83 files changed, 4065 insertions, 2176 deletions

diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c
index 142eef55c9e2..73a7065f0c6b 100644
--- a/net/6lowpan/iphc.c
+++ b/net/6lowpan/iphc.c
@@ -171,37 +171,6 @@ static int uncompress_context_based_src_addr(struct sk_buff *skb,
         return 0;
 }
 
-static int skb_deliver(struct sk_buff *skb, struct ipv6hdr *hdr,
-                       struct net_device *dev, skb_delivery_cb deliver_skb)
-{
-        struct sk_buff *new;
-        int stat;
-
-        new = skb_copy_expand(skb, sizeof(struct ipv6hdr), skb_tailroom(skb),
-                              GFP_ATOMIC);
-        kfree_skb(skb);
-
-        if (!new)
-                return -ENOMEM;
-
-        skb_push(new, sizeof(struct ipv6hdr));
-        skb_reset_network_header(new);
-        skb_copy_to_linear_data(new, hdr, sizeof(struct ipv6hdr));
-
-        new->protocol = htons(ETH_P_IPV6);
-        new->pkt_type = PACKET_HOST;
-        new->dev = dev;
-
-        raw_dump_table(__func__, "raw skb data dump before receiving",
-                       new->data, new->len);
-
-        stat = deliver_skb(new, dev);
-
-        kfree_skb(new);
-
-        return stat;
-}
-
 /* Uncompress function for multicast destination address,
  * when M bit is set.
  */
@@ -332,10 +301,12 @@ err:
 /* TTL uncompression values */
 static const u8 lowpan_ttl_values[] = { 0, 1, 64, 255 };
 
-int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
-                        const u8 *saddr, const u8 saddr_type, const u8 saddr_len,
-                        const u8 *daddr, const u8 daddr_type, const u8 daddr_len,
-                        u8 iphc0, u8 iphc1, skb_delivery_cb deliver_skb)
+int
+lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
+                         const u8 *saddr, const u8 saddr_type,
+                         const u8 saddr_len, const u8 *daddr,
+                         const u8 daddr_type, const u8 daddr_len,
+                         u8 iphc0, u8 iphc1)
 {
         struct ipv6hdr hdr = {};
         u8 tmp, num_context = 0;
@@ -460,7 +431,7 @@ int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
         /* UDP data uncompression */
         if (iphc0 & LOWPAN_IPHC_NH_C) {
                 struct udphdr uh;
-                struct sk_buff *new;
+                const int needed = sizeof(struct udphdr) + sizeof(hdr);
 
                 if (uncompress_udp_header(skb, &uh))
                         goto drop;
@@ -468,14 +439,11 @@ int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
                 /* replace the compressed UDP head by the uncompressed UDP
                  * header
                  */
-                new = skb_copy_expand(skb, sizeof(struct udphdr),
-                                      skb_tailroom(skb), GFP_ATOMIC);
-                kfree_skb(skb);
-
-                if (!new)
-                        return -ENOMEM;
-
-                skb = new;
+                err = skb_cow(skb, needed);
+                if (unlikely(err)) {
+                        kfree_skb(skb);
+                        return err;
+                }
 
                 skb_push(skb, sizeof(struct udphdr));
                 skb_reset_transport_header(skb);
@@ -485,6 +453,12 @@ int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
                                (u8 *)&uh, sizeof(uh));
 
                 hdr.nexthdr = UIP_PROTO_UDP;
+        } else {
+                err = skb_cow(skb, sizeof(hdr));
+                if (unlikely(err)) {
+                        kfree_skb(skb);
+                        return err;
+                }
         }
 
         hdr.payload_len = htons(skb->len);
@@ -497,15 +471,18 @@ int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
                 hdr.version, ntohs(hdr.payload_len), hdr.nexthdr,
                 hdr.hop_limit, &hdr.daddr);
 
-        raw_dump_table(__func__, "raw header dump", (u8 *)&hdr, sizeof(hdr));
+        skb_push(skb, sizeof(hdr));
+        skb_reset_network_header(skb);
+        skb_copy_to_linear_data(skb, &hdr, sizeof(hdr));
 
-        return skb_deliver(skb, &hdr, dev, deliver_skb);
+        raw_dump_table(__func__, "raw header dump", (u8 *)&hdr, sizeof(hdr));
 
+        return 0;
 drop:
         kfree_skb(skb);
         return -EINVAL;
 }
-EXPORT_SYMBOL_GPL(lowpan_process_data);
+EXPORT_SYMBOL_GPL(lowpan_header_decompress);
 
 static u8 lowpan_compress_addr_64(u8 **hc_ptr, u8 shift,
                                   const struct in6_addr *ipaddr,
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index c2e0d14433df..eef298d17452 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -53,7 +53,7 @@ struct skb_cb {
  * The list contains struct lowpan_dev elements.
  */
 static LIST_HEAD(bt_6lowpan_devices);
-static DEFINE_RWLOCK(devices_lock);
+static DEFINE_SPINLOCK(devices_lock);
 
 /* If psm is set to 0 (default value), then 6lowpan is disabled.
  * Other values are used to indicate a Protocol Service Multiplexer
@@ -67,6 +67,7 @@ static struct l2cap_chan *listen_chan;
 
 struct lowpan_peer {
         struct list_head list;
+        struct rcu_head rcu;
         struct l2cap_chan *chan;
 
         /* peer addresses in various formats */
@@ -86,6 +87,13 @@ struct lowpan_dev {
         struct delayed_work notify_peers;
 };
 
+static inline void peer_free(struct rcu_head *head)
+{
+        struct lowpan_peer *e = container_of(head, struct lowpan_peer, rcu);
+
+        kfree(e);
+}
+
 static inline struct lowpan_dev *lowpan_dev(const struct net_device *netdev)
 {
         return netdev_priv(netdev);
@@ -93,13 +101,14 @@ static inline struct lowpan_dev *lowpan_dev(const struct net_device *netdev)
 
 static inline void peer_add(struct lowpan_dev *dev, struct lowpan_peer *peer)
 {
-        list_add(&peer->list, &dev->peers);
+        list_add_rcu(&peer->list, &dev->peers);
         atomic_inc(&dev->peer_count);
 }
 
 static inline bool peer_del(struct lowpan_dev *dev, struct lowpan_peer *peer)
 {
-        list_del(&peer->list);
+        list_del_rcu(&peer->list);
+        call_rcu(&peer->rcu, peer_free);
 
         module_put(THIS_MODULE);
 
@@ -114,31 +123,37 @@ static inline bool peer_del(struct lowpan_dev *dev, struct lowpan_peer *peer)
 static inline struct lowpan_peer *peer_lookup_ba(struct lowpan_dev *dev,
                                                  bdaddr_t *ba, __u8 type)
 {
-        struct lowpan_peer *peer, *tmp;
+        struct lowpan_peer *peer;
 
         BT_DBG("peers %d addr %pMR type %d", atomic_read(&dev->peer_count),
                ba, type);
 
-        list_for_each_entry_safe(peer, tmp, &dev->peers, list) {
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(peer, &dev->peers, list) {
                 BT_DBG("dst addr %pMR dst type %d",
                        &peer->chan->dst, peer->chan->dst_type);
 
                 if (bacmp(&peer->chan->dst, ba))
                         continue;
 
-                if (type == peer->chan->dst_type)
+                if (type == peer->chan->dst_type) {
+                        rcu_read_unlock();
                         return peer;
+                }
         }
 
+        rcu_read_unlock();
+
         return NULL;
 }
 
-static inline struct lowpan_peer *peer_lookup_chan(struct lowpan_dev *dev,
-                                                   struct l2cap_chan *chan)
+static inline struct lowpan_peer *__peer_lookup_chan(struct lowpan_dev *dev,
+                                                     struct l2cap_chan *chan)
 {
-        struct lowpan_peer *peer, *tmp;
+        struct lowpan_peer *peer;
 
-        list_for_each_entry_safe(peer, tmp, &dev->peers, list) {
+        list_for_each_entry_rcu(peer, &dev->peers, list) {
                 if (peer->chan == chan)
                         return peer;
         }
@@ -146,12 +161,12 @@ static inline struct lowpan_peer *peer_lookup_chan(struct lowpan_dev *dev,
         return NULL;
 }
 
-static inline struct lowpan_peer *peer_lookup_conn(struct lowpan_dev *dev,
-                                                   struct l2cap_conn *conn)
+static inline struct lowpan_peer *__peer_lookup_conn(struct lowpan_dev *dev,
+                                                     struct l2cap_conn *conn)
 {
-        struct lowpan_peer *peer, *tmp;
+        struct lowpan_peer *peer;
 
-        list_for_each_entry_safe(peer, tmp, &dev->peers, list) {
+        list_for_each_entry_rcu(peer, &dev->peers, list) {
                 if (peer->chan->conn == conn)
                         return peer;
         }
@@ -163,7 +178,7 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_dev *dev,
                                                   struct in6_addr *daddr,
                                                   struct sk_buff *skb)
 {
-        struct lowpan_peer *peer, *tmp;
+        struct lowpan_peer *peer;
         struct in6_addr *nexthop;
         struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
         int count = atomic_read(&dev->peer_count);
@@ -174,9 +189,13 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_dev *dev,
          * send the packet. If only one peer exists, then we can send the
          * packet right away.
          */
-        if (count == 1)
-                return list_first_entry(&dev->peers, struct lowpan_peer,
-                                        list);
+        if (count == 1) {
+                rcu_read_lock();
+                peer = list_first_or_null_rcu(&dev->peers, struct lowpan_peer,
+                                              list);
+                rcu_read_unlock();
+                return peer;
+        }
 
         if (!rt) {
                 nexthop = &lowpan_cb(skb)->gw;
@@ -195,53 +214,57 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_dev *dev,
 
         BT_DBG("gw %pI6c", nexthop);
 
-        list_for_each_entry_safe(peer, tmp, &dev->peers, list) {
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(peer, &dev->peers, list) {
                 BT_DBG("dst addr %pMR dst type %d ip %pI6c",
                        &peer->chan->dst, peer->chan->dst_type,
                        &peer->peer_addr);
 
-                if (!ipv6_addr_cmp(&peer->peer_addr, nexthop))
+                if (!ipv6_addr_cmp(&peer->peer_addr, nexthop)) {
+                        rcu_read_unlock();
                         return peer;
+                }
         }
 
+        rcu_read_unlock();
+
         return NULL;
 }
 
 static struct lowpan_peer *lookup_peer(struct l2cap_conn *conn)
 {
-        struct lowpan_dev *entry, *tmp;
+        struct lowpan_dev *entry;
         struct lowpan_peer *peer = NULL;
-        unsigned long flags;
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
-                peer = peer_lookup_conn(entry, conn);
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+                peer = __peer_lookup_conn(entry, conn);
                 if (peer)
                         break;
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
         return peer;
 }
 
 static struct lowpan_dev *lookup_dev(struct l2cap_conn *conn)
 {
-        struct lowpan_dev *entry, *tmp;
+        struct lowpan_dev *entry;
         struct lowpan_dev *dev = NULL;
-        unsigned long flags;
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
                 if (conn->hcon->hdev == entry->hdev) {
                         dev = entry;
                         break;
                 }
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
         return dev;
 }
@@ -249,35 +272,27 @@ static struct lowpan_dev *lookup_dev(struct l2cap_conn *conn)
 static int give_skb_to_upper(struct sk_buff *skb, struct net_device *dev)
 {
         struct sk_buff *skb_cp;
-        int ret;
 
         skb_cp = skb_copy(skb, GFP_ATOMIC);
         if (!skb_cp)
-                return -ENOMEM;
-
-        ret = netif_rx(skb_cp);
-        if (ret < 0) {
-                BT_DBG("receive skb %d", ret);
                 return NET_RX_DROP;
-        }
 
-        return ret;
+        return netif_rx(skb_cp);
 }
 
-static int process_data(struct sk_buff *skb, struct net_device *netdev,
-                        struct l2cap_chan *chan)
+static int iphc_decompress(struct sk_buff *skb, struct net_device *netdev,
+                           struct l2cap_chan *chan)
 {
         const u8 *saddr, *daddr;
         u8 iphc0, iphc1;
         struct lowpan_dev *dev;
         struct lowpan_peer *peer;
-        unsigned long flags;
 
         dev = lowpan_dev(netdev);
 
-        read_lock_irqsave(&devices_lock, flags);
-        peer = peer_lookup_chan(dev, chan);
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_lock();
+        peer = __peer_lookup_chan(dev, chan);
+        rcu_read_unlock();
         if (!peer)
                 goto drop;
 
@@ -294,10 +309,11 @@ static int process_data(struct sk_buff *skb, struct net_device *netdev,
         if (lowpan_fetch_skb_u8(skb, &iphc1))
                 goto drop;
 
-        return lowpan_process_data(skb, netdev,
-                                   saddr, IEEE802154_ADDR_LONG, EUI64_ADDR_LEN,
-                                   daddr, IEEE802154_ADDR_LONG, EUI64_ADDR_LEN,
-                                   iphc0, iphc1, give_skb_to_upper);
+        return lowpan_header_decompress(skb, netdev,
+                                        saddr, IEEE802154_ADDR_LONG,
+                                        EUI64_ADDR_LEN, daddr,
+                                        IEEE802154_ADDR_LONG, EUI64_ADDR_LEN,
+                                        iphc0, iphc1);
 
 drop:
         kfree_skb(skb);
@@ -316,6 +332,10 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
         if (dev->type != ARPHRD_6LOWPAN)
                 goto drop;
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto drop;
+
         /* check that it's our buffer */
         if (skb->data[0] == LOWPAN_DISPATCH_IPV6) {
                 /* Copy the packet so that the IPv6 header is
@@ -340,8 +360,8 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
                 dev->stats.rx_bytes += skb->len;
                 dev->stats.rx_packets++;
 
-                kfree_skb(local_skb);
-                kfree_skb(skb);
+                consume_skb(local_skb);
+                consume_skb(skb);
         } else {
                 switch (skb->data[0] & 0xe0) {
                 case LOWPAN_DISPATCH_IPHC:      /* ipv6 datagram */
@@ -349,14 +369,25 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
                         if (!local_skb)
                                 goto drop;
 
-                        ret = process_data(local_skb, dev, chan);
-                        if (ret != NET_RX_SUCCESS)
+                        ret = iphc_decompress(local_skb, dev, chan);
+                        if (ret < 0)
                                 goto drop;
 
+                        local_skb->protocol = htons(ETH_P_IPV6);
+                        local_skb->pkt_type = PACKET_HOST;
+                        local_skb->dev = dev;
+
+                        if (give_skb_to_upper(local_skb, dev)
+                                        != NET_RX_SUCCESS) {
+                                kfree_skb(local_skb);
+                                goto drop;
+                        }
+
                         dev->stats.rx_bytes += skb->len;
                         dev->stats.rx_packets++;
 
-                        kfree_skb(skb);
+                        consume_skb(local_skb);
+                        consume_skb(skb);
                         break;
                 default:
                         break;
@@ -443,7 +474,6 @@ static int setup_header(struct sk_buff *skb, struct net_device *netdev,
         if (ipv6_addr_is_multicast(&ipv6_daddr)) {
                 lowpan_cb(skb)->chan = NULL;
         } else {
-                unsigned long flags;
                 u8 addr_type;
 
                 /* Get destination BT device from skb.
@@ -454,19 +484,14 @@ static int setup_header(struct sk_buff *skb, struct net_device *netdev,
                 BT_DBG("dest addr %pMR type %d IP %pI6c", &addr,
                        addr_type, &ipv6_daddr);
 
-                read_lock_irqsave(&devices_lock, flags);
                 peer = peer_lookup_ba(dev, &addr, addr_type);
-                read_unlock_irqrestore(&devices_lock, flags);
-
                 if (!peer) {
                         /* The packet might be sent to 6lowpan interface
                          * because of routing (either via default route
                          * or user set route) so get peer according to
                          * the destination address.
                          */
-                        read_lock_irqsave(&devices_lock, flags);
                         peer = peer_lookup_dst(dev, &ipv6_daddr, skb);
-                        read_unlock_irqrestore(&devices_lock, flags);
                         if (!peer) {
                                 BT_DBG("no such peer %pMR found", &addr);
                                 return -ENOENT;
@@ -549,14 +574,13 @@ static int send_pkt(struct l2cap_chan *chan, struct sk_buff *skb,
 static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
 {
         struct sk_buff *local_skb;
-        struct lowpan_dev *entry, *tmp;
-        unsigned long flags;
+        struct lowpan_dev *entry;
         int err = 0;
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
-                struct lowpan_peer *pentry, *ptmp;
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+                struct lowpan_peer *pentry;
                 struct lowpan_dev *dev;
 
                 if (entry->netdev != netdev)
@@ -564,7 +588,7 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
 
                 dev = lowpan_dev(entry->netdev);
 
-                list_for_each_entry_safe(pentry, ptmp, &dev->peers, list) {
+                list_for_each_entry_rcu(pentry, &dev->peers, list) {
                         int ret;
 
                         local_skb = skb_clone(skb, GFP_ATOMIC);
@@ -581,7 +605,7 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
                 }
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
         return err;
 }
@@ -638,7 +662,26 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
         return err < 0 ? NET_XMIT_DROP : err;
 }
 
+static struct lock_class_key bt_tx_busylock;
+static struct lock_class_key bt_netdev_xmit_lock_key;
+
+static void bt_set_lockdep_class_one(struct net_device *dev,
+                                     struct netdev_queue *txq,
+                                     void *_unused)
+{
+        lockdep_set_class(&txq->_xmit_lock, &bt_netdev_xmit_lock_key);
+}
+
+static int bt_dev_init(struct net_device *dev)
+{
+        netdev_for_each_tx_queue(dev, bt_set_lockdep_class_one, NULL);
+        dev->qdisc_tx_busylock = &bt_tx_busylock;
+
+        return 0;
+}
+
 static const struct net_device_ops netdev_ops = {
+        .ndo_init               = bt_dev_init,
         .ndo_start_xmit         = bt_xmit,
 };
 
@@ -783,7 +826,6 @@ static struct l2cap_chan *add_peer_chan(struct l2cap_chan *chan,
                                         struct lowpan_dev *dev)
 {
         struct lowpan_peer *peer;
-        unsigned long flags;
 
         peer = kzalloc(sizeof(*peer), GFP_ATOMIC);
         if (!peer)
@@ -806,10 +848,10 @@ static struct l2cap_chan *add_peer_chan(struct l2cap_chan *chan,
          */
         set_ip_addr_bits(chan->dst_type, (u8 *)&peer->peer_addr.s6_addr + 8);
 
-        write_lock_irqsave(&devices_lock, flags);
+        spin_lock(&devices_lock);
         INIT_LIST_HEAD(&peer->list);
         peer_add(dev, peer);
-        write_unlock_irqrestore(&devices_lock, flags);
+        spin_unlock(&devices_lock);
 
         /* Notifying peers about us needs to be done without locks held */
         INIT_DELAYED_WORK(&dev->notify_peers, do_notify_peers);
@@ -822,7 +864,6 @@ static int setup_netdev(struct l2cap_chan *chan, struct lowpan_dev **dev)
 {
         struct net_device *netdev;
         int err = 0;
-        unsigned long flags;
 
         netdev = alloc_netdev(sizeof(struct lowpan_dev), IFACE_NAME_TEMPLATE,
                               NET_NAME_UNKNOWN, netdev_setup);
@@ -852,10 +893,10 @@ static int setup_netdev(struct l2cap_chan *chan, struct lowpan_dev **dev)
         (*dev)->hdev = chan->conn->hcon->hdev;
         INIT_LIST_HEAD(&(*dev)->peers);
 
-        write_lock_irqsave(&devices_lock, flags);
+        spin_lock(&devices_lock);
         INIT_LIST_HEAD(&(*dev)->list);
-        list_add(&(*dev)->list, &bt_6lowpan_devices);
-        write_unlock_irqrestore(&devices_lock, flags);
+        list_add_rcu(&(*dev)->list, &bt_6lowpan_devices);
+        spin_unlock(&devices_lock);
 
         return 0;
 
@@ -909,11 +950,10 @@ static void delete_netdev(struct work_struct *work)
 
 static void chan_close_cb(struct l2cap_chan *chan)
 {
-        struct lowpan_dev *entry, *tmp;
+        struct lowpan_dev *entry;
         struct lowpan_dev *dev = NULL;
         struct lowpan_peer *peer;
         int err = -ENOENT;
-        unsigned long flags;
         bool last = false, removed = true;
 
         BT_DBG("chan %p conn %p", chan, chan->conn);
@@ -928,11 +968,11 @@ static void chan_close_cb(struct l2cap_chan *chan)
                 removed = false;
         }
 
-        write_lock_irqsave(&devices_lock, flags);
+        spin_lock(&devices_lock);
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
                 dev = lowpan_dev(entry->netdev);
-                peer = peer_lookup_chan(dev, chan);
+                peer = __peer_lookup_chan(dev, chan);
                 if (peer) {
                         last = peer_del(dev, peer);
                         err = 0;
@@ -943,13 +983,12 @@ static void chan_close_cb(struct l2cap_chan *chan)
                                atomic_read(&chan->kref.refcount));
 
                         l2cap_chan_put(chan);
-                        kfree(peer);
                         break;
                 }
         }
 
         if (!err && last && dev && !atomic_read(&dev->peer_count)) {
-                write_unlock_irqrestore(&devices_lock, flags);
+                spin_unlock(&devices_lock);
 
                 cancel_delayed_work_sync(&dev->notify_peers);
 
@@ -960,7 +999,7 @@ static void chan_close_cb(struct l2cap_chan *chan)
                         schedule_work(&entry->delete_netdev);
                 }
         } else {
-                write_unlock_irqrestore(&devices_lock, flags);
+                spin_unlock(&devices_lock);
         }
 
         return;
@@ -1152,10 +1191,9 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
 
 static void disconnect_all_peers(void)
 {
-        struct lowpan_dev *entry, *tmp_dev;
+        struct lowpan_dev *entry;
         struct lowpan_peer *peer, *tmp_peer, *new_peer;
         struct list_head peers;
-        unsigned long flags;
 
         INIT_LIST_HEAD(&peers);
 
@@ -1164,10 +1202,10 @@ static void disconnect_all_peers(void)
          * with the same list at the same time.
          */
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp_dev, &bt_6lowpan_devices, list) {
-                list_for_each_entry_safe(peer, tmp_peer, &entry->peers, list) {
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+                list_for_each_entry_rcu(peer, &entry->peers, list) {
                         new_peer = kmalloc(sizeof(*new_peer), GFP_ATOMIC);
                         if (!new_peer)
                                 break;
@@ -1179,26 +1217,36 @@ static void disconnect_all_peers(void)
                 }
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
+        spin_lock(&devices_lock);
         list_for_each_entry_safe(peer, tmp_peer, &peers, list) {
                 l2cap_chan_close(peer->chan, ENOENT);
-                kfree(peer);
+
+                list_del_rcu(&peer->list);
+                call_rcu(&peer->rcu, peer_free);
+
+                module_put(THIS_MODULE);
         }
+        spin_unlock(&devices_lock);
 }
 
-static int lowpan_psm_set(void *data, u64 val)
-{
+struct set_psm {
+        struct work_struct work;
         u16 psm;
+};
+
+static void do_psm_set(struct work_struct *work)
+{
+        struct set_psm *set_psm = container_of(work, struct set_psm, work);
 
-        psm = val;
-        if (psm == 0 || psm_6lowpan != psm)
+        if (set_psm->psm == 0 || psm_6lowpan != set_psm->psm)
                 /* Disconnect existing connections if 6lowpan is
                  * disabled (psm = 0), or if psm changes.
                  */
                 disconnect_all_peers();
 
-        psm_6lowpan = psm;
+        psm_6lowpan = set_psm->psm;
 
         if (listen_chan) {
                 l2cap_chan_close(listen_chan, 0);
@@ -1207,6 +1255,22 @@ static int lowpan_psm_set(void *data, u64 val)
 
         listen_chan = bt_6lowpan_listen();
 
+        kfree(set_psm);
+}
+
+static int lowpan_psm_set(void *data, u64 val)
+{
+        struct set_psm *set_psm;
+
+        set_psm = kzalloc(sizeof(*set_psm), GFP_KERNEL);
+        if (!set_psm)
+                return -ENOMEM;
+
+        set_psm->psm = val;
+        INIT_WORK(&set_psm->work, do_psm_set);
+
+        schedule_work(&set_psm->work);
+
         return 0;
 }
 
@@ -1288,19 +1352,18 @@ static ssize_t lowpan_control_write(struct file *fp,
 
 static int lowpan_control_show(struct seq_file *f, void *ptr)
 {
-        struct lowpan_dev *entry, *tmp_dev;
-        struct lowpan_peer *peer, *tmp_peer;
-        unsigned long flags;
+        struct lowpan_dev *entry;
+        struct lowpan_peer *peer;
 
-        read_lock_irqsave(&devices_lock, flags);
+        spin_lock(&devices_lock);
 
-        list_for_each_entry_safe(entry, tmp_dev, &bt_6lowpan_devices, list) {
-                list_for_each_entry_safe(peer, tmp_peer, &entry->peers, list)
+        list_for_each_entry(entry, &bt_6lowpan_devices, list) {
+                list_for_each_entry(peer, &entry->peers, list)
                         seq_printf(f, "%pMR (type %u)\n",
                                    &peer->chan->dst, peer->chan->dst_type);
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        spin_unlock(&devices_lock);
 
         return 0;
 }
@@ -1322,7 +1385,6 @@ static void disconnect_devices(void)
 {
         struct lowpan_dev *entry, *tmp, *new_dev;
         struct list_head devices;
-        unsigned long flags;
 
         INIT_LIST_HEAD(&devices);
 
@@ -1331,9 +1393,9 @@ static void disconnect_devices(void)
          * devices list.
          */
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
                 new_dev = kmalloc(sizeof(*new_dev), GFP_ATOMIC);
                 if (!new_dev)
                         break;
@@ -1341,10 +1403,10 @@ static void disconnect_devices(void)
                 new_dev->netdev = entry->netdev;
                 INIT_LIST_HEAD(&new_dev->list);
 
-                list_add(&new_dev->list, &devices);
+                list_add_rcu(&new_dev->list, &devices);
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
         list_for_each_entry_safe(entry, tmp, &devices, list) {
                 ifdown(entry->netdev);
@@ -1359,17 +1421,15 @@ static int device_event(struct notifier_block *unused,
                         unsigned long event, void *ptr)
 {
         struct net_device *netdev = netdev_notifier_info_to_dev(ptr);
-        struct lowpan_dev *entry, *tmp;
-        unsigned long flags;
+        struct lowpan_dev *entry;
 
         if (netdev->type != ARPHRD_6LOWPAN)
                 return NOTIFY_DONE;
 
         switch (event) {
         case NETDEV_UNREGISTER:
-                write_lock_irqsave(&devices_lock, flags);
-                list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices,
-                                         list) {
+                spin_lock(&devices_lock);
+                list_for_each_entry(entry, &bt_6lowpan_devices, list) {
                         if (entry->netdev == netdev) {
                                 BT_DBG("Unregistered netdev %s %p",
                                        netdev->name, netdev);
@@ -1378,7 +1438,7 @@ static int device_event(struct notifier_block *unused,
                                 break;
                         }
                 }
-                write_unlock_irqrestore(&devices_lock, flags);
+                spin_unlock(&devices_lock);
                 break;
         }
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b9517bd17190..96887ae8375b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -141,10 +141,11 @@ int hci_disconnect(struct hci_conn *conn, __u8 reason)
          */
         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) {
                 struct hci_dev *hdev = conn->hdev;
-                struct hci_cp_read_clock_offset cp;
+                struct hci_cp_read_clock_offset clkoff_cp;
 
-                cp.handle = cpu_to_le16(conn->handle);
-                hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(cp), &cp);
+                clkoff_cp.handle = cpu_to_le16(conn->handle);
+                hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
+                             &clkoff_cp);
         }
 
         conn->state = BT_DISCONN;
@@ -415,7 +416,7 @@ static void le_conn_timeout(struct work_struct *work)
          * happen with broken hardware or if low duty cycle was used
          * (which doesn't have a timeout of its own).
          */
-        if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
+        if (conn->role == HCI_ROLE_SLAVE) {
                 u8 enable = 0x00;
                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
                              &enable);
@@ -517,7 +518,7 @@ int hci_conn_del(struct hci_conn *conn)
                 /* Unacked frames */
                 hdev->acl_cnt += conn->sent;
         } else if (conn->type == LE_LINK) {
-                cancel_delayed_work_sync(&conn->le_conn_timeout);
+                cancel_delayed_work(&conn->le_conn_timeout);
 
                 if (hdev->le_pkts)
                         hdev->le_cnt += conn->sent;
@@ -544,6 +545,9 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_conn_del_sysfs(conn);
 
+        if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
+                hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
+
         hci_dev_put(hdev);
 
         hci_conn_put(conn);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index cb05d7f16a34..91995f8ab0a0 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4477,7 +4477,7 @@ int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
 
         BT_DBG("length %u", skb_queue_len(&req->cmd_q));
 
-        /* If an error occured during request building, remove all HCI
+        /* If an error occurred during request building, remove all HCI
          * commands queued on the HCI request queue.
          */
         if (req->err) {
@@ -4546,7 +4546,7 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
                 return -ENOMEM;
         }
 
-        /* Stand-alone HCI commands must be flaged as
+        /* Stand-alone HCI commands must be flagged as
          * single-command requests.
          */
         bt_cb(skb)->req.start = true;
@@ -4566,7 +4566,7 @@ void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
 
         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
 
-        /* If an error occured during request building, there is no point in
+        /* If an error occurred during request building, there is no point in
          * queueing the HCI command. We can simply return.
          */
         if (req->err)
@@ -4661,8 +4661,12 @@ static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
 
                 skb_shinfo(skb)->frag_list = NULL;
 
-                /* Queue all fragments atomically */
-                spin_lock(&queue->lock);
+                /* Queue all fragments atomically. We need to use spin_lock_bh
+                 * here because of 6LoWPAN links, as there this function is
+                 * called from softirq and using normal spin lock could cause
+                 * deadlocks.
+                 */
+                spin_lock_bh(&queue->lock);
 
                 __skb_queue_tail(queue, skb);
 
@@ -4679,7 +4683,7 @@ static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
                         __skb_queue_tail(queue, skb);
                 } while (list);
 
-                spin_unlock(&queue->lock);
+                spin_unlock_bh(&queue->lock);
         }
 }
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 8b0a2a6de419..aa152140c3e2 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -205,6 +205,8 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
         hdev->le_scan_type = LE_SCAN_PASSIVE;
 
         hdev->ssp_debug_mode = 0;
+
+        hci_bdaddr_list_clear(&hdev->le_white_list);
 }
 
 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1045,7 +1047,7 @@ static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_dev_lock(hdev);
 
-        /* If we're doing connection initation as peripheral. Set a
+        /* If we're doing connection initiation as peripheral. Set a
          * timeout in case something goes wrong.
          */
         if (*sent) {
@@ -1577,8 +1579,7 @@ static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
         struct inquiry_entry *e;
 
         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
-                                      name_len, conn->dev_class);
+                mgmt_device_connected(hdev, conn, 0, name, name_len);
 
         if (discov->state == DISCOVERY_STOPPED)
                 return;
@@ -2536,9 +2537,7 @@ static void hci_remote_features_evt(struct hci_dev *hdev,
                 cp.pscan_rep_mode = 0x02;
                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_connected(hdev, &conn->dst, conn->type,
-                                      conn->dst_type, 0, NULL, 0,
-                                      conn->dev_class);
+                mgmt_device_connected(hdev, conn, 0, NULL, 0);
 
         if (!hci_outgoing_auth_needed(hdev, conn)) {
                 conn->state = BT_CONNECTED;
@@ -3434,9 +3433,7 @@ static void hci_remote_ext_features_evt(struct hci_dev *hdev,
                 cp.pscan_rep_mode = 0x02;
                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_connected(hdev, &conn->dst, conn->type,
-                                      conn->dst_type, 0, NULL, 0,
-                                      conn->dev_class);
+                mgmt_device_connected(hdev, conn, 0, NULL, 0);
 
         if (!hci_outgoing_auth_needed(hdev, conn)) {
                 conn->state = BT_CONNECTED;
@@ -4214,8 +4211,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
         }
 
         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_connected(hdev, &conn->dst, conn->type,
-                                      conn->dst_type, 0, NULL, 0, NULL);
+                mgmt_device_connected(hdev, conn, 0, NULL, 0);
 
         conn->sec_level = BT_SECURITY_LOW;
         conn->handle = __le16_to_cpu(ev->handle);
@@ -4269,25 +4265,26 @@ static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
 }
 
 /* This function requires the caller holds hdev->lock */
-static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
-                                  u8 addr_type, u8 adv_type)
+static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
+                                              bdaddr_t *addr,
+                                              u8 addr_type, u8 adv_type)
 {
         struct hci_conn *conn;
         struct hci_conn_params *params;
 
         /* If the event is not connectable don't proceed further */
         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
-                return;
+                return NULL;
 
         /* Ignore if the device is blocked */
         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
-                return;
+                return NULL;
 
         /* Most controller will fail if we try to create new connections
          * while we have an existing one in slave role.
          */
         if (hdev->conn_hash.le_num_slave > 0)
-                return;
+                return NULL;
 
         /* If we're not connectable only connect devices that we have in
          * our pend_le_conns list.
@@ -4295,7 +4292,7 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
         params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
                                            addr, addr_type);
         if (!params)
-                return;
+                return NULL;
 
         switch (params->auto_connect) {
         case HCI_AUTO_CONN_DIRECT:
@@ -4304,7 +4301,7 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
                  * incoming connections from slave devices.
                  */
                 if (adv_type != LE_ADV_DIRECT_IND)
-                        return;
+                        return NULL;
                 break;
         case HCI_AUTO_CONN_ALWAYS:
                 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
@@ -4315,7 +4312,7 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
                  */
                 break;
         default:
-                return;
+                return NULL;
         }
 
         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
@@ -4328,7 +4325,7 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
                  * count consistent once the connection is established.
                  */
                 params->conn = hci_conn_get(conn);
-                return;
+                return conn;
         }
 
         switch (PTR_ERR(conn)) {
@@ -4341,7 +4338,10 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
                 break;
         default:
                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
+                return NULL;
         }
+
+        return NULL;
 }
 
 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
@@ -4349,6 +4349,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 {
         struct discovery_state *d = &hdev->discovery;
         struct smp_irk *irk;
+        struct hci_conn *conn;
         bool match;
         u32 flags;
 
@@ -4360,7 +4361,14 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
         }
 
         /* Check if we have been requested to connect to this device */
-        check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
+        conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
+        if (conn && type == LE_ADV_IND) {
+                /* Store report for later inclusion by
+                 * mgmt_device_connected
+                 */
+                memcpy(conn->le_adv_data, data, len);
+                conn->le_adv_data_len = len;
+        }
 
         /* Passive scanning shouldn't trigger any device found events,
          * except for devices marked as CONN_REPORT for which we do send
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 29e1ec7189bd..5e2cd2535978 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -987,7 +987,7 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         skb_queue_tail(&hdev->raw_q, skb);
                         queue_work(hdev->workqueue, &hdev->tx_work);
                 } else {
-                        /* Stand-alone HCI commands must be flaged as
+                        /* Stand-alone HCI commands must be flagged as
                          * single-command requests.
                          */
                         bt_cb(skb)->req.start = true;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b6f9777e057d..fc15174c612c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3873,9 +3873,7 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
         hci_dev_lock(hdev);
         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
-                mgmt_device_connected(hdev, &hcon->dst, hcon->type,
-                                      hcon->dst_type, 0, NULL, 0,
-                                      hcon->dev_class);
+                mgmt_device_connected(hdev, hcon, 0, NULL, 0);
         hci_dev_unlock(hdev);
 
         l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
@@ -4084,7 +4082,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
                 chan->num_conf_req++;
         }
 
-        /* Got Conf Rsp PENDING from remote side and asume we sent
+        /* Got Conf Rsp PENDING from remote side and assume we sent
            Conf Rsp PENDING in the code above */
         if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
             test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
@@ -5494,6 +5492,7 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
         if (credits > max_credits) {
                 BT_ERR("LE credits overflow");
                 l2cap_send_disconn_req(chan, ECONNRESET);
+                l2cap_chan_unlock(chan);
 
                 /* Return 0 so that we don't trigger an unnecessary
                  * command reject packet.
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index efb71b022ab6..9c4daf715cf8 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2725,10 +2725,40 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         if (cp->addr.type == BDADDR_BREDR) {
+                /* If disconnection is requested, then look up the
+                 * connection. If the remote device is connected, it
+                 * will be later used to terminate the link.
+                 *
+                 * Setting it to NULL explicitly will cause no
+                 * termination of the link.
+                 */
+                if (cp->disconnect)
+                        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
+                                                       &cp->addr.bdaddr);
+                else
+                        conn = NULL;
+
                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
         } else {
                 u8 addr_type;
 
+                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
+                                               &cp->addr.bdaddr);
+                if (conn) {
+                        /* Defer clearing up the connection parameters
+                         * until closing to give a chance of keeping
+                         * them if a repairing happens.
+                         */
+                        set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
+
+                        /* If disconnection is not requested, then
+                         * clear the connection variable so that the
+                         * link is not terminated.
+                         */
+                        if (!cp->disconnect)
+                                conn = NULL;
+                }
+
                 if (cp->addr.type == BDADDR_LE_PUBLIC)
                         addr_type = ADDR_LE_DEV_PUBLIC;
                 else
@@ -2736,8 +2766,6 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
 
-                hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
-
                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
         }
 
@@ -2747,17 +2775,9 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto unlock;
         }
 
-        if (cp->disconnect) {
-                if (cp->addr.type == BDADDR_BREDR)
-                        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
-                                                       &cp->addr.bdaddr);
-                else
-                        conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
-                                                       &cp->addr.bdaddr);
-        } else {
-                conn = NULL;
-        }
-
+        /* If the connection variable is set, then termination of the
+         * link is requested.
+         */
         if (!conn) {
                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
                                    &rp, sizeof(rp));
@@ -3062,6 +3082,11 @@ static void pairing_complete(struct pending_cmd *cmd, u8 status)
         hci_conn_put(conn);
 
         mgmt_pending_remove(cmd);
+
+        /* The device is paired so there is no need to remove
+         * its connection parameters anymore.
+         */
+        clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
 }
 
 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
@@ -6171,26 +6196,36 @@ static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
         return eir_len;
 }
 
-void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
-                           u8 *dev_class)
+void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
+                           u32 flags, u8 *name, u8 name_len)
 {
         char buf[512];
         struct mgmt_ev_device_connected *ev = (void *) buf;
         u16 eir_len = 0;
 
-        bacpy(&ev->addr.bdaddr, bdaddr);
-        ev->addr.type = link_to_bdaddr(link_type, addr_type);
+        bacpy(&ev->addr.bdaddr, &conn->dst);
+        ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
 
         ev->flags = __cpu_to_le32(flags);
 
-        if (name_len > 0)
-                eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
-                                          name, name_len);
+        /* We must ensure that the EIR Data fields are ordered and
+         * unique. Keep it simple for now and avoid the problem by not
+         * adding any BR/EDR data to the LE adv.
+         */
+        if (conn->le_adv_data_len > 0) {
+                memcpy(&ev->eir[eir_len],
+                       conn->le_adv_data, conn->le_adv_data_len);
+                eir_len = conn->le_adv_data_len;
+        } else {
+                if (name_len > 0)
+                        eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
+                                                  name, name_len);
 
-        if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
-                eir_len = eir_append_data(ev->eir, eir_len,
-                                          EIR_CLASS_OF_DEV, dev_class, 3);
+                if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
+                        eir_len = eir_append_data(ev->eir, eir_len,
+                                                  EIR_CLASS_OF_DEV,
+                                                  conn->dev_class, 3);
+        }
 
         ev->eir_len = cpu_to_le16(eir_len);
 
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index af73bc3acb40..bce9c3d39324 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -78,8 +78,8 @@ static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
 #define __get_type(b)     ((b & 0xef))
 
 #define __test_ea(b)      ((b & 0x01))
-#define __test_cr(b)      ((b & 0x02))
-#define __test_pf(b)      ((b & 0x10))
+#define __test_cr(b)      (!!(b & 0x02))
+#define __test_pf(b)      (!!(b & 0x10))
 
 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
@@ -904,7 +904,7 @@ static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
         hdr->len  = __len8(sizeof(*mcc) + 1);
 
         mcc = (void *) ptr; ptr += sizeof(*mcc);
-        mcc->type = __mcc_type(cr, RFCOMM_NSC);
+        mcc->type = __mcc_type(0, RFCOMM_NSC);
         mcc->len  = __len8(1);
 
         /* Type that we didn't like */
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index f09b6b65cf6b..3ebf65b50881 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -191,16 +191,13 @@ int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
         return 0;
 }
 
-static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
-                  u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat, bdaddr_t *ra,
-                  u8 res[16])
+static int smp_c1(struct crypto_blkcipher *tfm_aes, u8 k[16], u8 r[16],
+                  u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat,
+                  bdaddr_t *ra, u8 res[16])
 {
-        struct hci_dev *hdev = smp->conn->hcon->hdev;
         u8 p1[16], p2[16];
         int err;
 
-        BT_DBG("%s", hdev->name);
-
         memset(p1, 0, 16);
 
         /* p1 = pres || preq || _rat || _iat */
@@ -218,7 +215,7 @@ static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
         u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
 
         /* res = e(k, res) */
-        err = smp_e(smp->tfm_aes, k, res);
+        err = smp_e(tfm_aes, k, res);
         if (err) {
                 BT_ERR("Encrypt data error");
                 return err;
@@ -228,26 +225,23 @@ static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
         u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
 
         /* res = e(k, res) */
-        err = smp_e(smp->tfm_aes, k, res);
+        err = smp_e(tfm_aes, k, res);
         if (err)
                 BT_ERR("Encrypt data error");
 
         return err;
 }
 
-static int smp_s1(struct smp_chan *smp, u8 k[16], u8 r1[16], u8 r2[16],
-                  u8 _r[16])
+static int smp_s1(struct crypto_blkcipher *tfm_aes, u8 k[16], u8 r1[16],
+                  u8 r2[16], u8 _r[16])
 {
-        struct hci_dev *hdev = smp->conn->hcon->hdev;
         int err;
 
-        BT_DBG("%s", hdev->name);
-
         /* Just least significant octets from r1 and r2 are considered */
         memcpy(_r, r2, 8);
         memcpy(_r + 8, r1, 8);
 
-        err = smp_e(smp->tfm_aes, k, _r);
+        err = smp_e(tfm_aes, k, _r);
         if (err)
                 BT_ERR("Encrypt data error");
 
@@ -547,7 +541,7 @@ static u8 smp_confirm(struct smp_chan *smp)
 
         BT_DBG("conn %p", conn);
 
-        ret = smp_c1(smp, smp->tk, smp->prnd, smp->preq, smp->prsp,
+        ret = smp_c1(smp->tfm_aes, smp->tk, smp->prnd, smp->preq, smp->prsp,
                      conn->hcon->init_addr_type, &conn->hcon->init_addr,
                      conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
                      cp.confirm_val);
@@ -578,7 +572,7 @@ static u8 smp_random(struct smp_chan *smp)
 
         BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
 
-        ret = smp_c1(smp, smp->tk, smp->rrnd, smp->preq, smp->prsp,
+        ret = smp_c1(smp->tfm_aes, smp->tk, smp->rrnd, smp->preq, smp->prsp,
                      hcon->init_addr_type, &hcon->init_addr,
                      hcon->resp_addr_type, &hcon->resp_addr, confirm);
         if (ret)
@@ -594,7 +588,7 @@ static u8 smp_random(struct smp_chan *smp)
                 __le64 rand = 0;
                 __le16 ediv = 0;
 
-                smp_s1(smp, smp->tk, smp->rrnd, smp->prnd, stk);
+                smp_s1(smp->tfm_aes, smp->tk, smp->rrnd, smp->prnd, stk);
 
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
@@ -613,7 +607,7 @@ static u8 smp_random(struct smp_chan *smp)
                 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
                              smp->prnd);
 
-                smp_s1(smp, smp->tk, smp->prnd, smp->rrnd, stk);
+                smp_s1(smp->tfm_aes, smp->tk, smp->prnd, smp->rrnd, stk);
 
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
@@ -970,7 +964,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         if (sec_level > conn->hcon->pending_sec_level)
                 conn->hcon->pending_sec_level = sec_level;
 
-        /* If we need MITM check that it can be acheived */
+        /* If we need MITM check that it can be achieved */
         if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
                 u8 method;
 
@@ -1028,7 +1022,7 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
 
         auth = rsp->auth_req & AUTH_REQ_MASK;
 
-        /* If we need MITM check that it can be acheived */
+        /* If we need MITM check that it can be achieved */
         if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
                 u8 method;
 
diff --git a/net/ieee802154/6lowpan_rtnl.c b/net/ieee802154/6lowpan_rtnl.c
index 44136297b673..519a65452d90 100644
--- a/net/ieee802154/6lowpan_rtnl.c
+++ b/net/ieee802154/6lowpan_rtnl.c
@@ -49,8 +49,8 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netdevice.h>
+#include <linux/ieee802154.h>
 #include <net/af_ieee802154.h>
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
 #include <net/6lowpan.h>
 #include <net/ipv6.h>
@@ -58,12 +58,13 @@
 #include "reassembly.h"
 
 static LIST_HEAD(lowpan_devices);
+static int lowpan_open_count;
 
 /* private device info */
 struct lowpan_dev_info {
         struct net_device       *real_dev; /* real WPAN device ptr */
         struct mutex            dev_list_mtx; /* mutex for list ops */
-        __be16                  fragment_tag;
+        u16                     fragment_tag;
 };
 
 struct lowpan_dev_record {
@@ -140,24 +141,33 @@ static int lowpan_give_skb_to_devices(struct sk_buff *skb,
         struct sk_buff *skb_cp;
         int stat = NET_RX_SUCCESS;
 
+        skb->protocol = htons(ETH_P_IPV6);
+        skb->pkt_type = PACKET_HOST;
+
         rcu_read_lock();
         list_for_each_entry_rcu(entry, &lowpan_devices, list)
                 if (lowpan_dev_info(entry->ldev)->real_dev == skb->dev) {
                         skb_cp = skb_copy(skb, GFP_ATOMIC);
                         if (!skb_cp) {
-                                stat = -ENOMEM;
-                                break;
+                                kfree_skb(skb);
+                                rcu_read_unlock();
+                                return NET_RX_DROP;
                         }
 
                         skb_cp->dev = entry->ldev;
                         stat = netif_rx(skb_cp);
+                        if (stat == NET_RX_DROP)
+                                break;
                 }
         rcu_read_unlock();
 
+        consume_skb(skb);
+
         return stat;
 }
 
-static int process_data(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
+static int
+iphc_decompress(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
 {
         u8 iphc0, iphc1;
         struct ieee802154_addr_sa sa, da;
@@ -187,10 +197,9 @@ static int process_data(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
         else
                 dap = &da.hwaddr;
 
-        return lowpan_process_data(skb, skb->dev, sap, sa.addr_type,
-                                   IEEE802154_ADDR_LEN, dap, da.addr_type,
-                                   IEEE802154_ADDR_LEN, iphc0, iphc1,
-                                   lowpan_give_skb_to_devices);
+        return lowpan_header_decompress(skb, skb->dev, sap, sa.addr_type,
+                                        IEEE802154_ADDR_LEN, dap, da.addr_type,
+                                        IEEE802154_ADDR_LEN, iphc0, iphc1);
 
 drop:
         kfree_skb(skb);
@@ -233,7 +242,7 @@ lowpan_alloc_frag(struct sk_buff *skb, int size,
                                      &master_hdr->source, size);
                 if (rc < 0) {
                         kfree_skb(frag);
-                        return ERR_PTR(-rc);
+                        return ERR_PTR(rc);
                 }
         } else {
                 frag = ERR_PTR(-ENOMEM);
@@ -275,7 +284,8 @@ lowpan_xmit_fragmented(struct sk_buff *skb, struct net_device *dev,
 
         dgram_size = lowpan_uncompress_size(skb, &dgram_offset) -
                      skb->mac_len;
-        frag_tag = lowpan_dev_info(dev)->fragment_tag++;
+        frag_tag = htons(lowpan_dev_info(dev)->fragment_tag);
+        lowpan_dev_info(dev)->fragment_tag++;
 
         frag_hdr[0] = LOWPAN_DISPATCH_FRAG1 | ((dgram_size >> 8) & 0x07);
         frag_hdr[1] = dgram_size & 0xff;
@@ -294,7 +304,7 @@ lowpan_xmit_fragmented(struct sk_buff *skb, struct net_device *dev,
                                   frag_len + skb_network_header_len(skb));
         if (rc) {
                 pr_debug("%s unable to send FRAG1 packet (tag: %d)",
-                         __func__, frag_tag);
+                         __func__, ntohs(frag_tag));
                 goto err;
         }
 
@@ -315,7 +325,7 @@ lowpan_xmit_fragmented(struct sk_buff *skb, struct net_device *dev,
                                           frag_len);
                 if (rc) {
                         pr_debug("%s unable to send a FRAGN packet. (tag: %d, offset: %d)\n",
-                                 __func__, frag_tag, skb_offset);
+                                 __func__, ntohs(frag_tag), skb_offset);
                         goto err;
                 }
         } while (skb_unprocessed > frag_cap);
@@ -515,6 +525,9 @@ static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
         if (!netif_running(dev))
                 goto drop_skb;
 
+        if (skb->pkt_type == PACKET_OTHERHOST)
+                goto drop_skb;
+
         if (dev->type != ARPHRD_IEEE802154)
                 goto drop_skb;
 
@@ -523,55 +536,67 @@ static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
 
         /* check that it's our buffer */
         if (skb->data[0] == LOWPAN_DISPATCH_IPV6) {
-                skb->protocol = htons(ETH_P_IPV6);
-                skb->pkt_type = PACKET_HOST;
-
                 /* Pull off the 1-byte of 6lowpan header. */
                 skb_pull(skb, 1);
-
-                ret = lowpan_give_skb_to_devices(skb, NULL);
-                if (ret == NET_RX_DROP)
-                        goto drop;
+                return lowpan_give_skb_to_devices(skb, NULL);
         } else {
                 switch (skb->data[0] & 0xe0) {
                 case LOWPAN_DISPATCH_IPHC:      /* ipv6 datagram */
-                        ret = process_data(skb, &hdr);
-                        if (ret == NET_RX_DROP)
+                        ret = iphc_decompress(skb, &hdr);
+                        if (ret < 0)
                                 goto drop;
-                        break;
+
+                        return lowpan_give_skb_to_devices(skb, NULL);
                 case LOWPAN_DISPATCH_FRAG1:     /* first fragment header */
                         ret = lowpan_frag_rcv(skb, LOWPAN_DISPATCH_FRAG1);
                         if (ret == 1) {
-                                ret = process_data(skb, &hdr);
-                                if (ret == NET_RX_DROP)
+                                ret = iphc_decompress(skb, &hdr);
+                                if (ret < 0)
                                         goto drop;
+
+                                return lowpan_give_skb_to_devices(skb, NULL);
+                        } else if (ret == -1) {
+                                return NET_RX_DROP;
+                        } else {
+                                return NET_RX_SUCCESS;
                         }
-                        break;
                 case LOWPAN_DISPATCH_FRAGN:     /* next fragments headers */
                         ret = lowpan_frag_rcv(skb, LOWPAN_DISPATCH_FRAGN);
                         if (ret == 1) {
-                                ret = process_data(skb, &hdr);
-                                if (ret == NET_RX_DROP)
+                                ret = iphc_decompress(skb, &hdr);
+                                if (ret < 0)
                                         goto drop;
+
+                                return lowpan_give_skb_to_devices(skb, NULL);
+                        } else if (ret == -1) {
+                                return NET_RX_DROP;
+                        } else {
+                                return NET_RX_SUCCESS;
                         }
-                        break;
                 default:
                         break;
                 }
         }
 
-        return NET_RX_SUCCESS;
 drop_skb:
         kfree_skb(skb);
 drop:
         return NET_RX_DROP;
 }
 
+static struct packet_type lowpan_packet_type = {
+        .type = htons(ETH_P_IEEE802154),
+        .func = lowpan_rcv,
+};
+
 static int lowpan_newlink(struct net *src_net, struct net_device *dev,
                           struct nlattr *tb[], struct nlattr *data[])
 {
         struct net_device *real_dev;
         struct lowpan_dev_record *entry;
+        int ret;
+
+        ASSERT_RTNL();
 
         pr_debug("adding new link\n");
 
@@ -606,9 +631,14 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
         list_add_tail(&entry->list, &lowpan_devices);
         mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx);
 
-        register_netdevice(dev);
+        ret = register_netdevice(dev);
+        if (ret >= 0) {
+                if (!lowpan_open_count)
+                        dev_add_pack(&lowpan_packet_type);
+                lowpan_open_count++;
+        }
 
-        return 0;
+        return ret;
 }
 
 static void lowpan_dellink(struct net_device *dev, struct list_head *head)
@@ -619,6 +649,10 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head)
 
         ASSERT_RTNL();
 
+        lowpan_open_count--;
+        if (!lowpan_open_count)
+                dev_remove_pack(&lowpan_packet_type);
+
         mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
         list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) {
                 if (entry->ldev == dev) {
@@ -681,11 +715,6 @@ static struct notifier_block lowpan_dev_notifier = {
         .notifier_call = lowpan_device_event,
 };
 
-static struct packet_type lowpan_packet_type = {
-        .type = htons(ETH_P_IEEE802154),
-        .func = lowpan_rcv,
-};
-
 static int __init lowpan_init_module(void)
 {
         int err = 0;
@@ -698,8 +727,6 @@ static int __init lowpan_init_module(void)
         if (err < 0)
                 goto out_frag;
 
-        dev_add_pack(&lowpan_packet_type);
-
         err = register_netdevice_notifier(&lowpan_dev_notifier);
         if (err < 0)
                 goto out_pack;
@@ -707,7 +734,6 @@ static int __init lowpan_init_module(void)
         return 0;
 
 out_pack:
-        dev_remove_pack(&lowpan_packet_type);
         lowpan_netlink_fini();
 out_frag:
         lowpan_net_frag_exit();
@@ -719,8 +745,6 @@ static void __exit lowpan_cleanup_module(void)
 {
         lowpan_netlink_fini();
 
-        dev_remove_pack(&lowpan_packet_type);
-
         lowpan_net_frag_exit();
 
         unregister_netdevice_notifier(&lowpan_dev_notifier);
diff --git a/net/ieee802154/Makefile b/net/ieee802154/Makefile
index 3914b1ed4274..38354d4a70cb 100644
--- a/net/ieee802154/Makefile
+++ b/net/ieee802154/Makefile
@@ -2,8 +2,8 @@ obj-$(CONFIG_IEEE802154) += ieee802154.o af_802154.o
 obj-$(CONFIG_IEEE802154_6LOWPAN) += ieee802154_6lowpan.o
 
 ieee802154_6lowpan-y := 6lowpan_rtnl.o reassembly.o
-ieee802154-y := netlink.o nl-mac.o nl-phy.o nl_policy.o wpan-class.o \
-                header_ops.o
+ieee802154-y := netlink.o nl-mac.o nl-phy.o nl_policy.o core.o \
+                header_ops.o sysfs.o
 af_802154-y := af_ieee802154.o raw.o dgram.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/ieee802154/af802154.h b/net/ieee802154/af802154.h
index 8330a09bfc95..343b63e6f953 100644
--- a/net/ieee802154/af802154.h
+++ b/net/ieee802154/af802154.h
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 29e0de63001b..26da1e179737 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
diff --git a/net/ieee802154/wpan-class.c b/net/ieee802154/core.c
index 4955e0fe5883..620abc2ba5fc 100644
--- a/net/ieee802154/wpan-class.c
+++ b/net/ieee802154/core.c
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  */
 
 #include <linux/slab.h>
@@ -21,75 +17,10 @@
 #include <linux/module.h>
 #include <linux/device.h>
 
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 
 #include "ieee802154.h"
-
-#define MASTER_SHOW_COMPLEX(name, format_string, args...)               \
-static ssize_t name ## _show(struct device *dev,                        \
-                            struct device_attribute *attr, char *buf)   \
-{                                                                       \
-        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev); \
-        int ret;                                                        \
-                                                                        \
-        mutex_lock(&phy->pib_lock);                                     \
-        ret = snprintf(buf, PAGE_SIZE, format_string "\n", args);       \
-        mutex_unlock(&phy->pib_lock);                                   \
-        return ret;                                                     \
-}                                                                       \
-static DEVICE_ATTR_RO(name);
-
-#define MASTER_SHOW(field, format_string)                               \
-        MASTER_SHOW_COMPLEX(field, format_string, phy->field)
-
-MASTER_SHOW(current_channel, "%d");
-MASTER_SHOW(current_page, "%d");
-MASTER_SHOW(transmit_power, "%d +- 1 dB");
-MASTER_SHOW(cca_mode, "%d");
-
-static ssize_t channels_supported_show(struct device *dev,
-                                       struct device_attribute *attr,
-                                       char *buf)
-{
-        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev);
-        int ret;
-        int i, len = 0;
-
-        mutex_lock(&phy->pib_lock);
-        for (i = 0; i < 32; i++) {
-                ret = snprintf(buf + len, PAGE_SIZE - len,
-                               "%#09x\n", phy->channels_supported[i]);
-                if (ret < 0)
-                        break;
-                len += ret;
-        }
-        mutex_unlock(&phy->pib_lock);
-        return len;
-}
-static DEVICE_ATTR_RO(channels_supported);
-
-static struct attribute *pmib_attrs[] = {
-        &dev_attr_current_channel.attr,
-        &dev_attr_current_page.attr,
-        &dev_attr_channels_supported.attr,
-        &dev_attr_transmit_power.attr,
-        &dev_attr_cca_mode.attr,
-        NULL,
-};
-ATTRIBUTE_GROUPS(pmib);
-
-static void wpan_phy_release(struct device *d)
-{
-        struct wpan_phy *phy = container_of(d, struct wpan_phy, dev);
-
-        kfree(phy);
-}
-
-static struct class wpan_phy_class = {
-        .name = "ieee802154",
-        .dev_release = wpan_phy_release,
-        .dev_groups = pmib_groups,
-};
+#include "sysfs.h"
 
 static DEFINE_MUTEX(wpan_phy_mutex);
 static int wpan_phy_idx;
@@ -201,7 +132,7 @@ static int __init wpan_phy_class_init(void)
 {
         int rc;
 
-        rc = class_register(&wpan_phy_class);
+        rc = wpan_phy_sysfs_init();
         if (rc)
                 goto err;
 
@@ -211,7 +142,7 @@ static int __init wpan_phy_class_init(void)
 
         return 0;
 err_nl:
-        class_unregister(&wpan_phy_class);
+        wpan_phy_sysfs_exit();
 err:
         return rc;
 }
@@ -220,7 +151,7 @@ subsys_initcall(wpan_phy_class_init);
 static void __exit wpan_phy_class_exit(void)
 {
         ieee802154_nl_exit();
-        class_unregister(&wpan_phy_class);
+        wpan_phy_sysfs_exit();
 }
 module_exit(wpan_phy_class_exit);
 
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index fc9193eabd41..b8555ec71387 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
@@ -27,9 +23,9 @@
 #include <linux/if_arp.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/ieee802154.h>
 #include <net/sock.h>
 #include <net/af_ieee802154.h>
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
 
 #include <asm/ioctls.h>
diff --git a/net/ieee802154/header_ops.c b/net/ieee802154/header_ops.c
index c09294e39ca6..a051b6993177 100644
--- a/net/ieee802154/header_ops.c
+++ b/net/ieee802154/header_ops.c
@@ -14,8 +14,9 @@
  * Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
  */
 
+#include <linux/ieee802154.h>
+
 #include <net/mac802154.h>
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
 
 static int
diff --git a/net/ieee802154/ieee802154.h b/net/ieee802154/ieee802154.h
index 5d352f86979e..42ae63a345ab 100644
--- a/net/ieee802154/ieee802154.h
+++ b/net/ieee802154/ieee802154.h
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  */
 #ifndef IEEE_802154_LOCAL_H
 #define IEEE_802154_LOCAL_H
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 9222966f5e6d..6c3c2595a201 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index c6bfe22bfa5e..abd0f31bdc66 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
@@ -26,6 +22,7 @@
 #include <linux/kernel.h>
 #include <linux/if_arp.h>
 #include <linux/netdevice.h>
+#include <linux/ieee802154.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
 #include <net/sock.h>
@@ -33,9 +30,8 @@
 #include <linux/export.h>
 #include <net/af_ieee802154.h>
 #include <net/nl802154.h>
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 
 #include "ieee802154.h"
 
@@ -668,20 +664,6 @@ int ieee802154_set_macparams(struct sk_buff *skb, struct genl_info *info)
 
         phy = ops->get_phy(dev);
 
-        if ((!phy->set_lbt && info->attrs[IEEE802154_ATTR_LBT_ENABLED]) ||
-            (!phy->set_cca_mode && info->attrs[IEEE802154_ATTR_CCA_MODE]) ||
-            (!phy->set_cca_ed_level &&
-             info->attrs[IEEE802154_ATTR_CCA_ED_LEVEL]) ||
-            (!phy->set_csma_params &&
-             (info->attrs[IEEE802154_ATTR_CSMA_RETRIES] ||
-              info->attrs[IEEE802154_ATTR_CSMA_MIN_BE] ||
-              info->attrs[IEEE802154_ATTR_CSMA_MAX_BE])) ||
-            (!phy->set_frame_retries &&
-             info->attrs[IEEE802154_ATTR_FRAME_RETRIES])) {
-                rc = -EOPNOTSUPP;
-                goto out_phy;
-        }
-
         ops->get_mac_params(dev, &params);
 
         if (info->attrs[IEEE802154_ATTR_TXPOWER])
@@ -712,10 +694,9 @@ int ieee802154_set_macparams(struct sk_buff *skb, struct genl_info *info)
 
         wpan_phy_put(phy);
         dev_put(dev);
-        return rc;
 
-out_phy:
-        wpan_phy_put(phy);
+        return 0;
+
 out:
         dev_put(dev);
         return rc;
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index 972baf83411a..0afe760ff512 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
@@ -27,7 +23,7 @@
 #include <linux/if_arp.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 #include <net/af_ieee802154.h>
 #include <net/ieee802154_netdev.h>
 #include <net/rtnetlink.h> /* for rtnl_{un,}lock */
diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c
index 3a703ab88348..35c432668454 100644
--- a/net/ieee802154/nl_policy.c
+++ b/net/ieee802154/nl_policy.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  */
 
 #include <linux/kernel.h>
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index 73a4d53463de..21c38945ab8b 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
diff --git a/net/ieee802154/reassembly.c b/net/ieee802154/reassembly.c
index 7cfcd6885225..9d980ed3ffe2 100644
--- a/net/ieee802154/reassembly.c
+++ b/net/ieee802154/reassembly.c
@@ -33,7 +33,7 @@
 static const char lowpan_frags_cache_name[] = "lowpan-frags";
 
 struct lowpan_frag_info {
-        __be16 d_tag;
+        u16 d_tag;
         u16 d_size;
         u8 d_offset;
 };
@@ -48,7 +48,7 @@ static struct inet_frags lowpan_frags;
 static int lowpan_frag_reasm(struct lowpan_frag_queue *fq,
                              struct sk_buff *prev, struct net_device *dev);
 
-static unsigned int lowpan_hash_frag(__be16 tag, u16 d_size,
+static unsigned int lowpan_hash_frag(u16 tag, u16 d_size,
                                      const struct ieee802154_addr *saddr,
                                      const struct ieee802154_addr *daddr)
 {
@@ -330,11 +330,13 @@ static int lowpan_get_frag_info(struct sk_buff *skb, const u8 frag_type,
 {
         bool fail;
         u8 pattern = 0, low = 0;
+        __be16 d_tag = 0;
 
         fail = lowpan_fetch_skb(skb, &pattern, 1);
         fail |= lowpan_fetch_skb(skb, &low, 1);
         frag_info->d_size = (pattern & 7) << 8 | low;
-        fail |= lowpan_fetch_skb(skb, &frag_info->d_tag, 2);
+        fail |= lowpan_fetch_skb(skb, &d_tag, 2);
+        frag_info->d_tag = ntohs(d_tag);
 
         if (frag_type == LOWPAN_DISPATCH_FRAGN) {
                 fail |= lowpan_fetch_skb(skb, &frag_info->d_offset, 1);
diff --git a/net/ieee802154/reassembly.h b/net/ieee802154/reassembly.h
index 74e4a7c98191..836b16fa001f 100644
--- a/net/ieee802154/reassembly.h
+++ b/net/ieee802154/reassembly.h
@@ -4,7 +4,7 @@
 #include <net/inet_frag.h>
 
 struct lowpan_create_arg {
-        __be16 tag;
+        u16 tag;
         u16 d_size;
         const struct ieee802154_addr *src;
         const struct ieee802154_addr *dst;
@@ -15,7 +15,7 @@ struct lowpan_create_arg {
 struct lowpan_frag_queue {
         struct inet_frag_queue  q;
 
-        __be16                  tag;
+        u16                     tag;
         u16                     d_size;
         struct ieee802154_addr  saddr;
         struct ieee802154_addr  daddr;
diff --git a/net/ieee802154/sysfs.c b/net/ieee802154/sysfs.c
new file mode 100644
index 000000000000..eb9ca6f99122
--- /dev/null
+++ b/net/ieee802154/sysfs.c
@@ -0,0 +1,94 @@
+/* This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Authors:
+ * Alexander Aring <aar@pengutronix.de>
+ *
+ * Based on: net/wireless/sysfs.c
+ */
+
+#include <linux/device.h>
+
+#include <net/cfg802154.h>
+
+#define MASTER_SHOW_COMPLEX(name, format_string, args...)               \
+static ssize_t name ## _show(struct device *dev,                        \
+                            struct device_attribute *attr, char *buf)   \
+{                                                                       \
+        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev); \
+        int ret;                                                        \
+                                                                        \
+        mutex_lock(&phy->pib_lock);                                     \
+        ret = snprintf(buf, PAGE_SIZE, format_string "\n", args);       \
+        mutex_unlock(&phy->pib_lock);                                   \
+        return ret;                                                     \
+}                                                                       \
+static DEVICE_ATTR_RO(name)
+
+#define MASTER_SHOW(field, format_string)                               \
+        MASTER_SHOW_COMPLEX(field, format_string, phy->field)
+
+MASTER_SHOW(current_channel, "%d");
+MASTER_SHOW(current_page, "%d");
+MASTER_SHOW(transmit_power, "%d +- 1 dB");
+MASTER_SHOW(cca_mode, "%d");
+
+static ssize_t channels_supported_show(struct device *dev,
+                                       struct device_attribute *attr,
+                                       char *buf)
+{
+        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev);
+        int ret;
+        int i, len = 0;
+
+        mutex_lock(&phy->pib_lock);
+        for (i = 0; i < 32; i++) {
+                ret = snprintf(buf + len, PAGE_SIZE - len,
+                               "%#09x\n", phy->channels_supported[i]);
+                if (ret < 0)
+                        break;
+                len += ret;
+        }
+        mutex_unlock(&phy->pib_lock);
+        return len;
+}
+static DEVICE_ATTR_RO(channels_supported);
+
+static void wpan_phy_release(struct device *d)
+{
+        struct wpan_phy *phy = container_of(d, struct wpan_phy, dev);
+
+        kfree(phy);
+}
+
+static struct attribute *pmib_attrs[] = {
+        &dev_attr_current_channel.attr,
+        &dev_attr_current_page.attr,
+        &dev_attr_channels_supported.attr,
+        &dev_attr_transmit_power.attr,
+        &dev_attr_cca_mode.attr,
+        NULL,
+};
+ATTRIBUTE_GROUPS(pmib);
+
+struct class wpan_phy_class = {
+        .name = "ieee802154",
+        .dev_release = wpan_phy_release,
+        .dev_groups = pmib_groups,
+};
+
+int wpan_phy_sysfs_init(void)
+{
+        return class_register(&wpan_phy_class);
+}
+
+void wpan_phy_sysfs_exit(void)
+{
+        class_unregister(&wpan_phy_class);
+}
diff --git a/net/ieee802154/sysfs.h b/net/ieee802154/sysfs.h
new file mode 100644
index 000000000000..aa42e39ecbec
--- /dev/null
+++ b/net/ieee802154/sysfs.h
@@ -0,0 +1,9 @@
+#ifndef __IEEE802154_SYSFS_H
+#define __IEEE802154_SYSFS_H
+
+int wpan_phy_sysfs_init(void);
+void wpan_phy_sysfs_exit(void);
+
+extern struct class wpan_phy_class;
+
+#endif /* __IEEE802154_SYSFS_H */
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index aeb6a483b3bc..75cc6801a431 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -33,6 +33,13 @@ config MAC80211_RC_MINSTREL_HT
         ---help---
           This option enables the 'minstrel_ht' TX rate control algorithm
 
+config MAC80211_RC_MINSTREL_VHT
+        bool "Minstrel 802.11ac support" if EXPERT
+        depends on MAC80211_RC_MINSTREL_HT
+        default n
+        ---help---
+          This option enables VHT in the 'minstrel_ht' TX rate control algorithm
+
 choice
         prompt "Default rate control algorithm"
         depends on MAC80211_HAS_RC
@@ -169,6 +176,17 @@ config MAC80211_HT_DEBUG
 
           Do not select this option.
 
+config MAC80211_OCB_DEBUG
+        bool "Verbose OCB debugging"
+        depends on MAC80211_DEBUG_MENU
+        ---help---
+          Selecting this option causes mac80211 to print out
+          very verbose OCB debugging messages. It should not
+          be selected on production systems as those messages
+          are remotely triggerable.
+
+          Do not select this option.
+
 config MAC80211_IBSS_DEBUG
         bool "Verbose IBSS debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 7273d2796dd1..e53671b1105e 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -27,7 +27,8 @@ mac80211-y := \
         event.o \
         chan.o \
         trace.o mlme.o \
-        tdls.o
+        tdls.o \
+        ocb.o
 
 mac80211-$(CONFIG_MAC80211_LEDS) += led.o
 mac80211-$(CONFIG_MAC80211_DEBUGFS) += \
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index d6986f3aa5c4..9242c60048cf 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -149,11 +149,6 @@ void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
         rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
 }
 
-static inline int ieee80211_ac_from_tid(int tid)
-{
-        return ieee802_1d_to_ac[tid & 7];
-}
-
 /*
  * When multiple aggregation sessions on multiple stations
  * are being created/destroyed simultaneously, we need to
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 343da1e35025..06185940cbb6 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -20,6 +20,7 @@
 #include "cfg.h"
 #include "rate.h"
 #include "mesh.h"
+#include "wme.h"
 
 static struct wireless_dev *ieee80211_add_iface(struct wiphy *wiphy,
                                                 const char *name,
@@ -190,7 +191,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                  * receive the key. When wpa_supplicant has roamed
                  * using FT, it attempts to set the key before
                  * association has completed, this rejects that attempt
-                 * so it will set the key again after assocation.
+                 * so it will set the key again after association.
                  *
                  * TODO: accept the key if we have a station entry and
                  *       add it to the device after the station.
@@ -229,6 +230,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         case NUM_NL80211_IFTYPES:
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_OCB:
                 /* shouldn't happen */
                 WARN_ON_ONCE(1);
                 break;
@@ -1225,14 +1227,14 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
-                                 const u8 *mac)
+                                 struct station_del_parameters *params)
 {
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (mac)
-                return sta_info_destroy_addr_bss(sdata, mac);
+        if (params->mac)
+                return sta_info_destroy_addr_bss(sdata, params->mac);
 
         sta_info_flush(sdata);
         return 0;
@@ -1516,6 +1518,57 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
+static void mpp_set_pinfo(struct mesh_path *mpath, u8 *mpp,
+                          struct mpath_info *pinfo)
+{
+        memset(pinfo, 0, sizeof(*pinfo));
+        memcpy(mpp, mpath->mpp, ETH_ALEN);
+
+        pinfo->generation = mpp_paths_generation;
+}
+
+static int ieee80211_get_mpp(struct wiphy *wiphy, struct net_device *dev,
+                             u8 *dst, u8 *mpp, struct mpath_info *pinfo)
+
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct mesh_path *mpath;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        rcu_read_lock();
+        mpath = mpp_path_lookup(sdata, dst);
+        if (!mpath) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
+        memcpy(dst, mpath->dst, ETH_ALEN);
+        mpp_set_pinfo(mpath, mpp, pinfo);
+        rcu_read_unlock();
+        return 0;
+}
+
+static int ieee80211_dump_mpp(struct wiphy *wiphy, struct net_device *dev,
+                              int idx, u8 *dst, u8 *mpp,
+                              struct mpath_info *pinfo)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct mesh_path *mpath;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        rcu_read_lock();
+        mpath = mpp_path_lookup_by_idx(sdata, idx);
+        if (!mpath) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
+        memcpy(dst, mpath->dst, ETH_ALEN);
+        mpp_set_pinfo(mpath, mpp, pinfo);
+        rcu_read_unlock();
+        return 0;
+}
+
 static int ieee80211_get_mesh_config(struct wiphy *wiphy,
                                 struct net_device *dev,
                                 struct mesh_config *conf)
@@ -1966,6 +2019,17 @@ static int ieee80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
         return ieee80211_ibss_leave(IEEE80211_DEV_TO_SUB_IF(dev));
 }
 
+static int ieee80211_join_ocb(struct wiphy *wiphy, struct net_device *dev,
+                              struct ocb_setup *setup)
+{
+        return ieee80211_ocb_join(IEEE80211_DEV_TO_SUB_IF(dev), setup);
+}
+
+static int ieee80211_leave_ocb(struct wiphy *wiphy, struct net_device *dev)
+{
+        return ieee80211_ocb_leave(IEEE80211_DEV_TO_SUB_IF(dev));
+}
+
 static int ieee80211_set_mcast_rate(struct wiphy *wiphy, struct net_device *dev,
                                     int rate[IEEE80211_NUM_BANDS])
 {
@@ -2081,6 +2145,9 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy,
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 
+        if (local->ops->get_txpower)
+                return drv_get_txpower(local, sdata, dbm);
+
         if (!local->use_chanctx)
                 *dbm = local->hw.conf.power_level;
         else
@@ -2850,11 +2917,7 @@ static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
                 if (sdata->reserved_ready)
                         return 0;
 
-                err = ieee80211_vif_use_reserved_context(sdata);
-                if (err)
-                        return err;
-
-                return 0;
+                return ieee80211_vif_use_reserved_context(sdata);
         }
 
         if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
@@ -2868,7 +2931,6 @@ static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
                 return err;
 
         ieee80211_bss_info_change_notify(sdata, changed);
-        cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
 
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
@@ -2876,6 +2938,12 @@ static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
                 sdata->csa_block_tx = false;
         }
 
+        err = drv_post_channel_switch(sdata);
+        if (err)
+                return err;
+
+        cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
+
         return 0;
 }
 
@@ -3053,9 +3121,11 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_channel_switch ch_switch;
         struct ieee80211_chanctx_conf *conf;
         struct ieee80211_chanctx *chanctx;
-        int err, changed = 0;
+        u32 changed = 0;
+        int err;
 
         sdata_assert_lock(sdata);
         lockdep_assert_held(&local->mtx);
@@ -3088,6 +3158,10 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                 goto out;
         }
 
+        err = drv_pre_channel_switch(sdata, &ch_switch);
+        if (err)
+                goto out;
+
         err = ieee80211_vif_reserve_chanctx(sdata, &params->chandef,
                                             chanctx->mode,
                                             params->radar_required);
@@ -3101,6 +3175,12 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                 goto out;
         }
 
+        ch_switch.timestamp = 0;
+        ch_switch.device_timestamp = 0;
+        ch_switch.block_tx = params->block_tx;
+        ch_switch.chandef = params->chandef;
+        ch_switch.count = params->count;
+
         err = ieee80211_set_csa_beacon(sdata, params, &changed);
         if (err) {
                 ieee80211_vif_unreserve_chanctx(sdata);
@@ -3521,6 +3601,76 @@ static int ieee80211_set_ap_chanwidth(struct wiphy *wiphy,
         return ret;
 }
 
+static int ieee80211_add_tx_ts(struct wiphy *wiphy, struct net_device *dev,
+                               u8 tsid, const u8 *peer, u8 up,
+                               u16 admitted_time)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        int ac = ieee802_1d_to_ac[up];
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        if (!(sdata->wmm_acm & BIT(up)))
+                return -EINVAL;
+
+        if (ifmgd->tx_tspec[ac].admitted_time)
+                return -EBUSY;
+
+        if (admitted_time) {
+                ifmgd->tx_tspec[ac].admitted_time = 32 * admitted_time;
+                ifmgd->tx_tspec[ac].tsid = tsid;
+                ifmgd->tx_tspec[ac].up = up;
+        }
+
+        return 0;
+}
+
+static int ieee80211_del_tx_ts(struct wiphy *wiphy, struct net_device *dev,
+                               u8 tsid, const u8 *peer)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        int ac;
+
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
+
+                /* skip unused entries */
+                if (!tx_tspec->admitted_time)
+                        continue;
+
+                if (tx_tspec->tsid != tsid)
+                        continue;
+
+                /* due to this new packets will be reassigned to non-ACM ACs */
+                tx_tspec->up = -1;
+
+                /* Make sure that all packets have been sent to avoid to
+                 * restore the QoS params on packets that are still on the
+                 * queues.
+                 */
+                synchronize_net();
+                ieee80211_flush_queues(local, sdata);
+
+                /* restore the normal QoS parameters
+                 * (unconditionally to avoid races)
+                 */
+                tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
+                tx_tspec->downgraded = false;
+                ieee80211_sta_handle_tspec_ac_params(sdata);
+
+                /* finally clear all the data */
+                memset(tx_tspec, 0, sizeof(*tx_tspec));
+
+                return 0;
+        }
+
+        return -ENOENT;
+}
+
 const struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -3547,11 +3697,15 @@ const struct cfg80211_ops mac80211_config_ops = {
         .change_mpath = ieee80211_change_mpath,
         .get_mpath = ieee80211_get_mpath,
         .dump_mpath = ieee80211_dump_mpath,
+        .get_mpp = ieee80211_get_mpp,
+        .dump_mpp = ieee80211_dump_mpp,
         .update_mesh_config = ieee80211_update_mesh_config,
         .get_mesh_config = ieee80211_get_mesh_config,
         .join_mesh = ieee80211_join_mesh,
         .leave_mesh = ieee80211_leave_mesh,
 #endif
+        .join_ocb = ieee80211_join_ocb,
+        .leave_ocb = ieee80211_leave_ocb,
         .change_bss = ieee80211_change_bss,
         .set_txq_params = ieee80211_set_txq_params,
         .set_monitor_channel = ieee80211_set_monitor_channel,
@@ -3597,4 +3751,6 @@ const struct cfg80211_ops mac80211_config_ops = {
         .channel_switch = ieee80211_channel_switch,
         .set_qos_map = ieee80211_set_qos_map,
         .set_ap_chanwidth = ieee80211_set_ap_chanwidth,
+        .add_tx_ts = ieee80211_add_tx_ts,
+        .del_tx_ts = ieee80211_del_tx_ts,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 4c74e8da64b9..c7c514220298 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -270,6 +270,7 @@ ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
                 case NL80211_IFTYPE_ADHOC:
                 case NL80211_IFTYPE_WDS:
                 case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_OCB:
                         width = vif->bss_conf.chandef.width;
                         break;
                 case NL80211_IFTYPE_UNSPECIFIED:
@@ -674,6 +675,7 @@ void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                 case NL80211_IFTYPE_ADHOC:
                 case NL80211_IFTYPE_WDS:
                 case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_OCB:
                         break;
                 default:
                         WARN_ON_ONCE(1);
@@ -909,6 +911,7 @@ ieee80211_vif_chanctx_reservation_complete(struct ieee80211_sub_if_data *sdata)
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_MESH_POINT:
+        case NL80211_IFTYPE_OCB:
                 ieee80211_queue_work(&sdata->local->hw,
                                      &sdata->csa_finalize_work);
                 break;
@@ -1634,7 +1637,7 @@ int ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
                 }
                 break;
         case IEEE80211_CHANCTX_WILL_BE_REPLACED:
-                /* TODO: Perhaps the bandwith change could be treated as a
+                /* TODO: Perhaps the bandwidth change could be treated as a
                  * reservation itself? */
                 ret = -EBUSY;
                 goto out;
diff --git a/net/mac80211/debug.h b/net/mac80211/debug.h
index 493d68061f0c..1956b3115dd5 100644
--- a/net/mac80211/debug.h
+++ b/net/mac80211/debug.h
@@ -2,6 +2,12 @@
 #define __MAC80211_DEBUG_H
 #include <net/cfg80211.h>
 
+#ifdef CONFIG_MAC80211_OCB_DEBUG
+#define MAC80211_OCB_DEBUG 1
+#else
+#define MAC80211_OCB_DEBUG 0
+#endif
+
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
 #define MAC80211_IBSS_DEBUG 1
 #else
@@ -131,6 +137,10 @@ do {									\
         _sdata_dbg(MAC80211_HT_DEBUG && net_ratelimit(),                \
                    sdata, fmt, ##__VA_ARGS__)
 
+#define ocb_dbg(sdata, fmt, ...)                                        \
+        _sdata_dbg(MAC80211_OCB_DEBUG,                                  \
+                   sdata, fmt, ##__VA_ARGS__)
+
 #define ibss_dbg(sdata, fmt, ...)                                       \
         _sdata_dbg(MAC80211_IBSS_DEBUG,                                 \
                    sdata, fmt, ##__VA_ARGS__)
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 1521cabad3d6..5523b94c7c90 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -300,10 +300,8 @@ void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)
 
         lockdep_assert_held(&sdata->local->key_mtx);
 
-        if (sdata->debugfs.default_unicast_key) {
-                debugfs_remove(sdata->debugfs.default_unicast_key);
-                sdata->debugfs.default_unicast_key = NULL;
-        }
+        debugfs_remove(sdata->debugfs.default_unicast_key);
+        sdata->debugfs.default_unicast_key = NULL;
 
         if (sdata->default_unicast_key) {
                 key = key_mtx_dereference(sdata->local,
@@ -314,10 +312,8 @@ void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)
                                                sdata->vif.debugfs_dir, buf);
         }
 
-        if (sdata->debugfs.default_multicast_key) {
-                debugfs_remove(sdata->debugfs.default_multicast_key);
-                sdata->debugfs.default_multicast_key = NULL;
-        }
+        debugfs_remove(sdata->debugfs.default_multicast_key);
+        sdata->debugfs.default_multicast_key = NULL;
 
         if (sdata->default_multicast_key) {
                 key = key_mtx_dereference(sdata->local,
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 196d48c68134..9759dd1f0734 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -214,7 +214,8 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
                                     BSS_CHANGED_BEACON_ENABLED) &&
                          sdata->vif.type != NL80211_IFTYPE_AP &&
                          sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-                         sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
+                         sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+                         sdata->vif.type != NL80211_IFTYPE_OCB))
                 return;
 
         if (WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
@@ -631,6 +632,12 @@ static inline int drv_conf_tx(struct ieee80211_local *local,
         if (!check_sdata_in_driver(sdata))
                 return -EIO;
 
+        if (WARN_ONCE(params->cw_min == 0 ||
+                      params->cw_min > params->cw_max,
+                      "%s: invalid CW_min/CW_max: %d/%d\n",
+                      sdata->name, params->cw_min, params->cw_max))
+                return -EINVAL;
+
         trace_drv_conf_tx(local, sdata, ac, params);
         if (local->ops->conf_tx)
                 ret = local->ops->conf_tx(&local->hw, &sdata->vif,
@@ -764,12 +771,13 @@ static inline void drv_flush(struct ieee80211_local *local,
 }
 
 static inline void drv_channel_switch(struct ieee80211_local *local,
-                                     struct ieee80211_channel_switch *ch_switch)
+                                      struct ieee80211_sub_if_data *sdata,
+                                      struct ieee80211_channel_switch *ch_switch)
 {
         might_sleep();
 
-        trace_drv_channel_switch(local, ch_switch);
-        local->ops->channel_switch(&local->hw, ch_switch);
+        trace_drv_channel_switch(local, sdata, ch_switch);
+        local->ops->channel_switch(&local->hw, &sdata->vif, ch_switch);
         trace_drv_return_void(local);
 }
 
@@ -1144,13 +1152,15 @@ static inline void drv_stop_ap(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
-static inline void drv_restart_complete(struct ieee80211_local *local)
+static inline void
+drv_reconfig_complete(struct ieee80211_local *local,
+                      enum ieee80211_reconfig_type reconfig_type)
 {
         might_sleep();
 
-        trace_drv_restart_complete(local);
-        if (local->ops->restart_complete)
-                local->ops->restart_complete(&local->hw);
+        trace_drv_reconfig_complete(local, reconfig_type);
+        if (local->ops->reconfig_complete)
+                local->ops->reconfig_complete(&local->hw, reconfig_type);
         trace_drv_return_void(local);
 }
 
@@ -1196,6 +1206,40 @@ drv_channel_switch_beacon(struct ieee80211_sub_if_data *sdata,
         }
 }
 
+static inline int
+drv_pre_channel_switch(struct ieee80211_sub_if_data *sdata,
+                       struct ieee80211_channel_switch *ch_switch)
+{
+        struct ieee80211_local *local = sdata->local;
+        int ret = 0;
+
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
+
+        trace_drv_pre_channel_switch(local, sdata, ch_switch);
+        if (local->ops->pre_channel_switch)
+                ret = local->ops->pre_channel_switch(&local->hw, &sdata->vif,
+                                                     ch_switch);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
+static inline int
+drv_post_channel_switch(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        int ret = 0;
+
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
+
+        trace_drv_post_channel_switch(local, sdata);
+        if (local->ops->post_channel_switch)
+                ret = local->ops->post_channel_switch(&local->hw, &sdata->vif);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
 static inline int drv_join_ibss(struct ieee80211_local *local,
                                 struct ieee80211_sub_if_data *sdata)
 {
@@ -1238,4 +1282,18 @@ static inline u32 drv_get_expected_throughput(struct ieee80211_local *local,
         return ret;
 }
 
+static inline int drv_get_txpower(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata, int *dbm)
+{
+        int ret;
+
+        if (!local->ops->get_txpower)
+                return -EOPNOTSUPP;
+
+        ret = local->ops->get_txpower(&local->hw, &sdata->vif, dbm);
+        trace_drv_get_txpower(local, sdata, *dbm, ret);
+
+        return ret;
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c2aaec4dfcf0..a51c993ece73 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -131,7 +131,7 @@ enum ieee80211_bss_corrupt_data_flags {
  *
  * These are bss flags that are attached to a bss in the
  * @valid_data field of &struct ieee80211_bss.  They show which parts
- * of the data structure were recieved as a result of an un-corrupted
+ * of the data structure were received as a result of an un-corrupted
  * beacon/probe response.
  */
 enum ieee80211_bss_valid_data_flags {
@@ -399,6 +399,24 @@ struct ieee80211_mgd_assoc_data {
         u8 ie[];
 };
 
+struct ieee80211_sta_tx_tspec {
+        /* timestamp of the first packet in the time slice */
+        unsigned long time_slice_start;
+
+        u32 admitted_time; /* in usecs, unlike over the air */
+        u8 tsid;
+        s8 up; /* signed to be able to invalidate with -1 during teardown */
+
+        /* consumed TX time in microseconds in the time slice */
+        u32 consumed_tx_time;
+        enum {
+                TX_TSPEC_ACTION_NONE = 0,
+                TX_TSPEC_ACTION_DOWNGRADE,
+                TX_TSPEC_ACTION_STOP_DOWNGRADE,
+        } action;
+        bool downgraded;
+};
+
 struct ieee80211_if_managed {
         struct timer_list timer;
         struct timer_list conn_mon_timer;
@@ -434,6 +452,8 @@ struct ieee80211_if_managed {
 
         unsigned int flags;
 
+        bool csa_waiting_bcn;
+
         bool beacon_crc_valid;
         u32 beacon_crc;
 
@@ -507,6 +527,16 @@ struct ieee80211_if_managed {
 
         u8 tdls_peer[ETH_ALEN] __aligned(2);
         struct delayed_work tdls_peer_del_work;
+
+        /* WMM-AC TSPEC support */
+        struct ieee80211_sta_tx_tspec tx_tspec[IEEE80211_NUM_ACS];
+        /* Use a separate work struct so that we can do something here
+         * while the sdata->work is flushing the queues, for example.
+         * otherwise, in scenarios where we hardly get any traffic out
+         * on the BE queue, but there's a lot of VO traffic, we might
+         * get stuck in a downgraded situation and flush takes forever.
+         */
+        struct delayed_work tx_tspec_wk;
 };
 
 struct ieee80211_if_ibss {
@@ -547,6 +577,25 @@ struct ieee80211_if_ibss {
 };
 
 /**
+ * struct ieee80211_if_ocb - OCB mode state
+ *
+ * @housekeeping_timer: timer for periodic invocation of a housekeeping task
+ * @wrkq_flags: OCB deferred task action
+ * @incomplete_lock: delayed STA insertion lock
+ * @incomplete_stations: list of STAs waiting for delayed insertion
+ * @joined: indication if the interface is connected to an OCB network
+ */
+struct ieee80211_if_ocb {
+        struct timer_list housekeeping_timer;
+        unsigned long wrkq_flags;
+
+        spinlock_t incomplete_lock;
+        struct list_head incomplete_stations;
+
+        bool joined;
+};
+
+/**
  * struct ieee80211_mesh_sync_ops - Extensible synchronization framework interface
  *
  * these declarations define the interface, which enables
@@ -839,6 +888,7 @@ struct ieee80211_sub_if_data {
                 struct ieee80211_if_managed mgd;
                 struct ieee80211_if_ibss ibss;
                 struct ieee80211_if_mesh mesh;
+                struct ieee80211_if_ocb ocb;
                 u32 mntr_flags;
         } u;
 
@@ -1307,6 +1357,9 @@ struct ieee80211_local {
         /* virtual monitor interface */
         struct ieee80211_sub_if_data __rcu *monitor_sdata;
         struct cfg80211_chan_def monitor_chandef;
+
+        /* extended capabilities provided by mac80211 */
+        u8 ext_capa[8];
 };
 
 static inline struct ieee80211_sub_if_data *
@@ -1454,6 +1507,7 @@ void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
                                   __le16 fc, bool acked);
 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
@@ -1471,6 +1525,15 @@ int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata,
 int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_stop(struct ieee80211_sub_if_data *sdata);
 
+/* OCB code */
+void ieee80211_ocb_work(struct ieee80211_sub_if_data *sdata);
+void ieee80211_ocb_rx_no_sta(struct ieee80211_sub_if_data *sdata,
+                             const u8 *bssid, const u8 *addr, u32 supp_rates);
+void ieee80211_ocb_setup_sdata(struct ieee80211_sub_if_data *sdata);
+int ieee80211_ocb_join(struct ieee80211_sub_if_data *sdata,
+                       struct ocb_setup *setup);
+int ieee80211_ocb_leave(struct ieee80211_sub_if_data *sdata);
+
 /* mesh code */
 void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
@@ -1758,6 +1821,13 @@ static inline bool ieee80211_rx_reorder_ready(struct sk_buff_head *frames)
         return true;
 }
 
+extern const int ieee802_1d_to_ac[8];
+
+static inline int ieee80211_ac_from_tid(int tid)
+{
+        return ieee802_1d_to_ac[tid & 7];
+}
+
 void ieee80211_dynamic_ps_enable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_timer(unsigned long data);
@@ -1767,7 +1837,7 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_hdr *hdr);
 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_hdr *hdr, bool ack);
+                             struct ieee80211_hdr *hdr, bool ack, u16 tx_time);
 
 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
                                      unsigned long queues,
@@ -1833,8 +1903,10 @@ int __ieee80211_request_smps_ap(struct ieee80211_sub_if_data *sdata,
 void ieee80211_recalc_smps(struct ieee80211_sub_if_data *sdata);
 void ieee80211_recalc_min_chandef(struct ieee80211_sub_if_data *sdata);
 
-size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
-                          const u8 *ids, int n_ids, size_t offset);
+size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
+                              const u8 *ids, int n_ids,
+                              const u8 *after_ric, int n_after_ric,
+                              size_t offset);
 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset);
 u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                               u16 cap);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index af237223a8cd..6b631c049eba 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -259,6 +259,15 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
         list_for_each_entry(nsdata, &local->interfaces, list) {
                 if (nsdata != sdata && ieee80211_sdata_running(nsdata)) {
                         /*
+                         * Only OCB and monitor mode may coexist
+                         */
+                        if ((sdata->vif.type == NL80211_IFTYPE_OCB &&
+                             nsdata->vif.type != NL80211_IFTYPE_MONITOR) ||
+                            (sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+                             nsdata->vif.type == NL80211_IFTYPE_OCB))
+                                return -EBUSY;
+
+                        /*
                          * Allow only a single IBSS interface to be up at any
                          * time. This is restricted because beacon distribution
                          * cannot work properly if both are in the same IBSS.
@@ -521,6 +530,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_P2P_DEVICE:
+        case NL80211_IFTYPE_OCB:
                 /* no special treatment */
                 break;
         case NL80211_IFTYPE_UNSPECIFIED:
@@ -631,6 +641,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                 case NL80211_IFTYPE_ADHOC:
                 case NL80211_IFTYPE_AP:
                 case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_OCB:
                         netif_carrier_off(dev);
                         break;
                 case NL80211_IFTYPE_WDS:
@@ -842,6 +853,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         sdata_lock(sdata);
         mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                sdata->u.mgd.csa_waiting_bcn = false;
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
                                           IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -1279,6 +1292,9 @@ static void ieee80211_iface_work(struct work_struct *work)
                         break;
                 ieee80211_mesh_work(sdata);
                 break;
+        case NL80211_IFTYPE_OCB:
+                ieee80211_ocb_work(sdata);
+                break;
         default:
                 break;
         }
@@ -1298,6 +1314,9 @@ static void ieee80211_recalc_smps_work(struct work_struct *work)
 static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                                   enum nl80211_iftype type)
 {
+        static const u8 bssid_wildcard[ETH_ALEN] = {0xff, 0xff, 0xff,
+                                                    0xff, 0xff, 0xff};
+
         /* clear type-dependent union */
         memset(&sdata->u, 0, sizeof(sdata->u));
 
@@ -1349,6 +1368,10 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                 sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
                 ieee80211_sta_setup_sdata(sdata);
                 break;
+        case NL80211_IFTYPE_OCB:
+                sdata->vif.bss_conf.bssid = bssid_wildcard;
+                ieee80211_ocb_setup_sdata(sdata);
+                break;
         case NL80211_IFTYPE_ADHOC:
                 sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
                 ieee80211_ibss_setup_sdata(sdata);
@@ -1396,6 +1419,7 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_OCB:
                 /*
                  * Could maybe also all others here?
                  * Just not sure how that interacts
@@ -1411,6 +1435,7 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_OCB:
                 /*
                  * Could probably support everything
                  * but WDS here (WDS do_open can fail
@@ -1669,7 +1694,10 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                 }
 
                 ieee80211_assign_perm_addr(local, ndev->perm_addr, type);
-                memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
+                if (params && is_valid_ether_addr(params->macaddr))
+                        memcpy(ndev->dev_addr, params->macaddr, ETH_ALEN);
+                else
+                        memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
                 SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
 
                 /* don't use IEEE80211_DEV_TO_SUB_IF -- it checks too much */
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 4712150dc210..434a91ad12c8 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -94,8 +94,17 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         might_sleep();
 
-        if (key->flags & KEY_FLAG_TAINTED)
+        if (key->flags & KEY_FLAG_TAINTED) {
+                /* If we get here, it's during resume and the key is
+                 * tainted so shouldn't be used/programmed any more.
+                 * However, its flags may still indicate that it was
+                 * programmed into the device (since we're in resume)
+                 * so clear that flag now to avoid trying to remove
+                 * it again later.
+                 */
+                key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
                 return -EINVAL;
+        }
 
         if (!key->local->ops->set_key)
                 goto out_unsupported;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 0de7c93bf62b..282a4f36eb92 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -478,13 +478,9 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
         },
 };
 
-static const u8 extended_capabilities[] = {
-        0, 0, 0, 0, 0, 0, 0,
-        WLAN_EXT_CAPA8_OPMODE_NOTIF,
-};
-
-struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
-                                        const struct ieee80211_ops *ops)
+struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+                                           const struct ieee80211_ops *ops,
+                                           const char *requested_name)
 {
         struct ieee80211_local *local;
         int priv_size, i;
@@ -524,7 +520,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
          */
         priv_size = ALIGN(sizeof(*local), NETDEV_ALIGN) + priv_data_len;
 
-        wiphy = wiphy_new(&mac80211_config_ops, priv_size);
+        wiphy = wiphy_new_nm(&mac80211_config_ops, priv_size, requested_name);
 
         if (!wiphy)
                 return NULL;
@@ -539,10 +535,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                         WIPHY_FLAG_REPORTS_OBSS |
                         WIPHY_FLAG_OFFCHAN_TX;
 
-        wiphy->extended_capabilities = extended_capabilities;
-        wiphy->extended_capabilities_mask = extended_capabilities;
-        wiphy->extended_capabilities_len = ARRAY_SIZE(extended_capabilities);
-
         if (ops->remain_on_channel)
                 wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
@@ -550,6 +542,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                            NL80211_FEATURE_SAE |
                            NL80211_FEATURE_HT_IBSS |
                            NL80211_FEATURE_VIF_TXPOWER |
+                           NL80211_FEATURE_MAC_ON_CREATE |
                            NL80211_FEATURE_USERSPACE_MPM;
 
         if (!ops->hw_scan)
@@ -591,6 +584,13 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         wiphy->ht_capa_mod_mask = &mac80211_ht_capa_mod_mask;
         wiphy->vht_capa_mod_mask = &mac80211_vht_capa_mod_mask;
 
+        local->ext_capa[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF;
+
+        wiphy->extended_capabilities = local->ext_capa;
+        wiphy->extended_capabilities_mask = local->ext_capa;
+        wiphy->extended_capabilities_len =
+                ARRAY_SIZE(local->ext_capa);
+
         INIT_LIST_HEAD(&local->interfaces);
 
         __hw_addr_init(&local->mc_list);
@@ -651,7 +651,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         return &local->hw;
 }
-EXPORT_SYMBOL(ieee80211_alloc_hw);
+EXPORT_SYMBOL(ieee80211_alloc_hw_nm);
 
 static int ieee80211_init_cipher_suites(struct ieee80211_local *local)
 {
@@ -787,13 +787,14 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_WDS))
                         return -EINVAL;
 
-                /* DFS currently not supported with channel context drivers */
+                /* DFS is not supported with multi-channel combinations yet */
                 for (i = 0; i < local->hw.wiphy->n_iface_combinations; i++) {
                         const struct ieee80211_iface_combination *comb;
 
                         comb = &local->hw.wiphy->iface_combinations[i];
 
-                        if (comb->radar_detect_widths)
+                        if (comb->radar_detect_widths &&
+                            comb->num_different_channels > 1)
                                 return -EINVAL;
                 }
         }
@@ -958,6 +959,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)
                 local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
 
+        /* mac80211 supports eCSA, if the driver supports STA CSA at all */
+        if (local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)
+                local->ext_capa[0] |= WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING;
+
         local->hw.wiphy->max_num_csa_counters = IEEE80211_MAX_CSA_COUNTERS_NUM;
 
         result = wiphy_register(local->hw.wiphy);
@@ -1019,7 +1024,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         }
 
         /* add one default STA interface if supported */
-        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION)) {
+        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION) &&
+            !(hw->flags & IEEE80211_HW_NO_AUTO_VIF)) {
                 result = ieee80211_if_add(local, "wlan%d", NULL,
                                           NL80211_IFTYPE_STATION, NULL);
                 if (result)
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index f39a19f9090f..50c8473cf9dc 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -270,6 +270,8 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
                  const u8 *dst, const u8 *mpp);
 struct mesh_path *
 mesh_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx);
+struct mesh_path *
+mpp_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx);
 void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop);
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata);
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
@@ -317,6 +319,7 @@ void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
 
 bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
 extern int mesh_paths_generation;
+extern int mpp_paths_generation;
 
 #ifdef CONFIG_MAC80211_MESH
 static inline
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index a6699dceae7c..b890e225a8f1 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -44,6 +44,7 @@ static struct mesh_table __rcu *mesh_paths;
 static struct mesh_table __rcu *mpp_paths; /* Store paths for MPP&MAP */
 
 int mesh_paths_generation;
+int mpp_paths_generation;
 
 /* This lock will have the grow table function as writer and add / delete nodes
  * as readers. RCU provides sufficient protection only when reading the table
@@ -410,6 +411,33 @@ mesh_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx)
 }
 
 /**
+ * mpp_path_lookup_by_idx - look up a path in the proxy path table by its index
+ * @idx: index
+ * @sdata: local subif, or NULL for all entries
+ *
+ * Returns: pointer to the proxy path structure, or NULL if not found.
+ *
+ * Locking: must be called within a read rcu section.
+ */
+struct mesh_path *
+mpp_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx)
+{
+        struct mesh_table *tbl = rcu_dereference(mpp_paths);
+        struct mpath_node *node;
+        int i;
+        int j = 0;
+
+        for_each_mesh_entry(tbl, node, i) {
+                if (sdata && node->mpath->sdata != sdata)
+                        continue;
+                if (j++ == idx)
+                        return node->mpath;
+        }
+
+        return NULL;
+}
+
+/**
  * mesh_path_add_gate - add the given mpath to a mesh gate to our path table
  * @mpath: gate path to add to table
  */
@@ -691,6 +719,9 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
 
         spin_unlock(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
+
+        mpp_paths_generation++;
+
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPP_TABLE,  &ifmsh->wrkq_flags);
                 ieee80211_queue_work(&local->hw, &sdata->work);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2de88704278b..213a420704a6 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -775,11 +775,30 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                         WLAN_EID_QOS_CAPA,
                         WLAN_EID_RRM_ENABLED_CAPABILITIES,
                         WLAN_EID_MOBILITY_DOMAIN,
+                        WLAN_EID_FAST_BSS_TRANSITION,   /* reassoc only */
+                        WLAN_EID_RIC_DATA,              /* reassoc only */
                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
                 };
-                noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
-                                             before_ht, ARRAY_SIZE(before_ht),
-                                             offset);
+                static const u8 after_ric[] = {
+                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+                        WLAN_EID_HT_CAPABILITY,
+                        WLAN_EID_BSS_COEX_2040,
+                        WLAN_EID_EXT_CAPABILITY,
+                        WLAN_EID_QOS_TRAFFIC_CAPA,
+                        WLAN_EID_TIM_BCAST_REQ,
+                        WLAN_EID_INTERWORKING,
+                        /* 60GHz doesn't happen right now */
+                        WLAN_EID_VHT_CAPABILITY,
+                        WLAN_EID_OPMODE_NOTIF,
+                };
+
+                noffset = ieee80211_ie_split_ric(assoc_data->ie,
+                                                 assoc_data->ie_len,
+                                                 before_ht,
+                                                 ARRAY_SIZE(before_ht),
+                                                 after_ric,
+                                                 ARRAY_SIZE(after_ric),
+                                                 offset);
                 pos = skb_put(skb, noffset - offset);
                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
                 offset = noffset;
@@ -813,6 +832,8 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                         WLAN_EID_TIM_BCAST_REQ,
                         WLAN_EID_INTERWORKING,
                 };
+
+                /* RIC already taken above, so no need to handle here anymore */
                 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
                                              before_vht, ARRAY_SIZE(before_vht),
                                              offset);
@@ -1001,14 +1022,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         /* XXX: shouldn't really modify cfg80211-owned data! */
         ifmgd->associated->channel = sdata->csa_chandef.chan;
 
-        sdata->vif.csa_active = false;
-
-        /* XXX: wait for a beacon first? */
-        if (sdata->csa_block_tx) {
-                ieee80211_wake_vif_queues(local, sdata,
-                                          IEEE80211_QUEUE_STOP_REASON_CSA);
-                sdata->csa_block_tx = false;
-        }
+        ifmgd->csa_waiting_bcn = true;
 
         ieee80211_sta_reset_beacon_monitor(sdata);
         ieee80211_sta_reset_conn_monitor(sdata);
@@ -1019,6 +1033,35 @@ out:
         sdata_unlock(sdata);
 }
 
+static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        int ret;
+
+        sdata_assert_lock(sdata);
+
+        WARN_ON(!sdata->vif.csa_active);
+
+        if (sdata->csa_block_tx) {
+                ieee80211_wake_vif_queues(local, sdata,
+                                          IEEE80211_QUEUE_STOP_REASON_CSA);
+                sdata->csa_block_tx = false;
+        }
+
+        sdata->vif.csa_active = false;
+        ifmgd->csa_waiting_bcn = false;
+
+        ret = drv_post_channel_switch(sdata);
+        if (ret) {
+                sdata_info(sdata,
+                           "driver post channel switch failed, disconnecting\n");
+                ieee80211_queue_work(&local->hw,
+                                     &ifmgd->csa_connection_drop_work);
+                return;
+        }
+}
+
 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
@@ -1046,7 +1089,8 @@ static void ieee80211_chswitch_timer(unsigned long data)
 
 static void
 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
-                                 u64 timestamp, struct ieee802_11_elems *elems,
+                                 u64 timestamp, u32 device_timestamp,
+                                 struct ieee802_11_elems *elems,
                                  bool beacon)
 {
         struct ieee80211_local *local = sdata->local;
@@ -1056,6 +1100,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_chanctx *chanctx;
         enum ieee80211_band current_band;
         struct ieee80211_csa_ie csa_ie;
+        struct ieee80211_channel_switch ch_switch;
         int res;
 
         sdata_assert_lock(sdata);
@@ -1110,21 +1155,31 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 
         chanctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        if (local->use_chanctx) {
-                u32 num_chanctx = 0;
-                list_for_each_entry(chanctx, &local->chanctx_list, list)
-                       num_chanctx++;
+        if (local->use_chanctx &&
+            !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
+                sdata_info(sdata,
+                           "driver doesn't support chan-switch with channel contexts\n");
+                ieee80211_queue_work(&local->hw,
+                                     &ifmgd->csa_connection_drop_work);
+                mutex_unlock(&local->chanctx_mtx);
+                mutex_unlock(&local->mtx);
+                return;
+        }
 
-                if (num_chanctx > 1 ||
-                    !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
-                        sdata_info(sdata,
-                                   "not handling chan-switch with channel contexts\n");
-                        ieee80211_queue_work(&local->hw,
-                                             &ifmgd->csa_connection_drop_work);
-                        mutex_unlock(&local->chanctx_mtx);
-                        mutex_unlock(&local->mtx);
-                        return;
-                }
+        ch_switch.timestamp = timestamp;
+        ch_switch.device_timestamp = device_timestamp;
+        ch_switch.block_tx = csa_ie.mode;
+        ch_switch.chandef = csa_ie.chandef;
+        ch_switch.count = csa_ie.count;
+
+        if (drv_pre_channel_switch(sdata, &ch_switch)) {
+                sdata_info(sdata,
+                           "preparing for channel switch failed, disconnecting\n");
+                ieee80211_queue_work(&local->hw,
+                                     &ifmgd->csa_connection_drop_work);
+                mutex_unlock(&local->chanctx_mtx);
+                mutex_unlock(&local->mtx);
+                return;
         }
 
         res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
@@ -1152,14 +1207,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 
         if (local->ops->channel_switch) {
                 /* use driver's channel switch callback */
-                struct ieee80211_channel_switch ch_switch = {
-                        .timestamp = timestamp,
-                        .block_tx = csa_ie.mode,
-                        .chandef = csa_ie.chandef,
-                        .count = csa_ie.count,
-                };
-
-                drv_channel_switch(local, &ch_switch);
+                drv_channel_switch(local, sdata, &ch_switch);
                 return;
         }
 
@@ -1579,6 +1627,95 @@ void ieee80211_dfs_cac_timer_work(struct work_struct *work)
         mutex_unlock(&sdata->local->mtx);
 }
 
+static bool
+__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        bool ret;
+        int ac;
+
+        if (local->hw.queues < IEEE80211_NUM_ACS)
+                return false;
+
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
+                int non_acm_ac;
+                unsigned long now = jiffies;
+
+                if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
+                    tx_tspec->admitted_time &&
+                    time_after(now, tx_tspec->time_slice_start + HZ)) {
+                        tx_tspec->consumed_tx_time = 0;
+                        tx_tspec->time_slice_start = now;
+
+                        if (tx_tspec->downgraded)
+                                tx_tspec->action =
+                                        TX_TSPEC_ACTION_STOP_DOWNGRADE;
+                }
+
+                switch (tx_tspec->action) {
+                case TX_TSPEC_ACTION_STOP_DOWNGRADE:
+                        /* take the original parameters */
+                        if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
+                                sdata_err(sdata,
+                                          "failed to set TX queue parameters for queue %d\n",
+                                          ac);
+                        tx_tspec->action = TX_TSPEC_ACTION_NONE;
+                        tx_tspec->downgraded = false;
+                        ret = true;
+                        break;
+                case TX_TSPEC_ACTION_DOWNGRADE:
+                        if (time_after(now, tx_tspec->time_slice_start + HZ)) {
+                                tx_tspec->action = TX_TSPEC_ACTION_NONE;
+                                ret = true;
+                                break;
+                        }
+                        /* downgrade next lower non-ACM AC */
+                        for (non_acm_ac = ac + 1;
+                             non_acm_ac < IEEE80211_NUM_ACS;
+                             non_acm_ac++)
+                                if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
+                                        break;
+                        /* The loop will result in using BK even if it requires
+                         * admission control, such configuration makes no sense
+                         * and we have to transmit somehow - the AC selection
+                         * does the same thing.
+                         */
+                        if (drv_conf_tx(local, sdata, ac,
+                                        &sdata->tx_conf[non_acm_ac]))
+                                sdata_err(sdata,
+                                          "failed to set TX queue parameters for queue %d\n",
+                                          ac);
+                        tx_tspec->action = TX_TSPEC_ACTION_NONE;
+                        ret = true;
+                        schedule_delayed_work(&ifmgd->tx_tspec_wk,
+                                tx_tspec->time_slice_start + HZ - now + 1);
+                        break;
+                case TX_TSPEC_ACTION_NONE:
+                        /* nothing now */
+                        break;
+                }
+        }
+
+        return ret;
+}
+
+void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
+{
+        if (__ieee80211_sta_handle_tspec_ac_params(sdata))
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
+}
+
+static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = container_of(work, struct ieee80211_sub_if_data,
+                             u.mgd.tx_tspec_wk.work);
+        ieee80211_sta_handle_tspec_ac_params(sdata);
+}
+
 /* MLME */
 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
                                      struct ieee80211_sub_if_data *sdata,
@@ -1663,12 +1800,14 @@ static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
                 params.uapsd = uapsd;
 
                 mlme_dbg(sdata,
-                         "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
+                         "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
                          queue, aci, acm,
                          params.aifs, params.cw_min, params.cw_max,
-                         params.txop, params.uapsd);
+                         params.txop, params.uapsd,
+                         ifmgd->tx_tspec[queue].downgraded);
                 sdata->tx_conf[queue] = params;
-                if (drv_conf_tx(local, sdata, queue, &params))
+                if (!ifmgd->tx_tspec[queue].downgraded &&
+                    drv_conf_tx(local, sdata, queue, &params))
                         sdata_err(sdata,
                                   "failed to set TX queue parameters for queue %d\n",
                                   queue);
@@ -1923,6 +2062,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         ieee80211_vif_release_channel(sdata);
 
         sdata->vif.csa_active = false;
+        ifmgd->csa_waiting_bcn = false;
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
                                           IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -1930,6 +2070,10 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         }
         mutex_unlock(&local->mtx);
 
+        /* existing TX TSPEC sessions no longer exist */
+        memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
+        cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
+
         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
 }
 
@@ -1982,9 +2126,46 @@ out:
         mutex_unlock(&local->mtx);
 }
 
+static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
+                                           struct ieee80211_hdr *hdr,
+                                           u16 tx_time)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u16 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
+        int ac = ieee80211_ac_from_tid(tid);
+        struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
+        unsigned long now = jiffies;
+
+        if (likely(!tx_tspec->admitted_time))
+                return;
+
+        if (time_after(now, tx_tspec->time_slice_start + HZ)) {
+                tx_tspec->consumed_tx_time = 0;
+                tx_tspec->time_slice_start = now;
+
+                if (tx_tspec->downgraded) {
+                        tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
+                        schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
+                }
+        }
+
+        if (tx_tspec->downgraded)
+                return;
+
+        tx_tspec->consumed_tx_time += tx_time;
+
+        if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
+                tx_tspec->downgraded = true;
+                tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
+                schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
+        }
+}
+
 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_hdr *hdr, bool ack)
+                             struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
 {
+        ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
+
         if (!ieee80211_is_data(hdr->frame_control))
             return;
 
@@ -2047,8 +2228,6 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
 
         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
         run_again(sdata, ifmgd->probe_timeout);
-        if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
-                ieee80211_flush_queues(sdata->local, sdata);
 }
 
 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
@@ -2171,6 +2350,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
                                true, frame_buf);
         mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
+        ifmgd->csa_waiting_bcn = false;
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
                                           IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -3195,6 +3375,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
+        if (ifmgd->csa_waiting_bcn)
+                ieee80211_chswitch_post_beacon(sdata);
+
         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
                 return;
         ifmgd->beacon_crc = ncrc;
@@ -3203,6 +3386,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
 
         ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
+                                         rx_status->device_timestamp,
                                          &elems, true);
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
@@ -3334,8 +3518,9 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                 break;
 
                         ieee80211_sta_process_chanswitch(sdata,
-                                                         rx_status->mactime,
-                                                         &elems, false);
+                                                 rx_status->mactime,
+                                                 rx_status->device_timestamp,
+                                                 &elems, false);
                 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
                         ies_len = skb->len -
                                   offsetof(struct ieee80211_mgmt,
@@ -3356,8 +3541,9 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                 &mgmt->u.action.u.ext_chan_switch.data;
 
                         ieee80211_sta_process_chanswitch(sdata,
-                                                         rx_status->mactime,
-                                                         &elems, false);
+                                                 rx_status->mactime,
+                                                 rx_status->device_timestamp,
+                                                 &elems, false);
                 }
                 break;
         }
@@ -3664,11 +3850,12 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         if (local->quiescing)
                 return;
 
-        if (sdata->vif.csa_active)
+        if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
                 return;
 
         sdata->u.mgd.connection_loss = false;
@@ -3686,7 +3873,7 @@ static void ieee80211_sta_conn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
-        if (sdata->vif.csa_active)
+        if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
                 return;
 
         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
@@ -3798,6 +3985,8 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
                     (unsigned long) sdata);
+        INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
+                          ieee80211_sta_handle_tspec_ac_params_wk);
 
         ifmgd->flags = 0;
         ifmgd->powersave = sdata->wdev.ps;
diff --git a/net/mac80211/ocb.c b/net/mac80211/ocb.c
new file mode 100644
index 000000000000..358d5f9d8207
--- /dev/null
+++ b/net/mac80211/ocb.c
@@ -0,0 +1,250 @@
+/*
+ * OCB mode implementation
+ *
+ * Copyright: (c) 2014 Czech Technical University in Prague
+ *            (c) 2014 Volkswagen Group Research
+ * Author:    Rostislav Lisovy <rostislav.lisovy@fel.cvut.cz>
+ * Funded by: Volkswagen Group Research
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/rtnetlink.h>
+#include <net/mac80211.h>
+#include <asm/unaligned.h>
+
+#include "ieee80211_i.h"
+#include "driver-ops.h"
+#include "rate.h"
+
+#define IEEE80211_OCB_HOUSEKEEPING_INTERVAL             (60 * HZ)
+#define IEEE80211_OCB_PEER_INACTIVITY_LIMIT             (240 * HZ)
+#define IEEE80211_OCB_MAX_STA_ENTRIES                   128
+
+/**
+ * enum ocb_deferred_task_flags - mac80211 OCB deferred tasks
+ * @OCB_WORK_HOUSEKEEPING: run the periodic OCB housekeeping tasks
+ *
+ * These flags are used in @wrkq_flags field of &struct ieee80211_if_ocb
+ */
+enum ocb_deferred_task_flags {
+        OCB_WORK_HOUSEKEEPING,
+};
+
+void ieee80211_ocb_rx_no_sta(struct ieee80211_sub_if_data *sdata,
+                             const u8 *bssid, const u8 *addr,
+                             u32 supp_rates)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_supported_band *sband;
+        enum nl80211_bss_scan_width scan_width;
+        struct sta_info *sta;
+        int band;
+
+        /* XXX: Consider removing the least recently used entry and
+         *      allow new one to be added.
+         */
+        if (local->num_sta >= IEEE80211_OCB_MAX_STA_ENTRIES) {
+                net_info_ratelimited("%s: No room for a new OCB STA entry %pM\n",
+                                     sdata->name, addr);
+                return;
+        }
+
+        ocb_dbg(sdata, "Adding new OCB station %pM\n", addr);
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (WARN_ON_ONCE(!chanctx_conf)) {
+                rcu_read_unlock();
+                return;
+        }
+        band = chanctx_conf->def.chan->band;
+        scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
+        rcu_read_unlock();
+
+        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
+        if (!sta)
+                return;
+
+        sta->last_rx = jiffies;
+
+        /* Add only mandatory rates for now */
+        sband = local->hw.wiphy->bands[band];
+        sta->sta.supp_rates[band] =
+                ieee80211_mandatory_rates(sband, scan_width);
+
+        spin_lock(&ifocb->incomplete_lock);
+        list_add(&sta->list, &ifocb->incomplete_stations);
+        spin_unlock(&ifocb->incomplete_lock);
+        ieee80211_queue_work(&local->hw, &sdata->work);
+}
+
+static struct sta_info *ieee80211_ocb_finish_sta(struct sta_info *sta)
+        __acquires(RCU)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u8 addr[ETH_ALEN];
+
+        memcpy(addr, sta->sta.addr, ETH_ALEN);
+
+        ocb_dbg(sdata, "Adding new IBSS station %pM (dev=%s)\n",
+                addr, sdata->name);
+
+        sta_info_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+        sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+
+        rate_control_rate_init(sta);
+
+        /* If it fails, maybe we raced another insertion? */
+        if (sta_info_insert_rcu(sta))
+                return sta_info_get(sdata, addr);
+        return sta;
+}
+
+static void ieee80211_ocb_housekeeping(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+
+        ocb_dbg(sdata, "Running ocb housekeeping\n");
+
+        ieee80211_sta_expire(sdata, IEEE80211_OCB_PEER_INACTIVITY_LIMIT);
+
+        mod_timer(&ifocb->housekeeping_timer,
+                  round_jiffies(jiffies + IEEE80211_OCB_HOUSEKEEPING_INTERVAL));
+}
+
+void ieee80211_ocb_work(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+        struct sta_info *sta;
+
+        if (ifocb->joined != true)
+                return;
+
+        sdata_lock(sdata);
+
+        spin_lock_bh(&ifocb->incomplete_lock);
+        while (!list_empty(&ifocb->incomplete_stations)) {
+                sta = list_first_entry(&ifocb->incomplete_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&ifocb->incomplete_lock);
+
+                ieee80211_ocb_finish_sta(sta);
+                rcu_read_unlock();
+                spin_lock_bh(&ifocb->incomplete_lock);
+        }
+        spin_unlock_bh(&ifocb->incomplete_lock);
+
+        if (test_and_clear_bit(OCB_WORK_HOUSEKEEPING, &ifocb->wrkq_flags))
+                ieee80211_ocb_housekeeping(sdata);
+
+        sdata_unlock(sdata);
+}
+
+static void ieee80211_ocb_housekeeping_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata = (void *)data;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+
+        set_bit(OCB_WORK_HOUSEKEEPING, &ifocb->wrkq_flags);
+
+        ieee80211_queue_work(&local->hw, &sdata->work);
+}
+
+void ieee80211_ocb_setup_sdata(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+
+        setup_timer(&ifocb->housekeeping_timer,
+                    ieee80211_ocb_housekeeping_timer,
+                    (unsigned long)sdata);
+        INIT_LIST_HEAD(&ifocb->incomplete_stations);
+        spin_lock_init(&ifocb->incomplete_lock);
+}
+
+int ieee80211_ocb_join(struct ieee80211_sub_if_data *sdata,
+                       struct ocb_setup *setup)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+        u32 changed = BSS_CHANGED_OCB;
+        int err;
+
+        if (ifocb->joined == true)
+                return -EINVAL;
+
+        sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+        sdata->smps_mode = IEEE80211_SMPS_OFF;
+        sdata->needed_rx_chains = sdata->local->rx_chains;
+
+        mutex_lock(&sdata->local->mtx);
+        err = ieee80211_vif_use_channel(sdata, &setup->chandef,
+                                        IEEE80211_CHANCTX_SHARED);
+        mutex_unlock(&sdata->local->mtx);
+        if (err)
+                return err;
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        ifocb->joined = true;
+
+        set_bit(OCB_WORK_HOUSEKEEPING, &ifocb->wrkq_flags);
+        ieee80211_queue_work(&local->hw, &sdata->work);
+
+        netif_carrier_on(sdata->dev);
+        return 0;
+}
+
+int ieee80211_ocb_leave(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        ifocb->joined = false;
+        sta_info_flush(sdata);
+
+        spin_lock_bh(&ifocb->incomplete_lock);
+        while (!list_empty(&ifocb->incomplete_stations)) {
+                sta = list_first_entry(&ifocb->incomplete_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&ifocb->incomplete_lock);
+
+                sta_info_free(local, sta);
+                spin_lock_bh(&ifocb->incomplete_lock);
+        }
+        spin_unlock_bh(&ifocb->incomplete_lock);
+
+        netif_carrier_off(sdata->dev);
+        clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_OCB);
+
+        mutex_lock(&sdata->local->mtx);
+        ieee80211_vif_release_channel(sdata);
+        mutex_unlock(&sdata->local->mtx);
+
+        skb_queue_purge(&sdata->skb_queue);
+
+        del_timer_sync(&sdata->u.ocb.housekeeping_timer);
+        /* If the timer fired while we waited for it, it will have
+         * requeued the work. Now the work will be running again
+         * but will not rearm the timer again because it checks
+         * whether we are connected to the network or not -- at this
+         * point we shouldn't be anymore.
+         */
+
+        return 0;
+}
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 2baa7ed8789d..c2b91bf47f6d 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -191,7 +191,7 @@ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
                  * (1) if any success probabilitiy >= 95%, out of those rates
                  * choose the maximum throughput rate as max_prob_rate
                  * (2) if all success probabilities < 95%, the rate with
-                 * highest success probability is choosen as max_prob_rate */
+                 * highest success probability is chosen as max_prob_rate */
                 if (mrs->probability >= MINSTREL_FRAC(95, 100)) {
                         if (mrs->cur_tp >= mi->r[tmp_prob_rate].stats.cur_tp)
                                 tmp_prob_rate = i;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index df90ce2db00c..c50fd94d2aef 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -10,6 +10,7 @@
 #include <linux/skbuff.h>
 #include <linux/debugfs.h>
 #include <linux/random.h>
+#include <linux/moduleparam.h>
 #include <linux/ieee80211.h>
 #include <net/mac80211.h>
 #include "rate.h"
@@ -34,12 +35,17 @@
 /* Transmit duration for the raw data part of an average sized packet */
 #define MCS_DURATION(streams, sgi, bps) MCS_SYMBOL_TIME(sgi, MCS_NSYMS((streams) * (bps)))
 
+#define BW_20                   0
+#define BW_40                   1
+#define BW_80                   2
+
 /*
  * Define group sort order: HT40 -> SGI -> #streams
  */
 #define GROUP_IDX(_streams, _sgi, _ht40)        \
+        MINSTREL_HT_GROUP_0 +                   \
         MINSTREL_MAX_STREAMS * 2 * _ht40 +      \
-        MINSTREL_MAX_STREAMS * _sgi +           \
+        MINSTREL_MAX_STREAMS * _sgi +   \
         _streams - 1
 
 /* MCS rate information for an MCS group */
@@ -47,6 +53,7 @@
         [GROUP_IDX(_streams, _sgi, _ht40)] = {                          \
         .streams = _streams,                                            \
         .flags =                                                        \
+                IEEE80211_TX_RC_MCS |                                   \
                 (_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |                 \
                 (_ht40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),             \
         .duration = {                                                   \
@@ -61,6 +68,47 @@
         }                                                               \
 }
 
+#define VHT_GROUP_IDX(_streams, _sgi, _bw)                              \
+        (MINSTREL_VHT_GROUP_0 +                                         \
+         MINSTREL_MAX_STREAMS * 2 * (_bw) +                             \
+         MINSTREL_MAX_STREAMS * (_sgi) +                                \
+         (_streams) - 1)
+
+#define BW2VBPS(_bw, r3, r2, r1)                                        \
+        (_bw == BW_80 ? r3 : _bw == BW_40 ? r2 : r1)
+
+#define VHT_GROUP(_streams, _sgi, _bw)                                  \
+        [VHT_GROUP_IDX(_streams, _sgi, _bw)] = {                        \
+        .streams = _streams,                                            \
+        .flags =                                                        \
+                IEEE80211_TX_RC_VHT_MCS |                               \
+                (_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |                 \
+                (_bw == BW_80 ? IEEE80211_TX_RC_80_MHZ_WIDTH :          \
+                 _bw == BW_40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),      \
+        .duration = {                                                   \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  117,  54,  26)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  234, 108,  52)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  351, 162,  78)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  468, 216, 104)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  702, 324, 156)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  936, 432, 208)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw, 1053, 486, 234)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw, 1170, 540, 260)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw, 1404, 648, 312)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw, 1560, 720, 346))              \
+        }                                                               \
+}
+
 #define CCK_DURATION(_bitrate, _short, _len)            \
         (1000 * (10 /* SIFS */ +                        \
          (_short ? 72 + 24 : 144 + 48) +                \
@@ -76,53 +124,96 @@
         CCK_ACK_DURATION(55, _short),                   \
         CCK_ACK_DURATION(110, _short)
 
-#define CCK_GROUP                                               \
-        [MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS] = {     \
-                .streams = 0,                                   \
-                .duration = {                                   \
-                        CCK_DURATION_LIST(false),               \
-                        CCK_DURATION_LIST(true)                 \
-                }                                               \
+#define CCK_GROUP                                       \
+        [MINSTREL_CCK_GROUP] = {                        \
+                .streams = 0,                           \
+                .flags = 0,                             \
+                .duration = {                           \
+                        CCK_DURATION_LIST(false),       \
+                        CCK_DURATION_LIST(true)         \
+                }                                       \
         }
 
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+static bool minstrel_vht_only = true;
+module_param(minstrel_vht_only, bool, 0644);
+MODULE_PARM_DESC(minstrel_vht_only,
+                 "Use only VHT rates when VHT is supported by sta.");
+#endif
+
 /*
  * To enable sufficiently targeted rate sampling, MCS rates are divided into
  * groups, based on the number of streams and flags (HT40, SGI) that they
  * use.
  *
  * Sortorder has to be fixed for GROUP_IDX macro to be applicable:
- * HT40 -> SGI -> #streams
+ * BW -> SGI -> #streams
  */
 const struct mcs_group minstrel_mcs_groups[] = {
-        MCS_GROUP(1, 0, 0),
-        MCS_GROUP(2, 0, 0),
+        MCS_GROUP(1, 0, BW_20),
+        MCS_GROUP(2, 0, BW_20),
 #if MINSTREL_MAX_STREAMS >= 3
-        MCS_GROUP(3, 0, 0),
+        MCS_GROUP(3, 0, BW_20),
 #endif
 
-        MCS_GROUP(1, 1, 0),
-        MCS_GROUP(2, 1, 0),
+        MCS_GROUP(1, 1, BW_20),
+        MCS_GROUP(2, 1, BW_20),
 #if MINSTREL_MAX_STREAMS >= 3
-        MCS_GROUP(3, 1, 0),
+        MCS_GROUP(3, 1, BW_20),
 #endif
 
-        MCS_GROUP(1, 0, 1),
-        MCS_GROUP(2, 0, 1),
+        MCS_GROUP(1, 0, BW_40),
+        MCS_GROUP(2, 0, BW_40),
 #if MINSTREL_MAX_STREAMS >= 3
-        MCS_GROUP(3, 0, 1),
+        MCS_GROUP(3, 0, BW_40),
 #endif
 
-        MCS_GROUP(1, 1, 1),
-        MCS_GROUP(2, 1, 1),
+        MCS_GROUP(1, 1, BW_40),
+        MCS_GROUP(2, 1, BW_40),
 #if MINSTREL_MAX_STREAMS >= 3
-        MCS_GROUP(3, 1, 1),
+        MCS_GROUP(3, 1, BW_40),
 #endif
 
-        /* must be last */
-        CCK_GROUP
-};
+        CCK_GROUP,
 
-#define MINSTREL_CCK_GROUP      (ARRAY_SIZE(minstrel_mcs_groups) - 1)
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+        VHT_GROUP(1, 0, BW_20),
+        VHT_GROUP(2, 0, BW_20),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 0, BW_20),
+#endif
+
+        VHT_GROUP(1, 1, BW_20),
+        VHT_GROUP(2, 1, BW_20),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 1, BW_20),
+#endif
+
+        VHT_GROUP(1, 0, BW_40),
+        VHT_GROUP(2, 0, BW_40),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 0, BW_40),
+#endif
+
+        VHT_GROUP(1, 1, BW_40),
+        VHT_GROUP(2, 1, BW_40),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 1, BW_40),
+#endif
+
+        VHT_GROUP(1, 0, BW_80),
+        VHT_GROUP(2, 0, BW_80),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 0, BW_80),
+#endif
+
+        VHT_GROUP(1, 1, BW_80),
+        VHT_GROUP(2, 1, BW_80),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 1, BW_80),
+#endif
+#endif
+};
 
 static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
 
@@ -130,16 +221,64 @@ static void
 minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
 
 /*
+ * Some VHT MCSes are invalid (when Ndbps / Nes is not an integer)
+ * e.g for MCS9@20MHzx1Nss: Ndbps=8x52*(5/6) Nes=1
+ *
+ * Returns the valid mcs map for struct minstrel_mcs_group_data.supported
+ */
+static u16
+minstrel_get_valid_vht_rates(int bw, int nss, __le16 mcs_map)
+{
+        u16 mask = 0;
+
+        if (bw == BW_20) {
+                if (nss != 3 && nss != 6)
+                        mask = BIT(9);
+        } else if (bw == BW_80) {
+                if (nss == 3 || nss == 7)
+                        mask = BIT(6);
+                else if (nss == 6)
+                        mask = BIT(9);
+        } else {
+                WARN_ON(bw != BW_40);
+        }
+
+        switch ((le16_to_cpu(mcs_map) >> (2 * (nss - 1))) & 3) {
+        case IEEE80211_VHT_MCS_SUPPORT_0_7:
+                mask |= 0x300;
+                break;
+        case IEEE80211_VHT_MCS_SUPPORT_0_8:
+                mask |= 0x200;
+                break;
+        case IEEE80211_VHT_MCS_SUPPORT_0_9:
+                break;
+        default:
+                mask = 0x3ff;
+        }
+
+        return 0x3ff & ~mask;
+}
+
+/*
  * Look up an MCS group index based on mac80211 rate information
  */
 static int
 minstrel_ht_get_group_idx(struct ieee80211_tx_rate *rate)
 {
-        return GROUP_IDX((rate->idx / MCS_GROUP_RATES) + 1,
+        return GROUP_IDX((rate->idx / 8) + 1,
                          !!(rate->flags & IEEE80211_TX_RC_SHORT_GI),
                          !!(rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH));
 }
 
+static int
+minstrel_vht_get_group_idx(struct ieee80211_tx_rate *rate)
+{
+        return VHT_GROUP_IDX(ieee80211_rate_get_vht_nss(rate),
+                             !!(rate->flags & IEEE80211_TX_RC_SHORT_GI),
+                             !!(rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) +
+                             2*!!(rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH));
+}
+
 static struct minstrel_rate_stats *
 minstrel_ht_get_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
                       struct ieee80211_tx_rate *rate)
@@ -149,6 +288,9 @@ minstrel_ht_get_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         if (rate->flags & IEEE80211_TX_RC_MCS) {
                 group = minstrel_ht_get_group_idx(rate);
                 idx = rate->idx % 8;
+        } else if (rate->flags & IEEE80211_TX_RC_VHT_MCS) {
+                group = minstrel_vht_get_group_idx(rate);
+                idx = ieee80211_rate_get_vht_mcs(rate);
         } else {
                 group = MINSTREL_CCK_GROUP;
 
@@ -240,8 +382,8 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
  * MCS groups, CCK rates do not provide aggregation and are therefore at last.
  */
 static void
-minstrel_ht_sort_best_tp_rates(struct minstrel_ht_sta *mi, u8 index,
-                               u8 *tp_list)
+minstrel_ht_sort_best_tp_rates(struct minstrel_ht_sta *mi, u16 index,
+                               u16 *tp_list)
 {
         int cur_group, cur_idx, cur_thr, cur_prob;
         int tmp_group, tmp_idx, tmp_thr, tmp_prob;
@@ -278,7 +420,7 @@ minstrel_ht_sort_best_tp_rates(struct minstrel_ht_sta *mi, u8 index,
  * Find and set the topmost probability rate per sta and per group
  */
 static void
-minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u8 index)
+minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index)
 {
         struct minstrel_mcs_group_data *mg;
         struct minstrel_rate_stats *mr;
@@ -321,8 +463,8 @@ minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u8 index)
  */
 static void
 minstrel_ht_assign_best_tp_rates(struct minstrel_ht_sta *mi,
-                                 u8 tmp_mcs_tp_rate[MAX_THR_RATES],
-                                 u8 tmp_cck_tp_rate[MAX_THR_RATES])
+                                 u16 tmp_mcs_tp_rate[MAX_THR_RATES],
+                                 u16 tmp_cck_tp_rate[MAX_THR_RATES])
 {
         unsigned int tmp_group, tmp_idx, tmp_cck_tp, tmp_mcs_tp;
         int i;
@@ -386,8 +528,8 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
         struct minstrel_mcs_group_data *mg;
         struct minstrel_rate_stats *mr;
         int group, i, j;
-        u8 tmp_mcs_tp_rate[MAX_THR_RATES], tmp_group_tp_rate[MAX_THR_RATES];
-        u8 tmp_cck_tp_rate[MAX_THR_RATES], index;
+        u16 tmp_mcs_tp_rate[MAX_THR_RATES], tmp_group_tp_rate[MAX_THR_RATES];
+        u16 tmp_cck_tp_rate[MAX_THR_RATES], index;
 
         if (mi->ampdu_packets > 0) {
                 mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
@@ -485,7 +627,8 @@ minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct ieee80211_tx_rate *rat
         if (!rate->count)
                 return false;
 
-        if (rate->flags & IEEE80211_TX_RC_MCS)
+        if (rate->flags & IEEE80211_TX_RC_MCS ||
+            rate->flags & IEEE80211_TX_RC_VHT_MCS)
                 return true;
 
         return rate->idx == mp->cck_rates[0] ||
@@ -517,7 +660,7 @@ minstrel_next_sample_idx(struct minstrel_ht_sta *mi)
 }
 
 static void
-minstrel_downgrade_rate(struct minstrel_ht_sta *mi, u8 *idx, bool primary)
+minstrel_downgrade_rate(struct minstrel_ht_sta *mi, u16 *idx, bool primary)
 {
         int group, orig_group;
 
@@ -714,7 +857,7 @@ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
         struct minstrel_rate_stats *mr;
         u8 idx;
-        u16 flags;
+        u16 flags = group->flags;
 
         mr = minstrel_get_ratestats(mi, index);
         if (!mr->retry_updated)
@@ -730,13 +873,13 @@ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
                 ratetbl->rate[offset].count_rts = mr->retry_count_rtscts;
         }
 
-        if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+        if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP)
                 idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
-                flags = 0;
-        } else {
+        else if (flags & IEEE80211_TX_RC_VHT_MCS)
+                idx = ((group->streams - 1) << 4) |
+                      ((index % MCS_GROUP_RATES) & 0xF);
+        else
                 idx = index % MCS_GROUP_RATES + (group->streams - 1) * 8;
-                flags = IEEE80211_TX_RC_MCS | group->flags;
-        }
 
         if (offset > 0) {
                 ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts;
@@ -916,13 +1059,15 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
                 int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
                 rate->idx = mp->cck_rates[idx];
-                rate->flags = 0;
-                return;
+        } else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
+                ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
+                                       sample_group->streams);
+        } else {
+                rate->idx = sample_idx % MCS_GROUP_RATES +
+                            (sample_group->streams - 1) * 8;
         }
 
-        rate->idx = sample_idx % MCS_GROUP_RATES +
-                    (sample_group->streams - 1) * 8;
-        rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
+        rate->flags = sample_group->flags;
 }
 
 static void
@@ -962,6 +1107,8 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         struct minstrel_ht_sta *mi = &msp->ht;
         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
         u16 sta_cap = sta->ht_cap.cap;
+        struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+        int use_vht;
         int n_supported = 0;
         int ack_dur;
         int stbc;
@@ -971,8 +1118,14 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         if (!sta->ht_cap.ht_supported)
                 goto use_legacy;
 
-        BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) !=
-                MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS + 1);
+        BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) != MINSTREL_GROUPS_NB);
+
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+        if (vht_cap->vht_supported)
+                use_vht = vht_cap->vht_mcs.tx_mcs_map != cpu_to_le16(~0);
+        else
+#endif
+        use_vht = 0;
 
         msp->is_ht = true;
         memset(mi, 0, sizeof(*mi));
@@ -997,22 +1150,28 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         }
         mi->sample_tries = 4;
 
-        stbc = (sta_cap & IEEE80211_HT_CAP_RX_STBC) >>
-                IEEE80211_HT_CAP_RX_STBC_SHIFT;
-        mi->tx_flags |= stbc << IEEE80211_TX_CTL_STBC_SHIFT;
+        /* TODO tx_flags for vht - ATM the RC API is not fine-grained enough */
+        if (!use_vht) {
+                stbc = (sta_cap & IEEE80211_HT_CAP_RX_STBC) >>
+                        IEEE80211_HT_CAP_RX_STBC_SHIFT;
+                mi->tx_flags |= stbc << IEEE80211_TX_CTL_STBC_SHIFT;
 
-        if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
-                mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
+                if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
+                        mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
+        }
 
         for (i = 0; i < ARRAY_SIZE(mi->groups); i++) {
+                u32 gflags = minstrel_mcs_groups[i].flags;
+                int bw, nss;
+
                 mi->groups[i].supported = 0;
                 if (i == MINSTREL_CCK_GROUP) {
                         minstrel_ht_update_cck(mp, mi, sband, sta);
                         continue;
                 }
 
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI) {
-                        if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+                if (gflags & IEEE80211_TX_RC_SHORT_GI) {
+                        if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
                                 if (!(sta_cap & IEEE80211_HT_CAP_SGI_40))
                                         continue;
                         } else {
@@ -1021,17 +1180,51 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
                         }
                 }
 
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH &&
+                if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH &&
                     sta->bandwidth < IEEE80211_STA_RX_BW_40)
                         continue;
 
+                nss = minstrel_mcs_groups[i].streams;
+
                 /* Mark MCS > 7 as unsupported if STA is in static SMPS mode */
-                if (sta->smps_mode == IEEE80211_SMPS_STATIC &&
-                    minstrel_mcs_groups[i].streams > 1)
+                if (sta->smps_mode == IEEE80211_SMPS_STATIC && nss > 1)
+                        continue;
+
+                /* HT rate */
+                if (gflags & IEEE80211_TX_RC_MCS) {
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+                        if (use_vht && minstrel_vht_only)
+                                continue;
+#endif
+                        mi->groups[i].supported = mcs->rx_mask[nss - 1];
+                        if (mi->groups[i].supported)
+                                n_supported++;
                         continue;
+                }
+
+                /* VHT rate */
+                if (!vht_cap->vht_supported ||
+                    WARN_ON(!(gflags & IEEE80211_TX_RC_VHT_MCS)) ||
+                    WARN_ON(gflags & IEEE80211_TX_RC_160_MHZ_WIDTH))
+                        continue;
+
+                if (gflags & IEEE80211_TX_RC_80_MHZ_WIDTH) {
+                        if (sta->bandwidth < IEEE80211_STA_RX_BW_80 ||
+                            ((gflags & IEEE80211_TX_RC_SHORT_GI) &&
+                             !(vht_cap->cap & IEEE80211_VHT_CAP_SHORT_GI_80))) {
+                                continue;
+                        }
+                }
+
+                if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        bw = BW_40;
+                else if (gflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
+                        bw = BW_80;
+                else
+                        bw = BW_20;
 
-                mi->groups[i].supported =
-                        mcs->rx_mask[minstrel_mcs_groups[i].streams - 1];
+                mi->groups[i].supported = minstrel_get_valid_vht_rates(bw, nss,
+                                vht_cap->vht_mcs.tx_mcs_map);
 
                 if (mi->groups[i].supported)
                         n_supported++;
diff --git a/net/mac80211/rc80211_minstrel_ht.h b/net/mac80211/rc80211_minstrel_ht.h
index 01570e0e014b..f2217d6aa0c2 100644
--- a/net/mac80211/rc80211_minstrel_ht.h
+++ b/net/mac80211/rc80211_minstrel_ht.h
@@ -13,10 +13,32 @@
  * The number of streams can be changed to 2 to reduce code
  * size and memory footprint.
  */
-#define MINSTREL_MAX_STREAMS    3
-#define MINSTREL_STREAM_GROUPS  4
+#define MINSTREL_MAX_STREAMS            3
+#define MINSTREL_HT_STREAM_GROUPS       4 /* BW(=2) * SGI(=2) */
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+#define MINSTREL_VHT_STREAM_GROUPS      6 /* BW(=3) * SGI(=2) */
+#else
+#define MINSTREL_VHT_STREAM_GROUPS      0
+#endif
 
-#define MCS_GROUP_RATES 8
+#define MINSTREL_HT_GROUPS_NB   (MINSTREL_MAX_STREAMS *         \
+                                 MINSTREL_HT_STREAM_GROUPS)
+#define MINSTREL_VHT_GROUPS_NB  (MINSTREL_MAX_STREAMS *         \
+                                 MINSTREL_VHT_STREAM_GROUPS)
+#define MINSTREL_CCK_GROUPS_NB  1
+#define MINSTREL_GROUPS_NB      (MINSTREL_HT_GROUPS_NB +        \
+                                 MINSTREL_VHT_GROUPS_NB +       \
+                                 MINSTREL_CCK_GROUPS_NB)
+
+#define MINSTREL_HT_GROUP_0     0
+#define MINSTREL_CCK_GROUP      (MINSTREL_HT_GROUP_0 + MINSTREL_HT_GROUPS_NB)
+#define MINSTREL_VHT_GROUP_0    (MINSTREL_CCK_GROUP + 1)
+
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+#define MCS_GROUP_RATES         10
+#else
+#define MCS_GROUP_RATES         8
+#endif
 
 struct mcs_group {
         u32 flags;
@@ -31,11 +53,11 @@ struct minstrel_mcs_group_data {
         u8 column;
 
         /* bitfield of supported MCS rates of this group */
-        u8 supported;
+        u16 supported;
 
         /* sorted rate set within a MCS group*/
-        u8 max_group_tp_rate[MAX_THR_RATES];
-        u8 max_group_prob_rate;
+        u16 max_group_tp_rate[MAX_THR_RATES];
+        u16 max_group_prob_rate;
 
         /* MCS rate statistics */
         struct minstrel_rate_stats rates[MCS_GROUP_RATES];
@@ -52,8 +74,8 @@ struct minstrel_ht_sta {
         unsigned int avg_ampdu_len;
 
         /* overall sorted rate set */
-        u8 max_tp_rate[MAX_THR_RATES];
-        u8 max_prob_rate;
+        u16 max_tp_rate[MAX_THR_RATES];
+        u16 max_prob_rate;
 
         /* time of last status update */
         unsigned long stats_update;
@@ -80,7 +102,7 @@ struct minstrel_ht_sta {
         u8 cck_supported_short;
 
         /* MCS rate group info and statistics */
-        struct minstrel_mcs_group_data groups[MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS + 1];
+        struct minstrel_mcs_group_data groups[MINSTREL_GROUPS_NB];
 };
 
 struct minstrel_ht_sta_priv {
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
index d537bec93754..20c676b8e5b6 100644
--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -18,19 +18,23 @@
 static char *
 minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
 {
-        unsigned int max_mcs = MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS;
         const struct mcs_group *mg;
         unsigned int j, tp, prob, eprob;
         char htmode = '2';
         char gimode = 'L';
+        u32 gflags;
 
         if (!mi->groups[i].supported)
                 return p;
 
         mg = &minstrel_mcs_groups[i];
-        if (mg->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+        gflags = mg->flags;
+
+        if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
                 htmode = '4';
-        if (mg->flags & IEEE80211_TX_RC_SHORT_GI)
+        else if (gflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
+                htmode = '8';
+        if (gflags & IEEE80211_TX_RC_SHORT_GI)
                 gimode = 'S';
 
         for (j = 0; j < MCS_GROUP_RATES; j++) {
@@ -41,10 +45,12 @@ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
                 if (!(mi->groups[i].supported & BIT(j)))
                         continue;
 
-                if (i == max_mcs)
-                        p += sprintf(p, "CCK/%cP   ", j < 4 ? 'L' : 'S');
+                if (gflags & IEEE80211_TX_RC_MCS)
+                        p += sprintf(p, " HT%c0/%cGI ", htmode, gimode);
+                else if (gflags & IEEE80211_TX_RC_VHT_MCS)
+                        p += sprintf(p, "VHT%c0/%cGI ", htmode, gimode);
                 else
-                        p += sprintf(p, "HT%c0/%cGI ", htmode, gimode);
+                        p += sprintf(p, " CCK/%cP   ", j < 4 ? 'L' : 'S');
 
                 *(p++) = (idx == mi->max_tp_rate[0]) ? 'A' : ' ';
                 *(p++) = (idx == mi->max_tp_rate[1]) ? 'B' : ' ';
@@ -52,11 +58,14 @@ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
                 *(p++) = (idx == mi->max_tp_rate[3]) ? 'D' : ' ';
                 *(p++) = (idx == mi->max_prob_rate) ? 'P' : ' ';
 
-                if (i == max_mcs) {
-                        int r = bitrates[j % 4];
-                        p += sprintf(p, " %2u.%1uM", r / 10, r % 10);
+                if (gflags & IEEE80211_TX_RC_MCS) {
+                        p += sprintf(p, " MCS%-2u ", (mg->streams - 1) * 8 + j);
+                } else if (gflags & IEEE80211_TX_RC_VHT_MCS) {
+                        p += sprintf(p, " MCS%-1u/%1u", j, mg->streams);
                 } else {
-                        p += sprintf(p, " MCS%-2u", (mg->streams - 1) * 8 + j);
+                        int r = bitrates[j % 4];
+
+                        p += sprintf(p, " %2u.%1uM ", r / 10, r % 10);
                 }
 
                 tp = mr->cur_tp / 10;
@@ -85,7 +94,6 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
         struct minstrel_ht_sta *mi = &msp->ht;
         struct minstrel_debugfs_info *ms;
         unsigned int i;
-        unsigned int max_mcs = MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS;
         char *p;
         int ret;
 
@@ -96,18 +104,19 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 return ret;
         }
 
-        ms = kmalloc(8192, GFP_KERNEL);
+        ms = kmalloc(32768, GFP_KERNEL);
         if (!ms)
                 return -ENOMEM;
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "type           rate     tpt eprob *prob "
+        p += sprintf(p, " type           rate      tpt eprob *prob "
                         "ret  *ok(*cum)        ok(      cum)\n");
 
-
-        p = minstrel_ht_stats_dump(mi, max_mcs, p);
-        for (i = 0; i < max_mcs; i++)
+        p = minstrel_ht_stats_dump(mi, MINSTREL_CCK_GROUP, p);
+        for (i = 0; i < MINSTREL_CCK_GROUP; i++)
+                p = minstrel_ht_stats_dump(mi, i, p);
+        for (i++; i < ARRAY_SIZE(mi->groups); i++)
                 p = minstrel_ht_stats_dump(mi, i, p);
 
         p += sprintf(p, "\nTotal packet count::    ideal %d      "
@@ -119,7 +128,7 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10);
         ms->len = p - ms->buf;
 
-        WARN_ON(ms->len + sizeof(*ms) > 8192);
+        WARN_ON(ms->len + sizeof(*ms) > 32768);
 
         return nonseekable_open(inode, file);
 }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index b04ca4049c95..bc63aa0c5401 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1032,6 +1032,7 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                       ieee80211_is_pspoll(hdr->frame_control)) &&
                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                      rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
+                     rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
                      (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
                 /*
                  * accept port control frames from the AP even when it's not
@@ -1272,6 +1273,12 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                                 sta->last_rx_rate_vht_nss = status->vht_nss;
                         }
                 }
+        } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
+                u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
+                                                NL80211_IFTYPE_OCB);
+                /* OCB uses wild-card BSSID */
+                if (is_broadcast_ether_addr(bssid))
+                        sta->last_rx = jiffies;
         } else if (!is_multicast_ether_addr(hdr->addr1)) {
                 /*
                  * Mesh beacons will update last_rx when if they are found to
@@ -2820,6 +2827,7 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 
         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+            sdata->vif.type != NL80211_IFTYPE_OCB &&
             sdata->vif.type != NL80211_IFTYPE_STATION)
                 return RX_DROP_MONITOR;
 
@@ -3130,6 +3138,33 @@ static bool prepare_for_handlers(struct ieee80211_rx_data *rx,
                                                  BIT(rate_idx));
                 }
                 break;
+        case NL80211_IFTYPE_OCB:
+                if (!bssid)
+                        return false;
+                if (ieee80211_is_beacon(hdr->frame_control)) {
+                        return false;
+                } else if (!is_broadcast_ether_addr(bssid)) {
+                        ocb_dbg(sdata, "BSSID mismatch in OCB mode!\n");
+                        return false;
+                } else if (!multicast &&
+                           !ether_addr_equal(sdata->dev->dev_addr,
+                                             hdr->addr1)) {
+                        /* if we are in promisc mode we also accept
+                         * packets not destined for us
+                         */
+                        if (!(sdata->dev->flags & IFF_PROMISC))
+                                return false;
+                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
+                } else if (!rx->sta) {
+                        int rate_idx;
+                        if (status->flag & RX_FLAG_HT)
+                                rate_idx = 0; /* TODO: HT rates */
+                        else
+                                rate_idx = status->rate_idx;
+                        ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
+                                                BIT(rate_idx));
+                }
+                break;
         case NL80211_IFTYPE_MESH_POINT:
                 if (!multicast &&
                     !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index de494df3bab8..adc25371b171 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -501,7 +501,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
         /* make the station visible */
         sta_info_hash_add(local, sta);
 
-        list_add_rcu(&sta->list, &local->sta_list);
+        list_add_tail_rcu(&sta->list, &local->sta_list);
 
         /* notify driver */
         err = sta_info_insert_drv_state(local, sdata, sta);
@@ -1531,7 +1531,7 @@ void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta)
                 break;
         case 0:
                 /* XXX: what is a good value? */
-                n_frames = 8;
+                n_frames = 128;
                 break;
         }
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 89290e33dafe..9612d89fad56 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -704,7 +704,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
                 if ((sta->sdata->vif.type == NL80211_IFTYPE_STATION) &&
                     (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
-                        ieee80211_sta_tx_notify(sta->sdata, (void *) skb->data, acked);
+                        ieee80211_sta_tx_notify(sta->sdata, (void *) skb->data,
+                                                acked, info->status.tx_time);
 
                 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
                         if (info->flags & IEEE80211_TX_STAT_ACK) {
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index 4ea25dec0698..b4f368e2cb3b 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -562,8 +562,10 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,
         /* infer the initiator if we can, to support old userspace */
         switch (action_code) {
         case WLAN_TDLS_SETUP_REQUEST:
-                if (sta)
+                if (sta) {
                         set_sta_flag(sta, WLAN_STA_TDLS_INITIATOR);
+                        sta->sta.tdls_initiator = false;
+                }
                 /* fall-through */
         case WLAN_TDLS_SETUP_CONFIRM:
         case WLAN_TDLS_DISCOVERY_REQUEST:
@@ -575,8 +577,10 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,
                  * Make the last packet sent take effect for the initiator
                  * value.
                  */
-                if (sta)
+                if (sta) {
                         clear_sta_flag(sta, WLAN_STA_TDLS_INITIATOR);
+                        sta->sta.tdls_initiator = true;
+                }
                 /* fall-through */
         case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
                 initiator = false;
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 38fae7ebe984..809a4983eb4a 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -987,29 +987,34 @@ TRACE_EVENT(drv_flush,
 
 TRACE_EVENT(drv_channel_switch,
         TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
                  struct ieee80211_channel_switch *ch_switch),
 
-        TP_ARGS(local, ch_switch),
+        TP_ARGS(local, sdata, ch_switch),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                VIF_ENTRY
                 CHANDEF_ENTRY
                 __field(u64, timestamp)
+                __field(u32, device_timestamp)
                 __field(bool, block_tx)
                 __field(u8, count)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 CHANDEF_ASSIGN(&ch_switch->chandef)
                 __entry->timestamp = ch_switch->timestamp;
+                __entry->device_timestamp = ch_switch->device_timestamp;
                 __entry->block_tx = ch_switch->block_tx;
                 __entry->count = ch_switch->count;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " new " CHANDEF_PR_FMT " count:%d",
-                LOCAL_PR_ARG, CHANDEF_PR_ARG, __entry->count
+                LOCAL_PR_FMT VIF_PR_FMT " new " CHANDEF_PR_FMT " count:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, CHANDEF_PR_ARG, __entry->count
         )
 );
 
@@ -1557,9 +1562,26 @@ DEFINE_EVENT(local_sdata_evt, drv_stop_ap,
         TP_ARGS(local, sdata)
 );
 
-DEFINE_EVENT(local_only_evt, drv_restart_complete,
-        TP_PROTO(struct ieee80211_local *local),
-        TP_ARGS(local)
+TRACE_EVENT(drv_reconfig_complete,
+        TP_PROTO(struct ieee80211_local *local,
+                 enum ieee80211_reconfig_type reconfig_type),
+        TP_ARGS(local, reconfig_type),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u8, reconfig_type)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->reconfig_type = reconfig_type;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  " reconfig_type:%d",
+                LOCAL_PR_ARG, __entry->reconfig_type
+        )
+
 );
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -2106,6 +2128,72 @@ TRACE_EVENT(drv_channel_switch_beacon,
         )
 );
 
+TRACE_EVENT(drv_pre_channel_switch,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_channel_switch *ch_switch),
+
+        TP_ARGS(local, sdata, ch_switch),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                CHANDEF_ENTRY
+                __field(u64, timestamp)
+                __field(bool, block_tx)
+                __field(u8, count)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                CHANDEF_ASSIGN(&ch_switch->chandef)
+                __entry->timestamp = ch_switch->timestamp;
+                __entry->block_tx = ch_switch->block_tx;
+                __entry->count = ch_switch->count;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT VIF_PR_FMT " prepare channel switch to "
+                CHANDEF_PR_FMT  " count:%d block_tx:%d timestamp:%llu",
+                LOCAL_PR_ARG, VIF_PR_ARG, CHANDEF_PR_ARG, __entry->count,
+                __entry->block_tx, __entry->timestamp
+        )
+);
+
+DEFINE_EVENT(local_sdata_evt, drv_post_channel_switch,
+             TP_PROTO(struct ieee80211_local *local,
+                      struct ieee80211_sub_if_data *sdata),
+             TP_ARGS(local, sdata)
+);
+
+TRACE_EVENT(drv_get_txpower,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 int dbm, int ret),
+
+        TP_ARGS(local, sdata, dbm, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(int, dbm)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->dbm = dbm;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT VIF_PR_FMT " dbm:%d ret:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->dbm, __entry->ret
+        )
+);
+
 
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 #undef TRACE_SYSTEM
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 900632a250ec..3ffd91f295a6 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -296,6 +296,9 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                  */
                 return TX_DROP;
 
+        if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
+                return TX_CONTINUE;
+
         if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
                 return TX_CONTINUE;
 
@@ -2013,6 +2016,17 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         goto fail_rcu;
                 band = chanctx_conf->def.chan->band;
                 break;
+        case NL80211_IFTYPE_OCB:
+                /* DA SA BSSID */
+                memcpy(hdr.addr1, skb->data, ETH_ALEN);
+                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
+                eth_broadcast_addr(hdr.addr3);
+                hdrlen = 24;
+                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+                if (!chanctx_conf)
+                        goto fail_rcu;
+                band = chanctx_conf->def.chan->band;
+                break;
         case NL80211_IFTYPE_ADHOC:
                 /* DA SA BSSID */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -2057,6 +2071,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          * EAPOL frames from the local station.
          */
         if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
+                     (sdata->vif.type != NL80211_IFTYPE_OCB) &&
                      !multicast && !authorized &&
                      (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
                       !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 3c61060a4d2b..f9319a5dca64 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -693,6 +693,34 @@ void ieee80211_iterate_active_interfaces_rtnl(
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_rtnl);
 
+static void __iterate_stations(struct ieee80211_local *local,
+                               void (*iterator)(void *data,
+                                                struct ieee80211_sta *sta),
+                               void *data)
+{
+        struct sta_info *sta;
+
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (!sta->uploaded)
+                        continue;
+
+                iterator(data, &sta->sta);
+        }
+}
+
+void ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
+                        void (*iterator)(void *data,
+                                         struct ieee80211_sta *sta),
+                        void *data)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        rcu_read_lock();
+        __iterate_stations(local, iterator, data);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL_GPL(ieee80211_iterate_stations_atomic);
+
 struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
@@ -1073,6 +1101,7 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_chanctx_conf *chanctx_conf;
         int ac;
         bool use_11b, enable_qos;
+        bool is_ocb; /* Use another EDCA parameters if dot11OCBActivated=true */
         int aCWmin, aCWmax;
 
         if (!local->ops->conf_tx)
@@ -1097,6 +1126,8 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
          */
         enable_qos = (sdata->vif.type != NL80211_IFTYPE_STATION);
 
+        is_ocb = (sdata->vif.type == NL80211_IFTYPE_OCB);
+
         /* Set defaults according to 802.11-2007 Table 7-37 */
         aCWmax = 1023;
         if (use_11b)
@@ -1118,7 +1149,10 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                                 qparam.cw_max = aCWmax;
                                 qparam.cw_min = aCWmin;
                                 qparam.txop = 0;
-                                qparam.aifs = 7;
+                                if (is_ocb)
+                                        qparam.aifs = 9;
+                                else
+                                        qparam.aifs = 7;
                                 break;
                         /* never happens but let's not leave undefined */
                         default:
@@ -1126,21 +1160,32 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                                 qparam.cw_max = aCWmax;
                                 qparam.cw_min = aCWmin;
                                 qparam.txop = 0;
-                                qparam.aifs = 3;
+                                if (is_ocb)
+                                        qparam.aifs = 6;
+                                else
+                                        qparam.aifs = 3;
                                 break;
                         case IEEE80211_AC_VI:
                                 qparam.cw_max = aCWmin;
                                 qparam.cw_min = (aCWmin + 1) / 2 - 1;
-                                if (use_11b)
+                                if (is_ocb)
+                                        qparam.txop = 0;
+                                else if (use_11b)
                                         qparam.txop = 6016/32;
                                 else
                                         qparam.txop = 3008/32;
-                                qparam.aifs = 2;
+
+                                if (is_ocb)
+                                        qparam.aifs = 3;
+                                else
+                                        qparam.aifs = 2;
                                 break;
                         case IEEE80211_AC_VO:
                                 qparam.cw_max = (aCWmin + 1) / 2 - 1;
                                 qparam.cw_min = (aCWmin + 1) / 4 - 1;
-                                if (use_11b)
+                                if (is_ocb)
+                                        qparam.txop = 0;
+                                else if (use_11b)
                                         qparam.txop = 3264/32;
                                 else
                                         qparam.txop = 1504/32;
@@ -1813,6 +1858,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         ieee80211_bss_info_change_notify(sdata, changed);
                         sdata_unlock(sdata);
                         break;
+                case NL80211_IFTYPE_OCB:
+                        changed |= BSS_CHANGED_OCB;
+                        ieee80211_bss_info_change_notify(sdata, changed);
+                        break;
                 case NL80211_IFTYPE_ADHOC:
                         changed |= BSS_CHANGED_IBSS;
                         /* fall through */
@@ -1949,7 +1998,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
          * We may want to change that later, however.
          */
         if (!local->suspended || reconfig_due_to_wowlan)
-                drv_restart_complete(local);
+                drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_RESTART);
 
         if (!local->suspended)
                 return 0;
@@ -1960,6 +2009,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         mb();
         local->resuming = false;
 
+        if (!reconfig_due_to_wowlan)
+                drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_SUSPEND);
+
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
                         continue;
@@ -2052,42 +2104,36 @@ static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id)
         return false;
 }
 
-/**
- * ieee80211_ie_split - split an IE buffer according to ordering
- *
- * @ies: the IE buffer
- * @ielen: the length of the IE buffer
- * @ids: an array with element IDs that are allowed before
- *      the split
- * @n_ids: the size of the element ID array
- * @offset: offset where to start splitting in the buffer
- *
- * This function splits an IE buffer by updating the @offset
- * variable to point to the location where the buffer should be
- * split.
- *
- * It assumes that the given IE buffer is well-formed, this
- * has to be guaranteed by the caller!
- *
- * It also assumes that the IEs in the buffer are ordered
- * correctly, if not the result of using this function will not
- * be ordered correctly either, i.e. it does no reordering.
- *
- * The function returns the offset where the next part of the
- * buffer starts, which may be @ielen if the entire (remainder)
- * of the buffer should be used.
- */
-size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
-                          const u8 *ids, int n_ids, size_t offset)
+size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
+                              const u8 *ids, int n_ids,
+                              const u8 *after_ric, int n_after_ric,
+                              size_t offset)
 {
         size_t pos = offset;
 
-        while (pos < ielen && ieee80211_id_in_list(ids, n_ids, ies[pos]))
-                pos += 2 + ies[pos + 1];
+        while (pos < ielen && ieee80211_id_in_list(ids, n_ids, ies[pos])) {
+                if (ies[pos] == WLAN_EID_RIC_DATA && n_after_ric) {
+                        pos += 2 + ies[pos + 1];
+
+                        while (pos < ielen &&
+                               !ieee80211_id_in_list(after_ric, n_after_ric,
+                                                     ies[pos]))
+                                pos += 2 + ies[pos + 1];
+                } else {
+                        pos += 2 + ies[pos + 1];
+                }
+        }
 
         return pos;
 }
 
+size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
+                          const u8 *ids, int n_ids, size_t offset)
+{
+        return ieee80211_ie_split_ric(ies, ielen, ids, n_ids, NULL, 0, offset);
+}
+EXPORT_SYMBOL(ieee80211_ie_split);
+
 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset)
 {
         size_t pos = offset;
@@ -2526,11 +2572,23 @@ void ieee80211_dfs_radar_detected_work(struct work_struct *work)
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local, radar_detected_work);
         struct cfg80211_chan_def chandef = local->hw.conf.chandef;
+        struct ieee80211_chanctx *ctx;
+        int num_chanctx = 0;
+
+        mutex_lock(&local->chanctx_mtx);
+        list_for_each_entry(ctx, &local->chanctx_list, list) {
+                if (ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER)
+                        continue;
+
+                num_chanctx++;
+                chandef = ctx->conf.def;
+        }
+        mutex_unlock(&local->chanctx_mtx);
 
         ieee80211_dfs_cac_cancel(local);
 
-        if (local->use_chanctx)
-                /* currently not handled */
+        if (num_chanctx > 1)
+                /* XXX: multi-channel is not supported yet */
                 WARN_ON(1);
         else
                 cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 9181fb6d6437..a4220e92f0cc 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -111,8 +111,6 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
                 return newhdr + hdrlen;
 
-        skb_set_network_header(skb, skb_network_offset(skb) +
-                                    IEEE80211_WEP_IV_LEN);
         ieee80211_wep_get_iv(local, keylen, keyidx, newhdr + hdrlen);
         return newhdr + hdrlen;
 }
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 3b873989992c..fdf52db95b33 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -54,10 +54,18 @@ static int wme_downgrade_ac(struct sk_buff *skb)
 }
 
 static u16 ieee80211_downgrade_queue(struct ieee80211_sub_if_data *sdata,
-                                     struct sk_buff *skb)
+                                     struct sta_info *sta, struct sk_buff *skb)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
         /* in case we are a client verify acm is not set for this ac */
-        while (unlikely(sdata->wmm_acm & BIT(skb->priority))) {
+        while (sdata->wmm_acm & BIT(skb->priority)) {
+                int ac = ieee802_1d_to_ac[skb->priority];
+
+                if (ifmgd->tx_tspec[ac].admitted_time &&
+                    skb->priority == ifmgd->tx_tspec[ac].up)
+                        return ac;
+
                 if (wme_downgrade_ac(skb)) {
                         /*
                          * This should not really happen. The AP has marked all
@@ -96,7 +104,7 @@ u16 ieee80211_select_queue_80211(struct ieee80211_sub_if_data *sdata,
         p = ieee80211_get_qos_ctl(hdr);
         skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
 
-        return ieee80211_downgrade_queue(sdata, skb);
+        return ieee80211_downgrade_queue(sdata, NULL, skb);
 }
 
 /* Indicate which queue to use. */
@@ -108,6 +116,7 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         const u8 *ra = NULL;
         bool qos = false;
         struct mac80211_qos_map *qos_map;
+        u16 ret;
 
         if (local->hw.queues < IEEE80211_NUM_ACS || skb->len < 6) {
                 skb->priority = 0; /* required for correct WPA/11i MIC */
@@ -139,6 +148,10 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_ADHOC:
                 ra = skb->data;
                 break;
+        case NL80211_IFTYPE_OCB:
+                /* all stations are required to support WME */
+                qos = true;
+                break;
         default:
                 break;
         }
@@ -148,27 +161,29 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                 if (sta)
                         qos = sta->sta.wme;
         }
-        rcu_read_unlock();
 
         if (!qos) {
                 skb->priority = 0; /* required for correct WPA/11i MIC */
-                return IEEE80211_AC_BE;
+                ret = IEEE80211_AC_BE;
+                goto out;
         }
 
         if (skb->protocol == sdata->control_port_protocol) {
                 skb->priority = 7;
-                return ieee80211_downgrade_queue(sdata, skb);
+                goto downgrade;
         }
 
         /* use the data classifier to determine what 802.1d tag the
          * data frame has */
-        rcu_read_lock();
         qos_map = rcu_dereference(sdata->qos_map);
         skb->priority = cfg80211_classify8021d(skb, qos_map ?
                                                &qos_map->qos_map : NULL);
-        rcu_read_unlock();
 
-        return ieee80211_downgrade_queue(sdata, skb);
+ downgrade:
+        ret = ieee80211_downgrade_queue(sdata, sta, skb);
+ out:
+        rcu_read_unlock();
+        return ret;
 }
 
 /**
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 7fea4bb8acbc..80151edc5195 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -13,8 +13,6 @@
 #include <linux/netdevice.h>
 #include "ieee80211_i.h"
 
-extern const int ieee802_1d_to_ac[8];
-
 u16 ieee80211_select_queue_80211(struct ieee80211_sub_if_data *sdata,
                                  struct sk_buff *skb,
                                  struct ieee80211_hdr *hdr);
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 983527a4c1ab..12398fde02e8 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -209,8 +209,6 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
         memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) +
-                                    IEEE80211_TKIP_IV_LEN);
         pos += hdrlen;
 
         /* the HW only needs room for the IV, but not the actual IV */
@@ -434,8 +432,6 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
         memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) +
-                                    IEEE80211_CCMP_HDR_LEN);
 
         /* the HW only needs room for the IV, but not the actual IV */
         if (info->control.hw_key &&
@@ -575,7 +571,6 @@ ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
 
         pos = skb_push(skb, cs->hdr_len);
         memmove(pos, pos + cs->hdr_len, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) + cs->hdr_len);
 
         return TX_CONTINUE;
 }
diff --git a/net/mac802154/Kconfig b/net/mac802154/Kconfig
index 1818a99b3081..aa462b480a39 100644
--- a/net/mac802154/Kconfig
+++ b/net/mac802154/Kconfig
@@ -16,5 +16,5 @@ config MAC802154
           been tested yet!
 
           If you plan to use HardMAC IEEE 802.15.4 devices, you can
-          say N here. Alternatievly you can say M to compile it as
+          say N here. Alternatively you can say M to compile it as
           module.
diff --git a/net/mac802154/Makefile b/net/mac802154/Makefile
index 9723d6f3f3e5..2e497d0c829a 100644
--- a/net/mac802154/Makefile
+++ b/net/mac802154/Makefile
@@ -1,5 +1,5 @@
 obj-$(CONFIG_MAC802154) += mac802154.o
-mac802154-objs          := ieee802154_dev.o rx.o tx.o mac_cmd.o mib.o \
-                           monitor.o wpan.o llsec.o
+mac802154-objs          := main.o rx.o tx.o mac_cmd.o mib.o \
+                           iface.o llsec.o util.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/mac802154/driver-ops.h b/net/mac802154/driver-ops.h
new file mode 100644
index 000000000000..dfd29ffb8fee
--- /dev/null
+++ b/net/mac802154/driver-ops.h
@@ -0,0 +1,226 @@
+#ifndef __MAC802154_DRVIER_OPS
+#define __MAC802154_DRIVER_OPS
+
+#include <linux/types.h>
+#include <linux/rtnetlink.h>
+
+#include <net/mac802154.h>
+
+#include "ieee802154_i.h"
+
+static inline int
+drv_xmit_async(struct ieee802154_local *local, struct sk_buff *skb)
+{
+        return local->ops->xmit_async(&local->hw, skb);
+}
+
+static inline int
+drv_xmit_sync(struct ieee802154_local *local, struct sk_buff *skb)
+{
+        /* don't allow other operations while sync xmit */
+        ASSERT_RTNL();
+
+        might_sleep();
+
+        return local->ops->xmit_sync(&local->hw, skb);
+}
+
+static inline int drv_start(struct ieee802154_local *local)
+{
+        might_sleep();
+
+        local->started = true;
+        smp_mb();
+
+        return local->ops->start(&local->hw);
+}
+
+static inline void drv_stop(struct ieee802154_local *local)
+{
+        might_sleep();
+
+        local->ops->stop(&local->hw);
+
+        /* sync away all work on the tasklet before clearing started */
+        tasklet_disable(&local->tasklet);
+        tasklet_enable(&local->tasklet);
+
+        barrier();
+
+        local->started = false;
+}
+
+static inline int drv_set_channel(struct ieee802154_local *local,
+                                  const u8 page, const u8 channel)
+{
+        might_sleep();
+
+        return local->ops->set_channel(&local->hw, page, channel);
+}
+
+static inline int drv_set_tx_power(struct ieee802154_local *local,
+                                   const s8 dbm)
+{
+        might_sleep();
+
+        if (!local->ops->set_txpower) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_txpower(&local->hw, dbm);
+}
+
+static inline int drv_set_cca_mode(struct ieee802154_local *local,
+                                   const u8 cca_mode)
+{
+        might_sleep();
+
+        if (!local->ops->set_cca_mode) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_cca_mode(&local->hw, cca_mode);
+}
+
+static inline int drv_set_lbt_mode(struct ieee802154_local *local,
+                                   const bool mode)
+{
+        might_sleep();
+
+        if (!local->ops->set_lbt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_lbt(&local->hw, mode);
+}
+
+static inline int drv_set_cca_ed_level(struct ieee802154_local *local,
+                                       const s32 ed_level)
+{
+        might_sleep();
+
+        if (!local->ops->set_cca_ed_level) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_cca_ed_level(&local->hw, ed_level);
+}
+
+static inline int drv_set_pan_id(struct ieee802154_local *local,
+                                 const __le16 pan_id)
+{
+        struct ieee802154_hw_addr_filt filt;
+
+        might_sleep();
+
+        if (!local->ops->set_hw_addr_filt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        filt.pan_id = pan_id;
+
+        return local->ops->set_hw_addr_filt(&local->hw, &filt,
+                                            IEEE802154_AFILT_PANID_CHANGED);
+}
+
+static inline int drv_set_extended_addr(struct ieee802154_local *local,
+                                        const __le64 extended_addr)
+{
+        struct ieee802154_hw_addr_filt filt;
+
+        might_sleep();
+
+        if (!local->ops->set_hw_addr_filt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        filt.ieee_addr = extended_addr;
+
+        return local->ops->set_hw_addr_filt(&local->hw, &filt,
+                                            IEEE802154_AFILT_IEEEADDR_CHANGED);
+}
+
+static inline int drv_set_short_addr(struct ieee802154_local *local,
+                                     const __le16 short_addr)
+{
+        struct ieee802154_hw_addr_filt filt;
+
+        might_sleep();
+
+        if (!local->ops->set_hw_addr_filt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        filt.short_addr = short_addr;
+
+        return local->ops->set_hw_addr_filt(&local->hw, &filt,
+                                            IEEE802154_AFILT_SADDR_CHANGED);
+}
+
+static inline int drv_set_pan_coord(struct ieee802154_local *local,
+                                    const bool is_coord)
+{
+        struct ieee802154_hw_addr_filt filt;
+
+        might_sleep();
+
+        if (!local->ops->set_hw_addr_filt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        filt.pan_coord = is_coord;
+
+        return local->ops->set_hw_addr_filt(&local->hw, &filt,
+                                            IEEE802154_AFILT_PANC_CHANGED);
+}
+
+static inline int drv_set_csma_params(struct ieee802154_local *local,
+                                      u8 min_be, u8 max_be,
+                                      u8 max_csma_backoffs)
+{
+        might_sleep();
+
+        if (!local->ops->set_csma_params) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_csma_params(&local->hw, min_be, max_be,
+                                           max_csma_backoffs);
+}
+
+static inline int drv_set_max_frame_retries(struct ieee802154_local *local,
+                                            s8 max_frame_retries)
+{
+        might_sleep();
+
+        if (!local->ops->set_frame_retries) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_frame_retries(&local->hw, max_frame_retries);
+}
+
+static inline int drv_set_promiscuous_mode(struct ieee802154_local *local,
+                                           const bool on)
+{
+        might_sleep();
+
+        if (!local->ops->set_promiscuous_mode) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_promiscuous_mode(&local->hw, on);
+}
+
+#endif /* __MAC802154_DRVIER_OPS */
diff --git a/net/mac802154/ieee802154_dev.c b/net/mac802154/ieee802154_dev.c
deleted file mode 100644
index b36b2b996578..000000000000
--- a/net/mac802154/ieee802154_dev.c
+++ /dev/null
@@ -1,415 +0,0 @@
-/*
- * Copyright (C) 2007-2012 Siemens AG
- *
- * Written by:
- * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
- *
- * Based on the code from 'linux-zigbee.sourceforge.net' project.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-
-#include <net/netlink.h>
-#include <linux/nl802154.h>
-#include <net/mac802154.h>
-#include <net/ieee802154_netdev.h>
-#include <net/route.h>
-#include <net/wpan-phy.h>
-
-#include "mac802154.h"
-
-int mac802154_slave_open(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct mac802154_sub_if_data *subif;
-        struct mac802154_priv *ipriv = priv->hw;
-        int res = 0;
-
-        ASSERT_RTNL();
-
-        if (priv->type == IEEE802154_DEV_WPAN) {
-                mutex_lock(&priv->hw->slaves_mtx);
-                list_for_each_entry(subif, &priv->hw->slaves, list) {
-                        if (subif != priv && subif->type == priv->type &&
-                            subif->running) {
-                                mutex_unlock(&priv->hw->slaves_mtx);
-                                return -EBUSY;
-                        }
-                }
-                mutex_unlock(&priv->hw->slaves_mtx);
-        }
-
-        mutex_lock(&priv->hw->slaves_mtx);
-        priv->running = true;
-        mutex_unlock(&priv->hw->slaves_mtx);
-
-        if (ipriv->open_count++ == 0) {
-                res = ipriv->ops->start(&ipriv->hw);
-                WARN_ON(res);
-                if (res)
-                        goto err;
-        }
-
-        if (ipriv->ops->ieee_addr) {
-                __le64 addr = ieee802154_devaddr_from_raw(dev->dev_addr);
-
-                res = ipriv->ops->ieee_addr(&ipriv->hw, addr);
-                WARN_ON(res);
-                if (res)
-                        goto err;
-                mac802154_dev_set_ieee_addr(dev);
-        }
-
-        netif_start_queue(dev);
-        return 0;
-err:
-        priv->hw->open_count--;
-
-        return res;
-}
-
-int mac802154_slave_close(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct mac802154_priv *ipriv = priv->hw;
-
-        ASSERT_RTNL();
-
-        netif_stop_queue(dev);
-
-        mutex_lock(&priv->hw->slaves_mtx);
-        priv->running = false;
-        mutex_unlock(&priv->hw->slaves_mtx);
-
-        if (!--ipriv->open_count)
-                ipriv->ops->stop(&ipriv->hw);
-
-        return 0;
-}
-
-static int
-mac802154_netdev_register(struct wpan_phy *phy, struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-        struct mac802154_priv *ipriv;
-        int err;
-
-        ipriv = wpan_phy_priv(phy);
-
-        priv = netdev_priv(dev);
-        priv->dev = dev;
-        priv->hw = ipriv;
-
-        dev->needed_headroom = ipriv->hw.extra_tx_headroom;
-
-        SET_NETDEV_DEV(dev, &ipriv->phy->dev);
-
-        mutex_lock(&ipriv->slaves_mtx);
-        if (!ipriv->running) {
-                mutex_unlock(&ipriv->slaves_mtx);
-                return -ENODEV;
-        }
-        mutex_unlock(&ipriv->slaves_mtx);
-
-        err = register_netdev(dev);
-        if (err < 0)
-                return err;
-
-        rtnl_lock();
-        mutex_lock(&ipriv->slaves_mtx);
-        list_add_tail_rcu(&priv->list, &ipriv->slaves);
-        mutex_unlock(&ipriv->slaves_mtx);
-        rtnl_unlock();
-
-        return 0;
-}
-
-static void
-mac802154_del_iface(struct wpan_phy *phy, struct net_device *dev)
-{
-        struct mac802154_sub_if_data *sdata;
-
-        ASSERT_RTNL();
-
-        sdata = netdev_priv(dev);
-
-        BUG_ON(sdata->hw->phy != phy);
-
-        mutex_lock(&sdata->hw->slaves_mtx);
-        list_del_rcu(&sdata->list);
-        mutex_unlock(&sdata->hw->slaves_mtx);
-
-        synchronize_rcu();
-        unregister_netdevice(sdata->dev);
-}
-
-static struct net_device *
-mac802154_add_iface(struct wpan_phy *phy, const char *name, int type)
-{
-        struct net_device *dev;
-        int err = -ENOMEM;
-
-        switch (type) {
-        case IEEE802154_DEV_MONITOR:
-                dev = alloc_netdev(sizeof(struct mac802154_sub_if_data),
-                                   name, NET_NAME_UNKNOWN,
-                                   mac802154_monitor_setup);
-                break;
-        case IEEE802154_DEV_WPAN:
-                dev = alloc_netdev(sizeof(struct mac802154_sub_if_data),
-                                   name, NET_NAME_UNKNOWN,
-                                   mac802154_wpan_setup);
-                break;
-        default:
-                dev = NULL;
-                err = -EINVAL;
-                break;
-        }
-        if (!dev)
-                goto err;
-
-        err = mac802154_netdev_register(phy, dev);
-        if (err)
-                goto err_free;
-
-        dev_hold(dev); /* we return an incremented device refcount */
-        return dev;
-
-err_free:
-        free_netdev(dev);
-err:
-        return ERR_PTR(err);
-}
-
-static int mac802154_set_txpower(struct wpan_phy *phy, int db)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_txpower(&priv->hw, db);
-}
-
-static int mac802154_set_lbt(struct wpan_phy *phy, bool on)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_lbt(&priv->hw, on);
-}
-
-static int mac802154_set_cca_mode(struct wpan_phy *phy, u8 mode)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_cca_mode(&priv->hw, mode);
-}
-
-static int mac802154_set_cca_ed_level(struct wpan_phy *phy, s32 level)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_cca_ed_level(&priv->hw, level);
-}
-
-static int mac802154_set_csma_params(struct wpan_phy *phy, u8 min_be,
-                                     u8 max_be, u8 retries)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_csma_params(&priv->hw, min_be, max_be, retries);
-}
-
-static int mac802154_set_frame_retries(struct wpan_phy *phy, s8 retries)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_frame_retries(&priv->hw, retries);
-}
-
-struct ieee802154_dev *
-ieee802154_alloc_device(size_t priv_data_len, struct ieee802154_ops *ops)
-{
-        struct wpan_phy *phy;
-        struct mac802154_priv *priv;
-        size_t priv_size;
-
-        if (!ops || !ops->xmit || !ops->ed || !ops->start ||
-            !ops->stop || !ops->set_channel) {
-                pr_err("undefined IEEE802.15.4 device operations\n");
-                return NULL;
-        }
-
-        /* Ensure 32-byte alignment of our private data and hw private data.
-         * We use the wpan_phy priv data for both our mac802154_priv and for
-         * the driver's private data
-         *
-         * in memory it'll be like this:
-         *
-         * +-----------------------+
-         * | struct wpan_phy       |
-         * +-----------------------+
-         * | struct mac802154_priv |
-         * +-----------------------+
-         * | driver's private data |
-         * +-----------------------+
-         *
-         * Due to ieee802154 layer isn't aware of driver and MAC structures,
-         * so lets allign them here.
-         */
-
-        priv_size = ALIGN(sizeof(*priv), NETDEV_ALIGN) + priv_data_len;
-
-        phy = wpan_phy_alloc(priv_size);
-        if (!phy) {
-                pr_err("failure to allocate master IEEE802.15.4 device\n");
-                return NULL;
-        }
-
-        priv = wpan_phy_priv(phy);
-        priv->phy = phy;
-        priv->hw.phy = priv->phy;
-        priv->hw.priv = (char *)priv + ALIGN(sizeof(*priv), NETDEV_ALIGN);
-        priv->ops = ops;
-
-        INIT_LIST_HEAD(&priv->slaves);
-        mutex_init(&priv->slaves_mtx);
-
-        return &priv->hw;
-}
-EXPORT_SYMBOL(ieee802154_alloc_device);
-
-void ieee802154_free_device(struct ieee802154_dev *hw)
-{
-        struct mac802154_priv *priv = mac802154_to_priv(hw);
-
-        BUG_ON(!list_empty(&priv->slaves));
-
-        mutex_destroy(&priv->slaves_mtx);
-
-        wpan_phy_free(priv->phy);
-}
-EXPORT_SYMBOL(ieee802154_free_device);
-
-int ieee802154_register_device(struct ieee802154_dev *dev)
-{
-        struct mac802154_priv *priv = mac802154_to_priv(dev);
-        int rc = -ENOSYS;
-
-        if (dev->flags & IEEE802154_HW_TXPOWER) {
-                if (!priv->ops->set_txpower)
-                        goto out;
-
-                priv->phy->set_txpower = mac802154_set_txpower;
-        }
-
-        if (dev->flags & IEEE802154_HW_LBT) {
-                if (!priv->ops->set_lbt)
-                        goto out;
-
-                priv->phy->set_lbt = mac802154_set_lbt;
-        }
-
-        if (dev->flags & IEEE802154_HW_CCA_MODE) {
-                if (!priv->ops->set_cca_mode)
-                        goto out;
-
-                priv->phy->set_cca_mode = mac802154_set_cca_mode;
-        }
-
-        if (dev->flags & IEEE802154_HW_CCA_ED_LEVEL) {
-                if (!priv->ops->set_cca_ed_level)
-                        goto out;
-
-                priv->phy->set_cca_ed_level = mac802154_set_cca_ed_level;
-        }
-
-        if (dev->flags & IEEE802154_HW_CSMA_PARAMS) {
-                if (!priv->ops->set_csma_params)
-                        goto out;
-
-                priv->phy->set_csma_params = mac802154_set_csma_params;
-        }
-
-        if (dev->flags & IEEE802154_HW_FRAME_RETRIES) {
-                if (!priv->ops->set_frame_retries)
-                        goto out;
-
-                priv->phy->set_frame_retries = mac802154_set_frame_retries;
-        }
-
-        priv->dev_workqueue =
-                create_singlethread_workqueue(wpan_phy_name(priv->phy));
-        if (!priv->dev_workqueue) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        wpan_phy_set_dev(priv->phy, priv->hw.parent);
-
-        priv->phy->add_iface = mac802154_add_iface;
-        priv->phy->del_iface = mac802154_del_iface;
-
-        rc = wpan_phy_register(priv->phy);
-        if (rc < 0)
-                goto out_wq;
-
-        rtnl_lock();
-
-        mutex_lock(&priv->slaves_mtx);
-        priv->running = MAC802154_DEVICE_RUN;
-        mutex_unlock(&priv->slaves_mtx);
-
-        rtnl_unlock();
-
-        return 0;
-
-out_wq:
-        destroy_workqueue(priv->dev_workqueue);
-out:
-        return rc;
-}
-EXPORT_SYMBOL(ieee802154_register_device);
-
-void ieee802154_unregister_device(struct ieee802154_dev *dev)
-{
-        struct mac802154_priv *priv = mac802154_to_priv(dev);
-        struct mac802154_sub_if_data *sdata, *next;
-
-        flush_workqueue(priv->dev_workqueue);
-        destroy_workqueue(priv->dev_workqueue);
-
-        rtnl_lock();
-
-        mutex_lock(&priv->slaves_mtx);
-        priv->running = MAC802154_DEVICE_STOPPED;
-        mutex_unlock(&priv->slaves_mtx);
-
-        list_for_each_entry_safe(sdata, next, &priv->slaves, list) {
-                mutex_lock(&sdata->hw->slaves_mtx);
-                list_del(&sdata->list);
-                mutex_unlock(&sdata->hw->slaves_mtx);
-
-                unregister_netdevice(sdata->dev);
-        }
-
-        rtnl_unlock();
-
-        wpan_phy_unregister(priv->phy);
-}
-EXPORT_SYMBOL(ieee802154_unregister_device);
-
-MODULE_DESCRIPTION("IEEE 802.15.4 implementation");
-MODULE_LICENSE("GPL v2");
diff --git a/net/mac802154/mac802154.h b/net/mac802154/ieee802154_i.h
index 762a6f849c6b..1086a9d96f8f 100644
--- a/net/mac802154/mac802154.h
+++ b/net/mac802154/ieee802154_i.h
@@ -10,18 +10,14 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
  * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
  * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
  */
-#ifndef MAC802154_H
-#define MAC802154_H
+#ifndef __IEEE802154_I_H
+#define __IEEE802154_I_H
 
 #include <linux/mutex.h>
 #include <net/mac802154.h>
@@ -30,9 +26,9 @@
 #include "llsec.h"
 
 /* mac802154 device private data */
-struct mac802154_priv {
-        struct ieee802154_dev hw;
-        struct ieee802154_ops *ops;
+struct ieee802154_local {
+        struct ieee802154_hw hw;
+        const struct ieee802154_ops *ops;
 
         /* ieee802154 phy */
         struct wpan_phy *phy;
@@ -46,23 +42,27 @@ struct mac802154_priv {
          *
          * So atomic readers can use any of this protection methods.
          */
-        struct list_head        slaves;
-        struct mutex            slaves_mtx;
+        struct list_head        interfaces;
+        struct mutex            iflist_mtx;
 
         /* This one is used for scanning and other jobs not to be interfered
          * with serial driver.
          */
-        struct workqueue_struct *dev_workqueue;
+        struct workqueue_struct *workqueue;
 
-        /* SoftMAC device is registered and running. One can add subinterfaces.
-         * This flag should be modified under slaves_mtx and RTNL, so you can
-         * read them using any of protection methods.
-         */
-        bool running;
+        bool started;
+
+        struct tasklet_struct tasklet;
+        struct sk_buff_head skb_queue;
 };
 
-#define MAC802154_DEVICE_STOPPED        0x00
-#define MAC802154_DEVICE_RUN            0x01
+enum {
+        IEEE802154_RX_MSG        = 1,
+};
+
+enum ieee802154_sdata_state_bits {
+        SDATA_STATE_RUNNING,
+};
 
 /* Slave interface definition.
  *
@@ -70,23 +70,21 @@ struct mac802154_priv {
  * Each ieee802154 device/transceiver may have several slaves and able
  * to be associated with several networks at the same time.
  */
-struct mac802154_sub_if_data {
+struct ieee802154_sub_if_data {
         struct list_head list; /* the ieee802154_priv->slaves list */
 
-        struct mac802154_priv *hw;
+        struct ieee802154_local *local;
         struct net_device *dev;
 
         int type;
-        bool running;
+        unsigned long state;
 
         spinlock_t mib_lock;
 
         __le16 pan_id;
         __le16 short_addr;
         __le64 extended_addr;
-
-        u8 chan;
-        u8 page;
+        bool promisuous_mode;
 
         struct ieee802154_mac_params mac_params;
 
@@ -103,24 +101,36 @@ struct mac802154_sub_if_data {
         struct mac802154_llsec sec;
 };
 
-#define mac802154_to_priv(_hw)  container_of(_hw, struct mac802154_priv, hw)
-
 #define MAC802154_CHAN_NONE             0xff /* No channel is assigned */
 
+static inline struct ieee802154_local *
+hw_to_local(struct ieee802154_hw *hw)
+{
+        return container_of(hw, struct ieee802154_local, hw);
+}
+
+static inline struct ieee802154_sub_if_data *
+IEEE802154_DEV_TO_SUB_IF(const struct net_device *dev)
+{
+        return netdev_priv(dev);
+}
+
+static inline bool
+ieee802154_sdata_running(struct ieee802154_sub_if_data *sdata)
+{
+        return test_bit(SDATA_STATE_RUNNING, &sdata->state);
+}
+
 extern struct ieee802154_reduced_mlme_ops mac802154_mlme_reduced;
 extern struct ieee802154_mlme_ops mac802154_mlme_wpan;
 
-int mac802154_slave_open(struct net_device *dev);
-int mac802154_slave_close(struct net_device *dev);
-
-void mac802154_monitors_rx(struct mac802154_priv *priv, struct sk_buff *skb);
 void mac802154_monitor_setup(struct net_device *dev);
+netdev_tx_t
+ieee802154_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
-void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb);
 void mac802154_wpan_setup(struct net_device *dev);
-
-netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
-                         u8 page, u8 chan);
+netdev_tx_t
+ieee802154_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
 /* MIB callbacks */
 void mac802154_dev_set_short_addr(struct net_device *dev, __le16 val);
@@ -131,11 +141,6 @@ void mac802154_dev_set_pan_id(struct net_device *dev, __le16 val);
 void mac802154_dev_set_page_channel(struct net_device *dev, u8 page, u8 chan);
 u8 mac802154_dev_get_dsn(const struct net_device *dev);
 
-int mac802154_set_mac_params(struct net_device *dev,
-                             const struct ieee802154_mac_params *params);
-void mac802154_get_mac_params(struct net_device *dev,
-                              struct ieee802154_mac_params *params);
-
 int mac802154_get_params(struct net_device *dev,
                          struct ieee802154_llsec_params *params);
 int mac802154_set_params(struct net_device *dev,
@@ -169,4 +174,4 @@ void mac802154_get_table(struct net_device *dev,
                          struct ieee802154_llsec_table **t);
 void mac802154_unlock_table(struct net_device *dev);
 
-#endif /* MAC802154_H */
+#endif /* __IEEE802154_I_H */
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
new file mode 100644
index 000000000000..f7a6f83301e2
--- /dev/null
+++ b/net/mac802154/iface.c
@@ -0,0 +1,466 @@
+/*
+ * Copyright 2007-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Sergey Lapin <slapin@ossfans.org>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+
+#include <linux/netdevice.h>
+#include <linux/module.h>
+#include <linux/if_arp.h>
+#include <linux/ieee802154.h>
+
+#include <net/rtnetlink.h>
+#include <linux/nl802154.h>
+#include <net/af_ieee802154.h>
+#include <net/mac802154.h>
+#include <net/ieee802154_netdev.h>
+#include <net/cfg802154.h>
+
+#include "ieee802154_i.h"
+#include "driver-ops.h"
+
+static int mac802154_wpan_update_llsec(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_mlme_ops *ops = ieee802154_mlme_ops(dev);
+        int rc = 0;
+
+        if (ops->llsec) {
+                struct ieee802154_llsec_params params;
+                int changed = 0;
+
+                params.pan_id = sdata->pan_id;
+                changed |= IEEE802154_LLSEC_PARAM_PAN_ID;
+
+                params.hwaddr = sdata->extended_addr;
+                changed |= IEEE802154_LLSEC_PARAM_HWADDR;
+
+                rc = ops->llsec->set_params(dev, &params, changed);
+        }
+
+        return rc;
+}
+
+static int
+mac802154_wpan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct sockaddr_ieee802154 *sa =
+                (struct sockaddr_ieee802154 *)&ifr->ifr_addr;
+        int err = -ENOIOCTLCMD;
+
+        spin_lock_bh(&sdata->mib_lock);
+
+        switch (cmd) {
+        case SIOCGIFADDR:
+        {
+                u16 pan_id, short_addr;
+
+                pan_id = le16_to_cpu(sdata->pan_id);
+                short_addr = le16_to_cpu(sdata->short_addr);
+                if (pan_id == IEEE802154_PANID_BROADCAST ||
+                    short_addr == IEEE802154_ADDR_BROADCAST) {
+                        err = -EADDRNOTAVAIL;
+                        break;
+                }
+
+                sa->family = AF_IEEE802154;
+                sa->addr.addr_type = IEEE802154_ADDR_SHORT;
+                sa->addr.pan_id = pan_id;
+                sa->addr.short_addr = short_addr;
+
+                err = 0;
+                break;
+        }
+        case SIOCSIFADDR:
+                dev_warn(&dev->dev,
+                         "Using DEBUGing ioctl SIOCSIFADDR isn't recommended!\n");
+                if (sa->family != AF_IEEE802154 ||
+                    sa->addr.addr_type != IEEE802154_ADDR_SHORT ||
+                    sa->addr.pan_id == IEEE802154_PANID_BROADCAST ||
+                    sa->addr.short_addr == IEEE802154_ADDR_BROADCAST ||
+                    sa->addr.short_addr == IEEE802154_ADDR_UNDEF) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                sdata->pan_id = cpu_to_le16(sa->addr.pan_id);
+                sdata->short_addr = cpu_to_le16(sa->addr.short_addr);
+
+                err = mac802154_wpan_update_llsec(dev);
+                break;
+        }
+
+        spin_unlock_bh(&sdata->mib_lock);
+        return err;
+}
+
+static int mac802154_wpan_mac_addr(struct net_device *dev, void *p)
+{
+        struct sockaddr *addr = p;
+
+        if (netif_running(dev))
+                return -EBUSY;
+
+        /* FIXME: validate addr */
+        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+        mac802154_dev_set_ieee_addr(dev);
+        return mac802154_wpan_update_llsec(dev);
+}
+
+int mac802154_set_mac_params(struct net_device *dev,
+                             const struct ieee802154_mac_params *params)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        sdata->mac_params = *params;
+        mutex_unlock(&sdata->local->iflist_mtx);
+
+        return 0;
+}
+
+void mac802154_get_mac_params(struct net_device *dev,
+                              struct ieee802154_mac_params *params)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        *params = sdata->mac_params;
+        mutex_unlock(&sdata->local->iflist_mtx);
+}
+
+static int mac802154_slave_open(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_sub_if_data *subif;
+        struct ieee802154_local *local = sdata->local;
+        int res = 0;
+
+        ASSERT_RTNL();
+
+        if (sdata->type == IEEE802154_DEV_WPAN) {
+                mutex_lock(&sdata->local->iflist_mtx);
+                list_for_each_entry(subif, &sdata->local->interfaces, list) {
+                        if (subif != sdata && subif->type == sdata->type &&
+                            ieee802154_sdata_running(subif)) {
+                                mutex_unlock(&sdata->local->iflist_mtx);
+                                return -EBUSY;
+                        }
+                }
+                mutex_unlock(&sdata->local->iflist_mtx);
+        }
+
+        set_bit(SDATA_STATE_RUNNING, &sdata->state);
+
+        if (!local->open_count) {
+                res = drv_start(local);
+                WARN_ON(res);
+                if (res)
+                        goto err;
+        }
+
+        local->open_count++;
+        netif_start_queue(dev);
+        return 0;
+err:
+        /* might already be clear but that doesn't matter */
+        clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+
+        return res;
+}
+
+static int mac802154_wpan_open(struct net_device *dev)
+{
+        int rc;
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local = sdata->local;
+        struct wpan_phy *phy = sdata->local->phy;
+
+        rc = mac802154_slave_open(dev);
+        if (rc < 0)
+                return rc;
+
+        mutex_lock(&phy->pib_lock);
+
+        if (local->hw.flags & IEEE802154_HW_PROMISCUOUS) {
+                rc = drv_set_promiscuous_mode(local, sdata->promisuous_mode);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_TXPOWER) {
+                rc = drv_set_tx_power(local, sdata->mac_params.transmit_power);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_LBT) {
+                rc = drv_set_lbt_mode(local, sdata->mac_params.lbt);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_CCA_MODE) {
+                rc = drv_set_cca_mode(local, sdata->mac_params.cca_mode);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_CCA_ED_LEVEL) {
+                rc = drv_set_cca_ed_level(local,
+                                          sdata->mac_params.cca_ed_level);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_CSMA_PARAMS) {
+                rc = drv_set_csma_params(local, sdata->mac_params.min_be,
+                                         sdata->mac_params.max_be,
+                                         sdata->mac_params.csma_retries);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_FRAME_RETRIES) {
+                rc = drv_set_max_frame_retries(local,
+                                               sdata->mac_params.frame_retries);
+                if (rc < 0)
+                        goto out;
+        }
+
+        mutex_unlock(&phy->pib_lock);
+        return 0;
+
+out:
+        mutex_unlock(&phy->pib_lock);
+        return rc;
+}
+
+static int mac802154_slave_close(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local = sdata->local;
+
+        ASSERT_RTNL();
+
+        netif_stop_queue(dev);
+        local->open_count--;
+
+        clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+
+        if (!local->open_count)
+                drv_stop(local);
+
+        return 0;
+}
+
+static int mac802154_set_header_security(struct ieee802154_sub_if_data *sdata,
+                                         struct ieee802154_hdr *hdr,
+                                         const struct ieee802154_mac_cb *cb)
+{
+        struct ieee802154_llsec_params params;
+        u8 level;
+
+        mac802154_llsec_get_params(&sdata->sec, &params);
+
+        if (!params.enabled && cb->secen_override && cb->secen)
+                return -EINVAL;
+        if (!params.enabled ||
+            (cb->secen_override && !cb->secen) ||
+            !params.out_level)
+                return 0;
+        if (cb->seclevel_override && !cb->seclevel)
+                return -EINVAL;
+
+        level = cb->seclevel_override ? cb->seclevel : params.out_level;
+
+        hdr->fc.security_enabled = 1;
+        hdr->sec.level = level;
+        hdr->sec.key_id_mode = params.out_key.mode;
+        if (params.out_key.mode == IEEE802154_SCF_KEY_SHORT_INDEX)
+                hdr->sec.short_src = params.out_key.short_source;
+        else if (params.out_key.mode == IEEE802154_SCF_KEY_HW_INDEX)
+                hdr->sec.extended_src = params.out_key.extended_source;
+        hdr->sec.key_id = params.out_key.id;
+
+        return 0;
+}
+
+static int mac802154_header_create(struct sk_buff *skb,
+                                   struct net_device *dev,
+                                   unsigned short type,
+                                   const void *daddr,
+                                   const void *saddr,
+                                   unsigned len)
+{
+        struct ieee802154_hdr hdr;
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_mac_cb *cb = mac_cb(skb);
+        int hlen;
+
+        if (!daddr)
+                return -EINVAL;
+
+        memset(&hdr.fc, 0, sizeof(hdr.fc));
+        hdr.fc.type = cb->type;
+        hdr.fc.security_enabled = cb->secen;
+        hdr.fc.ack_request = cb->ackreq;
+        hdr.seq = ieee802154_mlme_ops(dev)->get_dsn(dev);
+
+        if (mac802154_set_header_security(sdata, &hdr, cb) < 0)
+                return -EINVAL;
+
+        if (!saddr) {
+                spin_lock_bh(&sdata->mib_lock);
+
+                if (sdata->short_addr == cpu_to_le16(IEEE802154_ADDR_BROADCAST) ||
+                    sdata->short_addr == cpu_to_le16(IEEE802154_ADDR_UNDEF) ||
+                    sdata->pan_id == cpu_to_le16(IEEE802154_PANID_BROADCAST)) {
+                        hdr.source.mode = IEEE802154_ADDR_LONG;
+                        hdr.source.extended_addr = sdata->extended_addr;
+                } else {
+                        hdr.source.mode = IEEE802154_ADDR_SHORT;
+                        hdr.source.short_addr = sdata->short_addr;
+                }
+
+                hdr.source.pan_id = sdata->pan_id;
+
+                spin_unlock_bh(&sdata->mib_lock);
+        } else {
+                hdr.source = *(const struct ieee802154_addr *)saddr;
+        }
+
+        hdr.dest = *(const struct ieee802154_addr *)daddr;
+
+        hlen = ieee802154_hdr_push(skb, &hdr);
+        if (hlen < 0)
+                return -EINVAL;
+
+        skb_reset_mac_header(skb);
+        skb->mac_len = hlen;
+
+        if (len > ieee802154_max_payload(&hdr))
+                return -EMSGSIZE;
+
+        return hlen;
+}
+
+static int
+mac802154_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+{
+        struct ieee802154_hdr hdr;
+        struct ieee802154_addr *addr = (struct ieee802154_addr *)haddr;
+
+        if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0) {
+                pr_debug("malformed packet\n");
+                return 0;
+        }
+
+        *addr = hdr.source;
+        return sizeof(*addr);
+}
+
+static struct header_ops mac802154_header_ops = {
+        .create         = mac802154_header_create,
+        .parse          = mac802154_header_parse,
+};
+
+static const struct net_device_ops mac802154_wpan_ops = {
+        .ndo_open               = mac802154_wpan_open,
+        .ndo_stop               = mac802154_slave_close,
+        .ndo_start_xmit         = ieee802154_subif_start_xmit,
+        .ndo_do_ioctl           = mac802154_wpan_ioctl,
+        .ndo_set_mac_address    = mac802154_wpan_mac_addr,
+};
+
+static const struct net_device_ops mac802154_monitor_ops = {
+        .ndo_open               = mac802154_wpan_open,
+        .ndo_stop               = mac802154_slave_close,
+        .ndo_start_xmit         = ieee802154_monitor_start_xmit,
+};
+
+static void mac802154_wpan_free(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mac802154_llsec_destroy(&sdata->sec);
+
+        free_netdev(dev);
+}
+
+void mac802154_wpan_setup(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata;
+
+        dev->addr_len           = IEEE802154_ADDR_LEN;
+        memset(dev->broadcast, 0xff, IEEE802154_ADDR_LEN);
+
+        dev->hard_header_len    = MAC802154_FRAME_HARD_HEADER_LEN;
+        dev->header_ops         = &mac802154_header_ops;
+        dev->needed_tailroom    = 2 + 16; /* FCS + MIC */
+        dev->mtu                = IEEE802154_MTU;
+        dev->tx_queue_len       = 300;
+        dev->type               = ARPHRD_IEEE802154;
+        dev->flags              = IFF_NOARP | IFF_BROADCAST;
+
+        dev->destructor         = mac802154_wpan_free;
+        dev->netdev_ops         = &mac802154_wpan_ops;
+        dev->ml_priv            = &mac802154_mlme_wpan;
+
+        sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        sdata->type = IEEE802154_DEV_WPAN;
+
+        spin_lock_init(&sdata->mib_lock);
+        mutex_init(&sdata->sec_mtx);
+
+        get_random_bytes(&sdata->bsn, 1);
+        get_random_bytes(&sdata->dsn, 1);
+
+        /* defaults per 802.15.4-2011 */
+        sdata->mac_params.min_be = 3;
+        sdata->mac_params.max_be = 5;
+        sdata->mac_params.csma_retries = 4;
+        /* for compatibility, actual default is 3 */
+        sdata->mac_params.frame_retries = -1;
+
+        sdata->pan_id = cpu_to_le16(IEEE802154_PANID_BROADCAST);
+        sdata->short_addr = cpu_to_le16(IEEE802154_ADDR_BROADCAST);
+
+        sdata->promisuous_mode = false;
+
+        mac802154_llsec_init(&sdata->sec);
+}
+
+void mac802154_monitor_setup(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata;
+
+        dev->needed_tailroom    = 2; /* room for FCS */
+        dev->mtu                = IEEE802154_MTU;
+        dev->tx_queue_len       = 10;
+        dev->type               = ARPHRD_IEEE802154_MONITOR;
+        dev->flags              = IFF_NOARP | IFF_BROADCAST;
+
+        dev->destructor         = free_netdev;
+        dev->netdev_ops         = &mac802154_monitor_ops;
+        dev->ml_priv            = &mac802154_mlme_reduced;
+
+        sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        sdata->type = IEEE802154_DEV_MONITOR;
+
+        sdata->promisuous_mode = true;
+}
diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c
index 457058142098..fa0d5237c2e0 100644
--- a/net/mac802154/llsec.c
+++ b/net/mac802154/llsec.c
@@ -17,10 +17,10 @@
 #include <linux/err.h>
 #include <linux/bug.h>
 #include <linux/completion.h>
-#include <net/ieee802154.h>
+#include <linux/ieee802154.h>
 #include <crypto/algapi.h>
 
-#include "mac802154.h"
+#include "ieee802154_i.h"
 #include "llsec.h"
 
 static void llsec_key_put(struct mac802154_llsec_key *key);
diff --git a/net/mac802154/mac_cmd.c b/net/mac802154/mac_cmd.c
index bf809131eef7..fc261ab33347 100644
--- a/net/mac802154/mac_cmd.c
+++ b/net/mac802154/mac_cmd.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
@@ -24,14 +20,14 @@
 
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
+#include <linux/ieee802154.h>
 
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 #include <net/mac802154.h>
 #include <net/nl802154.h>
 
-#include "mac802154.h"
+#include "ieee802154_i.h"
 
 static int mac802154_mlme_start_req(struct net_device *dev,
                                     struct ieee802154_addr *addr,
@@ -79,11 +75,33 @@ static int mac802154_mlme_start_req(struct net_device *dev,
 
 static struct wpan_phy *mac802154_get_phy(const struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        return to_phy(get_device(&priv->hw->phy->dev));
+        return to_phy(get_device(&sdata->local->phy->dev));
+}
+
+static int mac802154_set_mac_params(struct net_device *dev,
+                                    const struct ieee802154_mac_params *params)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        sdata->mac_params = *params;
+        mutex_unlock(&sdata->local->iflist_mtx);
+
+        return 0;
+}
+
+static void mac802154_get_mac_params(struct net_device *dev,
+                                     struct ieee802154_mac_params *params)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        *params = sdata->mac_params;
+        mutex_unlock(&sdata->local->iflist_mtx);
 }
 
 static struct ieee802154_llsec_ops mac802154_llsec_ops = {
diff --git a/net/mac802154/main.c b/net/mac802154/main.c
new file mode 100644
index 000000000000..86e533ed3775
--- /dev/null
+++ b/net/mac802154/main.c
@@ -0,0 +1,265 @@
+/*
+ * Copyright (C) 2007-2012 Siemens AG
+ *
+ * Written by:
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ *
+ * Based on the code from 'linux-zigbee.sourceforge.net' project.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+#include <net/netlink.h>
+#include <linux/nl802154.h>
+#include <net/mac802154.h>
+#include <net/ieee802154_netdev.h>
+#include <net/route.h>
+#include <net/cfg802154.h>
+
+#include "ieee802154_i.h"
+
+static int
+mac802154_netdev_register(struct wpan_phy *phy, struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local;
+        int err;
+
+        local = wpan_phy_priv(phy);
+
+        sdata->dev = dev;
+        sdata->local = local;
+
+        dev->needed_headroom = local->hw.extra_tx_headroom;
+
+        SET_NETDEV_DEV(dev, &local->phy->dev);
+
+        err = register_netdev(dev);
+        if (err < 0)
+                return err;
+
+        rtnl_lock();
+        mutex_lock(&local->iflist_mtx);
+        list_add_tail_rcu(&sdata->list, &local->interfaces);
+        mutex_unlock(&local->iflist_mtx);
+        rtnl_unlock();
+
+        return 0;
+}
+
+static void
+mac802154_del_iface(struct wpan_phy *phy, struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        ASSERT_RTNL();
+
+        BUG_ON(sdata->local->phy != phy);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        list_del_rcu(&sdata->list);
+        mutex_unlock(&sdata->local->iflist_mtx);
+
+        synchronize_rcu();
+        unregister_netdevice(sdata->dev);
+}
+
+static struct net_device *
+mac802154_add_iface(struct wpan_phy *phy, const char *name, int type)
+{
+        struct net_device *dev;
+        int err = -ENOMEM;
+
+        switch (type) {
+        case IEEE802154_DEV_MONITOR:
+                dev = alloc_netdev(sizeof(struct ieee802154_sub_if_data),
+                                   name, NET_NAME_UNKNOWN,
+                                   mac802154_monitor_setup);
+                break;
+        case IEEE802154_DEV_WPAN:
+                dev = alloc_netdev(sizeof(struct ieee802154_sub_if_data),
+                                   name, NET_NAME_UNKNOWN,
+                                   mac802154_wpan_setup);
+                break;
+        default:
+                dev = NULL;
+                err = -EINVAL;
+                break;
+        }
+        if (!dev)
+                goto err;
+
+        err = mac802154_netdev_register(phy, dev);
+        if (err)
+                goto err_free;
+
+        dev_hold(dev); /* we return an incremented device refcount */
+        return dev;
+
+err_free:
+        free_netdev(dev);
+err:
+        return ERR_PTR(err);
+}
+
+static void ieee802154_tasklet_handler(unsigned long data)
+{
+        struct ieee802154_local *local = (struct ieee802154_local *)data;
+        struct sk_buff *skb;
+
+        while ((skb = skb_dequeue(&local->skb_queue))) {
+                switch (skb->pkt_type) {
+                case IEEE802154_RX_MSG:
+                        /* Clear skb->pkt_type in order to not confuse kernel
+                         * netstack.
+                         */
+                        skb->pkt_type = 0;
+                        ieee802154_rx(&local->hw, skb);
+                        break;
+                default:
+                        WARN(1, "mac802154: Packet is of unknown type %d\n",
+                             skb->pkt_type);
+                        kfree_skb(skb);
+                        break;
+                }
+        }
+}
+
+struct ieee802154_hw *
+ieee802154_alloc_hw(size_t priv_data_len, const struct ieee802154_ops *ops)
+{
+        struct wpan_phy *phy;
+        struct ieee802154_local *local;
+        size_t priv_size;
+
+        if (!ops || !(ops->xmit_async || ops->xmit_sync) || !ops->ed ||
+            !ops->start || !ops->stop || !ops->set_channel) {
+                pr_err("undefined IEEE802.15.4 device operations\n");
+                return NULL;
+        }
+
+        /* Ensure 32-byte alignment of our private data and hw private data.
+         * We use the wpan_phy priv data for both our ieee802154_local and for
+         * the driver's private data
+         *
+         * in memory it'll be like this:
+         *
+         * +-------------------------+
+         * | struct wpan_phy         |
+         * +-------------------------+
+         * | struct ieee802154_local |
+         * +-------------------------+
+         * | driver's private data   |
+         * +-------------------------+
+         *
+         * Due to ieee802154 layer isn't aware of driver and MAC structures,
+         * so lets align them here.
+         */
+
+        priv_size = ALIGN(sizeof(*local), NETDEV_ALIGN) + priv_data_len;
+
+        phy = wpan_phy_alloc(priv_size);
+        if (!phy) {
+                pr_err("failure to allocate master IEEE802.15.4 device\n");
+                return NULL;
+        }
+
+        local = wpan_phy_priv(phy);
+        local->phy = phy;
+        local->hw.phy = local->phy;
+        local->hw.priv = (char *)local + ALIGN(sizeof(*local), NETDEV_ALIGN);
+        local->ops = ops;
+
+        INIT_LIST_HEAD(&local->interfaces);
+        mutex_init(&local->iflist_mtx);
+
+        tasklet_init(&local->tasklet,
+                     ieee802154_tasklet_handler,
+                     (unsigned long)local);
+
+        skb_queue_head_init(&local->skb_queue);
+
+        return &local->hw;
+}
+EXPORT_SYMBOL(ieee802154_alloc_hw);
+
+void ieee802154_free_hw(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+
+        BUG_ON(!list_empty(&local->interfaces));
+
+        mutex_destroy(&local->iflist_mtx);
+
+        wpan_phy_free(local->phy);
+}
+EXPORT_SYMBOL(ieee802154_free_hw);
+
+int ieee802154_register_hw(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        int rc = -ENOSYS;
+
+        local->workqueue =
+                create_singlethread_workqueue(wpan_phy_name(local->phy));
+        if (!local->workqueue) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        wpan_phy_set_dev(local->phy, local->hw.parent);
+
+        local->phy->add_iface = mac802154_add_iface;
+        local->phy->del_iface = mac802154_del_iface;
+
+        rc = wpan_phy_register(local->phy);
+        if (rc < 0)
+                goto out_wq;
+
+        return 0;
+
+out_wq:
+        destroy_workqueue(local->workqueue);
+out:
+        return rc;
+}
+EXPORT_SYMBOL(ieee802154_register_hw);
+
+void ieee802154_unregister_hw(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        struct ieee802154_sub_if_data *sdata, *next;
+
+        tasklet_kill(&local->tasklet);
+        flush_workqueue(local->workqueue);
+        destroy_workqueue(local->workqueue);
+
+        rtnl_lock();
+
+        list_for_each_entry_safe(sdata, next, &local->interfaces, list) {
+                mutex_lock(&sdata->local->iflist_mtx);
+                list_del(&sdata->list);
+                mutex_unlock(&sdata->local->iflist_mtx);
+
+                unregister_netdevice(sdata->dev);
+        }
+
+        rtnl_unlock();
+
+        wpan_phy_unregister(local->phy);
+}
+EXPORT_SYMBOL(ieee802154_unregister_hw);
+
+MODULE_DESCRIPTION("IEEE 802.15.4 implementation");
+MODULE_LICENSE("GPL v2");
diff --git a/net/mac802154/mib.c b/net/mac802154/mib.c
index 868a040fd422..0184fced2f62 100644
--- a/net/mac802154/mib.c
+++ b/net/mac802154/mib.c
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
  * Sergey Lapin <slapin@ossfans.org>
@@ -25,14 +21,10 @@
 
 #include <net/mac802154.h>
 #include <net/ieee802154_netdev.h>
-#include <net/wpan-phy.h>
-
-#include "mac802154.h"
+#include <net/cfg802154.h>
 
-struct phy_chan_notify_work {
-        struct work_struct work;
-        struct net_device *dev;
-};
+#include "ieee802154_i.h"
+#include "driver-ops.h"
 
 struct hw_addr_filt_notify_work {
         struct work_struct work;
@@ -40,25 +32,24 @@ struct hw_addr_filt_notify_work {
         unsigned long changed;
 };
 
-static struct mac802154_priv *mac802154_slave_get_priv(struct net_device *dev)
+static struct ieee802154_local *mac802154_slave_get_priv(struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        return priv->hw;
+        return sdata->local;
 }
 
 static void hw_addr_notify(struct work_struct *work)
 {
         struct hw_addr_filt_notify_work *nw = container_of(work,
                         struct hw_addr_filt_notify_work, work);
-        struct mac802154_priv *hw = mac802154_slave_get_priv(nw->dev);
+        struct ieee802154_local *local = mac802154_slave_get_priv(nw->dev);
         int res;
 
-        res = hw->ops->set_hw_addr_filt(&hw->hw,
-                                        &hw->hw.hw_filt,
-                                        nw->changed);
+        res = local->ops->set_hw_addr_filt(&local->hw, &local->hw.hw_filt,
+                                           nw->changed);
         if (res)
                 pr_debug("failed changed mask %lx\n", nw->changed);
 
@@ -67,7 +58,7 @@ static void hw_addr_notify(struct work_struct *work)
 
 static void set_hw_addr_filt(struct net_device *dev, unsigned long changed)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         struct hw_addr_filt_notify_work *work;
 
         work = kzalloc(sizeof(*work), GFP_ATOMIC);
@@ -77,141 +68,110 @@ static void set_hw_addr_filt(struct net_device *dev, unsigned long changed)
         INIT_WORK(&work->work, hw_addr_notify);
         work->dev = dev;
         work->changed = changed;
-        queue_work(priv->hw->dev_workqueue, &work->work);
+        queue_work(sdata->local->workqueue, &work->work);
 }
 
 void mac802154_dev_set_short_addr(struct net_device *dev, __le16 val)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        priv->short_addr = val;
-        spin_unlock_bh(&priv->mib_lock);
+        spin_lock_bh(&sdata->mib_lock);
+        sdata->short_addr = val;
+        spin_unlock_bh(&sdata->mib_lock);
 
-        if ((priv->hw->ops->set_hw_addr_filt) &&
-            (priv->hw->hw.hw_filt.short_addr != priv->short_addr)) {
-                priv->hw->hw.hw_filt.short_addr = priv->short_addr;
-                set_hw_addr_filt(dev, IEEE802515_AFILT_SADDR_CHANGED);
+        if ((sdata->local->ops->set_hw_addr_filt) &&
+            (sdata->local->hw.hw_filt.short_addr != sdata->short_addr)) {
+                sdata->local->hw.hw_filt.short_addr = sdata->short_addr;
+                set_hw_addr_filt(dev, IEEE802154_AFILT_SADDR_CHANGED);
         }
 }
 
 __le16 mac802154_dev_get_short_addr(const struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         __le16 ret;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        ret = priv->short_addr;
-        spin_unlock_bh(&priv->mib_lock);
+        spin_lock_bh(&sdata->mib_lock);
+        ret = sdata->short_addr;
+        spin_unlock_bh(&sdata->mib_lock);
 
         return ret;
 }
 
 void mac802154_dev_set_ieee_addr(struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct mac802154_priv *mac = priv->hw;
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local = sdata->local;
 
-        priv->extended_addr = ieee802154_devaddr_from_raw(dev->dev_addr);
+        sdata->extended_addr = ieee802154_devaddr_from_raw(dev->dev_addr);
 
-        if (mac->ops->set_hw_addr_filt &&
-            mac->hw.hw_filt.ieee_addr != priv->extended_addr) {
-                mac->hw.hw_filt.ieee_addr = priv->extended_addr;
-                set_hw_addr_filt(dev, IEEE802515_AFILT_IEEEADDR_CHANGED);
+        if (local->ops->set_hw_addr_filt &&
+            local->hw.hw_filt.ieee_addr != sdata->extended_addr) {
+                local->hw.hw_filt.ieee_addr = sdata->extended_addr;
+                set_hw_addr_filt(dev, IEEE802154_AFILT_IEEEADDR_CHANGED);
         }
 }
 
 __le16 mac802154_dev_get_pan_id(const struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         __le16 ret;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        ret = priv->pan_id;
-        spin_unlock_bh(&priv->mib_lock);
+        spin_lock_bh(&sdata->mib_lock);
+        ret = sdata->pan_id;
+        spin_unlock_bh(&sdata->mib_lock);
 
         return ret;
 }
 
 void mac802154_dev_set_pan_id(struct net_device *dev, __le16 val)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        priv->pan_id = val;
-        spin_unlock_bh(&priv->mib_lock);
+        spin_lock_bh(&sdata->mib_lock);
+        sdata->pan_id = val;
+        spin_unlock_bh(&sdata->mib_lock);
 
-        if ((priv->hw->ops->set_hw_addr_filt) &&
-            (priv->hw->hw.hw_filt.pan_id != priv->pan_id)) {
-                priv->hw->hw.hw_filt.pan_id = priv->pan_id;
-                set_hw_addr_filt(dev, IEEE802515_AFILT_PANID_CHANGED);
+        if ((sdata->local->ops->set_hw_addr_filt) &&
+            (sdata->local->hw.hw_filt.pan_id != sdata->pan_id)) {
+                sdata->local->hw.hw_filt.pan_id = sdata->pan_id;
+                set_hw_addr_filt(dev, IEEE802154_AFILT_PANID_CHANGED);
         }
 }
 
 u8 mac802154_dev_get_dsn(const struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        return priv->dsn++;
-}
-
-static void phy_chan_notify(struct work_struct *work)
-{
-        struct phy_chan_notify_work *nw = container_of(work,
-                                          struct phy_chan_notify_work, work);
-        struct mac802154_priv *hw = mac802154_slave_get_priv(nw->dev);
-        struct mac802154_sub_if_data *priv = netdev_priv(nw->dev);
-        int res;
-
-        mutex_lock(&priv->hw->phy->pib_lock);
-        res = hw->ops->set_channel(&hw->hw, priv->page, priv->chan);
-        if (res) {
-                pr_debug("set_channel failed\n");
-        } else {
-                priv->hw->phy->current_channel = priv->chan;
-                priv->hw->phy->current_page = priv->page;
-        }
-        mutex_unlock(&priv->hw->phy->pib_lock);
-
-        kfree(nw);
+        return sdata->dsn++;
 }
 
 void mac802154_dev_set_page_channel(struct net_device *dev, u8 page, u8 chan)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct phy_chan_notify_work *work;
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local = sdata->local;
+        int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        priv->page = page;
-        priv->chan = chan;
-        spin_unlock_bh(&priv->mib_lock);
-
-        mutex_lock(&priv->hw->phy->pib_lock);
-        if (priv->hw->phy->current_channel != priv->chan ||
-            priv->hw->phy->current_page != priv->page) {
-                mutex_unlock(&priv->hw->phy->pib_lock);
-
-                work = kzalloc(sizeof(*work), GFP_ATOMIC);
-                if (!work)
-                        return;
-
-                INIT_WORK(&work->work, phy_chan_notify);
-                work->dev = dev;
-                queue_work(priv->hw->dev_workqueue, &work->work);
+        res = drv_set_channel(local, page, chan);
+        if (res) {
+                pr_debug("set_channel failed\n");
         } else {
-                mutex_unlock(&priv->hw->phy->pib_lock);
+                mutex_lock(&local->phy->pib_lock);
+                local->phy->current_channel = chan;
+                local->phy->current_page = page;
+                mutex_unlock(&local->phy->pib_lock);
         }
 }
 
@@ -219,14 +179,14 @@ void mac802154_dev_set_page_channel(struct net_device *dev, u8 page, u8 chan)
 int mac802154_get_params(struct net_device *dev,
                          struct ieee802154_llsec_params *params)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_get_params(&priv->sec, params);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_get_params(&sdata->sec, params);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -235,14 +195,14 @@ int mac802154_set_params(struct net_device *dev,
                          const struct ieee802154_llsec_params *params,
                          int changed)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_set_params(&priv->sec, params, changed);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_set_params(&sdata->sec, params, changed);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -252,14 +212,14 @@ int mac802154_add_key(struct net_device *dev,
                       const struct ieee802154_llsec_key_id *id,
                       const struct ieee802154_llsec_key *key)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_key_add(&priv->sec, id, key);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_key_add(&sdata->sec, id, key);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -267,14 +227,14 @@ int mac802154_add_key(struct net_device *dev,
 int mac802154_del_key(struct net_device *dev,
                       const struct ieee802154_llsec_key_id *id)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_key_del(&priv->sec, id);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_key_del(&sdata->sec, id);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -283,28 +243,28 @@ int mac802154_del_key(struct net_device *dev,
 int mac802154_add_dev(struct net_device *dev,
                       const struct ieee802154_llsec_device *llsec_dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_dev_add(&priv->sec, llsec_dev);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_dev_add(&sdata->sec, llsec_dev);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
 
 int mac802154_del_dev(struct net_device *dev, __le64 dev_addr)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_dev_del(&priv->sec, dev_addr);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_dev_del(&sdata->sec, dev_addr);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -314,14 +274,14 @@ int mac802154_add_devkey(struct net_device *dev,
                          __le64 device_addr,
                          const struct ieee802154_llsec_device_key *key)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_devkey_add(&priv->sec, device_addr, key);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_devkey_add(&sdata->sec, device_addr, key);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -330,14 +290,14 @@ int mac802154_del_devkey(struct net_device *dev,
                          __le64 device_addr,
                          const struct ieee802154_llsec_device_key *key)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_devkey_del(&priv->sec, device_addr, key);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_devkey_del(&sdata->sec, device_addr, key);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -346,14 +306,14 @@ int mac802154_del_devkey(struct net_device *dev,
 int mac802154_add_seclevel(struct net_device *dev,
                            const struct ieee802154_llsec_seclevel *sl)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_seclevel_add(&priv->sec, sl);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_seclevel_add(&sdata->sec, sl);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -361,14 +321,14 @@ int mac802154_add_seclevel(struct net_device *dev,
 int mac802154_del_seclevel(struct net_device *dev,
                            const struct ieee802154_llsec_seclevel *sl)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_seclevel_del(&priv->sec, sl);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_seclevel_del(&sdata->sec, sl);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -376,28 +336,28 @@ int mac802154_del_seclevel(struct net_device *dev,
 
 void mac802154_lock_table(struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
 }
 
 void mac802154_get_table(struct net_device *dev,
                          struct ieee802154_llsec_table **t)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        *t = &priv->sec.table;
+        *t = &sdata->sec.table;
 }
 
 void mac802154_unlock_table(struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_unlock(&priv->sec_mtx);
+        mutex_unlock(&sdata->sec_mtx);
 }
diff --git a/net/mac802154/monitor.c b/net/mac802154/monitor.c
deleted file mode 100644
index a68230e2b25f..000000000000
--- a/net/mac802154/monitor.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Copyright 2007, 2008, 2009 Siemens AG
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- * Written by:
- * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
- * Sergey Lapin <slapin@ossfans.org>
- * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
- * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
- */
-
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/if_arp.h>
-#include <linux/crc-ccitt.h>
-
-#include <net/ieee802154.h>
-#include <net/mac802154.h>
-#include <net/netlink.h>
-#include <net/wpan-phy.h>
-#include <linux/nl802154.h>
-
-#include "mac802154.h"
-
-static netdev_tx_t mac802154_monitor_xmit(struct sk_buff *skb,
-                                          struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-        u8 chan, page;
-
-        priv = netdev_priv(dev);
-
-        /* FIXME: locking */
-        chan = priv->hw->phy->current_channel;
-        page = priv->hw->phy->current_page;
-
-        if (chan == MAC802154_CHAN_NONE) /* not initialized */
-                return NETDEV_TX_OK;
-
-        if (WARN_ON(page >= WPAN_NUM_PAGES) ||
-            WARN_ON(chan >= WPAN_NUM_CHANNELS))
-                return NETDEV_TX_OK;
-
-        skb->skb_iif = dev->ifindex;
-        dev->stats.tx_packets++;
-        dev->stats.tx_bytes += skb->len;
-
-        return mac802154_tx(priv->hw, skb, page, chan);
-}
-
-
-void mac802154_monitors_rx(struct mac802154_priv *priv, struct sk_buff *skb)
-{
-        struct sk_buff *skb2;
-        struct mac802154_sub_if_data *sdata;
-        u16 crc = crc_ccitt(0, skb->data, skb->len);
-        u8 *data;
-
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &priv->slaves, list) {
-                if (sdata->type != IEEE802154_DEV_MONITOR ||
-                    !netif_running(sdata->dev))
-                        continue;
-
-                skb2 = skb_clone(skb, GFP_ATOMIC);
-                skb2->dev = sdata->dev;
-                skb2->pkt_type = PACKET_HOST;
-                data = skb_put(skb2, 2);
-                data[0] = crc & 0xff;
-                data[1] = crc >> 8;
-
-                netif_rx_ni(skb2);
-        }
-        rcu_read_unlock();
-}
-
-static const struct net_device_ops mac802154_monitor_ops = {
-        .ndo_open               = mac802154_slave_open,
-        .ndo_stop               = mac802154_slave_close,
-        .ndo_start_xmit         = mac802154_monitor_xmit,
-};
-
-void mac802154_monitor_setup(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-
-        dev->addr_len           = 0;
-        dev->hard_header_len    = 0;
-        dev->needed_tailroom    = 2; /* room for FCS */
-        dev->mtu                = IEEE802154_MTU;
-        dev->tx_queue_len       = 10;
-        dev->type               = ARPHRD_IEEE802154_MONITOR;
-        dev->flags              = IFF_NOARP | IFF_BROADCAST;
-        dev->watchdog_timeo     = 0;
-
-        dev->destructor         = free_netdev;
-        dev->netdev_ops         = &mac802154_monitor_ops;
-        dev->ml_priv            = &mac802154_mlme_reduced;
-
-        priv = netdev_priv(dev);
-        priv->type = IEEE802154_DEV_MONITOR;
-
-        priv->chan = MAC802154_CHAN_NONE; /* not initialized */
-        priv->page = 0;
-}
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index a14cf9ede171..95961cccc253 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
  * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
@@ -23,92 +19,285 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/workqueue.h>
 #include <linux/netdevice.h>
 #include <linux/crc-ccitt.h>
+#include <asm/unaligned.h>
 
 #include <net/mac802154.h>
 #include <net/ieee802154_netdev.h>
+#include <net/rtnetlink.h>
+#include <linux/nl802154.h>
 
-#include "mac802154.h"
+#include "ieee802154_i.h"
 
-/* The IEEE 802.15.4 standard defines 4 MAC packet types:
- * - beacon frame
- * - MAC command frame
- * - acknowledgement frame
- * - data frame
- *
- * and only the data frame should be pushed to the upper layers, other types
- * are just internal MAC layer management information. So only data packets
- * are going to be sent to the networking queue, all other will be processed
- * right here by using the device workqueue.
- */
-struct rx_work {
-        struct sk_buff *skb;
-        struct work_struct work;
-        struct ieee802154_dev *dev;
-        u8 lqi;
-};
+static int ieee802154_deliver_skb(struct sk_buff *skb)
+{
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->protocol = htons(ETH_P_IEEE802154);
 
-static void
-mac802154_subif_rx(struct ieee802154_dev *hw, struct sk_buff *skb, u8 lqi)
+        return netif_receive_skb(skb);
+}
+
+static int
+ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
+                       struct sk_buff *skb, const struct ieee802154_hdr *hdr)
 {
-        struct mac802154_priv *priv = mac802154_to_priv(hw);
+        __le16 span, sshort;
+        int rc;
 
-        mac_cb(skb)->lqi = lqi;
-        skb->protocol = htons(ETH_P_IEEE802154);
-        skb_reset_mac_header(skb);
+        pr_debug("getting packet via slave interface %s\n", sdata->dev->name);
 
-        if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
-                u16 crc;
+        spin_lock_bh(&sdata->mib_lock);
 
-                if (skb->len < 2) {
-                        pr_debug("got invalid frame\n");
-                        goto fail;
-                }
-                crc = crc_ccitt(0, skb->data, skb->len);
-                if (crc) {
-                        pr_debug("CRC mismatch\n");
-                        goto fail;
-                }
-                skb_trim(skb, skb->len - 2); /* CRC */
+        span = sdata->pan_id;
+        sshort = sdata->short_addr;
+
+        switch (mac_cb(skb)->dest.mode) {
+        case IEEE802154_ADDR_NONE:
+                if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
+                        /* FIXME: check if we are PAN coordinator */
+                        skb->pkt_type = PACKET_OTHERHOST;
+                else
+                        /* ACK comes with both addresses empty */
+                        skb->pkt_type = PACKET_HOST;
+                break;
+        case IEEE802154_ADDR_LONG:
+                if (mac_cb(skb)->dest.pan_id != span &&
+                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
+                        skb->pkt_type = PACKET_OTHERHOST;
+                else if (mac_cb(skb)->dest.extended_addr == sdata->extended_addr)
+                        skb->pkt_type = PACKET_HOST;
+                else
+                        skb->pkt_type = PACKET_OTHERHOST;
+                break;
+        case IEEE802154_ADDR_SHORT:
+                if (mac_cb(skb)->dest.pan_id != span &&
+                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
+                        skb->pkt_type = PACKET_OTHERHOST;
+                else if (mac_cb(skb)->dest.short_addr == sshort)
+                        skb->pkt_type = PACKET_HOST;
+                else if (mac_cb(skb)->dest.short_addr ==
+                          cpu_to_le16(IEEE802154_ADDR_BROADCAST))
+                        skb->pkt_type = PACKET_BROADCAST;
+                else
+                        skb->pkt_type = PACKET_OTHERHOST;
+                break;
+        default:
+                spin_unlock_bh(&sdata->mib_lock);
+                pr_debug("invalid dest mode\n");
+                kfree_skb(skb);
+                return NET_RX_DROP;
         }
 
-        mac802154_monitors_rx(priv, skb);
-        mac802154_wpans_rx(priv, skb);
+        spin_unlock_bh(&sdata->mib_lock);
 
-        return;
+        skb->dev = sdata->dev;
+
+        rc = mac802154_llsec_decrypt(&sdata->sec, skb);
+        if (rc) {
+                pr_debug("decryption failed: %i\n", rc);
+                goto fail;
+        }
+
+        sdata->dev->stats.rx_packets++;
+        sdata->dev->stats.rx_bytes += skb->len;
+
+        switch (mac_cb(skb)->type) {
+        case IEEE802154_FC_TYPE_DATA:
+                return ieee802154_deliver_skb(skb);
+        default:
+                pr_warn("ieee802154: bad frame received (type = %d)\n",
+                        mac_cb(skb)->type);
+                goto fail;
+        }
 
 fail:
         kfree_skb(skb);
+        return NET_RX_DROP;
 }
 
-static void mac802154_rx_worker(struct work_struct *work)
+static void
+ieee802154_print_addr(const char *name, const struct ieee802154_addr *addr)
 {
-        struct rx_work *rw = container_of(work, struct rx_work, work);
+        if (addr->mode == IEEE802154_ADDR_NONE)
+                pr_debug("%s not present\n", name);
+
+        pr_debug("%s PAN ID: %04x\n", name, le16_to_cpu(addr->pan_id));
+        if (addr->mode == IEEE802154_ADDR_SHORT) {
+                pr_debug("%s is short: %04x\n", name,
+                         le16_to_cpu(addr->short_addr));
+        } else {
+                u64 hw = swab64((__force u64)addr->extended_addr);
 
-        mac802154_subif_rx(rw->dev, rw->skb, rw->lqi);
-        kfree(rw);
+                pr_debug("%s is hardware: %8phC\n", name, &hw);
+        }
 }
 
-void
-ieee802154_rx_irqsafe(struct ieee802154_dev *dev, struct sk_buff *skb, u8 lqi)
+static int
+ieee802154_parse_frame_start(struct sk_buff *skb, struct ieee802154_hdr *hdr)
 {
-        struct mac802154_priv *priv = mac802154_to_priv(dev);
-        struct rx_work *work;
+        int hlen;
+        struct ieee802154_mac_cb *cb = mac_cb_init(skb);
 
-        if (!skb)
-                return;
+        skb_reset_mac_header(skb);
+
+        hlen = ieee802154_hdr_pull(skb, hdr);
+        if (hlen < 0)
+                return -EINVAL;
+
+        skb->mac_len = hlen;
+
+        pr_debug("fc: %04x dsn: %02x\n", le16_to_cpup((__le16 *)&hdr->fc),
+                 hdr->seq);
+
+        cb->type = hdr->fc.type;
+        cb->ackreq = hdr->fc.ack_request;
+        cb->secen = hdr->fc.security_enabled;
+
+        ieee802154_print_addr("destination", &hdr->dest);
+        ieee802154_print_addr("source", &hdr->source);
+
+        cb->source = hdr->source;
+        cb->dest = hdr->dest;
+
+        if (hdr->fc.security_enabled) {
+                u64 key;
+
+                pr_debug("seclevel %i\n", hdr->sec.level);
+
+                switch (hdr->sec.key_id_mode) {
+                case IEEE802154_SCF_KEY_IMPLICIT:
+                        pr_debug("implicit key\n");
+                        break;
+
+                case IEEE802154_SCF_KEY_INDEX:
+                        pr_debug("key %02x\n", hdr->sec.key_id);
+                        break;
+
+                case IEEE802154_SCF_KEY_SHORT_INDEX:
+                        pr_debug("key %04x:%04x %02x\n",
+                                 le32_to_cpu(hdr->sec.short_src) >> 16,
+                                 le32_to_cpu(hdr->sec.short_src) & 0xffff,
+                                 hdr->sec.key_id);
+                        break;
+
+                case IEEE802154_SCF_KEY_HW_INDEX:
+                        key = swab64((__force u64)hdr->sec.extended_src);
+                        pr_debug("key source %8phC %02x\n", &key,
+                                 hdr->sec.key_id);
+                        break;
+                }
+        }
+
+        return 0;
+}
+
+static void
+__ieee802154_rx_handle_packet(struct ieee802154_local *local,
+                              struct sk_buff *skb)
+{
+        int ret;
+        struct ieee802154_sub_if_data *sdata;
+        struct ieee802154_hdr hdr;
 
-        work = kzalloc(sizeof(*work), GFP_ATOMIC);
-        if (!work)
+        ret = ieee802154_parse_frame_start(skb, &hdr);
+        if (ret) {
+                pr_debug("got invalid frame\n");
+                kfree_skb(skb);
                 return;
+        }
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (sdata->type != IEEE802154_DEV_WPAN ||
+                    !netif_running(sdata->dev))
+                        continue;
+
+                ieee802154_subif_frame(sdata, skb, &hdr);
+                skb = NULL;
+                break;
+        }
+
+        if (skb)
+                kfree_skb(skb);
+}
+
+static void
+ieee802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
+{
+        struct sk_buff *skb2;
+        struct ieee802154_sub_if_data *sdata;
+
+        skb_reset_mac_header(skb);
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_IEEE802154);
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (sdata->type != IEEE802154_DEV_MONITOR)
+                        continue;
+
+                if (!ieee802154_sdata_running(sdata))
+                        continue;
+
+                skb2 = skb_clone(skb, GFP_ATOMIC);
+                if (skb2) {
+                        skb2->dev = sdata->dev;
+                        ieee802154_deliver_skb(skb2);
+
+                        sdata->dev->stats.rx_packets++;
+                        sdata->dev->stats.rx_bytes += skb->len;
+                }
+        }
+}
+
+void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        u16 crc;
 
-        INIT_WORK(&work->work, mac802154_rx_worker);
-        work->skb = skb;
-        work->dev = dev;
-        work->lqi = lqi;
+        WARN_ON_ONCE(softirq_count() == 0);
 
-        queue_work(priv->dev_workqueue, &work->work);
+        /* TODO: When a transceiver omits the checksum here, we
+         * add an own calculated one. This is currently an ugly
+         * solution because the monitor needs a crc here.
+         */
+        if (local->hw.flags & IEEE802154_HW_RX_OMIT_CKSUM) {
+                crc = crc_ccitt(0, skb->data, skb->len);
+                put_unaligned_le16(crc, skb_put(skb, 2));
+        }
+
+        rcu_read_lock();
+
+        ieee802154_monitors_rx(local, skb);
+
+        /* Check if transceiver doesn't validate the checksum.
+         * If not we validate the checksum here.
+         */
+        if (local->hw.flags & IEEE802154_HW_RX_DROP_BAD_CKSUM) {
+                crc = crc_ccitt(0, skb->data, skb->len);
+                if (crc) {
+                        rcu_read_unlock();
+                        kfree_skb(skb);
+                        return;
+                }
+        }
+        /* remove crc */
+        skb_trim(skb, skb->len - 2);
+
+        __ieee802154_rx_handle_packet(local, skb);
+
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee802154_rx);
+
+void
+ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+
+        mac_cb(skb)->lqi = lqi;
+        skb->pkt_type = IEEE802154_RX_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
 }
 EXPORT_SYMBOL(ieee802154_rx_irqsafe);
diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
index fdf4c0e67259..cc37b77f2632 100644
--- a/net/mac802154/tx.c
+++ b/net/mac802154/tx.c
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
  * Sergey Lapin <slapin@ossfans.org>
@@ -24,106 +20,98 @@
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/crc-ccitt.h>
+#include <asm/unaligned.h>
 
+#include <net/rtnetlink.h>
 #include <net/ieee802154_netdev.h>
 #include <net/mac802154.h>
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 
-#include "mac802154.h"
+#include "ieee802154_i.h"
+#include "driver-ops.h"
 
 /* IEEE 802.15.4 transceivers can sleep during the xmit session, so process
  * packets through the workqueue.
  */
-struct xmit_work {
+struct ieee802154_xmit_cb {
         struct sk_buff *skb;
         struct work_struct work;
-        struct mac802154_priv *priv;
-        u8 chan;
-        u8 page;
+        struct ieee802154_local *local;
 };
 
-static void mac802154_xmit_worker(struct work_struct *work)
+static struct ieee802154_xmit_cb ieee802154_xmit_cb;
+
+static void ieee802154_xmit_worker(struct work_struct *work)
 {
-        struct xmit_work *xw = container_of(work, struct xmit_work, work);
-        struct mac802154_sub_if_data *sdata;
+        struct ieee802154_xmit_cb *cb =
+                container_of(work, struct ieee802154_xmit_cb, work);
+        struct ieee802154_local *local = cb->local;
+        struct sk_buff *skb = cb->skb;
+        struct net_device *dev = skb->dev;
         int res;
 
-        mutex_lock(&xw->priv->phy->pib_lock);
-        if (xw->priv->phy->current_channel != xw->chan ||
-            xw->priv->phy->current_page != xw->page) {
-                res = xw->priv->ops->set_channel(&xw->priv->hw,
-                                                  xw->page,
-                                                  xw->chan);
-                if (res) {
-                        pr_debug("set_channel failed\n");
-                        goto out;
-                }
+        rtnl_lock();
 
-                xw->priv->phy->current_channel = xw->chan;
-                xw->priv->phy->current_page = xw->page;
-        }
+        /* check if ifdown occurred while schedule */
+        if (!netif_running(dev))
+                goto err_tx;
 
-        res = xw->priv->ops->xmit(&xw->priv->hw, xw->skb);
+        res = drv_xmit_sync(local, skb);
         if (res)
-                pr_debug("transmission failed\n");
+                goto err_tx;
 
-out:
-        mutex_unlock(&xw->priv->phy->pib_lock);
+        ieee802154_xmit_complete(&local->hw, skb);
 
-        /* Restart the netif queue on each sub_if_data object. */
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &xw->priv->slaves, list)
-                netif_wake_queue(sdata->dev);
-        rcu_read_unlock();
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
 
-        dev_kfree_skb(xw->skb);
+        rtnl_unlock();
 
-        kfree(xw);
+        return;
+
+err_tx:
+        /* Restart the netif queue on each sub_if_data object. */
+        ieee802154_wake_queue(&local->hw);
+        rtnl_unlock();
+        kfree_skb(skb);
+        netdev_dbg(dev, "transmission failed\n");
 }
 
-netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
-                         u8 page, u8 chan)
+static netdev_tx_t
+ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
 {
-        struct xmit_work *work;
-        struct mac802154_sub_if_data *sdata;
-
-        if (!(priv->phy->channels_supported[page] & (1 << chan))) {
-                WARN_ON(1);
-                goto err_tx;
-        }
-
-        mac802154_monitors_rx(mac802154_to_priv(&priv->hw), skb);
+        struct net_device *dev = skb->dev;
+        int ret;
 
-        if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
+        if (!(local->hw.flags & IEEE802154_HW_TX_OMIT_CKSUM)) {
                 u16 crc = crc_ccitt(0, skb->data, skb->len);
-                u8 *data = skb_put(skb, 2);
 
-                data[0] = crc & 0xff;
-                data[1] = crc >> 8;
+                put_unaligned_le16(crc, skb_put(skb, 2));
         }
 
-        if (skb_cow_head(skb, priv->hw.extra_tx_headroom))
+        if (skb_cow_head(skb, local->hw.extra_tx_headroom))
                 goto err_tx;
 
-        work = kzalloc(sizeof(*work), GFP_ATOMIC);
-        if (!work) {
-                kfree_skb(skb);
-                return NETDEV_TX_BUSY;
-        }
-
         /* Stop the netif queue on each sub_if_data object. */
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &priv->slaves, list)
-                netif_stop_queue(sdata->dev);
-        rcu_read_unlock();
+        ieee802154_stop_queue(&local->hw);
+
+        /* async is priority, otherwise sync is fallback */
+        if (local->ops->xmit_async) {
+                ret = drv_xmit_async(local, skb);
+                if (ret) {
+                        ieee802154_wake_queue(&local->hw);
+                        goto err_tx;
+                }
 
-        INIT_WORK(&work->work, mac802154_xmit_worker);
-        work->skb = skb;
-        work->priv = priv;
-        work->page = page;
-        work->chan = chan;
+                dev->stats.tx_packets++;
+                dev->stats.tx_bytes += skb->len;
+        } else {
+                INIT_WORK(&ieee802154_xmit_cb.work, ieee802154_xmit_worker);
+                ieee802154_xmit_cb.skb = skb;
+                ieee802154_xmit_cb.local = local;
 
-        queue_work(priv->dev_workqueue, &work->work);
+                queue_work(local->workqueue, &ieee802154_xmit_cb.work);
+        }
 
         return NETDEV_TX_OK;
 
@@ -131,3 +119,31 @@ err_tx:
         kfree_skb(skb);
         return NETDEV_TX_OK;
 }
+
+netdev_tx_t
+ieee802154_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        skb->skb_iif = dev->ifindex;
+
+        return ieee802154_tx(sdata->local, skb);
+}
+
+netdev_tx_t
+ieee802154_subif_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        int rc;
+
+        rc = mac802154_llsec_encrypt(&sdata->sec, skb);
+        if (rc) {
+                netdev_warn(dev, "encryption failed: %i\n", rc);
+                kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+
+        skb->skb_iif = dev->ifindex;
+
+        return ieee802154_tx(sdata->local, skb);
+}
diff --git a/net/mac802154/util.c b/net/mac802154/util.c
new file mode 100644
index 000000000000..117e4eff4ca8
--- /dev/null
+++ b/net/mac802154/util.c
@@ -0,0 +1,55 @@
+/* This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Authors:
+ * Alexander Aring <aar@pengutronix.de>
+ *
+ * Based on: net/mac80211/util.c
+ */
+
+#include "ieee802154_i.h"
+
+void ieee802154_wake_queue(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        struct ieee802154_sub_if_data *sdata;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (!sdata->dev)
+                        continue;
+
+                netif_wake_queue(sdata->dev);
+        }
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee802154_wake_queue);
+
+void ieee802154_stop_queue(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        struct ieee802154_sub_if_data *sdata;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (!sdata->dev)
+                        continue;
+
+                netif_stop_queue(sdata->dev);
+        }
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee802154_stop_queue);
+
+void ieee802154_xmit_complete(struct ieee802154_hw *hw, struct sk_buff *skb)
+{
+        ieee802154_wake_queue(hw);
+        consume_skb(skb);
+}
+EXPORT_SYMBOL(ieee802154_xmit_complete);
diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
deleted file mode 100644
index 4ab86a57dca5..000000000000
--- a/net/mac802154/wpan.c
+++ /dev/null
@@ -1,599 +0,0 @@
-/*
- * Copyright 2007-2012 Siemens AG
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- * Written by:
- * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
- * Sergey Lapin <slapin@ossfans.org>
- * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
- * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
- */
-
-#include <linux/netdevice.h>
-#include <linux/module.h>
-#include <linux/if_arp.h>
-
-#include <net/rtnetlink.h>
-#include <linux/nl802154.h>
-#include <net/af_ieee802154.h>
-#include <net/mac802154.h>
-#include <net/ieee802154_netdev.h>
-#include <net/ieee802154.h>
-#include <net/wpan-phy.h>
-
-#include "mac802154.h"
-
-static int mac802154_wpan_update_llsec(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct ieee802154_mlme_ops *ops = ieee802154_mlme_ops(dev);
-        int rc = 0;
-
-        if (ops->llsec) {
-                struct ieee802154_llsec_params params;
-                int changed = 0;
-
-                params.pan_id = priv->pan_id;
-                changed |= IEEE802154_LLSEC_PARAM_PAN_ID;
-
-                params.hwaddr = priv->extended_addr;
-                changed |= IEEE802154_LLSEC_PARAM_HWADDR;
-
-                rc = ops->llsec->set_params(dev, &params, changed);
-        }
-
-        return rc;
-}
-
-static int
-mac802154_wpan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct sockaddr_ieee802154 *sa =
-                (struct sockaddr_ieee802154 *)&ifr->ifr_addr;
-        int err = -ENOIOCTLCMD;
-
-        spin_lock_bh(&priv->mib_lock);
-
-        switch (cmd) {
-        case SIOCGIFADDR:
-        {
-                u16 pan_id, short_addr;
-
-                pan_id = le16_to_cpu(priv->pan_id);
-                short_addr = le16_to_cpu(priv->short_addr);
-                if (pan_id == IEEE802154_PANID_BROADCAST ||
-                    short_addr == IEEE802154_ADDR_BROADCAST) {
-                        err = -EADDRNOTAVAIL;
-                        break;
-                }
-
-                sa->family = AF_IEEE802154;
-                sa->addr.addr_type = IEEE802154_ADDR_SHORT;
-                sa->addr.pan_id = pan_id;
-                sa->addr.short_addr = short_addr;
-
-                err = 0;
-                break;
-        }
-        case SIOCSIFADDR:
-                dev_warn(&dev->dev,
-                         "Using DEBUGing ioctl SIOCSIFADDR isn't recommended!\n");
-                if (sa->family != AF_IEEE802154 ||
-                    sa->addr.addr_type != IEEE802154_ADDR_SHORT ||
-                    sa->addr.pan_id == IEEE802154_PANID_BROADCAST ||
-                    sa->addr.short_addr == IEEE802154_ADDR_BROADCAST ||
-                    sa->addr.short_addr == IEEE802154_ADDR_UNDEF) {
-                        err = -EINVAL;
-                        break;
-                }
-
-                priv->pan_id = cpu_to_le16(sa->addr.pan_id);
-                priv->short_addr = cpu_to_le16(sa->addr.short_addr);
-
-                err = mac802154_wpan_update_llsec(dev);
-                break;
-        }
-
-        spin_unlock_bh(&priv->mib_lock);
-        return err;
-}
-
-static int mac802154_wpan_mac_addr(struct net_device *dev, void *p)
-{
-        struct sockaddr *addr = p;
-
-        if (netif_running(dev))
-                return -EBUSY;
-
-        /* FIXME: validate addr */
-        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-        mac802154_dev_set_ieee_addr(dev);
-        return mac802154_wpan_update_llsec(dev);
-}
-
-int mac802154_set_mac_params(struct net_device *dev,
-                             const struct ieee802154_mac_params *params)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-
-        mutex_lock(&priv->hw->slaves_mtx);
-        priv->mac_params = *params;
-        mutex_unlock(&priv->hw->slaves_mtx);
-
-        return 0;
-}
-
-void mac802154_get_mac_params(struct net_device *dev,
-                              struct ieee802154_mac_params *params)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-
-        mutex_lock(&priv->hw->slaves_mtx);
-        *params = priv->mac_params;
-        mutex_unlock(&priv->hw->slaves_mtx);
-}
-
-static int mac802154_wpan_open(struct net_device *dev)
-{
-        int rc;
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct wpan_phy *phy = priv->hw->phy;
-
-        rc = mac802154_slave_open(dev);
-        if (rc < 0)
-                return rc;
-
-        mutex_lock(&phy->pib_lock);
-
-        if (phy->set_txpower) {
-                rc = phy->set_txpower(phy, priv->mac_params.transmit_power);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_lbt) {
-                rc = phy->set_lbt(phy, priv->mac_params.lbt);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_cca_mode) {
-                rc = phy->set_cca_mode(phy, priv->mac_params.cca_mode);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_cca_ed_level) {
-                rc = phy->set_cca_ed_level(phy, priv->mac_params.cca_ed_level);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_csma_params) {
-                rc = phy->set_csma_params(phy, priv->mac_params.min_be,
-                                          priv->mac_params.max_be,
-                                          priv->mac_params.csma_retries);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_frame_retries) {
-                rc = phy->set_frame_retries(phy,
-                                            priv->mac_params.frame_retries);
-                if (rc < 0)
-                        goto out;
-        }
-
-        mutex_unlock(&phy->pib_lock);
-        return 0;
-
-out:
-        mutex_unlock(&phy->pib_lock);
-        return rc;
-}
-
-static int mac802154_set_header_security(struct mac802154_sub_if_data *priv,
-                                         struct ieee802154_hdr *hdr,
-                                         const struct ieee802154_mac_cb *cb)
-{
-        struct ieee802154_llsec_params params;
-        u8 level;
-
-        mac802154_llsec_get_params(&priv->sec, &params);
-
-        if (!params.enabled && cb->secen_override && cb->secen)
-                return -EINVAL;
-        if (!params.enabled ||
-            (cb->secen_override && !cb->secen) ||
-            !params.out_level)
-                return 0;
-        if (cb->seclevel_override && !cb->seclevel)
-                return -EINVAL;
-
-        level = cb->seclevel_override ? cb->seclevel : params.out_level;
-
-        hdr->fc.security_enabled = 1;
-        hdr->sec.level = level;
-        hdr->sec.key_id_mode = params.out_key.mode;
-        if (params.out_key.mode == IEEE802154_SCF_KEY_SHORT_INDEX)
-                hdr->sec.short_src = params.out_key.short_source;
-        else if (params.out_key.mode == IEEE802154_SCF_KEY_HW_INDEX)
-                hdr->sec.extended_src = params.out_key.extended_source;
-        hdr->sec.key_id = params.out_key.id;
-
-        return 0;
-}
-
-static int mac802154_header_create(struct sk_buff *skb,
-                                   struct net_device *dev,
-                                   unsigned short type,
-                                   const void *daddr,
-                                   const void *saddr,
-                                   unsigned len)
-{
-        struct ieee802154_hdr hdr;
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct ieee802154_mac_cb *cb = mac_cb(skb);
-        int hlen;
-
-        if (!daddr)
-                return -EINVAL;
-
-        memset(&hdr.fc, 0, sizeof(hdr.fc));
-        hdr.fc.type = cb->type;
-        hdr.fc.security_enabled = cb->secen;
-        hdr.fc.ack_request = cb->ackreq;
-        hdr.seq = ieee802154_mlme_ops(dev)->get_dsn(dev);
-
-        if (mac802154_set_header_security(priv, &hdr, cb) < 0)
-                return -EINVAL;
-
-        if (!saddr) {
-                spin_lock_bh(&priv->mib_lock);
-
-                if (priv->short_addr == cpu_to_le16(IEEE802154_ADDR_BROADCAST) ||
-                    priv->short_addr == cpu_to_le16(IEEE802154_ADDR_UNDEF) ||
-                    priv->pan_id == cpu_to_le16(IEEE802154_PANID_BROADCAST)) {
-                        hdr.source.mode = IEEE802154_ADDR_LONG;
-                        hdr.source.extended_addr = priv->extended_addr;
-                } else {
-                        hdr.source.mode = IEEE802154_ADDR_SHORT;
-                        hdr.source.short_addr = priv->short_addr;
-                }
-
-                hdr.source.pan_id = priv->pan_id;
-
-                spin_unlock_bh(&priv->mib_lock);
-        } else {
-                hdr.source = *(const struct ieee802154_addr *)saddr;
-        }
-
-        hdr.dest = *(const struct ieee802154_addr *)daddr;
-
-        hlen = ieee802154_hdr_push(skb, &hdr);
-        if (hlen < 0)
-                return -EINVAL;
-
-        skb_reset_mac_header(skb);
-        skb->mac_len = hlen;
-
-        if (len > ieee802154_max_payload(&hdr))
-                return -EMSGSIZE;
-
-        return hlen;
-}
-
-static int
-mac802154_header_parse(const struct sk_buff *skb, unsigned char *haddr)
-{
-        struct ieee802154_hdr hdr;
-        struct ieee802154_addr *addr = (struct ieee802154_addr *)haddr;
-
-        if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0) {
-                pr_debug("malformed packet\n");
-                return 0;
-        }
-
-        *addr = hdr.source;
-        return sizeof(*addr);
-}
-
-static netdev_tx_t
-mac802154_wpan_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-        u8 chan, page;
-        int rc;
-
-        priv = netdev_priv(dev);
-
-        spin_lock_bh(&priv->mib_lock);
-        chan = priv->chan;
-        page = priv->page;
-        spin_unlock_bh(&priv->mib_lock);
-
-        if (chan == MAC802154_CHAN_NONE ||
-            page >= WPAN_NUM_PAGES ||
-            chan >= WPAN_NUM_CHANNELS) {
-                kfree_skb(skb);
-                return NETDEV_TX_OK;
-        }
-
-        rc = mac802154_llsec_encrypt(&priv->sec, skb);
-        if (rc) {
-                pr_warn("encryption failed: %i\n", rc);
-                kfree_skb(skb);
-                return NETDEV_TX_OK;
-        }
-
-        skb->skb_iif = dev->ifindex;
-        dev->stats.tx_packets++;
-        dev->stats.tx_bytes += skb->len;
-
-        return mac802154_tx(priv->hw, skb, page, chan);
-}
-
-static struct header_ops mac802154_header_ops = {
-        .create         = mac802154_header_create,
-        .parse          = mac802154_header_parse,
-};
-
-static const struct net_device_ops mac802154_wpan_ops = {
-        .ndo_open               = mac802154_wpan_open,
-        .ndo_stop               = mac802154_slave_close,
-        .ndo_start_xmit         = mac802154_wpan_xmit,
-        .ndo_do_ioctl           = mac802154_wpan_ioctl,
-        .ndo_set_mac_address    = mac802154_wpan_mac_addr,
-};
-
-static void mac802154_wpan_free(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-
-        mac802154_llsec_destroy(&priv->sec);
-
-        free_netdev(dev);
-}
-
-void mac802154_wpan_setup(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-
-        dev->addr_len           = IEEE802154_ADDR_LEN;
-        memset(dev->broadcast, 0xff, IEEE802154_ADDR_LEN);
-
-        dev->hard_header_len    = MAC802154_FRAME_HARD_HEADER_LEN;
-        dev->header_ops         = &mac802154_header_ops;
-        dev->needed_tailroom    = 2 + 16; /* FCS + MIC */
-        dev->mtu                = IEEE802154_MTU;
-        dev->tx_queue_len       = 300;
-        dev->type               = ARPHRD_IEEE802154;
-        dev->flags              = IFF_NOARP | IFF_BROADCAST;
-        dev->watchdog_timeo     = 0;
-
-        dev->destructor         = mac802154_wpan_free;
-        dev->netdev_ops         = &mac802154_wpan_ops;
-        dev->ml_priv            = &mac802154_mlme_wpan;
-
-        priv = netdev_priv(dev);
-        priv->type = IEEE802154_DEV_WPAN;
-
-        priv->chan = MAC802154_CHAN_NONE;
-        priv->page = 0;
-
-        spin_lock_init(&priv->mib_lock);
-        mutex_init(&priv->sec_mtx);
-
-        get_random_bytes(&priv->bsn, 1);
-        get_random_bytes(&priv->dsn, 1);
-
-        /* defaults per 802.15.4-2011 */
-        priv->mac_params.min_be = 3;
-        priv->mac_params.max_be = 5;
-        priv->mac_params.csma_retries = 4;
-        priv->mac_params.frame_retries = -1; /* for compatibility, actual default is 3 */
-
-        priv->pan_id = cpu_to_le16(IEEE802154_PANID_BROADCAST);
-        priv->short_addr = cpu_to_le16(IEEE802154_ADDR_BROADCAST);
-
-        mac802154_llsec_init(&priv->sec);
-}
-
-static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
-{
-        return netif_rx_ni(skb);
-}
-
-static int
-mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb,
-                      const struct ieee802154_hdr *hdr)
-{
-        __le16 span, sshort;
-        int rc;
-
-        pr_debug("getting packet via slave interface %s\n", sdata->dev->name);
-
-        spin_lock_bh(&sdata->mib_lock);
-
-        span = sdata->pan_id;
-        sshort = sdata->short_addr;
-
-        switch (mac_cb(skb)->dest.mode) {
-        case IEEE802154_ADDR_NONE:
-                if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
-                        /* FIXME: check if we are PAN coordinator */
-                        skb->pkt_type = PACKET_OTHERHOST;
-                else
-                        /* ACK comes with both addresses empty */
-                        skb->pkt_type = PACKET_HOST;
-                break;
-        case IEEE802154_ADDR_LONG:
-                if (mac_cb(skb)->dest.pan_id != span &&
-                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
-                        skb->pkt_type = PACKET_OTHERHOST;
-                else if (mac_cb(skb)->dest.extended_addr == sdata->extended_addr)
-                        skb->pkt_type = PACKET_HOST;
-                else
-                        skb->pkt_type = PACKET_OTHERHOST;
-                break;
-        case IEEE802154_ADDR_SHORT:
-                if (mac_cb(skb)->dest.pan_id != span &&
-                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
-                        skb->pkt_type = PACKET_OTHERHOST;
-                else if (mac_cb(skb)->dest.short_addr == sshort)
-                        skb->pkt_type = PACKET_HOST;
-                else if (mac_cb(skb)->dest.short_addr ==
-                          cpu_to_le16(IEEE802154_ADDR_BROADCAST))
-                        skb->pkt_type = PACKET_BROADCAST;
-                else
-                        skb->pkt_type = PACKET_OTHERHOST;
-                break;
-        default:
-                spin_unlock_bh(&sdata->mib_lock);
-                pr_debug("invalid dest mode\n");
-                kfree_skb(skb);
-                return NET_RX_DROP;
-        }
-
-        spin_unlock_bh(&sdata->mib_lock);
-
-        skb->dev = sdata->dev;
-
-        rc = mac802154_llsec_decrypt(&sdata->sec, skb);
-        if (rc) {
-                pr_debug("decryption failed: %i\n", rc);
-                goto fail;
-        }
-
-        sdata->dev->stats.rx_packets++;
-        sdata->dev->stats.rx_bytes += skb->len;
-
-        switch (mac_cb(skb)->type) {
-        case IEEE802154_FC_TYPE_DATA:
-                return mac802154_process_data(sdata->dev, skb);
-        default:
-                pr_warn("ieee802154: bad frame received (type = %d)\n",
-                        mac_cb(skb)->type);
-                goto fail;
-        }
-
-fail:
-        kfree_skb(skb);
-        return NET_RX_DROP;
-}
-
-static void mac802154_print_addr(const char *name,
-                                 const struct ieee802154_addr *addr)
-{
-        if (addr->mode == IEEE802154_ADDR_NONE)
-                pr_debug("%s not present\n", name);
-
-        pr_debug("%s PAN ID: %04x\n", name, le16_to_cpu(addr->pan_id));
-        if (addr->mode == IEEE802154_ADDR_SHORT) {
-                pr_debug("%s is short: %04x\n", name,
-                         le16_to_cpu(addr->short_addr));
-        } else {
-                u64 hw = swab64((__force u64) addr->extended_addr);
-
-                pr_debug("%s is hardware: %8phC\n", name, &hw);
-        }
-}
-
-static int mac802154_parse_frame_start(struct sk_buff *skb,
-                                       struct ieee802154_hdr *hdr)
-{
-        int hlen;
-        struct ieee802154_mac_cb *cb = mac_cb_init(skb);
-
-        hlen = ieee802154_hdr_pull(skb, hdr);
-        if (hlen < 0)
-                return -EINVAL;
-
-        skb->mac_len = hlen;
-
-        pr_debug("fc: %04x dsn: %02x\n", le16_to_cpup((__le16 *)&hdr->fc),
-                 hdr->seq);
-
-        cb->type = hdr->fc.type;
-        cb->ackreq = hdr->fc.ack_request;
-        cb->secen = hdr->fc.security_enabled;
-
-        mac802154_print_addr("destination", &hdr->dest);
-        mac802154_print_addr("source", &hdr->source);
-
-        cb->source = hdr->source;
-        cb->dest = hdr->dest;
-
-        if (hdr->fc.security_enabled) {
-                u64 key;
-
-                pr_debug("seclevel %i\n", hdr->sec.level);
-
-                switch (hdr->sec.key_id_mode) {
-                case IEEE802154_SCF_KEY_IMPLICIT:
-                        pr_debug("implicit key\n");
-                        break;
-
-                case IEEE802154_SCF_KEY_INDEX:
-                        pr_debug("key %02x\n", hdr->sec.key_id);
-                        break;
-
-                case IEEE802154_SCF_KEY_SHORT_INDEX:
-                        pr_debug("key %04x:%04x %02x\n",
-                                 le32_to_cpu(hdr->sec.short_src) >> 16,
-                                 le32_to_cpu(hdr->sec.short_src) & 0xffff,
-                                 hdr->sec.key_id);
-                        break;
-
-                case IEEE802154_SCF_KEY_HW_INDEX:
-                        key = swab64((__force u64) hdr->sec.extended_src);
-                        pr_debug("key source %8phC %02x\n", &key,
-                                 hdr->sec.key_id);
-                        break;
-                }
-        }
-
-        return 0;
-}
-
-void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb)
-{
-        int ret;
-        struct mac802154_sub_if_data *sdata;
-        struct ieee802154_hdr hdr;
-
-        ret = mac802154_parse_frame_start(skb, &hdr);
-        if (ret) {
-                pr_debug("got invalid frame\n");
-                kfree_skb(skb);
-                return;
-        }
-
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &priv->slaves, list) {
-                if (sdata->type != IEEE802154_DEV_WPAN ||
-                    !netif_running(sdata->dev))
-                        continue;
-
-                mac802154_subif_frame(sdata, skb, &hdr);
-                skb = NULL;
-                break;
-        }
-        rcu_read_unlock();
-
-        if (skb)
-                kfree_skb(skb);
-}
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index a761670af31d..4c9e39f04ef8 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -10,7 +10,7 @@ obj-$(CONFIG_WEXT_SPY) += wext-spy.o
 obj-$(CONFIG_WEXT_PRIV) += wext-priv.o
 
 cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
-cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o trace.o
+cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o trace.o ocb.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
 cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o
 cfg80211-$(CONFIG_CFG80211_INTERNAL_REGDB) += regdb.o
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 72d81e2154d5..85506f1d0789 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -115,7 +115,7 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
 EXPORT_SYMBOL(cfg80211_chandef_valid);
 
 static void chandef_primary_freqs(const struct cfg80211_chan_def *c,
-                                  int *pri40, int *pri80)
+                                  u32 *pri40, u32 *pri80)
 {
         int tmp;
 
@@ -366,6 +366,7 @@ int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
 
                 break;
         case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_OCB:
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_AP_VLAN:
@@ -892,6 +893,13 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
                                 *radar_detect |= BIT(wdev->chandef.width);
                 }
                 return;
+        case NL80211_IFTYPE_OCB:
+                if (wdev->chandef.chan) {
+                        *chan = wdev->chandef.chan;
+                        *chanmode = CHAN_MODE_SHARED;
+                        return;
+                }
+                break;
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_WDS:
diff --git a/net/wireless/core.c b/net/wireless/core.c
index f52a4cd7017c..a4d27927aba2 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -86,11 +86,11 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
         return &rdev->wiphy;
 }
 
-int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
-                        char *newname)
+static int cfg80211_dev_check_name(struct cfg80211_registered_device *rdev,
+                                   const char *newname)
 {
         struct cfg80211_registered_device *rdev2;
-        int wiphy_idx, taken = -1, result, digits;
+        int wiphy_idx, taken = -1, digits;
 
         ASSERT_RTNL();
 
@@ -109,15 +109,28 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                         return -EINVAL;
         }
 
+        /* Ensure another device does not already have this name. */
+        list_for_each_entry(rdev2, &cfg80211_rdev_list, list)
+                if (strcmp(newname, wiphy_name(&rdev2->wiphy)) == 0)
+                        return -EINVAL;
+
+        return 0;
+}
+
+int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
+                        char *newname)
+{
+        int result;
+
+        ASSERT_RTNL();
 
         /* Ignore nop renames */
-        if (strcmp(newname, dev_name(&rdev->wiphy.dev)) == 0)
+        if (strcmp(newname, wiphy_name(&rdev->wiphy)) == 0)
                 return 0;
 
-        /* Ensure another device does not already have this name. */
-        list_for_each_entry(rdev2, &cfg80211_rdev_list, list)
-                if (strcmp(newname, dev_name(&rdev2->wiphy.dev)) == 0)
-                        return -EINVAL;
+        result = cfg80211_dev_check_name(rdev, newname);
+        if (result < 0)
+                return result;
 
         result = device_rename(&rdev->wiphy.dev, newname);
         if (result)
@@ -309,7 +322,8 @@ static void cfg80211_destroy_iface_wk(struct work_struct *work)
 
 /* exported functions */
 
-struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
+struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
+                           const char *requested_name)
 {
         static atomic_t wiphy_counter = ATOMIC_INIT(0);
 
@@ -346,7 +360,31 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy_idx--;
 
         /* give it a proper name */
-        dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
+        if (requested_name && requested_name[0]) {
+                int rv;
+
+                rtnl_lock();
+                rv = cfg80211_dev_check_name(rdev, requested_name);
+
+                if (rv < 0) {
+                        rtnl_unlock();
+                        goto use_default_name;
+                }
+
+                rv = dev_set_name(&rdev->wiphy.dev, "%s", requested_name);
+                rtnl_unlock();
+                if (rv)
+                        goto use_default_name;
+        } else {
+use_default_name:
+                /* NOTE:  This is *probably* safe w/out holding rtnl because of
+                 * the restrictions on phy names.  Probably this call could
+                 * fail if some other part of the kernel (re)named a device
+                 * phyX.  But, might should add some locking and check return
+                 * value, and use a different name if this one exists?
+                 */
+                dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
+        }
 
         INIT_LIST_HEAD(&rdev->wdev_list);
         INIT_LIST_HEAD(&rdev->beacon_registrations);
@@ -406,7 +444,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 
         return &rdev->wiphy;
 }
-EXPORT_SYMBOL(wiphy_new);
+EXPORT_SYMBOL(wiphy_new_nm);
 
 static int wiphy_verify_combinations(struct wiphy *wiphy)
 {
@@ -831,7 +869,22 @@ void __cfg80211_leave(struct cfg80211_registered_device *rdev,
         case NL80211_IFTYPE_P2P_GO:
                 __cfg80211_stop_ap(rdev, dev, true);
                 break;
-        default:
+        case NL80211_IFTYPE_OCB:
+                __cfg80211_leave_ocb(rdev, dev);
+                break;
+        case NL80211_IFTYPE_WDS:
+                /* must be handled by mac80211/driver, has no APIs */
+                break;
+        case NL80211_IFTYPE_P2P_DEVICE:
+                /* cannot happen, has no netdev */
+                break;
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_MONITOR:
+                /* nothing to do */
+                break;
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NUM_NL80211_IFTYPES:
+                /* invalid */
                 break;
         }
 }
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 7e3a3cef7df9..61ee664cf2bd 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -290,6 +290,18 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev,
                               struct cfg80211_chan_def *chandef);
 
+/* OCB */
+int __cfg80211_join_ocb(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        struct ocb_setup *setup);
+int cfg80211_join_ocb(struct cfg80211_registered_device *rdev,
+                      struct net_device *dev,
+                      struct ocb_setup *setup);
+int __cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev);
+int cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev);
+
 /* AP */
 int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
                        struct net_device *dev, bool notify);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5839c85075f1..1a31736914e5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -884,7 +884,12 @@ static int nl80211_key_allowed(struct wireless_dev *wdev)
                 if (!wdev->current_bss)
                         return -ENOLINK;
                 break;
-        default:
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NL80211_IFTYPE_OCB:
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_P2P_DEVICE:
+        case NL80211_IFTYPE_WDS:
+        case NUM_NL80211_IFTYPES:
                 return -EINVAL;
         }
 
@@ -1514,8 +1519,8 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
                                 CMD(channel_switch, CHANNEL_SWITCH);
                         CMD(set_qos_map, SET_QOS_MAP);
-                        if (rdev->wiphy.flags &
-                                        WIPHY_FLAG_SUPPORTS_WMM_ADMISSION)
+                        if (rdev->wiphy.features &
+                                        NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
                                 CMD(add_tx_ts, ADD_TX_TS);
                 }
                 /* add into the if now */
@@ -2605,7 +2610,9 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
             !(rdev->wiphy.interface_modes & (1 << type)))
                 return -EOPNOTSUPP;
 
-        if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
+        if ((type == NL80211_IFTYPE_P2P_DEVICE ||
+             rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
+            info->attrs[NL80211_ATTR_MAC]) {
                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
                            ETH_ALEN);
                 if (!is_valid_ether_addr(params.macaddr))
@@ -4398,10 +4405,12 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
-        u8 *mac_addr = NULL;
+        struct station_del_parameters params;
+
+        memset(&params, 0, sizeof(params));
 
         if (info->attrs[NL80211_ATTR_MAC])
-                mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+                params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
@@ -4412,7 +4421,28 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->del_station)
                 return -EOPNOTSUPP;
 
-        return rdev_del_station(rdev, dev, mac_addr);
+        if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
+                params.subtype =
+                        nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
+                if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
+                    params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
+                        return -EINVAL;
+        } else {
+                /* Default to Deauthentication frame */
+                params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
+        }
+
+        if (info->attrs[NL80211_ATTR_REASON_CODE]) {
+                params.reason_code =
+                        nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+                if (params.reason_code == 0)
+                        return -EINVAL; /* 0 is reserved */
+        } else {
+                /* Default to reason code 2 */
+                params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
+        }
+
+        return rdev_del_station(rdev, dev, &params);
 }
 
 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
@@ -4624,6 +4654,96 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
         return rdev_del_mpath(rdev, dev, dst);
 }
 
+static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        int err;
+        struct net_device *dev = info->user_ptr[1];
+        struct mpath_info pinfo;
+        struct sk_buff *msg;
+        u8 *dst = NULL;
+        u8 mpp[ETH_ALEN];
+
+        memset(&pinfo, 0, sizeof(pinfo));
+
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+
+        dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+        if (!rdev->ops->get_mpp)
+                return -EOPNOTSUPP;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
+                return -EOPNOTSUPP;
+
+        err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
+        if (err)
+                return err;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
+                               dev, dst, mpp, &pinfo) < 0) {
+                nlmsg_free(msg);
+                return -ENOBUFS;
+        }
+
+        return genlmsg_reply(msg, info);
+}
+
+static int nl80211_dump_mpp(struct sk_buff *skb,
+                            struct netlink_callback *cb)
+{
+        struct mpath_info pinfo;
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+        u8 dst[ETH_ALEN];
+        u8 mpp[ETH_ALEN];
+        int path_idx = cb->args[2];
+        int err;
+
+        err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
+        if (err)
+                return err;
+
+        if (!rdev->ops->dump_mpp) {
+                err = -EOPNOTSUPP;
+                goto out_err;
+        }
+
+        if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
+                err = -EOPNOTSUPP;
+                goto out_err;
+        }
+
+        while (1) {
+                err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
+                                    mpp, &pinfo);
+                if (err == -ENOENT)
+                        break;
+                if (err)
+                        goto out_err;
+
+                if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
+                                       cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                       wdev->netdev, dst, mpp,
+                                       &pinfo) < 0)
+                        goto out;
+
+                path_idx++;
+        }
+
+ out:
+        cb->args[2] = path_idx;
+        err = skb->len;
+ out_err:
+        nl80211_finish_wdev_dump(rdev);
+        return err;
+}
+
 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -5923,7 +6043,6 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
          * function is called under RTNL lock, so this should not be a problem.
          */
         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
-        u8 radar_detect_width = 0;
         int err;
         bool need_new_beacon = false;
         int len, i;
@@ -6059,10 +6178,8 @@ skip_beacons:
         if (err < 0)
                 return err;
 
-        if (err > 0) {
-                radar_detect_width = BIT(params.chandef.width);
+        if (err > 0)
                 params.radar_required = true;
-        }
 
         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
                 params.block_tx = true;
@@ -8159,6 +8276,28 @@ static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
         return -EINVAL;
 }
 
+static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct ocb_setup setup = {};
+        int err;
+
+        err = nl80211_parse_chandef(rdev, info, &setup.chandef);
+        if (err)
+                return err;
+
+        return cfg80211_join_ocb(rdev, dev, &setup);
+}
+
+static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+
+        return cfg80211_leave_ocb(rdev, dev);
+}
+
 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -9444,7 +9583,7 @@ static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
         u16 admitted_time = 0;
         int err;
 
-        if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_WMM_ADMISSION))
+        if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
                 return -EOPNOTSUPP;
 
         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
@@ -9460,12 +9599,10 @@ static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
 
         /* WMM uses TIDs 0-7 even for TSPEC */
-        if (tsid < IEEE80211_FIRST_TSPEC_TSID) {
-                if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_WMM_ADMISSION))
-                        return -EINVAL;
-        } else {
+        if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
                 /* TODO: handle 802.11 TSPEC/admission control
-                 * need more attributes for that (e.g. BA session requirement)
+                 * need more attributes for that (e.g. BA session requirement);
+                 * change the WMM adminssion test above to allow both then
                  */
                 return -EINVAL;
         }
@@ -9782,6 +9919,15 @@ static const struct genl_ops nl80211_ops[] = {
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
+                .cmd = NL80211_CMD_GET_MPP,
+                .doit = nl80211_get_mpp,
+                .dumpit = nl80211_dump_mpp,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
                 .cmd = NL80211_CMD_SET_MPATH,
                 .doit = nl80211_set_mpath,
                 .policy = nl80211_policy,
@@ -10095,6 +10241,22 @@ static const struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_JOIN_OCB,
+                .doit = nl80211_join_ocb,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_LEAVE_OCB,
+                .doit = nl80211_leave_ocb,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 #ifdef CONFIG_PM
         {
                 .cmd = NL80211_CMD_GET_WOWLAN,
diff --git a/net/wireless/ocb.c b/net/wireless/ocb.c
new file mode 100644
index 000000000000..c00d4a792319
--- /dev/null
+++ b/net/wireless/ocb.c
@@ -0,0 +1,88 @@
+/*
+ * OCB mode implementation
+ *
+ * Copyright: (c) 2014 Czech Technical University in Prague
+ *            (c) 2014 Volkswagen Group Research
+ * Author:    Rostislav Lisovy <rostislav.lisovy@fel.cvut.cz>
+ * Funded by: Volkswagen Group Research
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/ieee80211.h>
+#include <net/cfg80211.h>
+#include "nl80211.h"
+#include "core.h"
+#include "rdev-ops.h"
+
+int __cfg80211_join_ocb(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        struct ocb_setup *setup)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
+                return -EOPNOTSUPP;
+
+        if (WARN_ON(!setup->chandef.chan))
+                return -EINVAL;
+
+        err = rdev_join_ocb(rdev, dev, setup);
+        if (!err)
+                wdev->chandef = setup->chandef;
+
+        return err;
+}
+
+int cfg80211_join_ocb(struct cfg80211_registered_device *rdev,
+                      struct net_device *dev,
+                      struct ocb_setup *setup)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_join_ocb(rdev, dev, setup);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
+int __cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
+                return -EOPNOTSUPP;
+
+        if (!rdev->ops->leave_ocb)
+                return -EOPNOTSUPP;
+
+        err = rdev_leave_ocb(rdev, dev);
+        if (!err)
+                memset(&wdev->chandef, 0, sizeof(wdev->chandef));
+
+        return err;
+}
+
+int cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_leave_ocb(rdev, dev);
+        wdev_unlock(wdev);
+
+        return err;
+}
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index f6d457d6a558..1b3864cd50ca 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -178,11 +178,12 @@ static inline int rdev_add_station(struct cfg80211_registered_device *rdev,
 }
 
 static inline int rdev_del_station(struct cfg80211_registered_device *rdev,
-                                   struct net_device *dev, u8 *mac)
+                                   struct net_device *dev,
+                                   struct station_del_parameters *params)
 {
         int ret;
-        trace_rdev_del_station(&rdev->wiphy, dev, mac);
-        ret = rdev->ops->del_station(&rdev->wiphy, dev, mac);
+        trace_rdev_del_station(&rdev->wiphy, dev, params);
+        ret = rdev->ops->del_station(&rdev->wiphy, dev, params);
         trace_rdev_return_int(&rdev->wiphy, ret);
         return ret;
 }
@@ -263,6 +264,18 @@ static inline int rdev_get_mpath(struct cfg80211_registered_device *rdev,
 
 }
 
+static inline int rdev_get_mpp(struct cfg80211_registered_device *rdev,
+                               struct net_device *dev, u8 *dst, u8 *mpp,
+                               struct mpath_info *pinfo)
+{
+        int ret;
+
+        trace_rdev_get_mpp(&rdev->wiphy, dev, dst, mpp);
+        ret = rdev->ops->get_mpp(&rdev->wiphy, dev, dst, mpp, pinfo);
+        trace_rdev_return_int_mpath_info(&rdev->wiphy, ret, pinfo);
+        return ret;
+}
+
 static inline int rdev_dump_mpath(struct cfg80211_registered_device *rdev,
                                   struct net_device *dev, int idx, u8 *dst,
                                   u8 *next_hop, struct mpath_info *pinfo)
@@ -271,7 +284,20 @@ static inline int rdev_dump_mpath(struct cfg80211_registered_device *rdev,
         int ret;
         trace_rdev_dump_mpath(&rdev->wiphy, dev, idx, dst, next_hop);
         ret = rdev->ops->dump_mpath(&rdev->wiphy, dev, idx, dst, next_hop,
-                                     pinfo);
+                                    pinfo);
+        trace_rdev_return_int_mpath_info(&rdev->wiphy, ret, pinfo);
+        return ret;
+}
+
+static inline int rdev_dump_mpp(struct cfg80211_registered_device *rdev,
+                                struct net_device *dev, int idx, u8 *dst,
+                                u8 *mpp, struct mpath_info *pinfo)
+
+{
+        int ret;
+
+        trace_rdev_dump_mpp(&rdev->wiphy, dev, idx, dst, mpp);
+        ret = rdev->ops->dump_mpp(&rdev->wiphy, dev, idx, dst, mpp, pinfo);
         trace_rdev_return_int_mpath_info(&rdev->wiphy, ret, pinfo);
         return ret;
 }
@@ -322,6 +348,27 @@ static inline int rdev_leave_mesh(struct cfg80211_registered_device *rdev,
         return ret;
 }
 
+static inline int rdev_join_ocb(struct cfg80211_registered_device *rdev,
+                                struct net_device *dev,
+                                struct ocb_setup *setup)
+{
+        int ret;
+        trace_rdev_join_ocb(&rdev->wiphy, dev, setup);
+        ret = rdev->ops->join_ocb(&rdev->wiphy, dev, setup);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
+
+static inline int rdev_leave_ocb(struct cfg80211_registered_device *rdev,
+                                 struct net_device *dev)
+{
+        int ret;
+        trace_rdev_leave_ocb(&rdev->wiphy, dev);
+        ret = rdev->ops->leave_ocb(&rdev->wiphy, dev);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
+
 static inline int rdev_change_bss(struct cfg80211_registered_device *rdev,
                                   struct net_device *dev,
                                   struct bss_parameters *params)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index dc1668ff543b..0ab3711c79a0 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -80,9 +80,18 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         if (!request)
                 return -ENOMEM;
 
-        if (wdev->conn->params.channel)
+        if (wdev->conn->params.channel) {
+                enum ieee80211_band band = wdev->conn->params.channel->band;
+                struct ieee80211_supported_band *sband =
+                        wdev->wiphy->bands[band];
+
+                if (!sband) {
+                        kfree(request);
+                        return -EINVAL;
+                }
                 request->channels[0] = wdev->conn->params.channel;
-        else {
+                request->rates[band] = (1 << sband->n_bitrates) - 1;
+        } else {
                 int i = 0, j;
                 enum ieee80211_band band;
                 struct ieee80211_supported_band *bands;
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 625a6e6d1168..277a85df910e 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -600,6 +600,11 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_leave_ibss,
         TP_ARGS(wiphy, netdev)
 );
 
+DEFINE_EVENT(wiphy_netdev_evt, rdev_leave_ocb,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
+        TP_ARGS(wiphy, netdev)
+);
+
 DEFINE_EVENT(wiphy_netdev_evt, rdev_flush_pmksa,
         TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
         TP_ARGS(wiphy, netdev)
@@ -680,9 +685,34 @@ DECLARE_EVENT_CLASS(wiphy_netdev_mac_evt,
                   WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(sta_mac))
 );
 
-DEFINE_EVENT(wiphy_netdev_mac_evt, rdev_del_station,
-        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, const u8 *mac),
-        TP_ARGS(wiphy, netdev, mac)
+DECLARE_EVENT_CLASS(station_del,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct station_del_parameters *params),
+        TP_ARGS(wiphy, netdev, params),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                MAC_ENTRY(sta_mac)
+                __field(u8, subtype)
+                __field(u16, reason_code)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                MAC_ASSIGN(sta_mac, params->mac);
+                __entry->subtype = params->subtype;
+                __entry->reason_code = params->reason_code;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", station mac: " MAC_PR_FMT
+                  ", subtype: %u, reason_code: %u",
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(sta_mac),
+                  __entry->subtype, __entry->reason_code)
+);
+
+DEFINE_EVENT(station_del, rdev_del_station,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct station_del_parameters *params),
+        TP_ARGS(wiphy, netdev, params)
 );
 
 DEFINE_EVENT(wiphy_netdev_mac_evt, rdev_get_station,
@@ -801,6 +831,51 @@ TRACE_EVENT(rdev_dump_mpath,
                   MAC_PR_ARG(next_hop))
 );
 
+TRACE_EVENT(rdev_get_mpp,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 u8 *dst, u8 *mpp),
+        TP_ARGS(wiphy, netdev, dst, mpp),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                MAC_ENTRY(dst)
+                MAC_ENTRY(mpp)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                MAC_ASSIGN(dst, dst);
+                MAC_ASSIGN(mpp, mpp);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", destination: " MAC_PR_FMT
+                  ", mpp: " MAC_PR_FMT, WIPHY_PR_ARG, NETDEV_PR_ARG,
+                  MAC_PR_ARG(dst), MAC_PR_ARG(mpp))
+);
+
+TRACE_EVENT(rdev_dump_mpp,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int idx,
+                 u8 *dst, u8 *mpp),
+        TP_ARGS(wiphy, netdev, idx, mpp, dst),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                MAC_ENTRY(dst)
+                MAC_ENTRY(mpp)
+                __field(int, idx)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                MAC_ASSIGN(dst, dst);
+                MAC_ASSIGN(mpp, mpp);
+                __entry->idx = idx;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", index: %d, destination: "
+                  MAC_PR_FMT ", mpp: " MAC_PR_FMT,
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->idx, MAC_PR_ARG(dst),
+                  MAC_PR_ARG(mpp))
+);
+
 TRACE_EVENT(rdev_return_int_mpath_info,
         TP_PROTO(struct wiphy *wiphy, int ret, struct mpath_info *pinfo),
         TP_ARGS(wiphy, ret, pinfo),
@@ -1246,6 +1321,22 @@ TRACE_EVENT(rdev_join_ibss,
                   WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(bssid), __entry->ssid)
 );
 
+TRACE_EVENT(rdev_join_ocb,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 const struct ocb_setup *setup),
+        TP_ARGS(wiphy, netdev, setup),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT,
+                  WIPHY_PR_ARG, NETDEV_PR_ARG)
+);
+
 TRACE_EVENT(rdev_set_wiphy_params,
         TP_PROTO(struct wiphy *wiphy, u32 changed),
         TP_ARGS(wiphy, changed),
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 5e233a577d0f..d0ac795445b7 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -442,7 +442,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 break;
         case cpu_to_le16(0):
                 if (iftype != NL80211_IFTYPE_ADHOC &&
-                    iftype != NL80211_IFTYPE_STATION)
+                    iftype != NL80211_IFTYPE_STATION &&
+                    iftype != NL80211_IFTYPE_OCB)
                                 return -1;
                 break;
         }
@@ -519,6 +520,7 @@ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
                 hdrlen = 24;
                 break;
+        case NL80211_IFTYPE_OCB:
         case NL80211_IFTYPE_ADHOC:
                 /* DA SA BSSID */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -937,6 +939,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                         if (dev->ieee80211_ptr->use_4addr)
                                 break;
                         /* fall through */
+                case NL80211_IFTYPE_OCB:
                 case NL80211_IFTYPE_P2P_CLIENT:
                 case NL80211_IFTYPE_ADHOC:
                         dev->priv_flags |= IFF_DONT_BRIDGE;