Index: sys/arm/xscale/ixp425/if_npe.c
===================================================================
--- sys/arm/xscale/ixp425/if_npe.c	(revision 215570)
+++ sys/arm/xscale/ixp425/if_npe.c	(working copy)
@@ -360,7 +360,7 @@ npe_attach(device_t dev)
 	ifp->if_ioctl = npeioctl;
 	ifp->if_init = npeinit;
 	IFQ_SET_MAXLEN(&ifp->if_snd, sc->txdma.nbuf - 1);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 	ifp->if_linkmib = &sc->mibdata;
 	ifp->if_linkmiblen = sizeof(sc->mibdata);
Index: sys/arm/at91/if_ate.c
===================================================================
--- sys/arm/at91/if_ate.c	(revision 215570)
+++ sys/arm/at91/if_ate.c	(working copy)
@@ -273,8 +273,8 @@ ate_attach(device_t dev)
 	ifp->if_ioctl = ateioctl;
 	ifp->if_init = ateinit;
 	ifp->if_baudrate = 10000000;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 	ifp->if_timer = 0;
 	ifp->if_linkmib = &sc->mibdata;
Index: sys/conf/files
===================================================================
--- sys/conf/files	(revision 215570)
+++ sys/conf/files	(working copy)
@@ -2352,7 +2352,7 @@ net80211/ieee80211_action.c	optional wlan
 net80211/ieee80211_ageq.c	optional wlan
 net80211/ieee80211_adhoc.c	optional wlan
 net80211/ieee80211_ageq.c	optional wlan
-net80211/ieee80211_amrr.c	optional wlan wlan_amrr
+net80211/ieee80211_amrr.c	optional wlan | wlan_amrr
 net80211/ieee80211_crypto.c	optional wlan
 net80211/ieee80211_crypto_ccmp.c optional wlan wlan_ccmp
 net80211/ieee80211_crypto_none.c optional wlan
@@ -2375,6 +2375,7 @@ net80211/ieee80211_power.c	optional wlan
 net80211/ieee80211_proto.c	optional wlan
 net80211/ieee80211_radiotap.c	optional wlan
 net80211/ieee80211_ratectl.c	optional wlan
+net80211/ieee80211_ratectl_none.c optional wlan
 net80211/ieee80211_regdomain.c	optional wlan
 net80211/ieee80211_rssadapt.c	optional wlan wlan_rssadapt
 net80211/ieee80211_scan.c	optional wlan
Index: sys/mips/adm5120/if_admsw.c
===================================================================
--- sys/mips/adm5120/if_admsw.c	(revision 215570)
+++ sys/mips/adm5120/if_admsw.c	(working copy)
@@ -541,8 +541,8 @@ admsw_attach(device_t dev)
 		ifp->if_init = admsw_init;
 		ifp->if_mtu = ETHERMTU;
 		ifp->if_baudrate = IF_Mbps(100);
-		IFQ_SET_MAXLEN(&ifp->if_snd, max(ADMSW_NTXLDESC, IFQ_MAXLEN));
-		ifp->if_snd.ifq_drv_maxlen = max(ADMSW_NTXLDESC, IFQ_MAXLEN);
+		IFQ_SET_MAXLEN(&ifp->if_snd, max(ADMSW_NTXLDESC, ifqmaxlen));
+		ifp->if_snd.ifq_drv_maxlen = max(ADMSW_NTXLDESC, ifqmaxlen);
 		IFQ_SET_READY(&ifp->if_snd);
 		ifp->if_capabilities |= IFCAP_VLAN_MTU;
 
Index: sys/modules/wlan/Makefile
===================================================================
--- sys/modules/wlan/Makefile	(revision 215570)
+++ sys/modules/wlan/Makefile	(working copy)
@@ -3,13 +3,13 @@
 .PATH: ${.CURDIR}/../../net80211
 
 KMOD=	wlan
-SRCS=	ieee80211.c ieee80211_action.c ieee80211_ageq.c ieee80211_amrr.c \
+SRCS=	ieee80211.c ieee80211_action.c ieee80211_ageq.c \
 	ieee80211_crypto.c ieee80211_crypto_none.c ieee80211_dfs.c \
 	ieee80211_freebsd.c ieee80211_input.c ieee80211_ioctl.c \
 	ieee80211_mesh.c ieee80211_node.c ieee80211_output.c ieee80211_phy.c \
 	ieee80211_power.c ieee80211_proto.c ieee80211_scan.c \
 	ieee80211_scan_sta.c ieee80211_radiotap.c ieee80211_ratectl.c \
-	ieee80211_regdomain.c ieee80211_rssadapt.c \
+	ieee80211_ratectl_none.c ieee80211_regdomain.c \
 	ieee80211_ht.c ieee80211_hwmp.c ieee80211_adhoc.c ieee80211_hostap.c \
 	ieee80211_monitor.c ieee80211_sta.c ieee80211_wds.c ieee80211_ddb.c
 SRCS+=	bus_if.h device_if.h opt_inet.h opt_inet6.h opt_ipx.h opt_wlan.h \
Index: sys/netgraph/ng_eiface.c
===================================================================
--- sys/netgraph/ng_eiface.c	(revision 215570)
+++ sys/netgraph/ng_eiface.c	(working copy)
@@ -369,8 +369,7 @@ ng_eiface_constructor(node_p node)
 	ifp->if_output = ether_output;
 	ifp->if_start = ng_eiface_start;
 	ifp->if_ioctl = ng_eiface_ioctl;
-	ifp->if_watchdog = NULL;
-	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	ifp->if_flags = (IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST);
 
 	/* Give this node the same name as the interface (if possible) */
Index: sys/netgraph/ng_tty.c
===================================================================
--- sys/netgraph/ng_tty.c	(revision 215570)
+++ sys/netgraph/ng_tty.c	(working copy)
@@ -164,7 +164,7 @@ ngt_constructor(node_p node)
 	sc->node = node;
 
 	mtx_init(&sc->outq.ifq_mtx, "ng_tty node+queue", NULL, MTX_DEF);
-	IFQ_SET_MAXLEN(&sc->outq, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&sc->outq, ifqmaxlen);
 
 	return (0);
 }
Index: sys/netgraph/ng_sppp.c
===================================================================
--- sys/netgraph/ng_sppp.c	(revision 215570)
+++ sys/netgraph/ng_sppp.c	(working copy)
@@ -279,7 +279,6 @@ ng_sppp_constructor (node_p node)
 	if_initname (SP2IFP(pp), NG_SPPP_IFACE_NAME, priv->unit);
 	ifp->if_start = ng_sppp_start;
 	ifp->if_ioctl = ng_sppp_ioctl;
-	ifp->if_watchdog = NULL;
 	ifp->if_flags = (IFF_POINTOPOINT|IFF_MULTICAST);
 
 	/* Give this node the same name as the interface (if possible) */
Index: sys/netgraph/ng_fec.c
===================================================================
--- sys/netgraph/ng_fec.c	(revision 215570)
+++ sys/netgraph/ng_fec.c	(working copy)
@@ -1227,8 +1227,7 @@ ng_fec_constructor(node_p node)
 	ifp->if_start = ng_fec_start;
 	ifp->if_ioctl = ng_fec_ioctl;
 	ifp->if_init = ng_fec_init;
-	ifp->if_watchdog = NULL;
-	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	ifp->if_mtu = NG_FEC_MTU_DEFAULT;
 	ifp->if_flags = (IFF_SIMPLEX|IFF_BROADCAST|IFF_MULTICAST);
 	ifp->if_addrlen = 0;			/* XXX */
Index: sys/netgraph/ng_iface.c
===================================================================
--- sys/netgraph/ng_iface.c	(revision 215570)
+++ sys/netgraph/ng_iface.c	(working copy)
@@ -558,15 +558,14 @@ ng_iface_constructor(node_p node)
 	ifp->if_output = ng_iface_output;
 	ifp->if_start = ng_iface_start;
 	ifp->if_ioctl = ng_iface_ioctl;
-	ifp->if_watchdog = NULL;
 	ifp->if_mtu = NG_IFACE_MTU_DEFAULT;
 	ifp->if_flags = (IFF_SIMPLEX|IFF_POINTOPOINT|IFF_NOARP|IFF_MULTICAST);
 	ifp->if_type = IFT_PROPVIRTUAL;		/* XXX */
 	ifp->if_addrlen = 0;			/* XXX */
 	ifp->if_hdrlen = 0;			/* XXX */
 	ifp->if_baudrate = 64000;		/* XXX */
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	/* Give this node the same name as the interface (if possible) */
Index: sys/pci/if_rl.c
===================================================================
--- sys/pci/if_rl.c	(revision 215570)
+++ sys/pci/if_rl.c	(working copy)
@@ -942,8 +942,8 @@ rl_attach(device_t dev)
 #ifdef DEVICE_POLLING
 	ifp->if_capabilities |= IFCAP_POLLING;
 #endif
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	/*
Index: sys/dev/sbni/if_sbni.c
===================================================================
--- sys/dev/sbni/if_sbni.c	(revision 215570)
+++ sys/dev/sbni/if_sbni.c	(working copy)
@@ -235,7 +235,7 @@ sbni_attach(struct sbni_softc *sc, int unit, struc
 	ifp->if_init	= sbni_init;
 	ifp->if_start	= sbni_start;
 	ifp->if_ioctl	= sbni_ioctl;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 
 	/* report real baud rate */
 	csr0 = sbni_inb(sc, CSR0);
Index: sys/dev/wpi/if_wpi.c
===================================================================
--- sys/dev/wpi/if_wpi.c	(revision 215570)
+++ sys/dev/wpi/if_wpi.c	(working copy)
@@ -661,8 +661,8 @@ wpi_attach(device_t dev)
 	ifp->if_init = wpi_init;
 	ifp->if_ioctl = wpi_ioctl;
 	ifp->if_start = wpi_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ieee80211_ifattach(ic, macaddr);
Index: sys/dev/ce/if_ce.c
===================================================================
--- sys/dev/ce/if_ce.c	(revision 215570)
+++ sys/dev/ce/if_ce.c	(working copy)
@@ -701,9 +701,9 @@ static int ce_attach (device_t dev)
 #endif
 			continue;
 		}
-		d->queue.ifq_maxlen	= IFQ_MAXLEN;
-		d->hi_queue.ifq_maxlen	= IFQ_MAXLEN;
-		d->rqueue.ifq_maxlen	= IFQ_MAXLEN;
+		d->queue.ifq_maxlen	= ifqmaxlen;
+		d->hi_queue.ifq_maxlen	= ifqmaxlen;
+		d->rqueue.ifq_maxlen	= ifqmaxlen;
 #if __FreeBSD_version >= 500000
 		mtx_init (&d->queue.ifq_mtx, "ce_queue", NULL, MTX_DEF);
 		mtx_init (&d->hi_queue.ifq_mtx, "ce_queue_hi", NULL, MTX_DEF);
@@ -733,7 +733,7 @@ static int ce_attach (device_t dev)
 		d->ifp->if_start	= ce_ifstart;
 		d->ifp->if_watchdog	= ce_ifwatchdog;
 		d->ifp->if_init		= ce_initialize;
-		d->rqueue.ifq_maxlen	= IFQ_MAXLEN;
+		d->rqueue.ifq_maxlen	= ifqmaxlen;
 #if __FreeBSD_version >= 500000
 		mtx_init (&d->rqueue.ifq_mtx, "ce_rqueue", NULL, MTX_DEF);
 #endif		
Index: sys/dev/cm/smc90cx6.c
===================================================================
--- sys/dev/cm/smc90cx6.c	(revision 215570)
+++ sys/dev/cm/smc90cx6.c	(working copy)
@@ -197,7 +197,7 @@ cm_attach(dev)
 	ifp->if_watchdog  = cm_watchdog;
 	ifp->if_init = cm_init;
 	/* XXX IFQ_SET_READY(&ifp->if_snd); */
-	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	ifp->if_timer = 0;
 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX;
 
Index: sys/dev/cp/if_cp.c
===================================================================
--- sys/dev/cp/if_cp.c	(revision 215570)
+++ sys/dev/cp/if_cp.c	(working copy)
@@ -504,8 +504,8 @@ static int cp_attach (device_t dev)
 			NG_NODE_UNREF (d->node);
 			continue;
 		}
-		d->queue.ifq_maxlen = IFQ_MAXLEN;
-		d->hi_queue.ifq_maxlen = IFQ_MAXLEN;
+		d->queue.ifq_maxlen = ifqmaxlen;
+		d->hi_queue.ifq_maxlen = ifqmaxlen;
 		mtx_init (&d->queue.ifq_mtx, "cp_queue", NULL, MTX_DEF);
 		mtx_init (&d->hi_queue.ifq_mtx, "cp_queue_hi", NULL, MTX_DEF);
 		callout_init (&d->timeout_handle, CALLOUT_MPSAFE);
Index: sys/dev/cs/if_cs.c
===================================================================
--- sys/dev/cs/if_cs.c	(revision 215570)
+++ sys/dev/cs/if_cs.c	(working copy)
@@ -500,7 +500,7 @@ cs_attach(device_t dev)
 	ifp->if_start=cs_start;
 	ifp->if_ioctl=cs_ioctl;
 	ifp->if_init=cs_init;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 
 	ifp->if_flags=(IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST);
 
Index: sys/dev/cx/if_cx.c
===================================================================
--- sys/dev/cx/if_cx.c	(revision 215570)
+++ sys/dev/cx/if_cx.c	(working copy)
@@ -830,8 +830,8 @@ static int cx_attach (device_t dev)
 			cx_bus_dma_mem_free (&d->dmamem);
 			continue;
 		}
-		d->lo_queue.ifq_maxlen = IFQ_MAXLEN;
-		d->hi_queue.ifq_maxlen = IFQ_MAXLEN;
+		d->lo_queue.ifq_maxlen = ifqmaxlen;
+		d->hi_queue.ifq_maxlen = ifqmaxlen;
 		mtx_init (&d->lo_queue.ifq_mtx, "cx_queue_lo", NULL, MTX_DEF);
 		mtx_init (&d->hi_queue.ifq_mtx, "cx_queue_hi", NULL, MTX_DEF);
 		callout_init (&d->timeout_handle, CALLOUT_MPSAFE);
Index: sys/dev/sk/if_sk.c
===================================================================
--- sys/dev/sk/if_sk.c	(revision 215570)
+++ sys/dev/sk/if_sk.c	(working copy)
@@ -1372,8 +1372,6 @@ sk_attach(dev)
 	ifp->if_capenable = ifp->if_capabilities;
 	ifp->if_ioctl = sk_ioctl;
 	ifp->if_start = sk_start;
-	ifp->if_timer = 0;
-	ifp->if_watchdog = NULL;
 	ifp->if_init = sk_init;
 	IFQ_SET_MAXLEN(&ifp->if_snd, SK_TX_RING_CNT - 1);
 	ifp->if_snd.ifq_drv_maxlen = SK_TX_RING_CNT - 1;
Index: sys/dev/sn/if_sn.c
===================================================================
--- sys/dev/sn/if_sn.c	(revision 215570)
+++ sys/dev/sn/if_sn.c	(working copy)
@@ -205,8 +205,8 @@ sn_attach(device_t dev)
 	ifp->if_watchdog = snwatchdog;
 	ifp->if_init = sninit;
 	ifp->if_baudrate = 10000000;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 	ifp->if_timer = 0;
 
Index: sys/dev/malo/if_malo.c
===================================================================
--- sys/dev/malo/if_malo.c	(revision 215570)
+++ sys/dev/malo/if_malo.c	(working copy)
@@ -275,8 +275,8 @@ malo_attach(uint16_t devid, struct malo_softc *sc)
 	ifp->if_watchdog = malo_watchdog;
 	ifp->if_ioctl = malo_ioctl;
 	ifp->if_init = malo_init;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/dev/ppbus/if_plip.c
===================================================================
--- sys/dev/ppbus/if_plip.c	(revision 215570)
+++ sys/dev/ppbus/if_plip.c	(working copy)
@@ -262,7 +262,7 @@ lp_attach(device_t dev)
 	ifp->if_output = lpoutput;
 	ifp->if_hdrlen = 0;
 	ifp->if_addrlen = 0;
-	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	if_attach(ifp);
 
 	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
Index: sys/dev/le/lance.c
===================================================================
--- sys/dev/le/lance.c	(revision 215570)
+++ sys/dev/le/lance.c	(working copy)
@@ -133,8 +133,8 @@ lance_config(struct lance_softc *sc, const char* n
 	ifp->if_flags &= ~IFF_MULTICAST;
 #endif
 	ifp->if_baudrate = IF_Mbps(10);
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	/* Initialize ifmedia structures. */
Index: sys/dev/ed/if_ed.c
===================================================================
--- sys/dev/ed/if_ed.c	(revision 215570)
+++ sys/dev/ed/if_ed.c	(working copy)
@@ -283,8 +283,8 @@ ed_attach(device_t dev)
 	ifp->if_ioctl = ed_ioctl;
 	ifp->if_watchdog = ed_watchdog;
 	ifp->if_init = ed_init;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 	ifp->if_linkmib = &sc->mibdata;
 	ifp->if_linkmiblen = sizeof sc->mibdata;
Index: sys/dev/iwi/if_iwivar.h
===================================================================
--- sys/dev/iwi/if_iwivar.h	(revision 215570)
+++ sys/dev/iwi/if_iwivar.h	(working copy)
@@ -193,6 +193,7 @@ struct iwi_softc {
 	struct task		sc_restarttask;	/* restart adapter processing */
 	struct task		sc_disassoctask;
 	struct task		sc_wmetask;	/* set wme parameters */
+	struct task		sc_monitortask;
 
 	unsigned int		sc_softled : 1,	/* enable LED gpio status */
 				sc_ledstate: 1,	/* LED on/off state */
Index: sys/dev/iwi/if_iwi.c
===================================================================
--- sys/dev/iwi/if_iwi.c	(revision 215570)
+++ sys/dev/iwi/if_iwi.c	(working copy)
@@ -180,6 +180,7 @@ static void	iwi_release_fw_dma(struct iwi_softc *s
 static int	iwi_config(struct iwi_softc *);
 static int	iwi_get_firmware(struct iwi_softc *, enum ieee80211_opmode);
 static void	iwi_put_firmware(struct iwi_softc *);
+static void	iwi_monitor_scan(void *, int);
 static int	iwi_scanchan(struct iwi_softc *, unsigned long, int);
 static void	iwi_scan_start(struct ieee80211com *);
 static void	iwi_scan_end(struct ieee80211com *);
@@ -292,6 +293,7 @@ iwi_attach(device_t dev)
 	TASK_INIT(&sc->sc_restarttask, 0, iwi_restart, sc);
 	TASK_INIT(&sc->sc_disassoctask, 0, iwi_disassoc, sc);
 	TASK_INIT(&sc->sc_wmetask, 0, iwi_update_wme, sc);
+	TASK_INIT(&sc->sc_monitortask, 0, iwi_monitor_scan, sc);
 
 	callout_init_mtx(&sc->sc_wdtimer, &sc->sc_mtx, 0);
 	callout_init_mtx(&sc->sc_rftimer, &sc->sc_mtx, 0);
@@ -363,8 +365,8 @@ iwi_attach(device_t dev)
 	ifp->if_init = iwi_init;
 	ifp->if_ioctl = iwi_ioctl;
 	ifp->if_start = iwi_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
@@ -460,6 +462,7 @@ iwi_detach(device_t dev)
 	ieee80211_draintask(ic, &sc->sc_radiofftask);
 	ieee80211_draintask(ic, &sc->sc_restarttask);
 	ieee80211_draintask(ic, &sc->sc_disassoctask);
+	ieee80211_draintask(ic, &sc->sc_monitortask);
 
 	iwi_stop(sc);
 
@@ -988,7 +991,8 @@ iwi_newstate(struct ieee80211vap *vap, enum ieee80
 			 * This is all totally bogus and needs to be redone.
 			 */
 			iwi_auth_and_assoc(sc, vap);
-		}
+		} else if (vap->iv_opmode == IEEE80211_M_MONITOR)
+			ieee80211_runtask(ic, &sc->sc_monitortask);
 		break;
 	case IEEE80211_S_ASSOC:
 		/*
@@ -1364,7 +1368,7 @@ iwi_checkforqos(struct ieee80211vap *vap,
 
 	ni = vap->iv_bss;
 	ni->ni_capinfo = capinfo;
-	ni->ni_associd = associd;
+	ni->ni_associd = associd & 0x3fff;
 	if (wme != NULL)
 		ni->ni_flags |= IEEE80211_NODE_QOS;
 	else
@@ -1407,6 +1411,18 @@ iwi_notification_intr(struct iwi_softc *sc, struct
 
 		IWI_STATE_END(sc, IWI_FW_SCANNING);
 
+		/*
+		 * Monitor mode works by doing a passive scan to set
+		 * the channel and enable rx.  Because we don't want
+		 * to abort a scan lest the firmware crash we scan
+		 * for a short period of time and automatically restart
+		 * the scan when notified the sweep has completed.
+		 */
+		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
+			ieee80211_runtask(ic, &sc->sc_monitortask);
+			break;
+		}
+
 		if (scan->status == IWI_SCAN_COMPLETED) {
 			/* NB: don't need to defer, net80211 does it for us */
 			ieee80211_scan_next(vap);
@@ -1467,7 +1483,7 @@ iwi_notification_intr(struct iwi_softc *sc, struct
 			IWI_STATE_END(sc, IWI_FW_ASSOCIATING);
 			iwi_checkforqos(vap,
 			    (const struct ieee80211_frame *)(assoc+1),
-			    le16toh(notif->len) - sizeof(*assoc));
+			    le16toh(notif->len) - sizeof(*assoc) - 1);
 			ieee80211_new_state(vap, IEEE80211_S_RUN, -1);
 			break;
 		case IWI_ASSOC_INIT:
@@ -2557,6 +2573,11 @@ iwi_config(struct iwi_softc *sc)
 	config.answer_pbreq = (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
 	config.disable_unicast_decryption = 1;
 	config.disable_multicast_decryption = 1;
+	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
+		config.allow_invalid_frames = 1;
+		config.allow_beacon_and_probe_resp = 1;
+		config.allow_mgt = 1;
+	}
 	DPRINTF(("Configuring adapter\n"));
 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config);
 	if (error != 0)
@@ -2642,6 +2663,17 @@ scan_band(const struct ieee80211_channel *c)
 	return IEEE80211_IS_CHAN_5GHZ(c) ?  IWI_CHAN_5GHZ : IWI_CHAN_2GHZ;
 }
 
+static void
+iwi_monitor_scan(void *arg, int npending)
+{
+	struct iwi_softc *sc = arg;
+	IWI_LOCK_DECL;
+
+	IWI_LOCK(sc);
+	(void) iwi_scanchan(sc, 2000, 0);
+	IWI_UNLOCK(sc);
+}
+
 /*
  * Start a scan on the current channel or all channels.
  */
Index: sys/dev/hatm/if_hatm.c
===================================================================
--- sys/dev/hatm/if_hatm.c	(revision 215570)
+++ sys/dev/hatm/if_hatm.c	(working copy)
@@ -1928,7 +1928,6 @@ hatm_attach(device_t dev)
 	ifp->if_flags = IFF_SIMPLEX;
 	ifp->if_ioctl = hatm_ioctl;
 	ifp->if_start = hatm_start;
-	ifp->if_watchdog = NULL;
 	ifp->if_init = hatm_init;
 
 	utopia_attach(&sc->utopia, IFP2IFATM(sc->ifp), &sc->media, &sc->mtx,
Index: sys/dev/iwn/if_iwn.c
===================================================================
--- sys/dev/iwn/if_iwn.c	(revision 215570)
+++ sys/dev/iwn/if_iwn.c	(working copy)
@@ -627,8 +627,8 @@ iwn_attach(device_t dev)
 	ifp->if_init = iwn_init;
 	ifp->if_ioctl = iwn_ioctl;
 	ifp->if_start = iwn_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ieee80211_ifattach(ic, macaddr);
Index: sys/dev/mwl/if_mwl.c
===================================================================
--- sys/dev/mwl/if_mwl.c	(revision 215570)
+++ sys/dev/mwl/if_mwl.c	(working copy)
@@ -404,8 +404,8 @@ mwl_attach(uint16_t devid, struct mwl_softc *sc)
 	ifp->if_watchdog = mwl_watchdog;
 	ifp->if_ioctl = mwl_ioctl;
 	ifp->if_init = mwl_init;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/dev/patm/if_patm_attach.c
===================================================================
--- sys/dev/patm/if_patm_attach.c	(revision 215570)
+++ sys/dev/patm/if_patm_attach.c	(working copy)
@@ -197,11 +197,9 @@ patm_attach(device_t dev)
 	ifp->if_softc = sc;
 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 	ifp->if_flags = IFF_SIMPLEX;
-	ifp->if_watchdog = NULL;
 	ifp->if_init = patm_init;
 	ifp->if_ioctl = patm_ioctl;
 	ifp->if_start = patm_start;
-	ifp->if_watchdog = NULL;
 
 	/* do this early so we can destroy unconditionally */
 	mtx_init(&sc->mtx, device_get_nameunit(dev),
Index: sys/dev/ep/if_ep.c
===================================================================
--- sys/dev/ep/if_ep.c	(revision 215570)
+++ sys/dev/ep/if_ep.c	(working copy)
@@ -304,8 +304,8 @@ ep_attach(struct ep_softc *sc)
 	ifp->if_ioctl = epioctl;
 	ifp->if_watchdog = epwatchdog;
 	ifp->if_init = epinit;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	if (!sc->epb.mii_trans) {
Index: sys/dev/nfe/if_nfe.c
===================================================================
--- sys/dev/nfe/if_nfe.c	(revision 215570)
+++ sys/dev/nfe/if_nfe.c	(working copy)
@@ -567,7 +567,6 @@ nfe_attach(device_t dev)
 	ifp->if_start = nfe_start;
 	ifp->if_hwassist = 0;
 	ifp->if_capabilities = 0;
-	ifp->if_watchdog = NULL;
 	ifp->if_init = nfe_init;
 	IFQ_SET_MAXLEN(&ifp->if_snd, NFE_TX_RING_COUNT - 1);
 	ifp->if_snd.ifq_drv_maxlen = NFE_TX_RING_COUNT - 1;
Index: sys/dev/ex/if_ex.c
===================================================================
--- sys/dev/ex/if_ex.c	(revision 215570)
+++ sys/dev/ex/if_ex.c	(working copy)
@@ -237,7 +237,7 @@ ex_attach(device_t dev)
 	ifp->if_start = ex_start;
 	ifp->if_ioctl = ex_ioctl;
 	ifp->if_init = ex_init;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 
 	ifmedia_init(&sc->ifmedia, 0, ex_ifmedia_upd, ex_ifmedia_sts);
 	mtx_init(&sc->lock, device_get_nameunit(dev), MTX_NETWORK_LOCK,
Index: sys/dev/my/if_my.c
===================================================================
--- sys/dev/my/if_my.c	(revision 215570)
+++ sys/dev/my/if_my.c	(working copy)
@@ -889,8 +889,8 @@ my_attach(device_t dev)
 	ifp->if_watchdog = my_watchdog;
 	ifp->if_init = my_init;
 	ifp->if_baudrate = 10000000;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	if (sc->my_info->my_did == MTD803ID)
Index: sys/dev/fe/if_fe.c
===================================================================
--- sys/dev/fe/if_fe.c	(revision 215570)
+++ sys/dev/fe/if_fe.c	(working copy)
@@ -766,7 +766,7 @@ fe_attach (device_t dev)
 	 * Set fixed interface flags.
 	 */
  	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 
 #if FE_SINGLE_TRANSMISSION
 	/* Override txb config to allocate minimum.  */
Index: sys/dev/ipw/if_ipw.c
===================================================================
--- sys/dev/ipw/if_ipw.c	(revision 215570)
+++ sys/dev/ipw/if_ipw.c	(working copy)
@@ -289,8 +289,8 @@ ipw_attach(device_t dev)
 	ifp->if_init = ipw_init;
 	ifp->if_ioctl = ipw_ioctl;
 	ifp->if_start = ipw_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/dev/bwi/if_bwi.c
===================================================================
--- sys/dev/bwi/if_bwi.c	(revision 215570)
+++ sys/dev/bwi/if_bwi.c	(working copy)
@@ -462,8 +462,8 @@ bwi_attach(struct bwi_softc *sc)
 	ifp->if_ioctl = bwi_ioctl;
 	ifp->if_start = bwi_start;
 	ifp->if_watchdog = bwi_watchdog;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	/*
Index: sys/dev/smc/if_smc.c
===================================================================
--- sys/dev/smc/if_smc.c	(revision 215570)
+++ sys/dev/smc/if_smc.c	(working copy)
@@ -347,7 +347,7 @@ smc_attach(device_t dev)
 	ifp->if_init = smc_init;
 	ifp->if_ioctl = smc_ioctl;
 	ifp->if_start = smc_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ifp->if_capabilities = ifp->if_capenable = 0;
Index: sys/dev/cxgb/cxgb_main.c
===================================================================
--- sys/dev/cxgb/cxgb_main.c	(revision 215570)
+++ sys/dev/cxgb/cxgb_main.c	(working copy)
@@ -1019,11 +1019,7 @@ cxgb_port_attach(device_t dev)
 	ifp->if_ioctl = cxgb_ioctl;
 	ifp->if_start = cxgb_start;
 
-
-	ifp->if_timer = 0;	/* Disable ifnet watchdog */
-	ifp->if_watchdog = NULL;
-
-	ifp->if_snd.ifq_drv_maxlen = cxgb_snd_queue_len;
+	ifp->if_snd.ifq_drv_maxlen = max(cxgb_snd_queue_len, ifqmaxlen);
 	IFQ_SET_MAXLEN(&ifp->if_snd, ifp->if_snd.ifq_drv_maxlen);
 	IFQ_SET_READY(&ifp->if_snd);
 
Index: sys/dev/bwn/if_bwn.c
===================================================================
--- sys/dev/bwn/if_bwn.c	(revision 215570)
+++ sys/dev/bwn/if_bwn.c	(working copy)
@@ -1193,8 +1193,8 @@ bwn_attach_pre(struct bwn_softc *sc)
 	ifp->if_init = bwn_init;
 	ifp->if_ioctl = bwn_ioctl;
 	ifp->if_start = bwn_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	return (0);
Index: sys/dev/vx/if_vx.c
===================================================================
--- sys/dev/vx/if_vx.c	(revision 215570)
+++ sys/dev/vx/if_vx.c	(working copy)
@@ -188,7 +188,7 @@ vx_attach(device_t dev)
 	}
 
 	ifp->if_mtu = ETHERMTU;
-	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 	ifp->if_start = vx_start;
 	ifp->if_ioctl = vx_ioctl;
Index: sys/dev/stge/if_stge.c
===================================================================
--- sys/dev/stge/if_stge.c	(revision 215570)
+++ sys/dev/stge/if_stge.c	(working copy)
@@ -722,8 +722,6 @@ stge_attach(device_t dev)
 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 	ifp->if_ioctl = stge_ioctl;
 	ifp->if_start = stge_start;
-	ifp->if_timer = 0;
-	ifp->if_watchdog = NULL;
 	ifp->if_init = stge_init;
 	ifp->if_mtu = ETHERMTU;
 	ifp->if_snd.ifq_drv_maxlen = STGE_TX_RING_CNT - 1;
Index: sys/dev/wi/if_wi.c
===================================================================
--- sys/dev/wi/if_wi.c	(revision 215570)
+++ sys/dev/wi/if_wi.c	(working copy)
@@ -333,8 +333,8 @@ wi_attach(device_t dev)
 	ifp->if_ioctl = wi_ioctl;
 	ifp->if_start = wi_start;
 	ifp->if_init = wi_init;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/dev/wl/if_wl.c
===================================================================
--- sys/dev/wl/if_wl.c	(revision 215570)
+++ sys/dev/wl/if_wl.c	(working copy)
@@ -560,7 +560,7 @@ wlattach(device_t device)
     ifp->if_start = wlstart;
     ifp->if_ioctl = wlioctl;
     ifp->if_timer = 0;   /* paranoia */
-    ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+    ifp->if_snd.ifq_maxlen = ifqmaxlen;
     /* no entries
        ifp->if_watchdog
        ifp->if_done
Index: sys/dev/snc/dp83932.c
===================================================================
--- sys/dev/snc/dp83932.c	(revision 215570)
+++ sys/dev/snc/dp83932.c	(working copy)
@@ -177,7 +177,7 @@ sncconfig(sc, media, nmedia, defmedia, myea)
 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
         ifp->if_init = sncinit;
         ifp->if_mtu = ETHERMTU;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 
 	/* Initialize media goo. */
 	ifmedia_init(&sc->sc_media, 0, snc_mediachange,
Index: sys/dev/pdq/pdq_ifsubr.c
===================================================================
--- sys/dev/pdq/pdq_ifsubr.c	(revision 215570)
+++ sys/dev/pdq/pdq_ifsubr.c	(working copy)
@@ -423,7 +423,7 @@ pdq_ifattach(pdq_softc_t *sc, const pdq_uint8_t *l
 
     ifp->if_softc = sc;
     ifp->if_init = (if_init_f_t *)pdq_ifinit;
-    ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+    ifp->if_snd.ifq_maxlen = ifqmaxlen;
     ifp->if_flags = IFF_BROADCAST|IFF_SIMPLEX|IFF_NOTRAILERS|IFF_MULTICAST;
 
     ifp->if_watchdog = pdq_ifwatchdog;
Index: sys/dev/nxge/if_nxge.c
===================================================================
--- sys/dev/nxge/if_nxge.c	(revision 215570)
+++ sys/dev/nxge/if_nxge.c	(working copy)
@@ -1190,7 +1190,7 @@ xge_interface_setup(device_t dev)
 	ifnetp->if_start    = xge_send;
 
 	/* TODO: Check and assign optimal value */
-	ifnetp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	ifnetp->if_snd.ifq_maxlen = ifqmaxlen;
 
 	ifnetp->if_capabilities = IFCAP_VLAN_HWTAGGING | IFCAP_VLAN_MTU |
 	    IFCAP_HWCSUM;
Index: sys/dev/xe/if_xe.c
===================================================================
--- sys/dev/xe/if_xe.c	(revision 215570)
+++ sys/dev/xe/if_xe.c	(working copy)
@@ -254,7 +254,7 @@ xe_attach(device_t dev)
 	scp->ifp->if_ioctl = xe_ioctl;
 	scp->ifp->if_init = xe_init;
 	scp->ifp->if_baudrate = 100000000;
-	IFQ_SET_MAXLEN(&scp->ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&scp->ifp->if_snd, ifqmaxlen);
 
 	/* Initialise the ifmedia structure */
 	ifmedia_init(scp->ifm, 0, xe_media_change, xe_media_status);
Index: sys/dev/iicbus/if_ic.c
===================================================================
--- sys/dev/iicbus/if_ic.c	(revision 215570)
+++ sys/dev/iicbus/if_ic.c	(working copy)
@@ -181,7 +181,7 @@ icattach(device_t dev)
 	ifp->if_output = icoutput;
 	ifp->if_hdrlen = 0;
 	ifp->if_addrlen = 0;
-	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 
 	ic_alloc_buffers(sc, ICMTU);
 
Index: sys/dev/ral/rt2560.c
===================================================================
--- sys/dev/ral/rt2560.c	(revision 215570)
+++ sys/dev/ral/rt2560.c	(working copy)
@@ -267,8 +267,8 @@ rt2560_attach(device_t dev, int id)
 	ifp->if_init = rt2560_init;
 	ifp->if_ioctl = rt2560_ioctl;
 	ifp->if_start = rt2560_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/dev/ral/rt2661.c
===================================================================
--- sys/dev/ral/rt2661.c	(revision 215570)
+++ sys/dev/ral/rt2661.c	(working copy)
@@ -269,8 +269,8 @@ rt2661_attach(device_t dev, int id)
 	ifp->if_init = rt2661_init;
 	ifp->if_ioctl = rt2661_ioctl;
 	ifp->if_start = rt2661_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/dev/ae/if_ae.c
===================================================================
--- sys/dev/ae/if_ae.c	(revision 215570)
+++ sys/dev/ae/if_ae.c	(working copy)
@@ -378,7 +378,7 @@ ae_attach(device_t dev)
 	ifp->if_init = ae_init;
 	ifp->if_capabilities = IFCAP_VLAN_MTU | IFCAP_VLAN_HWTAGGING;
 	ifp->if_hwassist = 0;
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_MAXLEN(&ifp->if_snd, ifp->if_snd.ifq_drv_maxlen);
 	IFQ_SET_READY(&ifp->if_snd);
 	if (pci_find_extcap(dev, PCIY_PMG, &pmc) == 0) {
Index: sys/dev/usb/net/uhso.c
===================================================================
--- sys/dev/usb/net/uhso.c	(revision 215570)
+++ sys/dev/usb/net/uhso.c	(working copy)
@@ -1471,8 +1471,8 @@ static int uhso_attach_ifnet(struct uhso_softc *sc
 	ifp->if_output = uhso_if_output;
 	ifp->if_flags = 0;
 	ifp->if_softc = sc;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	if_attach(ifp);
Index: sys/dev/usb/net/usb_ethernet.c
===================================================================
--- sys/dev/usb/net/usb_ethernet.c	(revision 215570)
+++ sys/dev/usb/net/usb_ethernet.c	(working copy)
@@ -214,8 +214,8 @@ ue_attach_post_task(struct usb_proc_msg *_task)
 		ifp->if_ioctl = uether_ioctl;
 	ifp->if_start = ue_start;
 	ifp->if_init = ue_init;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 	ue->ue_ifp = ifp;
 
Index: sys/dev/usb/wlan/if_urtw.c
===================================================================
--- sys/dev/usb/wlan/if_urtw.c	(revision 215570)
+++ sys/dev/usb/wlan/if_urtw.c	(working copy)
@@ -868,8 +868,8 @@ urtw_attach(device_t dev)
 	ifp->if_ioctl = urtw_ioctl;
 	ifp->if_start = urtw_start;
 	/* XXX URTW_TX_DATA_LIST_COUNT */
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic = ifp->if_l2com;
Index: sys/dev/usb/wlan/if_uath.c
===================================================================
--- sys/dev/usb/wlan/if_uath.c	(revision 215570)
+++ sys/dev/usb/wlan/if_uath.c	(working copy)
@@ -438,8 +438,8 @@ uath_attach(device_t dev)
 	ifp->if_ioctl = uath_ioctl;
 	ifp->if_start = uath_start;
 	/* XXX UATH_TX_DATA_LIST_COUNT */
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic = ifp->if_l2com;
Index: sys/dev/usb/wlan/if_ural.c
===================================================================
--- sys/dev/usb/wlan/if_ural.c	(revision 215570)
+++ sys/dev/usb/wlan/if_ural.c	(working copy)
@@ -467,8 +467,8 @@ ural_attach(device_t self)
 	ifp->if_init = ural_init;
 	ifp->if_ioctl = ural_ioctl;
 	ifp->if_start = ural_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/dev/usb/wlan/if_rum.c
===================================================================
--- sys/dev/usb/wlan/if_rum.c	(revision 215570)
+++ sys/dev/usb/wlan/if_rum.c	(working copy)
@@ -478,8 +478,8 @@ rum_attach(device_t self)
 	ifp->if_init = rum_init;
 	ifp->if_ioctl = rum_ioctl;
 	ifp->if_start = rum_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/dev/usb/wlan/if_run.c
===================================================================
--- sys/dev/usb/wlan/if_run.c	(revision 215570)
+++ sys/dev/usb/wlan/if_run.c	(working copy)
@@ -615,8 +615,8 @@ run_attach(device_t self)
 	ifp->if_init = run_init;
 	ifp->if_ioctl = run_ioctl;
 	ifp->if_start = run_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/dev/usb/wlan/if_zyd.c
===================================================================
--- sys/dev/usb/wlan/if_zyd.c	(revision 215570)
+++ sys/dev/usb/wlan/if_zyd.c	(working copy)
@@ -381,7 +381,7 @@ zyd_attach(device_t dev)
 	ifp->if_init = zyd_init;
 	ifp->if_ioctl = zyd_ioctl;
 	ifp->if_start = zyd_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic = ifp->if_l2com;
Index: sys/dev/usb/wlan/if_upgt.c
===================================================================
--- sys/dev/usb/wlan/if_upgt.c	(revision 215570)
+++ sys/dev/usb/wlan/if_upgt.c	(working copy)
@@ -331,7 +331,7 @@ upgt_attach(device_t dev)
 	ifp->if_init = upgt_init;
 	ifp->if_ioctl = upgt_ioctl;
 	ifp->if_start = upgt_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic = ifp->if_l2com;
Index: sys/dev/ctau/if_ct.c
===================================================================
--- sys/dev/ctau/if_ct.c	(revision 215570)
+++ sys/dev/ctau/if_ct.c	(working copy)
@@ -721,8 +721,8 @@ static int ct_attach (device_t dev)
 			ct_bus_dma_mem_free (&d->dmamem);
 			continue;
 		}
-		d->queue.ifq_maxlen = IFQ_MAXLEN;
-		d->hi_queue.ifq_maxlen = IFQ_MAXLEN;
+		d->queue.ifq_maxlen = ifqmaxlen;
+		d->hi_queue.ifq_maxlen = ifqmaxlen;
 		mtx_init (&d->queue.ifq_mtx, "ct_queue", NULL, MTX_DEF);
 		mtx_init (&d->hi_queue.ifq_mtx, "ct_queue_hi", NULL, MTX_DEF);		
 		callout_init (&d->timeout_handle, CALLOUT_MPSAFE);
Index: sys/dev/ie/if_ie.c
===================================================================
--- sys/dev/ie/if_ie.c	(revision 215570)
+++ sys/dev/ie/if_ie.c	(working copy)
@@ -318,7 +318,7 @@ ie_attach(device_t dev)
 	ifp->if_start = iestart;
 	ifp->if_ioctl = ieioctl;
 	ifp->if_init = ieinit;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 
 	ether_ifattach(ifp, sc->enaddr);
 
Index: sys/dev/an/if_an.c
===================================================================
--- sys/dev/an/if_an.c	(revision 215570)
+++ sys/dev/an/if_an.c	(working copy)
@@ -773,8 +773,8 @@ an_attach(struct an_softc *sc, int unit, int flags
 	ifp->if_watchdog = an_watchdog;
 	ifp->if_init = an_init;
 	ifp->if_baudrate = 10000000;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	bzero(sc->an_config.an_nodename, sizeof(sc->an_config.an_nodename));
Index: sys/dev/ath/if_ath.c
===================================================================
--- sys/dev/ath/if_ath.c	(revision 215570)
+++ sys/dev/ath/if_ath.c	(working copy)
@@ -560,11 +560,10 @@ ath_attach(u_int16_t devid, struct ath_softc *sc)
 	ifp->if_softc = sc;
 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
 	ifp->if_start = ath_start;
-	ifp->if_watchdog = NULL;
 	ifp->if_ioctl = ath_ioctl;
 	ifp->if_init = ath_init;
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	ic->ic_ifp = ifp;
Index: sys/net80211/ieee80211_hwmp.c
===================================================================
--- sys/net80211/ieee80211_hwmp.c	(revision 215570)
+++ sys/net80211/ieee80211_hwmp.c	(working copy)
@@ -707,9 +707,10 @@ hwmp_recv_preq(struct ieee80211vap *vap, struct ie
 	rtorig = ieee80211_mesh_rt_find(vap, preq->preq_origaddr);
 	if (rtorig == NULL)
 		rtorig = ieee80211_mesh_rt_add(vap, preq->preq_origaddr);
-	if (rtorig == NULL)
+	if (rtorig == NULL) {
 		/* XXX stat */
 		return;
+	}
 	hrorig = IEEE80211_MESH_ROUTE_PRIV(rtorig, struct ieee80211_hwmp_route);
 	/*
 	 * Sequence number validation.
Index: sys/net80211/ieee80211_node.c
===================================================================
--- sys/net80211/ieee80211_node.c	(revision 215570)
+++ sys/net80211/ieee80211_node.c	(working copy)
@@ -817,6 +817,7 @@ ieee80211_sta_join(struct ieee80211vap *vap, struc
 	if (ieee80211_iserp_rateset(&ni->ni_rates))
 		ni->ni_flags |= IEEE80211_NODE_ERP;
 	ieee80211_node_setuptxparms(ni);
+	ieee80211_ratectl_node_init(ni);
 
 	return ieee80211_sta_join1(ieee80211_ref_node(ni));
 }
@@ -1401,6 +1402,7 @@ ieee80211_fakeup_adhoc_node(struct ieee80211vap *v
 #endif
 		}
 		ieee80211_node_setuptxparms(ni);
+		ieee80211_ratectl_node_init(ni);
 		if (ic->ic_newassoc != NULL)
 			ic->ic_newassoc(ni, 1);
 		/* XXX not right for 802.1x/WPA */
@@ -1470,6 +1472,7 @@ ieee80211_add_neighbor(struct ieee80211vap *vap,
 		if (ieee80211_iserp_rateset(&ni->ni_rates))
 			ni->ni_flags |= IEEE80211_NODE_ERP;
 		ieee80211_node_setuptxparms(ni);
+		ieee80211_ratectl_node_init(ni);
 		if (ic->ic_newassoc != NULL)
 			ic->ic_newassoc(ni, 1);
 		/* XXX not right for 802.1x/WPA */
@@ -2338,6 +2341,7 @@ ieee80211_node_join(struct ieee80211_node *ni, int
 	);
 
 	ieee80211_node_setuptxparms(ni);
+	ieee80211_ratectl_node_init(ni);
 	/* give driver a chance to setup state like ni_txrate */
 	if (ic->ic_newassoc != NULL)
 		ic->ic_newassoc(ni, newassoc);
Index: sys/net80211/ieee80211_sta.c
===================================================================
--- sys/net80211/ieee80211_sta.c	(revision 215570)
+++ sys/net80211/ieee80211_sta.c	(working copy)
@@ -60,6 +60,7 @@ __FBSDID("$FreeBSD$");
 #ifdef IEEE80211_SUPPORT_SUPERG
 #include <net80211/ieee80211_superg.h>
 #endif
+#include <net80211/ieee80211_ratectl.h>
 
 #define	IEEE80211_RATE2MBS(r)	(((r) & IEEE80211_RATE_VAL) / 2)
 
@@ -585,7 +586,7 @@ sta_input(struct ieee80211_node *ni, struct mbuf *
 		}
 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
 		ni->ni_noise = nf;
-		if (HAS_SEQ(type)) {
+		if (HAS_SEQ(type) && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 			uint8_t tid = ieee80211_gettid(wh);
 			if (IEEE80211_QOS_HAS_SEQ(wh) &&
 			    TID_TO_WME_AC(tid) >= WME_AC_VI)
@@ -1597,6 +1598,7 @@ sta_recv_mgmt(struct ieee80211_node *ni, struct mb
 			     IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
 			ieee80211_setup_basic_htrates(ni, htinfo);
 			ieee80211_node_setuptxparms(ni);
+			ieee80211_ratectl_node_init(ni);
 		} else {
 #ifdef IEEE80211_SUPPORT_SUPERG
 			if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_ATH))
Index: sys/net80211/ieee80211_scan_sta.c
===================================================================
--- sys/net80211/ieee80211_scan_sta.c	(revision 215570)
+++ sys/net80211/ieee80211_scan_sta.c	(working copy)
@@ -1361,7 +1361,7 @@ sta_age(struct ieee80211_scan_state *ss)
 	KASSERT(vap->iv_opmode == IEEE80211_M_STA,
 		("wrong mode %u", vap->iv_opmode));
 	if (vap->iv_roaming == IEEE80211_ROAMING_AUTO &&
-	    (vap->iv_ic->ic_flags & IEEE80211_F_BGSCAN) &&
+	    (vap->iv_flags & IEEE80211_F_BGSCAN) &&
 	    vap->iv_state >= IEEE80211_S_RUN)
 		/* XXX vap is implicit */
 		sta_roam_check(ss, vap);
Index: sys/net80211/ieee80211_var.h
===================================================================
--- sys/net80211/ieee80211_var.h	(revision 215570)
+++ sys/net80211/ieee80211_var.h	(working copy)
@@ -32,11 +32,11 @@
  * Definitions for IEEE 802.11 drivers.
  */
 /* NB: portability glue must go first */
-#ifdef __NetBSD__
+#if defined(__NetBSD__)
 #include <net80211/ieee80211_netbsd.h>
-#elif __FreeBSD__
+#elif defined(__FreeBSD__)
 #include <net80211/ieee80211_freebsd.h>
-#elif __linux__
+#elif defined(__linux__)
 #include <net80211/ieee80211_linux.h>
 #else
 #error	"No support for your operating system!"
Index: sys/net80211/ieee80211.c
===================================================================
--- sys/net80211/ieee80211.c	(revision 215570)
+++ sys/net80211/ieee80211.c	(working copy)
@@ -392,11 +392,10 @@ ieee80211_vap_setup(struct ieee80211com *ic, struc
 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
 	ifp->if_start = ieee80211_start;
 	ifp->if_ioctl = ieee80211_ioctl;
-	ifp->if_watchdog = NULL;		/* NB: no watchdog routine */
 	ifp->if_init = ieee80211_init;
 	/* NB: input+output filled in by ether_ifattach */
-	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
-	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 	IFQ_SET_READY(&ifp->if_snd);
 
 	vap->iv_ifp = ifp;
@@ -486,9 +485,8 @@ ieee80211_vap_setup(struct ieee80211com *ic, struc
 	ieee80211_scan_vattach(vap);
 	ieee80211_regdomain_vattach(vap);
 	ieee80211_radiotap_vattach(vap);
+	ieee80211_ratectl_set(vap, IEEE80211_RATECTL_NONE);
 
-	ieee80211_ratectl_set(vap, IEEE80211_RATECTL_AMRR);
-
 	return 0;
 }
 
Index: sys/net80211/ieee80211_rssadapt.c
===================================================================
--- sys/net80211/ieee80211_rssadapt.c	(revision 215570)
+++ sys/net80211/ieee80211_rssadapt.c	(working copy)
@@ -58,12 +58,12 @@ struct rssadapt_expavgctl {
 };
 
 static struct rssadapt_expavgctl master_expavgctl = {
-	rc_decay_denom : 16,
-	rc_decay_old : 15,
-	rc_thresh_denom : 8,
-	rc_thresh_old : 4,
-	rc_avgrssi_denom : 8,
-	rc_avgrssi_old : 4
+	.rc_decay_denom = 16,
+	.rc_decay_old = 15,
+	.rc_thresh_denom = 8,
+	.rc_thresh_old = 4,
+	.rc_avgrssi_denom = 8,
+	.rc_avgrssi_old = 4
 };
 
 #ifdef interpolate
@@ -169,13 +169,17 @@ rssadapt_node_init(struct ieee80211_node *ni)
 	struct ieee80211_rssadapt *rsa = vap->iv_rs;
 	const struct ieee80211_rateset *rs = &ni->ni_rates;
 
-	ni->ni_rctls = ra = malloc(sizeof(struct ieee80211_rssadapt_node),
-	    M_80211_RATECTL, M_NOWAIT|M_ZERO);
-	if (ra == NULL) {
-		if_printf(vap->iv_ifp, "couldn't alloc per-node ratectl "
-		    "structure\n");
-		return;
-	}
+	if (ni->ni_rctls == NULL) {
+		ni->ni_rctls = ra = 
+		    malloc(sizeof(struct ieee80211_rssadapt_node),
+		        M_80211_RATECTL, M_NOWAIT|M_ZERO);
+		if (ra == NULL) {
+			if_printf(vap->iv_ifp, "couldn't alloc per-node ratectl "
+			    "structure\n");
+			return;
+		}
+	} else
+		ra = ni->ni_rctls;
 	ra->ra_rs = rsa;
 	ra->ra_rates = *rs;
 	rssadapt_updatestats(ra);
Index: sys/net80211/ieee80211_ratectl.c
===================================================================
--- sys/net80211/ieee80211_ratectl.c	(revision 215570)
+++ sys/net80211/ieee80211_ratectl.c	(working copy)
@@ -39,6 +39,14 @@ __FBSDID("$FreeBSD$");
 
 static const struct ieee80211_ratectl *ratectls[IEEE80211_RATECTL_MAX];
 
+static const char *ratectl_modnames[IEEE80211_RATECTL_MAX] = {
+	[IEEE80211_RATECTL_AMRR]	= "wlan_amrr",
+	[IEEE80211_RATECTL_RSSADAPT]	= "wlan_rssadapt",
+	[IEEE80211_RATECTL_ONOE]	= "wlan_onoe",
+	[IEEE80211_RATECTL_SAMPLE]	= "wlan_sample",
+	[IEEE80211_RATECTL_NONE]	= "wlan_none",
+};
+
 MALLOC_DEFINE(M_80211_RATECTL, "80211ratectl", "802.11 rate control");
 
 void
@@ -58,9 +66,27 @@ ieee80211_ratectl_unregister(int type)
 }
 
 void
+ieee80211_ratectl_init(struct ieee80211vap *vap)
+{
+	if (vap->iv_rate == ratectls[IEEE80211_RATECTL_NONE])
+		ieee80211_ratectl_set(vap, IEEE80211_RATECTL_AMRR);
+	vap->iv_rate->ir_init(vap);
+}
+
+void
 ieee80211_ratectl_set(struct ieee80211vap *vap, int type)
 {
 	if (type >= IEEE80211_RATECTL_MAX)
 		return;
+	if (ratectls[type] == NULL) {
+		ieee80211_load_module(ratectl_modnames[type]);
+		if (ratectls[type] == NULL) {
+			IEEE80211_DPRINTF(vap, IEEE80211_MSG_RATECTL,
+			    "%s: unable to load algo %u, module %s\n",
+			    __func__, type, ratectl_modnames[type]);
+			vap->iv_rate = ratectls[IEEE80211_RATECTL_NONE];
+			return;
+		}
+	}
 	vap->iv_rate = ratectls[type];
 }
Index: sys/net80211/ieee80211_amrr.c
===================================================================
--- sys/net80211/ieee80211_amrr.c	(revision 215570)
+++ sys/net80211/ieee80211_amrr.c	(working copy)
@@ -136,16 +136,16 @@ amrr_node_init(struct ieee80211_node *ni)
 	struct ieee80211_amrr *amrr = vap->iv_rs;
 	struct ieee80211_amrr_node *amn;
 
-	KASSERT(ni->ni_rctls == NULL, ("%s: ni_rctls already initialized",
-	    __func__));
-
-	ni->ni_rctls = amn = malloc(sizeof(struct ieee80211_amrr_node),
-	    M_80211_RATECTL, M_NOWAIT|M_ZERO);
-	if (amn == NULL) {
-		if_printf(vap->iv_ifp, "couldn't alloc per-node ratectl "
-		    "structure\n");
-		return;
-	}
+	if (ni->ni_rctls == NULL) {
+		ni->ni_rctls = amn = malloc(sizeof(struct ieee80211_amrr_node),
+		    M_80211_RATECTL, M_NOWAIT|M_ZERO);
+		if (amn == NULL) {
+			if_printf(vap->iv_ifp, "couldn't alloc per-node ratectl "
+			    "structure\n");
+			return;
+		}
+	} else
+		amn = ni->ni_rctls;
 	amn->amn_amrr = amrr;
 	amn->amn_success = 0;
 	amn->amn_recovery = 0;
Index: sys/net80211/ieee80211_ratectl.h
===================================================================
--- sys/net80211/ieee80211_ratectl.h	(revision 215570)
+++ sys/net80211/ieee80211_ratectl.h	(working copy)
@@ -26,10 +26,11 @@
  */
 
 enum ieee80211_ratealgs {
-	IEEE80211_RATECTL_AMRR 		= 0,
+	IEEE80211_RATECTL_AMRR		= 0,
 	IEEE80211_RATECTL_RSSADAPT	= 1,
 	IEEE80211_RATECTL_ONOE		= 2,
 	IEEE80211_RATECTL_SAMPLE	= 3,
+	IEEE80211_RATECTL_NONE		= 4,
 	IEEE80211_RATECTL_MAX
 };
 
@@ -56,17 +57,12 @@ struct ieee80211_ratectl {
 
 void	ieee80211_ratectl_register(int, const struct ieee80211_ratectl *);
 void	ieee80211_ratectl_unregister(int);
+void	ieee80211_ratectl_init(struct ieee80211vap *);
 void	ieee80211_ratectl_set(struct ieee80211vap *, int);
 
 MALLOC_DECLARE(M_80211_RATECTL);
 
 static void __inline
-ieee80211_ratectl_init(struct ieee80211vap *vap)
-{
-	vap->iv_rate->ir_init(vap);
-}
-
-static void __inline
 ieee80211_ratectl_deinit(struct ieee80211vap *vap)
 {
 	vap->iv_rate->ir_deinit(vap);
@@ -85,8 +81,6 @@ ieee80211_ratectl_node_deinit(struct ieee80211_nod
 {
 	const struct ieee80211vap *vap = ni->ni_vap;
 
-	if (ni->ni_rctls == NULL)	/* ratectl not setup */
-		return;
 	vap->iv_rate->ir_node_deinit(ni);
 }
 
@@ -95,8 +89,6 @@ ieee80211_ratectl_rate(struct ieee80211_node *ni,
 {
 	const struct ieee80211vap *vap = ni->ni_vap;
 
-	if (ni->ni_rctls == NULL)	/* ratectl not setup */
-		return 0;
 	return vap->iv_rate->ir_rate(ni, arg, iarg);
 }
 
@@ -104,8 +96,6 @@ static void __inline
 ieee80211_ratectl_tx_complete(const struct ieee80211vap *vap,
     const struct ieee80211_node *ni, int status, void *arg1, void *arg2)
 {
-	if (ni->ni_rctls == NULL)	/* ratectl not setup */
-		return;
 	vap->iv_rate->ir_tx_complete(vap, ni, status, arg1, arg2);
 }
 
@@ -115,8 +105,6 @@ ieee80211_ratectl_tx_update(const struct ieee80211
 {
 	if (vap->iv_rate->ir_tx_update == NULL)
 		return;
-	if (ni->ni_rctls == NULL)	/* ratectl not setup */
-		return;
 	vap->iv_rate->ir_tx_update(vap, ni, arg1, arg2, arg3);
 }
 
Index: sys/net/if.c
===================================================================
--- sys/net/if.c	(revision 215570)
+++ sys/net/if.c	(working copy)
@@ -106,6 +106,10 @@ static int slowtimo_started;
 SYSCTL_NODE(_net, PF_LINK, link, CTLFLAG_RW, 0, "Link layers");
 SYSCTL_NODE(_net_link, 0, generic, CTLFLAG_RW, 0, "Generic link-management");
 
+TUNABLE_INT("net.link.ifqmaxlen", &ifqmaxlen);
+SYSCTL_UINT(_net_link, OID_AUTO, ifqmaxlen, CTLFLAG_RDTUN,
+    &ifqmaxlen, 0, "max send queue size");
+
 /* Log link state change events */
 static int log_link_state_change = 1;
 
Index: sys/net/if_stf.c
===================================================================
--- sys/net/if_stf.c	(revision 215570)
+++ sys/net/if_stf.c	(working copy)
@@ -252,7 +252,7 @@ stf_clone_create(struct if_clone *ifc, char *name,
 	ifp->if_mtu    = IPV6_MMTU;
 	ifp->if_ioctl  = stf_ioctl;
 	ifp->if_output = stf_output;
-	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	if_attach(ifp);
 	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
 	return (0);
Index: sys/net/if_ef.c
===================================================================
--- sys/net/if_ef.c	(revision 215570)
+++ sys/net/if_ef.c	(working copy)
@@ -128,9 +128,8 @@ ef_attach(struct efnet *sc)
 	struct ifnet *ifp = sc->ef_ifp;
 
 	ifp->if_start = ef_start;
-	ifp->if_watchdog = NULL;
 	ifp->if_init = ef_init;
-	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	ifp->if_flags = (IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST);
 	/*
 	 * Attach the interface
Index: sys/net/if_gif.c
===================================================================
--- sys/net/if_gif.c	(revision 215570)
+++ sys/net/if_gif.c	(working copy)
@@ -185,7 +185,7 @@ gif_clone_create(ifc, unit, params)
 	GIF2IFP(sc)->if_ioctl  = gif_ioctl;
 	GIF2IFP(sc)->if_start  = gif_start;
 	GIF2IFP(sc)->if_output = gif_output;
-	GIF2IFP(sc)->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	GIF2IFP(sc)->if_snd.ifq_maxlen = ifqmaxlen;
 	if_attach(GIF2IFP(sc));
 	bpfattach(GIF2IFP(sc), DLT_NULL, sizeof(u_int32_t));
 	if (ng_gif_attach_p != NULL)
Index: sys/net/if_gre.c
===================================================================
--- sys/net/if_gre.c	(revision 215570)
+++ sys/net/if_gre.c	(working copy)
@@ -191,7 +191,7 @@ gre_clone_create(ifc, unit, params)
 	GRE2IFP(sc)->if_softc = sc;
 	if_initname(GRE2IFP(sc), ifc->ifc_name, unit);
 
-	GRE2IFP(sc)->if_snd.ifq_maxlen = IFQ_MAXLEN;
+	GRE2IFP(sc)->if_snd.ifq_maxlen = ifqmaxlen;
 	GRE2IFP(sc)->if_addrlen = 0;
 	GRE2IFP(sc)->if_hdrlen = 24; /* IP + GRE */
 	GRE2IFP(sc)->if_mtu = GREMTU;
--- /dev/null	2010-11-20 17:55:00.000000000 +0100
+++ sys/net80211/ieee80211_ratectl_none.c	2010-11-20 17:48:09.581136428 +0100
@@ -0,0 +1,114 @@
+/*-
+ * Copyright (c) 2010 Bernhard Schmidt <bschmidt@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: releng/8.1/sys/net80211/ieee80211_ratectl_none.c 214399 2010-10-26 20:23:29Z bschmidt $");
+
+#include "opt_wlan.h"
+
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/module.h>
+#include <sys/socket.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/if_media.h>
+
+#ifdef INET
+#include <netinet/in.h>
+#include <netinet/if_ether.h>
+#endif
+
+#include <net80211/ieee80211_var.h>
+#include <net80211/ieee80211_ratectl.h>
+
+static void
+none_init(struct ieee80211vap *vap)
+{
+}
+
+static void
+none_deinit(struct ieee80211vap *vap)
+{
+	free(vap->iv_rs, M_80211_RATECTL);
+}
+
+static void
+none_node_init(struct ieee80211_node *ni)
+{
+	ni->ni_txrate = ni->ni_rates.rs_rates[0] & IEEE80211_RATE_VAL;
+}
+
+static void
+none_node_deinit(struct ieee80211_node *ni)
+{
+}
+
+static int
+none_rate(struct ieee80211_node *ni, void *arg __unused, uint32_t iarg __unused)
+{
+	int rix = 0;
+
+	ni->ni_txrate = ni->ni_rates.rs_rates[rix] & IEEE80211_RATE_VAL;
+	return rix;
+}
+
+static void
+none_tx_complete(const struct ieee80211vap *vap,
+    const struct ieee80211_node *ni, int ok,
+    void *arg1, void *arg2 __unused)
+{
+}
+
+static void
+none_tx_update(const struct ieee80211vap *vap, const struct ieee80211_node *ni,
+    void *arg1, void *arg2, void *arg3)
+{
+}
+
+static void
+none_setinterval(const struct ieee80211vap *vap, int msecs)
+{
+}
+
+/* number of references from net80211 layer */
+static	int nrefs = 0;
+
+static const struct ieee80211_ratectl none = {
+	.ir_name	= "none",
+	.ir_attach	= NULL,
+	.ir_detach	= NULL,
+	.ir_init	= none_init,
+	.ir_deinit	= none_deinit,
+	.ir_node_init	= none_node_init,
+	.ir_node_deinit	= none_node_deinit,
+	.ir_rate	= none_rate,
+	.ir_tx_complete	= none_tx_complete,
+	.ir_tx_update	= none_tx_update,
+	.ir_setinterval	= none_setinterval,
+};
+IEEE80211_RATECTL_MODULE(ratectl_none, 1);
+IEEE80211_RATECTL_ALG(none, IEEE80211_RATECTL_NONE, none);