diff --git a/usr.sbin/wpa/wpa_cli/Makefile b/usr.sbin/wpa/wpa_cli/Makefile
index 91b9511c1ee6..af0d14c44b8a 100644
--- a/usr.sbin/wpa/wpa_cli/Makefile
+++ b/usr.sbin/wpa/wpa_cli/Makefile
@@ -4,8 +4,11 @@ WPA_SUPPLICANT_DISTDIR?= ${.CURDIR}/../../../contrib/wpa_supplicant
 .PATH: ${WPA_SUPPLICANT_DISTDIR}
 
 PROG=	wpa_cli
-SRCS=	wpa_cli.c wpa_ctrl.c
+SRCS=	wpa_cli.c wpa_ctrl.c os_unix.c
 
 MAN=	wpa_cli.8
 
+CFLAGS+= -DCONFIG_CTRL_IFACE
+CFLAGS+= -DCONFIG_CTRL_IFACE_UNIX
+
 .include <bsd.prog.mk>
diff --git a/usr.sbin/wpa/wpa_passphrase/Makefile b/usr.sbin/wpa/wpa_passphrase/Makefile
index c5ddce166b40..002dee5468dc 100644
--- a/usr.sbin/wpa/wpa_passphrase/Makefile
+++ b/usr.sbin/wpa/wpa_passphrase/Makefile
@@ -6,6 +6,9 @@ WPA_SUPPLICANT_DISTDIR?= ${.CURDIR}/../../../contrib/wpa_supplicant
 PROG=	wpa_passphrase
 SRCS=	wpa_passphrase.c sha1.c md5.c
 
+CFLAGS+= -DINTERNAL_SHA1
+CFLAGS+= -DINTERNAL_MD5
+
 MAN=	wpa_passphrase.8
 
 .include <bsd.prog.mk>
diff --git a/usr.sbin/wpa/wpa_supplicant/Makefile b/usr.sbin/wpa/wpa_supplicant/Makefile
index a8ed5c50e84c..3569d1f81d22 100644
--- a/usr.sbin/wpa/wpa_supplicant/Makefile
+++ b/usr.sbin/wpa/wpa_supplicant/Makefile
@@ -7,9 +7,11 @@ WPA_SUPPLICANT_DISTDIR?= ${.CURDIR}/../../../contrib/wpa_supplicant
 
 PROG=	wpa_supplicant
 SRCS=	config.c eloop.c common.c md5.c rc4.c sha1.c aes_wrap.c \
-	wpa_supplicant.c events.c wpa.c preauth.c \
-	ctrl_iface.c l2_packet.c main.c drivers.c driver_freebsd.c \
-	driver_ndis.c driver_ndis_.c Packet32.c
+	wpa_supplicant.c events.c wpa.c preauth.c pmksa_cache.c \
+	ctrl_iface.c ctrl_iface_unix.c l2_packet.c main.c drivers.c \
+	driver_ndis.c Packet32.c \
+	driver_freebsd.c os_unix.c
+
 
 MAN=	wpa_supplicant.8 wpa_supplicant.conf.5
 
@@ -17,6 +19,8 @@ CFLAGS+= -I${.CURDIR} -I${WPA_SUPPLICANT_DISTDIR}
 CFLAGS+= -DCONFIG_DRIVER_BSD
 CFLAGS+= -DCONFIG_DRIVER_NDIS
 CFLAGS+= -DCONFIG_CTRL_IFACE
+CFLAGS+= -DCONFIG_CTRL_IFACE_UNIX
+CFLAGS+= -DCONFIG_TERMINATE_ONLASTIF
 CFLAGS+= -g
 DPADD+=	${LIBPCAP}
 LDADD+=	-lpcap
@@ -26,7 +30,7 @@ SRCS+=	config_file.c base64.c
 CFLAGS+=-DCONFIG_BACKEND_FILE
 
 .if ${MK_WPA_SUPPLICANT_EAPOL} != "no"
-SRCS+=	eapol_sm.c eap.c
+SRCS+=	eapol_sm.c eap.c eap_methods.c
 CFLAGS+= -DIEEE8021X_EAPOL
 
 .if ${MK_OPENSSL} != "no" && !defined(RELEASE_CRUNCH)
diff --git a/usr.sbin/wpa/wpa_supplicant/Packet32.c b/usr.sbin/wpa/wpa_supplicant/Packet32.c
index d68948968552..73463950fc36 100644
--- a/usr.sbin/wpa/wpa_supplicant/Packet32.c
+++ b/usr.sbin/wpa/wpa_supplicant/Packet32.c
@@ -57,6 +57,8 @@ __FBSDID("$FreeBSD$");
 #include <netdb.h>
 #include <net/route.h>
 
+#include <net80211/ieee80211_ioctl.h>
+
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -97,6 +99,7 @@ typedef struct NDIS_802_11_KEY_COMPAT {
 struct adapter {
 	int			socket;
 	char			name[IFNAMSIZ];
+	int			prev_roaming;
 };
 
 PCHAR
@@ -113,6 +116,7 @@ PacketOpenAdapter(iface)
 	int			s;
 	int			ifflags;
 	struct ifreq		ifr;
+	struct ieee80211req	ireq;
 
 	s = socket(PF_INET, SOCK_DGRAM, 0);
 
@@ -124,8 +128,24 @@ PacketOpenAdapter(iface)
 		return(NULL);
 
 	a->socket = s;
+	if (strncmp(iface, "\\Device\\NPF_", 12) == 0)
+		iface += 12;
+	else if (strncmp(iface, "\\DEVICE\\", 8) == 0)
+		iface += 8;
 	snprintf(a->name, IFNAMSIZ, "%s", iface);
 
+	/* Turn off net80211 roaming */
+	bzero((char *)&ireq, sizeof(ireq));
+	strncpy(ireq.i_name, iface, sizeof (ifr.ifr_name));
+	ireq.i_type = IEEE80211_IOC_ROAMING;
+	if (ioctl(a->socket, SIOCG80211, &ireq) == 0) {
+		a->prev_roaming = ireq.i_val;
+		ireq.i_val = IEEE80211_ROAMING_MANUAL;
+		if (ioctl(a->socket, SIOCS80211, &ireq) < 0)
+			fprintf(stderr,
+			    "Could not set IEEE80211_ROAMING_MANUAL\n");
+	}
+
 	bzero((char *)&ifr, sizeof(ifr));
         strncpy(ifr.ifr_name, iface, sizeof (ifr.ifr_name));
         if (ioctl(a->socket, SIOCGIFFLAGS, (caddr_t)&ifr) < 0) {
@@ -326,12 +346,20 @@ PacketCloseAdapter(iface)
 {	
 	struct adapter		*a;
 	struct ifreq		ifr;
+	struct ieee80211req	ireq;
 
 	if (iface == NULL)
 		return;
 
 	a = iface;
 
+	/* Reset net80211 roaming */
+	bzero((char *)&ireq, sizeof(ireq));
+	strncpy(ireq.i_name, a->name, sizeof (ifr.ifr_name));
+	ireq.i_type = IEEE80211_IOC_ROAMING;
+	ireq.i_val = a->prev_roaming;
+	ioctl(a->socket, SIOCS80211, &ireq);
+
 	bzero((char *)&ifr, sizeof(ifr));
         strncpy(ifr.ifr_name, a->name, sizeof (ifr.ifr_name));
         ioctl(a->socket, SIOCGIFFLAGS, (caddr_t)&ifr);
diff --git a/usr.sbin/wpa/wpa_supplicant/wpa_supplicant.conf.5 b/usr.sbin/wpa/wpa_supplicant/wpa_supplicant.conf.5
index 68c176f0f12b..084176ccf646 100644
--- a/usr.sbin/wpa/wpa_supplicant/wpa_supplicant.conf.5
+++ b/usr.sbin/wpa/wpa_supplicant/wpa_supplicant.conf.5
@@ -24,7 +24,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd February 14, 2006
+.Dd July 8, 2007
 .Dt WPA_SUPPLICANT.CONF 5
 .Os
 .Sh NAME
@@ -263,6 +263,10 @@ Identity string for EAP.
 .It Va anonymous_identity
 Anonymous identity string for EAP (to be used as the unencrypted identity
 with EAP types that support different tunneled identities; e.g.\& EAP-TTLS).
+.It Va mixed_cell
+Configure whether networks that allow both plaintext and encryption
+are allowed when selecting a BSS from the scan results.
+By default this is set to 0 (disabled).
 .It Va password
 Password string for EAP.
 .It Va ca_cert