+                              struct iw_freq *freq, char *extra);
+int cfg80211_mgd_wext_giwfreq(struct net_device *dev,
+                              struct iw_request_info *info,
+                              struct iw_freq *freq, char *extra);
+int cfg80211_mgd_wext_siwap(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct sockaddr *ap_addr, char *extra);
+int cfg80211_mgd_wext_giwap(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct sockaddr *ap_addr, char *extra);
+int cfg80211_mgd_wext_siwessid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_point *data, char *ssid);
+int cfg80211_mgd_wext_giwessid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_point *data, char *ssid);
+
+int cfg80211_wext_freq(struct wiphy *wiphy, struct iw_freq *freq);
+
+
+extern const struct iw_handler_def cfg80211_wext_handler;
+#endif /* __WEXT_COMPAT */
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
new file mode 100644
index 000000000000..d16cd9ea4d00
--- /dev/null
+++ b/net/wireless/wext-sme.c
@@ -0,0 +1,404 @@
+/*
+ * cfg80211 wext compat for managed mode.
+ *
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ * Copyright (C) 2009   Intel Corporation. All rights reserved.
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <net/cfg80211.h>
+#include "wext-compat.h"
+#include "nl80211.h"
+
+int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev)
+{
+        struct cfg80211_cached_keys *ck = NULL;
+        const u8 *prev_bssid = NULL;
+        int err, i;
+
+        ASSERT_RDEV_LOCK(rdev);
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!netif_running(wdev->netdev))
+                return 0;
+
+        wdev->wext.connect.ie = wdev->wext.ie;
+        wdev->wext.connect.ie_len = wdev->wext.ie_len;
+        wdev->wext.connect.privacy = wdev->wext.default_key != -1;
+
+        if (wdev->wext.keys) {
+                wdev->wext.keys->def = wdev->wext.default_key;
+                wdev->wext.keys->defmgmt = wdev->wext.default_mgmt_key;
+        }
+
+        if (!wdev->wext.connect.ssid_len)
+                return 0;
+
+        if (wdev->wext.keys) {
+                ck = kmemdup(wdev->wext.keys, sizeof(*ck), GFP_KERNEL);
+                if (!ck)
+                        return -ENOMEM;
+                for (i = 0; i < 6; i++)
+                        ck->params[i].key = ck->data[i];
+        }
+
+        if (wdev->wext.prev_bssid_valid)
+                prev_bssid = wdev->wext.prev_bssid;
+
+        err = __cfg80211_connect(rdev, wdev->netdev,
+                                 &wdev->wext.connect, ck, prev_bssid);
+        if (err)
+                kfree(ck);
+
+        return err;
+}
+
+int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
+                              struct iw_request_info *info,
+                              struct iw_freq *wextfreq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct ieee80211_channel *chan = NULL;
+        int err, freq;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+        if (freq < 0)
+                return freq;
+
+        if (freq) {
+                chan = ieee80211_get_channel(wdev->wiphy, freq);
+                if (!chan)
+                        return -EINVAL;
+                if (chan->flags & IEEE80211_CHAN_DISABLED)
+                        return -EINVAL;
+        }
+
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
+        wdev_lock(wdev);
+
+        if (wdev->sme_state != CFG80211_SME_IDLE) {
+                bool event = true;
+
+                if (wdev->wext.connect.channel == chan) {
+                        err = 0;
+                        goto out;
+                }
+
+                /* if SSID set, we'll try right again, avoid event */
+                if (wdev->wext.connect.ssid_len)
+                        event = false;
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, event);
+                if (err)
+                        goto out;
+        }
+
+
+        wdev->wext.connect.channel = chan;
+
+        /* SSID is not set, we just want to switch channel */
+        if (chan && !wdev->wext.connect.ssid_len) {
+                err = rdev_set_freq(rdev, wdev, freq, NL80211_CHAN_NO_HT);
+                goto out;
+        }
+
+        err = cfg80211_mgd_wext_connect(rdev, wdev);
+ out:
+        wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
+        return err;
+}
+
+int cfg80211_mgd_wext_giwfreq(struct net_device *dev,
+                              struct iw_request_info *info,
+                              struct iw_freq *freq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan = NULL;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        wdev_lock(wdev);
+        if (wdev->current_bss)
+                chan = wdev->current_bss->pub.channel;
+        else if (wdev->wext.connect.channel)
+                chan = wdev->wext.connect.channel;
+        wdev_unlock(wdev);
+
+        if (chan) {
+                freq->m = chan->center_freq;
+                freq->e = 6;
+                return 0;
+        }
+
+        /* no channel if not joining */
+        return -EINVAL;
+}
+
+int cfg80211_mgd_wext_siwessid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        size_t len = data->length;
+        int err;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        if (!data->flags)
+                len = 0;
+
+        /* iwconfig uses nul termination in SSID.. */
+        if (len > 0 && ssid[len - 1] == '\0')
+                len--;
+
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
+        wdev_lock(wdev);
+
+        err = 0;
+
+        if (wdev->sme_state != CFG80211_SME_IDLE) {
+                bool event = true;
+
+                if (wdev->wext.connect.ssid && len &&
+                    len == wdev->wext.connect.ssid_len &&
+                    memcmp(wdev->wext.connect.ssid, ssid, len) == 0)
+                        goto out;
+
+                /* if SSID set now, we'll try to connect, avoid event */
+                if (len)
+                        event = false;
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, event);
+                if (err)
+                        goto out;
+        }
+
+        wdev->wext.prev_bssid_valid = false;
+        wdev->wext.connect.ssid = wdev->wext.ssid;
+        memcpy(wdev->wext.ssid, ssid, len);
+        wdev->wext.connect.ssid_len = len;
+
+        wdev->wext.connect.crypto.control_port = false;
+
+        err = cfg80211_mgd_wext_connect(rdev, wdev);
+ out:
+        wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
+        return err;
+}
+
+int cfg80211_mgd_wext_giwessid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        data->flags = 0;
+
+        wdev_lock(wdev);
+        if (wdev->current_bss) {
+                const u8 *ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
+                                                    WLAN_EID_SSID);
+                if (ie) {
+                        data->flags = 1;
+                        data->length = ie[1];
+                        memcpy(ssid, ie + 2, data->length);
+                }
+        } else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
+                data->flags = 1;
+                data->length = wdev->wext.connect.ssid_len;
+                memcpy(ssid, wdev->wext.connect.ssid, data->length);
+        } else
+                data->flags = 0;
+        wdev_unlock(wdev);
+
+        return 0;
+}
+
+int cfg80211_mgd_wext_siwap(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u8 *bssid = ap_addr->sa_data;
+        int err;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        if (ap_addr->sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+
+        /* automatic mode */
+        if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid))
+                bssid = NULL;
+
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
+        wdev_lock(wdev);
+
+        if (wdev->sme_state != CFG80211_SME_IDLE) {
+                err = 0;
+                /* both automatic */
+                if (!bssid && !wdev->wext.connect.bssid)
+                        goto out;
+
+                /* fixed already - and no change */
+                if (wdev->wext.connect.bssid && bssid &&
+                    compare_ether_addr(bssid, wdev->wext.connect.bssid) == 0)
+                        goto out;
+
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, false);
+                if (err)
+                        goto out;
+        }
+
+        if (bssid) {
+                memcpy(wdev->wext.bssid, bssid, ETH_ALEN);
+                wdev->wext.connect.bssid = wdev->wext.bssid;
+        } else
+                wdev->wext.connect.bssid = NULL;
+
+        err = cfg80211_mgd_wext_connect(rdev, wdev);
+ out:
+        wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
+        return err;
+}
+
+int cfg80211_mgd_wext_giwap(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        ap_addr->sa_family = ARPHRD_ETHER;
+
+        wdev_lock(wdev);
+        if (wdev->current_bss)
+                memcpy(ap_addr->sa_data, wdev->current_bss->pub.bssid, ETH_ALEN);
+        else if (wdev->wext.connect.bssid)
+                memcpy(ap_addr->sa_data, wdev->wext.connect.bssid, ETH_ALEN);
+        else
+                memset(ap_addr->sa_data, 0, ETH_ALEN);
+        wdev_unlock(wdev);
+
+        return 0;
+}
+
+int cfg80211_wext_siwgenie(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u8 *ie = extra;
+        int ie_len = data->length, err;
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        if (!ie_len)
+                ie = NULL;
+
+        wdev_lock(wdev);
+
+        /* no change */
+        err = 0;
+        if (wdev->wext.ie_len == ie_len &&
+            memcmp(wdev->wext.ie, ie, ie_len) == 0)
+                goto out;
+
+        if (ie_len) {
+                ie = kmemdup(extra, ie_len, GFP_KERNEL);
+                if (!ie) {
+                        err = -ENOMEM;
+                        goto out;
+                }
+        } else
+                ie = NULL;
+
+        kfree(wdev->wext.ie);
+        wdev->wext.ie = ie;
+        wdev->wext.ie_len = ie_len;
+
+        if (wdev->sme_state != CFG80211_SME_IDLE) {
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, false);
+                if (err)
+                        goto out;
+        }
+
+        /* userspace better not think we'll reconnect */
+        err = 0;
+ out:
+        wdev_unlock(wdev);
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwgenie);
+
+int cfg80211_wext_siwmlme(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_point *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct iw_mlme *mlme = (struct iw_mlme *)extra;
+        struct cfg80211_registered_device *rdev;
+        int err;
+
+        if (!wdev)
+                return -EOPNOTSUPP;
+
+        rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+        if (mlme->addr.sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+
+        wdev_lock(wdev);
+        switch (mlme->cmd) {
+        case IW_MLME_DEAUTH:
+        case IW_MLME_DISASSOC:
+                err = __cfg80211_disconnect(rdev, dev, mlme->reason_code,
+                                            true);
+                break;
+        default:
+                err = -EOPNOTSUPP;
+                break;
+        }
+        wdev_unlock(wdev);
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwmlme);
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 252c2010c2e2..5b4a0cee4418 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -417,6 +417,21 @@ static const int event_type_size[] = {
         IW_EV_QUAL_LEN,                 /* IW_HEADER_TYPE_QUAL */
 };
 
+#ifdef CONFIG_COMPAT
+static const int compat_event_type_size[] = {
+        IW_EV_COMPAT_LCP_LEN,           /* IW_HEADER_TYPE_NULL */
+        0,
+        IW_EV_COMPAT_CHAR_LEN,          /* IW_HEADER_TYPE_CHAR */
+        0,
+        IW_EV_COMPAT_UINT_LEN,          /* IW_HEADER_TYPE_UINT */
+        IW_EV_COMPAT_FREQ_LEN,          /* IW_HEADER_TYPE_FREQ */
+        IW_EV_COMPAT_ADDR_LEN,          /* IW_HEADER_TYPE_ADDR */
+        0,
+        IW_EV_COMPAT_POINT_LEN,         /* Without variable payload */
+        IW_EV_COMPAT_PARAM_LEN,         /* IW_HEADER_TYPE_PARAM */
+        IW_EV_COMPAT_QUAL_LEN,          /* IW_HEADER_TYPE_QUAL */
+};
+#endif
 
 /************************ COMMON SUBROUTINES ************************/
 /*
@@ -610,6 +625,11 @@ static void wireless_seq_printf_stats(struct seq_file *seq,
 {
         /* Get stats from the driver */
         struct iw_statistics *stats = get_wireless_stats(dev);
+        static struct iw_statistics nullstats = {};
+
+        /* show device if it's wireless regardless of current stats */
+        if (!stats && dev->wireless_handlers)
+                stats = &nullstats;
 
         if (stats) {
                 seq_printf(seq, "%6s: %04x  %3d%c  %3d%c  %3d%c  %6d %6d %6d "
@@ -628,7 +648,9 @@ static void wireless_seq_printf_stats(struct seq_file *seq,
                            stats->discard.nwid, stats->discard.code,
                            stats->discard.fragment, stats->discard.retries,
                            stats->discard.misc, stats->miss.beacon);
-                stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+
+                if (stats != &nullstats)
+                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
         }
 }
 
@@ -1250,65 +1272,57 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
 }
 #endif
 
-/************************* EVENT PROCESSING *************************/
-/*
- * Process events generated by the wireless layer or the driver.
- * Most often, the event will be propagated through rtnetlink
- */
+static int __net_init wext_pernet_init(struct net *net)
+{
+        skb_queue_head_init(&net->wext_nlevents);
+        return 0;
+}
 
-/* ---------------------------------------------------------------- */
-/*
- * Locking...
- * ----------
- *
- * Thanks to Herbert Xu <herbert@gondor.apana.org.au> for fixing
- * the locking issue in here and implementing this code !
- *
- * The issue : wireless_send_event() is often called in interrupt context,
- * while the Netlink layer can never be called in interrupt context.
- * The fully formed RtNetlink events are queued, and then a tasklet is run
- * to feed those to Netlink.
- * The skb_queue is interrupt safe, and its lock is not held while calling
- * Netlink, so there is no possibility of dealock.
- * Jean II
- */
+static void __net_exit wext_pernet_exit(struct net *net)
+{
+        skb_queue_purge(&net->wext_nlevents);
+}
 
-static struct sk_buff_head wireless_nlevent_queue;
+static struct pernet_operations wext_pernet_ops = {
+        .init = wext_pernet_init,
+        .exit = wext_pernet_exit,
+};
 
 static int __init wireless_nlevent_init(void)
 {
-        skb_queue_head_init(&wireless_nlevent_queue);
-        return 0;
+        return register_pernet_subsys(&wext_pernet_ops);
 }
 
 subsys_initcall(wireless_nlevent_init);
 
-static void wireless_nlevent_process(unsigned long data)
+/* Process events generated by the wireless layer or the driver. */
+static void wireless_nlevent_process(struct work_struct *work)
 {
         struct sk_buff *skb;
+        struct net *net;
 
-        while ((skb = skb_dequeue(&wireless_nlevent_queue)))
-                rtnl_notify(skb, &init_net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
+        rtnl_lock();
+
+        for_each_net(net) {
+                while ((skb = skb_dequeue(&net->wext_nlevents)))
+                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
+                                    GFP_KERNEL);
+        }
+
+        rtnl_unlock();
 }
 
-static DECLARE_TASKLET(wireless_nlevent_tasklet, wireless_nlevent_process, 0);
+static DECLARE_WORK(wireless_nlevent_work, wireless_nlevent_process);
 
-/* ---------------------------------------------------------------- */
-/*
- * Fill a rtnetlink message with our event data.
- * Note that we propage only the specified event and don't dump the
- * current wireless config. Dumping the wireless config is far too
- * expensive (for each parameter, the driver need to query the hardware).
- */
-static int rtnetlink_fill_iwinfo(struct sk_buff *skb, struct net_device *dev,
-                                 int type, char *event, int event_len)
+static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev,
+                                              struct sk_buff *skb)
 {
         struct ifinfomsg *r;
         struct nlmsghdr  *nlh;
 
-        nlh = nlmsg_put(skb, 0, 0, type, sizeof(*r), 0);
-        if (nlh == NULL)
-                return -EMSGSIZE;
+        nlh = nlmsg_put(skb, 0, 0, RTM_NEWLINK, sizeof(*r), 0);
+        if (!nlh)
+                return NULL;
 
         r = nlmsg_data(nlh);
         r->ifi_family = AF_UNSPEC;
@@ -1319,48 +1333,14 @@ static int rtnetlink_fill_iwinfo(struct sk_buff *skb, struct net_device *dev,
         r->ifi_change = 0;      /* Wireless changes don't affect those flags */
 
         NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
-        /* Add the wireless events in the netlink packet */
-        NLA_PUT(skb, IFLA_WIRELESS, event_len, event);
 
-        return nlmsg_end(skb, nlh);
-
-nla_put_failure:
+        return nlh;
+ nla_put_failure:
         nlmsg_cancel(skb, nlh);
-        return -EMSGSIZE;
+        return NULL;
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Create and broadcast and send it on the standard rtnetlink socket
- * This is a pure clone rtmsg_ifinfo() in net/core/rtnetlink.c
- * Andrzej Krzysztofowicz mandated that I used a IFLA_XXX field
- * within a RTM_NEWLINK event.
- */
-static void rtmsg_iwinfo(struct net_device *dev, char *event, int event_len)
-{
-        struct sk_buff *skb;
-        int err;
-
-        if (!net_eq(dev_net(dev), &init_net))
-                return;
-
-        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
-        if (!skb)
-                return;
 
-        err = rtnetlink_fill_iwinfo(skb, dev, RTM_NEWLINK, event, event_len);
-        if (err < 0) {
-                WARN_ON(err == -EMSGSIZE);
-                kfree_skb(skb);
-                return;
-        }
-
-        NETLINK_CB(skb).dst_group = RTNLGRP_LINK;
-        skb_queue_tail(&wireless_nlevent_queue, skb);
-        tasklet_schedule(&wireless_nlevent_tasklet);
-}
-
-/* ---------------------------------------------------------------- */
 /*
  * Main event dispatcher. Called from other parts and drivers.
  * Send the event on the appropriate channels.
@@ -1369,7 +1349,7 @@ static void rtmsg_iwinfo(struct net_device *dev, char *event, int event_len)
 void wireless_send_event(struct net_device *    dev,
                          unsigned int           cmd,
                          union iwreq_data *     wrqu,
-                         char *                 extra)
+                         const char *           extra)
 {
         const struct iw_ioctl_description *     descr = NULL;
         int extra_len = 0;
@@ -1379,6 +1359,25 @@ void wireless_send_event(struct net_device *	dev,
         int wrqu_off = 0;                       /* Offset in wrqu */
         /* Don't "optimise" the following variable, it will crash */
         unsigned        cmd_index;              /* *MUST* be unsigned */
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+        struct nlattr *nla;
+#ifdef CONFIG_COMPAT
+        struct __compat_iw_event *compat_event;
+        struct compat_iw_point compat_wrqu;
+        struct sk_buff *compskb;
+#endif
+
+        /*
+         * Nothing in the kernel sends scan events with data, be safe.
+         * This is necessary because we cannot fix up scan event data
+         * for compat, due to being contained in 'extra', but normally
+         * applications are required to retrieve the scan data anyway
+         * and no data is included in the event, this codifies that
+         * practice.
+         */
+        if (WARN_ON(cmd == SIOCGIWSCAN && extra))
+                extra = NULL;
 
         /* Get the description of the Event */
         if (cmd <= SIOCIWLAST) {
@@ -1426,25 +1425,107 @@ void wireless_send_event(struct net_device *	dev,
         hdr_len = event_type_size[descr->header_type];
         event_len = hdr_len + extra_len;
 
-        /* Create temporary buffer to hold the event */
-        event = kmalloc(event_len, GFP_ATOMIC);
-        if (event == NULL)
+        /*
+         * The problem for 64/32 bit.
+         *
+         * On 64-bit, a regular event is laid out as follows:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | wrqu data ... (with the correct size)         |
+         *
+         * This padding exists because we manipulate event->u,
+         * and 'event' is not packed.
+         *
+         * An iw_point event is laid out like this instead:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | iwpnt.len | iwpnt.flg |     p a d d i n g     |
+         *      | extra data  ...
+         *
+         * The second padding exists because struct iw_point is extended,
+         * but this depends on the platform...
+         *
+         * On 32-bit, all the padding shouldn't be there.
+         */
+
+        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!skb)
+                return;
+
+        /* Send via the RtNetlink event channel */
+        nlh = rtnetlink_ifinfo_prep(dev, skb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                return;
+        }
+
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(skb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
                 return;
+        }
+        event = nla_data(nla);
 
-        /* Fill event */
+        /* Fill event - first clear to avoid data leaking */
+        memset(event, 0, hdr_len);
         event->len = event_len;
         event->cmd = cmd;
         memcpy(&event->u, ((char *) wrqu) + wrqu_off, hdr_len - IW_EV_LCP_LEN);
-        if (extra)
+        if (extra_len)
                 memcpy(((char *) event) + hdr_len, extra, extra_len);
 
+        nlmsg_end(skb, nlh);
+#ifdef CONFIG_COMPAT
+        hdr_len = compat_event_type_size[descr->header_type];
+        event_len = hdr_len + extra_len;
+
+        compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!compskb) {
+                kfree_skb(skb);
+                return;
+        }
+
         /* Send via the RtNetlink event channel */
-        rtmsg_iwinfo(dev, (char *) event, event_len);
+        nlh = rtnetlink_ifinfo_prep(dev, compskb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
 
-        /* Cleanup */
-        kfree(event);
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(compskb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
+        compat_event = nla_data(nla);
 
-        return;         /* Always success, I guess ;-) */
+        compat_event->len = event_len;
+        compat_event->cmd = cmd;
+        if (descr->header_type == IW_HEADER_TYPE_POINT) {
+                compat_wrqu.length = wrqu->data.length;
+                compat_wrqu.flags = wrqu->data.flags;
+                memcpy(&compat_event->pointer,
+                        ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+                if (extra_len)
+                        memcpy(((char *) compat_event) + hdr_len,
+                                extra, extra_len);
+        } else {
+                /* extra_len must be zero, so no if (extra) needed */
+                memcpy(&compat_event->pointer, wrqu,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+        }
+
+        nlmsg_end(compskb, nlh);
+
+        skb_shinfo(skb)->frag_list = compskb;
+#endif
+        skb_queue_tail(&dev_net(dev)->wext_nlevents, skb);
+        schedule_work(&wireless_nlevent_work);
 }
 EXPORT_SYMBOL(wireless_send_event);