Index: head/sys/dev/iwi/if_iwi.c
===================================================================
--- head/sys/dev/iwi/if_iwi.c
+++ head/sys/dev/iwi/if_iwi.c
@@ -155,7 +155,6 @@
 static int	iwi_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 static void	iwi_wme_init(struct iwi_softc *);
 static int	iwi_wme_setparams(struct iwi_softc *);
-static void	iwi_update_wme(void *, int);
 static int	iwi_wme_update(struct ieee80211com *);
 static uint16_t	iwi_read_prom_word(struct iwi_softc *, uint8_t);
 static void	iwi_frame_intr(struct iwi_softc *, struct iwi_rx_data *, int,
@@ -286,7 +285,6 @@
 	TASK_INIT(&sc->sc_radiofftask, 0, iwi_radio_off, sc);
 	TASK_INIT(&sc->sc_restarttask, 0, iwi_restart, sc);
 	TASK_INIT(&sc->sc_disassoctask, 0, iwi_disassoc, sc);
-	TASK_INIT(&sc->sc_wmetask, 0, iwi_update_wme, sc);
 	TASK_INIT(&sc->sc_monitortask, 0, iwi_monitor_scan, sc);
 
 	callout_init_mtx(&sc->sc_wdtimer, &sc->sc_mtx, 0);
@@ -1060,22 +1058,12 @@
 #undef IWI_USEC
 #undef IWI_EXP2
 
-static void
-iwi_update_wme(void *arg, int npending)
-{
-	struct iwi_softc *sc = arg;
-	IWI_LOCK_DECL;
-
-	IWI_LOCK(sc);
-	(void) iwi_wme_setparams(sc);
-	IWI_UNLOCK(sc);
-}
-
 static int
 iwi_wme_update(struct ieee80211com *ic)
 {
 	struct iwi_softc *sc = ic->ic_softc;
 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
+	IWI_LOCK_DECL;
 
 	/*
 	 * We may be called to update the WME parameters in
@@ -1085,8 +1073,11 @@
 	 * to the adapter as part of the work iwi_auth_and_assoc
 	 * does.
 	 */
-	if (vap->iv_state == IEEE80211_S_RUN)
-		ieee80211_runtask(ic, &sc->sc_wmetask);
+	if (vap->iv_state == IEEE80211_S_RUN) {
+		IWI_LOCK(sc);
+		iwi_wme_setparams(sc);
+		IWI_UNLOCK(sc);
+	}
 	return (0);
 }
 
Index: head/sys/dev/iwi/if_iwivar.h
===================================================================
--- head/sys/dev/iwi/if_iwivar.h
+++ head/sys/dev/iwi/if_iwivar.h
@@ -192,7 +192,6 @@
 	struct task		sc_radiofftask;	/* radio off processing */
 	struct task		sc_restarttask;	/* restart adapter processing */
 	struct task		sc_disassoctask;
-	struct task		sc_wmetask;	/* set wme parameters */
 	struct task		sc_monitortask;
 
 	unsigned int		sc_running : 1,	/* initialized */
Index: head/sys/dev/otus/if_otus.c
===================================================================
--- head/sys/dev/otus/if_otus.c
+++ head/sys/dev/otus/if_otus.c
@@ -155,7 +155,6 @@
 
 void		otus_next_scan(void *, int);
 static void	otus_tx_task(void *, int pending);
-static void	otus_wme_update_task(void *, int pending);
 void		otus_do_async(struct otus_softc *,
 		    void (*)(struct otus_softc *, void *), void *, int);
 int		otus_newstate(struct ieee80211vap *, enum ieee80211_state,
@@ -177,8 +176,9 @@
 		    const struct ieee80211_bpf_params *);
 int		otus_ioctl(struct ifnet *, u_long, caddr_t);
 int		otus_set_multi(struct otus_softc *);
-static void	otus_updateedca(struct otus_softc *sc);
-static void	otus_updateslot(struct otus_softc *sc);
+static int	otus_updateedca(struct ieee80211com *);
+static void	otus_updateedca_locked(struct otus_softc *);
+static void	otus_updateslot(struct otus_softc *);
 int		otus_init_mac(struct otus_softc *);
 uint32_t	otus_phy_get_def(struct otus_softc *, uint32_t);
 int		otus_set_board_values(struct otus_softc *,
@@ -300,7 +300,6 @@
 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->scan_to, 0, otus_next_scan, sc);
 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->calib_to, 0, otus_calibrate_to, sc);
 	TASK_INIT(&sc->tx_task, 0, otus_tx_task, sc);
-	TASK_INIT(&sc->wme_update_task, 0, otus_wme_update_task, sc);
 	mbufq_init(&sc->sc_snd, ifqmaxlen);
 
 	iface_index = 0;
@@ -345,7 +344,6 @@
 	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
-	taskqueue_drain(taskqueue_thread, &sc->wme_update_task);
 
 	otus_close_pipes(sc);
 #if 0
@@ -590,44 +588,6 @@
 	OTUS_UNLOCK(sc);
 }
 
-static void
-otus_wme_update_task(void *arg, int pending)
-{
-	struct otus_softc *sc = arg;
-
-	OTUS_LOCK(sc);
-	/*
-	 * XXX TODO: take temporary copy of EDCA information
-	 * when scheduling this so we have a more time-correct view
-	 * of things.
-	 */
-	otus_updateedca(sc);
-	OTUS_UNLOCK(sc);
-}
-
-static void
-otus_wme_schedule_update(struct otus_softc *sc)
-{
-
-	taskqueue_enqueue(taskqueue_thread, &sc->wme_update_task);
-}
-
-/*
- * This is called by net80211 in RX packet context, so we
- * can't sleep here.
- *
- * TODO: have net80211 schedule an update itself for its
- * own internal taskqueue.
- */
-static int
-otus_wme_update(struct ieee80211com *ic)
-{
-	struct otus_softc *sc = ic->ic_softc;
-
-	otus_wme_schedule_update(sc);
-	return (0);
-}
-
 static int
 otus_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
 {
@@ -811,7 +771,7 @@
 	ic->ic_transmit = otus_transmit;
 	ic->ic_update_chw = otus_update_chw;
 	ic->ic_ampdu_enable = otus_ampdu_enable;
-	ic->ic_wme.wme_update = otus_wme_update;
+	ic->ic_wme.wme_update = otus_updateedca;
 	ic->ic_newassoc = otus_newassoc;
 	ic->ic_node_alloc = otus_node_alloc;
 
@@ -2383,8 +2343,25 @@
 	return (r);
 }
 
+static int
+otus_updateedca(struct ieee80211com *ic)
+{
+	struct otus_softc *sc = ic->ic_softc;
+
+	OTUS_LOCK(sc);
+	/*
+	 * XXX TODO: take temporary copy of EDCA information
+	 * when scheduling this so we have a more time-correct view
+	 * of things.
+	 * XXX TODO: this can be done on the net80211 level
+	 */
+	otus_updateedca_locked(sc);
+	OTUS_UNLOCK(sc);
+	return (0);
+}
+
 static void
-otus_updateedca(struct otus_softc *sc)
+otus_updateedca_locked(struct otus_softc *sc)
 {
 #define EXP2(val)	((1 << (val)) - 1)
 #define AIFS(val)	((val) * 9 + 10)
@@ -2508,7 +2485,7 @@
 		return error;
 
 	/* Set default EDCA parameters. */
-	otus_updateedca(sc);
+	otus_updateedca_locked(sc);
 
 	return 0;
 }
@@ -3185,7 +3162,6 @@
 	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
-	taskqueue_drain(taskqueue_thread, &sc->wme_update_task);
 
 	OTUS_LOCK(sc);
 	sc->sc_running = 0;
Index: head/sys/dev/otus/if_otusreg.h
===================================================================
--- head/sys/dev/otus/if_otusreg.h
+++ head/sys/dev/otus/if_otusreg.h
@@ -1009,7 +1009,6 @@
 	struct ieee80211_channel	*sc_curchan;
 
 	struct task			tx_task;
-	struct task			wme_update_task;
 	struct timeout_task		scan_to;
 	struct timeout_task		calib_to;
 
Index: head/sys/dev/usb/wlan/if_rum.c
===================================================================
--- head/sys/dev/usb/wlan/if_rum.c
+++ head/sys/dev/usb/wlan/if_rum.c
@@ -216,8 +216,6 @@
 static void		rum_update_slot_cb(struct rum_softc *,
 			    union sec_param *, uint8_t);
 static void		rum_update_slot(struct ieee80211com *);
-static void		rum_wme_update_cb(struct rum_softc *,
-			    union sec_param *, uint8_t);
 static int		rum_wme_update(struct ieee80211com *);
 static void		rum_set_bssid(struct rum_softc *, const uint8_t *);
 static void		rum_set_macaddr(struct rum_softc *, const uint8_t *);
@@ -2083,14 +2081,15 @@
 	rum_cmd_sleepable(ic->ic_softc, NULL, 0, 0, rum_update_slot_cb);
 }
 
-static void
-rum_wme_update_cb(struct rum_softc *sc, union sec_param *data, uint8_t rvp_id)
+static int
+rum_wme_update(struct ieee80211com *ic)
 {
-	struct ieee80211com *ic = &sc->sc_ic;
 	const struct wmeParams *chanp =
 	    ic->ic_wme.wme_chanParams.cap_wmeParams;
+	struct rum_softc *sc = ic->ic_softc;
 	int error = 0;
 
+	RUM_LOCK(sc);
 	error = rum_write(sc, RT2573_AIFSN_CSR,
 	    chanp[WME_AC_VO].wmep_aifsn  << 12 |
 	    chanp[WME_AC_VI].wmep_aifsn  <<  8 |
@@ -2125,21 +2124,14 @@
 
 	memcpy(sc->wme_params, chanp, sizeof(*chanp) * WME_NUM_AC);
 
-	return;
-
 print_err:
-	device_printf(sc->sc_dev, "%s: WME update failed, error %d\n",
-	    __func__, error);
-}
-
-static int
-rum_wme_update(struct ieee80211com *ic)
-{
-	struct rum_softc *sc = ic->ic_softc;
-
-	rum_cmd_sleepable(sc, NULL, 0, 0, rum_wme_update_cb);
+	RUM_UNLOCK(sc);
+	if (error != 0) {
+		device_printf(sc->sc_dev, "%s: WME update failed, error %d\n",
+		    __func__, error);
+	}
 
-	return (0);
+	return (error);
 }
 
 static void
Index: head/sys/dev/usb/wlan/if_rumvar.h
===================================================================
--- head/sys/dev/usb/wlan/if_rumvar.h
+++ head/sys/dev/usb/wlan/if_rumvar.h
@@ -73,7 +73,6 @@
 
 union sec_param {
 	struct ieee80211_key		key;
-	struct wmeParams		wme_params[WME_NUM_AC];
 	uint8_t				macaddr[IEEE80211_ADDR_LEN];
 	struct ieee80211vap		*vap;
 };
Index: head/sys/dev/usb/wlan/if_run.c
===================================================================
--- head/sys/dev/usb/wlan/if_run.c
+++ head/sys/dev/usb/wlan/if_run.c
@@ -381,7 +381,6 @@
 static int	run_media_change(struct ifnet *);
 static int	run_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 static int	run_wme_update(struct ieee80211com *);
-static void	run_wme_update_cb(void *);
 static void	run_key_set_cb(void *);
 static int	run_key_set(struct ieee80211vap *, struct ieee80211_key *);
 static void	run_key_delete_cb(void *);
@@ -2174,19 +2173,16 @@
 	return(rvp->newstate(vap, nstate, arg));
 }
 
-/* ARGSUSED */
-static void
-run_wme_update_cb(void *arg)
+static int
+run_wme_update(struct ieee80211com *ic)
 {
-	struct ieee80211com *ic = arg;
 	struct run_softc *sc = ic->ic_softc;
 	const struct wmeParams *ac =
 	    ic->ic_wme.wme_chanParams.cap_wmeParams;
 	int aci, error = 0;
 
-	RUN_LOCK_ASSERT(sc, MA_OWNED);
-
 	/* update MAC TX configuration registers */
+	RUN_LOCK(sc);
 	for (aci = 0; aci < WME_NUM_AC; aci++) {
 		error = run_write(sc, RT2860_EDCA_AC_CFG(aci),
 		    ac[aci].wmep_logcwmax << 16 |
@@ -2224,33 +2220,11 @@
 	    ac[WME_AC_VI].wmep_txopLimit);
 
 err:
+	RUN_UNLOCK(sc);
 	if (error)
 		DPRINTF("WME update failed\n");
 
-	return;
-}
-
-static int
-run_wme_update(struct ieee80211com *ic)
-{
-	struct run_softc *sc = ic->ic_softc;
-
-	/* sometime called wothout lock */
-	if (mtx_owned(&ic->ic_comlock.mtx)) {
-		uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
-		DPRINTF("cmdq_store=%d\n", i);
-		sc->cmdq[i].func = run_wme_update_cb;
-		sc->cmdq[i].arg0 = ic;
-		ieee80211_runtask(ic, &sc->cmdq_task);
-		return (0);
-	}
-
-	RUN_LOCK(sc);
-	run_wme_update_cb(ic);
-	RUN_UNLOCK(sc);
-
-	/* return whatever, upper layer doesn't care anyway */
-	return (0);
+	return (error);
 }
 
 static void