Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
	drivers/net/wireless/iwlwifi/iwl-testmode.c
	include/net/nfc/nfc.h
	net/nfc/netlink.c
	net/wireless/nl80211.c

244 files changed, 11021 insertions, 7053 deletions

diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index abd3b71cd4ab..5f58fa53238c 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -282,8 +282,7 @@ source "drivers/net/wireless/orinoco/Kconfig"
 source "drivers/net/wireless/p54/Kconfig"
 source "drivers/net/wireless/rt2x00/Kconfig"
 source "drivers/net/wireless/rtlwifi/Kconfig"
-source "drivers/net/wireless/wl1251/Kconfig"
-source "drivers/net/wireless/wl12xx/Kconfig"
+source "drivers/net/wireless/ti/Kconfig"
 source "drivers/net/wireless/zd1211rw/Kconfig"
 source "drivers/net/wireless/mwifiex/Kconfig"
 
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 98db76196b59..0ce218b931d4 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -51,9 +51,7 @@ obj-$(CONFIG_ATH_COMMON)	+= ath/
 
 obj-$(CONFIG_MAC80211_HWSIM)    += mac80211_hwsim.o
 
-obj-$(CONFIG_WL1251)    += wl1251/
-obj-$(CONFIG_WL12XX)    += wl12xx/
-obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wl12xx/
+obj-$(CONFIG_WL_TI)     += ti/
 
 obj-$(CONFIG_IWM)       += iwmc3200wifi/
 
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index f5ce5623da99..0ac09a2bd144 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1991,19 +1991,4 @@ static struct pci_driver adm8211_driver = {
 #endif /* CONFIG_PM */
 };
 
-
-
-static int __init adm8211_init(void)
-{
-        return pci_register_driver(&adm8211_driver);
-}
-
-
-static void __exit adm8211_exit(void)
-{
-        pci_unregister_driver(&adm8211_driver);
-}
-
-
-module_init(adm8211_init);
-module_exit(adm8211_exit);
+module_pci_driver(adm8211_driver);
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 4045e5ab0555..faa8bcb4aac1 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -2512,10 +2512,8 @@ static void __exit at76_mod_exit(void)
 
         printk(KERN_INFO DRIVER_DESC " " DRIVER_VERSION " unloading\n");
         usb_deregister(&at76_driver);
-        for (i = 0; i < ARRAY_SIZE(firmwares); i++) {
-                if (firmwares[i].fw)
-                        release_firmware(firmwares[i].fw);
-        }
+        for (i = 0; i < ARRAY_SIZE(firmwares); i++)
+                release_firmware(firmwares[i].fw);
         led_trigger_unregister_simple(ledtrig_tx);
 }
 
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 55ef93dd7438..64a453a6dfe4 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -1527,7 +1527,7 @@ void ath5k_eeprom_detach(struct ath5k_hw *ah);
 
 /* Protocol Control Unit Functions */
 /* Helpers */
-int ath5k_hw_get_frame_duration(struct ath5k_hw *ah,
+int ath5k_hw_get_frame_duration(struct ath5k_hw *ah, enum ieee80211_band band,
                 int len, struct ieee80211_rate *rate, bool shortpre);
 unsigned int ath5k_hw_get_default_slottime(struct ath5k_hw *ah);
 unsigned int ath5k_hw_get_default_sifs(struct ath5k_hw *ah);
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 3007bba12d94..49e3b19cf781 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1170,7 +1170,7 @@ ath5k_check_ibss_tsf(struct ath5k_hw *ah, struct sk_buff *skb,
 
         if (ieee80211_is_beacon(mgmt->frame_control) &&
             le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS &&
-            memcmp(mgmt->bssid, common->curbssid, ETH_ALEN) == 0) {
+            compare_ether_addr(mgmt->bssid, common->curbssid) == 0) {
                 /*
                  * Received an IBSS beacon with the same BSSID. Hardware *must*
                  * have updated the local TSF. We have to work around various
@@ -1234,7 +1234,7 @@ ath5k_update_beacon_rssi(struct ath5k_hw *ah, struct sk_buff *skb, int rssi)
 
         /* only beacons from our BSSID */
         if (!ieee80211_is_beacon(mgmt->frame_control) ||
-            memcmp(mgmt->bssid, common->curbssid, ETH_ALEN) != 0)
+            compare_ether_addr(mgmt->bssid, common->curbssid) != 0)
                 return;
 
         ewma_add(&ah->ah_beacon_rssi_avg, rssi);
diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c
index 53424e8e6d82..dff48fbc63bf 100644
--- a/drivers/net/wireless/ath/ath5k/pci.c
+++ b/drivers/net/wireless/ath/ath5k/pci.c
@@ -47,6 +47,7 @@ static DEFINE_PCI_DEVICE_TABLE(ath5k_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x001b) }, /* 5413 Eagle */
         { PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */
         { PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */
+        { PCI_VDEVICE(ATHEROS, 0xff1b) }, /* AR5BXB63 */
         { 0 }
 };
 MODULE_DEVICE_TABLE(pci, ath5k_pci_id_table);
@@ -339,28 +340,4 @@ static struct pci_driver ath5k_pci_driver = {
         .driver.pm      = ATH5K_PM_OPS,
 };
 
-/*
- * Module init/exit functions
- */
-static int __init
-init_ath5k_pci(void)
-{
-        int ret;
-
-        ret = pci_register_driver(&ath5k_pci_driver);
-        if (ret) {
-                pr_err("pci: can't register pci driver\n");
-                return ret;
-        }
-
-        return 0;
-}
-
-static void __exit
-exit_ath5k_pci(void)
-{
-        pci_unregister_driver(&ath5k_pci_driver);
-}
-
-module_init(init_ath5k_pci);
-module_exit(exit_ath5k_pci);
+module_pci_driver(ath5k_pci_driver);
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index cebfd6fd31d3..1f16b4227d8f 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -110,7 +110,7 @@ static const unsigned int ack_rates_high[] =
  * bwmodes.
  */
 int
-ath5k_hw_get_frame_duration(struct ath5k_hw *ah,
+ath5k_hw_get_frame_duration(struct ath5k_hw *ah, enum ieee80211_band band,
                 int len, struct ieee80211_rate *rate, bool shortpre)
 {
         int sifs, preamble, plcp_bits, sym_time;
@@ -120,7 +120,7 @@ ath5k_hw_get_frame_duration(struct ath5k_hw *ah,
         /* Fallback */
         if (!ah->ah_bwmode) {
                 __le16 raw_dur = ieee80211_generic_frame_duration(ah->hw,
-                                        NULL, len, rate);
+                                        NULL, band, len, rate);
 
                 /* subtract difference between long and short preamble */
                 dur = le16_to_cpu(raw_dur);
@@ -302,14 +302,15 @@ ath5k_hw_write_rate_duration(struct ath5k_hw *ah)
                  * actual rate for this rate. See mac80211 tx.c
                  * ieee80211_duration() for a brief description of
                  * what rate we should choose to TX ACKs. */
-                tx_time = ath5k_hw_get_frame_duration(ah, 10, rate, false);
+                tx_time = ath5k_hw_get_frame_duration(ah, band, 10,
+                                        rate, false);
 
                 ath5k_hw_reg_write(ah, tx_time, reg);
 
                 if (!(rate->flags & IEEE80211_RATE_SHORT_PREAMBLE))
                         continue;
 
-                tx_time = ath5k_hw_get_frame_duration(ah, 10, rate, true);
+                tx_time = ath5k_hw_get_frame_duration(ah, band, 10, rate, true);
                 ath5k_hw_reg_write(ah, tx_time,
                         reg + (AR5K_SET_SHORT_PREAMBLE << 2));
         }
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index a6de200538c3..65fe929529a8 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -565,6 +565,7 @@ ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
 int ath5k_hw_set_ifs_intervals(struct ath5k_hw *ah, unsigned int slot_time)
 {
         struct ieee80211_channel *channel = ah->ah_current_channel;
+        enum ieee80211_band band;
         struct ieee80211_rate *rate;
         u32 ack_tx_time, eifs, eifs_clock, sifs, sifs_clock;
         u32 slot_time_clock = ath5k_hw_htoclock(ah, slot_time);
@@ -600,11 +601,12 @@ int ath5k_hw_set_ifs_intervals(struct ath5k_hw *ah, unsigned int slot_time)
          * Also we have different lowest rate for 802.11a
          */
         if (channel->band == IEEE80211_BAND_5GHZ)
-                rate = &ah->sbands[IEEE80211_BAND_5GHZ].bitrates[0];
+                band = IEEE80211_BAND_5GHZ;
         else
-                rate = &ah->sbands[IEEE80211_BAND_2GHZ].bitrates[0];
+                band = IEEE80211_BAND_2GHZ;
 
-        ack_tx_time = ath5k_hw_get_frame_duration(ah, 10, rate, false);
+        rate = &ah->sbands[band].bitrates[0];
+        ack_tx_time = ath5k_hw_get_frame_duration(ah, band, 10, rate, false);
 
         /* ack_tx_time includes an SIFS already */
         eifs = ack_tx_time + sifs + 2 * slot_time;
diff --git a/drivers/net/wireless/ath/ath6kl/Makefile b/drivers/net/wireless/ath/ath6kl/Makefile
index 85746c3eb027..8cae8886f17d 100644
--- a/drivers/net/wireless/ath/ath6kl/Makefile
+++ b/drivers/net/wireless/ath/ath6kl/Makefile
@@ -25,7 +25,8 @@
 obj-$(CONFIG_ATH6KL) += ath6kl_core.o
 ath6kl_core-y += debug.o
 ath6kl_core-y += hif.o
-ath6kl_core-y += htc.o
+ath6kl_core-y += htc_mbox.o
+ath6kl_core-y += htc_pipe.o
 ath6kl_core-y += bmi.o
 ath6kl_core-y += cfg80211.o
 ath6kl_core-y += init.o
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index bdcc68fb1e37..28a65d3a03d0 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -51,6 +51,8 @@
         .max_power      = 30,                       \
 }
 
+#define DEFAULT_BG_SCAN_PERIOD 60
+
 static struct ieee80211_rate ath6kl_rates[] = {
         RATETAB_ENT(10, 0x1, 0),
         RATETAB_ENT(20, 0x2, 0),
@@ -71,7 +73,8 @@ static struct ieee80211_rate ath6kl_rates[] = {
 #define ath6kl_g_rates     (ath6kl_rates + 0)
 #define ath6kl_g_rates_size    12
 
-#define ath6kl_g_htcap (IEEE80211_HT_CAP_SUP_WIDTH_20_40 | \
+#define ath6kl_g_htcap IEEE80211_HT_CAP_SGI_20
+#define ath6kl_a_htcap (IEEE80211_HT_CAP_SUP_WIDTH_20_40 | \
                         IEEE80211_HT_CAP_SGI_20          | \
                         IEEE80211_HT_CAP_SGI_40)
 
@@ -128,7 +131,7 @@ static struct ieee80211_supported_band ath6kl_band_5ghz = {
         .channels = ath6kl_5ghz_a_channels,
         .n_bitrates = ath6kl_a_rates_size,
         .bitrates = ath6kl_a_rates,
-        .ht_cap.cap = ath6kl_g_htcap,
+        .ht_cap.cap = ath6kl_a_htcap,
         .ht_cap.ht_supported = true,
 };
 
@@ -609,6 +612,17 @@ static int ath6kl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                                         vif->req_bssid, vif->ch_hint,
                                         ar->connect_ctrl_flags, nw_subtype);
 
+        /* disable background scan if period is 0 */
+        if (sme->bg_scan_period == 0)
+                sme->bg_scan_period = 0xffff;
+
+        /* configure default value if not specified */
+        if (sme->bg_scan_period == -1)
+                sme->bg_scan_period = DEFAULT_BG_SCAN_PERIOD;
+
+        ath6kl_wmi_scanparams_cmd(ar->wmi, vif->fw_vif_idx, 0, 0,
+                                  sme->bg_scan_period, 0, 0, 0, 3, 0, 0, 0);
+
         up(&ar->sem);
 
         if (status == -EINVAL) {
@@ -943,6 +957,8 @@ static int ath6kl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
         if (test_bit(CONNECTED, &vif->flags))
                 force_fg_scan = 1;
 
+        vif->scan_req = request;
+
         if (test_bit(ATH6KL_FW_CAPABILITY_STA_P2PDEV_DUPLEX,
                      ar->fw_capabilities)) {
                 /*
@@ -965,10 +981,10 @@ static int ath6kl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
                                                 ATH6KL_FG_SCAN_INTERVAL,
                                                 n_channels, channels);
         }
-        if (ret)
+        if (ret) {
                 ath6kl_err("wmi_startscan_cmd failed\n");
-        else
-                vif->scan_req = request;
+                vif->scan_req = NULL;
+        }
 
         kfree(channels);
 
@@ -1438,9 +1454,38 @@ static int ath6kl_cfg80211_change_iface(struct wiphy *wiphy,
                                         struct vif_params *params)
 {
         struct ath6kl_vif *vif = netdev_priv(ndev);
+        int i;
 
         ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: type %u\n", __func__, type);
 
+        /*
+         * Don't bring up p2p on an interface which is not initialized
+         * for p2p operation where fw does not have capability to switch
+         * dynamically between non-p2p and p2p type interface.
+         */
+        if (!test_bit(ATH6KL_FW_CAPABILITY_STA_P2PDEV_DUPLEX,
+                      vif->ar->fw_capabilities) &&
+            (type == NL80211_IFTYPE_P2P_CLIENT ||
+             type == NL80211_IFTYPE_P2P_GO)) {
+                if (vif->ar->vif_max == 1) {
+                        if (vif->fw_vif_idx != 0)
+                                return -EINVAL;
+                        else
+                                goto set_iface_type;
+                }
+
+                for (i = vif->ar->max_norm_iface; i < vif->ar->vif_max; i++) {
+                        if (i == vif->fw_vif_idx)
+                                break;
+                }
+
+                if (i == vif->ar->vif_max) {
+                        ath6kl_err("Invalid interface to bring up P2P\n");
+                        return -EINVAL;
+                }
+        }
+
+set_iface_type:
         switch (type) {
         case NL80211_IFTYPE_STATION:
                 vif->next_mode = INFRA_NETWORK;
@@ -1926,12 +1971,61 @@ static int ath6kl_wow_sta(struct ath6kl *ar, struct ath6kl_vif *vif)
         return 0;
 }
 
+static int is_hsleep_mode_procsed(struct ath6kl_vif *vif)
+{
+        return test_bit(HOST_SLEEP_MODE_CMD_PROCESSED, &vif->flags);
+}
+
+static bool is_ctrl_ep_empty(struct ath6kl *ar)
+{
+        return !ar->tx_pending[ar->ctrl_ep];
+}
+
+static int ath6kl_cfg80211_host_sleep(struct ath6kl *ar, struct ath6kl_vif *vif)
+{
+        int ret, left;
+
+        clear_bit(HOST_SLEEP_MODE_CMD_PROCESSED, &vif->flags);
+
+        ret = ath6kl_wmi_set_host_sleep_mode_cmd(ar->wmi, vif->fw_vif_idx,
+                                                 ATH6KL_HOST_MODE_ASLEEP);
+        if (ret)
+                return ret;
+
+        left = wait_event_interruptible_timeout(ar->event_wq,
+                                                is_hsleep_mode_procsed(vif),
+                                                WMI_TIMEOUT);
+        if (left == 0) {
+                ath6kl_warn("timeout, didn't get host sleep cmd processed event\n");
+                ret = -ETIMEDOUT;
+        } else if (left < 0) {
+                ath6kl_warn("error while waiting for host sleep cmd processed event %d\n",
+                            left);
+                ret = left;
+        }
+
+        if (ar->tx_pending[ar->ctrl_ep]) {
+                left = wait_event_interruptible_timeout(ar->event_wq,
+                                                        is_ctrl_ep_empty(ar),
+                                                        WMI_TIMEOUT);
+                if (left == 0) {
+                        ath6kl_warn("clear wmi ctrl data timeout\n");
+                        ret = -ETIMEDOUT;
+                } else if (left < 0) {
+                        ath6kl_warn("clear wmi ctrl data failed: %d\n", left);
+                        ret = left;
+                }
+        }
+
+        return ret;
+}
+
 static int ath6kl_wow_suspend(struct ath6kl *ar, struct cfg80211_wowlan *wow)
 {
         struct in_device *in_dev;
         struct in_ifaddr *ifa;
         struct ath6kl_vif *vif;
-        int ret, left;
+        int ret;
         u32 filter = 0;
         u16 i, bmiss_time;
         u8 index = 0;
@@ -2032,39 +2126,11 @@ skip_arp:
         if (ret)
                 return ret;
 
-        clear_bit(HOST_SLEEP_MODE_CMD_PROCESSED, &vif->flags);
-
-        ret = ath6kl_wmi_set_host_sleep_mode_cmd(ar->wmi, vif->fw_vif_idx,
-                                                 ATH6KL_HOST_MODE_ASLEEP);
+        ret = ath6kl_cfg80211_host_sleep(ar, vif);
         if (ret)
                 return ret;
 
-        left = wait_event_interruptible_timeout(ar->event_wq,
-                        test_bit(HOST_SLEEP_MODE_CMD_PROCESSED, &vif->flags),
-                        WMI_TIMEOUT);
-        if (left == 0) {
-                ath6kl_warn("timeout, didn't get host sleep cmd "
-                            "processed event\n");
-                ret = -ETIMEDOUT;
-        } else if (left < 0) {
-                ath6kl_warn("error while waiting for host sleep cmd "
-                            "processed event %d\n", left);
-                ret = left;
-        }
-
-        if (ar->tx_pending[ar->ctrl_ep]) {
-                left = wait_event_interruptible_timeout(ar->event_wq,
-                                ar->tx_pending[ar->ctrl_ep] == 0, WMI_TIMEOUT);
-                if (left == 0) {
-                        ath6kl_warn("clear wmi ctrl data timeout\n");
-                        ret = -ETIMEDOUT;
-                } else if (left < 0) {
-                        ath6kl_warn("clear wmi ctrl data failed: %d\n", left);
-                        ret = left;
-                }
-        }
-
-        return ret;
+        return 0;
 }
 
 static int ath6kl_wow_resume(struct ath6kl *ar)
@@ -2111,10 +2177,82 @@ static int ath6kl_wow_resume(struct ath6kl *ar)
         return 0;
 }
 
+static int ath6kl_cfg80211_deepsleep_suspend(struct ath6kl *ar)
+{
+        struct ath6kl_vif *vif;
+        int ret;
+
+        vif = ath6kl_vif_first(ar);
+        if (!vif)
+                return -EIO;
+
+        if (!ath6kl_cfg80211_ready(vif))
+                return -EIO;
+
+        ath6kl_cfg80211_stop_all(ar);
+
+        /* Save the current power mode before enabling power save */
+        ar->wmi->saved_pwr_mode = ar->wmi->pwr_mode;
+
+        ret = ath6kl_wmi_powermode_cmd(ar->wmi, 0, REC_POWER);
+        if (ret)
+                return ret;
+
+        /* Disable WOW mode */
+        ret = ath6kl_wmi_set_wow_mode_cmd(ar->wmi, vif->fw_vif_idx,
+                                          ATH6KL_WOW_MODE_DISABLE,
+                                          0, 0);
+        if (ret)
+                return ret;
+
+        /* Flush all non control pkts in TX path */
+        ath6kl_tx_data_cleanup(ar);
+
+        ret = ath6kl_cfg80211_host_sleep(ar, vif);
+        if (ret)
+                return ret;
+
+        return 0;
+}
+
+static int ath6kl_cfg80211_deepsleep_resume(struct ath6kl *ar)
+{
+        struct ath6kl_vif *vif;
+        int ret;
+
+        vif = ath6kl_vif_first(ar);
+
+        if (!vif)
+                return -EIO;
+
+        if (ar->wmi->pwr_mode != ar->wmi->saved_pwr_mode) {
+                ret = ath6kl_wmi_powermode_cmd(ar->wmi, 0,
+                                               ar->wmi->saved_pwr_mode);
+                if (ret)
+                        return ret;
+        }
+
+        ret = ath6kl_wmi_set_host_sleep_mode_cmd(ar->wmi, vif->fw_vif_idx,
+                                                 ATH6KL_HOST_MODE_AWAKE);
+        if (ret)
+                return ret;
+
+        ar->state = ATH6KL_STATE_ON;
+
+        /* Reset scan parameter to default values */
+        ret = ath6kl_wmi_scanparams_cmd(ar->wmi, vif->fw_vif_idx,
+                                        0, 0, 0, 0, 0, 0, 3, 0, 0, 0);
+        if (ret)
+                return ret;
+
+        return 0;
+}
+
 int ath6kl_cfg80211_suspend(struct ath6kl *ar,
                             enum ath6kl_cfg_suspend_mode mode,
                             struct cfg80211_wowlan *wow)
 {
+        struct ath6kl_vif *vif;
         enum ath6kl_state prev_state;
         int ret;
 
@@ -2139,15 +2277,12 @@ int ath6kl_cfg80211_suspend(struct ath6kl *ar,
 
         case ATH6KL_CFG_SUSPEND_DEEPSLEEP:
 
-                ath6kl_cfg80211_stop_all(ar);
-
-                /* save the current power mode before enabling power save */
-                ar->wmi->saved_pwr_mode = ar->wmi->pwr_mode;
+                ath6kl_dbg(ATH6KL_DBG_SUSPEND, "deep sleep suspend\n");
 
-                ret = ath6kl_wmi_powermode_cmd(ar->wmi, 0, REC_POWER);
+                ret = ath6kl_cfg80211_deepsleep_suspend(ar);
                 if (ret) {
-                        ath6kl_warn("wmi powermode command failed during suspend: %d\n",
-                                    ret);
+                        ath6kl_err("deepsleep suspend failed: %d\n", ret);
+                        return ret;
                 }
 
                 ar->state = ATH6KL_STATE_DEEPSLEEP;
@@ -2187,6 +2322,9 @@ int ath6kl_cfg80211_suspend(struct ath6kl *ar,
                 break;
         }
 
+        list_for_each_entry(vif, &ar->vif_list, list)
+                ath6kl_cfg80211_scan_complete_event(vif, true);
+
         return 0;
 }
 EXPORT_SYMBOL(ath6kl_cfg80211_suspend);
@@ -2208,17 +2346,13 @@ int ath6kl_cfg80211_resume(struct ath6kl *ar)
                 break;
 
         case ATH6KL_STATE_DEEPSLEEP:
-                if (ar->wmi->pwr_mode != ar->wmi->saved_pwr_mode) {
-                        ret = ath6kl_wmi_powermode_cmd(ar->wmi, 0,
-                                                       ar->wmi->saved_pwr_mode);
-                        if (ret) {
-                                ath6kl_warn("wmi powermode command failed during resume: %d\n",
-                                            ret);
-                        }
-                }
-
-                ar->state = ATH6KL_STATE_ON;
+                ath6kl_dbg(ATH6KL_DBG_SUSPEND, "deep sleep resume\n");
 
+                ret = ath6kl_cfg80211_deepsleep_resume(ar);
+                if (ret) {
+                        ath6kl_warn("deep sleep resume failed: %d\n", ret);
+                        return ret;
+                }
                 break;
 
         case ATH6KL_STATE_CUTPOWER:
@@ -2292,31 +2426,25 @@ void ath6kl_check_wow_status(struct ath6kl *ar)
 }
 #endif
 
-static int ath6kl_set_channel(struct wiphy *wiphy, struct net_device *dev,
-                              struct ieee80211_channel *chan,
-                              enum nl80211_channel_type channel_type)
+static int ath6kl_set_htcap(struct ath6kl_vif *vif, enum ieee80211_band band,
+                            bool ht_enable)
 {
-        struct ath6kl_vif *vif;
-
-        /*
-         * 'dev' could be NULL if a channel change is required for the hardware
-         * device itself, instead of a particular VIF.
-         *
-         * FIXME: To be handled properly when monitor mode is supported.
-         */
-        if (!dev)
-                return -EBUSY;
-
-        vif = netdev_priv(dev);
+        struct ath6kl_htcap *htcap = &vif->htcap;
 
-        if (!ath6kl_cfg80211_ready(vif))
-                return -EIO;
+        if (htcap->ht_enable == ht_enable)
+                return 0;
 
-        ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: center_freq=%u hw_value=%u\n",
-                   __func__, chan->center_freq, chan->hw_value);
-        vif->next_chan = chan->center_freq;
+        if (ht_enable) {
+                /* Set default ht capabilities */
+                htcap->ht_enable = true;
+                htcap->cap_info = (band == IEEE80211_BAND_2GHZ) ?
+                                   ath6kl_g_htcap : ath6kl_a_htcap;
+                htcap->ampdu_factor = IEEE80211_HT_MAX_AMPDU_16K;
+        } else /* Disable ht */
+                memset(htcap, 0, sizeof(*htcap));
 
-        return 0;
+        return ath6kl_wmi_set_htcap_cmd(vif->ar->wmi, vif->fw_vif_idx,
+                                        band, htcap);
 }
 
 static bool ath6kl_is_p2p_ie(const u8 *pos)
@@ -2393,6 +2521,81 @@ static int ath6kl_set_ies(struct ath6kl_vif *vif,
         return 0;
 }
 
+static int ath6kl_set_channel(struct wiphy *wiphy, struct net_device *dev,
+                              struct ieee80211_channel *chan,
+                              enum nl80211_channel_type channel_type)
+{
+        struct ath6kl_vif *vif;
+
+        /*
+         * 'dev' could be NULL if a channel change is required for the hardware
+         * device itself, instead of a particular VIF.
+         *
+         * FIXME: To be handled properly when monitor mode is supported.
+         */
+        if (!dev)
+                return -EBUSY;
+
+        vif = netdev_priv(dev);
+
+        if (!ath6kl_cfg80211_ready(vif))
+                return -EIO;
+
+        ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: center_freq=%u hw_value=%u\n",
+                   __func__, chan->center_freq, chan->hw_value);
+        vif->next_chan = chan->center_freq;
+        vif->next_ch_type = channel_type;
+        vif->next_ch_band = chan->band;
+
+        return 0;
+}
+
+static int ath6kl_get_rsn_capab(struct cfg80211_beacon_data *beacon,
+                                u8 *rsn_capab)
+{
+        const u8 *rsn_ie;
+        size_t rsn_ie_len;
+        u16 cnt;
+
+        if (!beacon->tail)
+                return -EINVAL;
+
+        rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, beacon->tail, beacon->tail_len);
+        if (!rsn_ie)
+                return -EINVAL;
+
+        rsn_ie_len = *(rsn_ie + 1);
+        /* skip element id and length */
+        rsn_ie += 2;
+
+        /* skip version, group cipher */
+        if (rsn_ie_len < 6)
+                return -EINVAL;
+        rsn_ie +=  6;
+        rsn_ie_len -= 6;
+
+        /* skip pairwise cipher suite */
+        if (rsn_ie_len < 2)
+                return -EINVAL;
+        cnt = *((u16 *) rsn_ie);
+        rsn_ie += (2 + cnt * 4);
+        rsn_ie_len -= (2 + cnt * 4);
+
+        /* skip akm suite */
+        if (rsn_ie_len < 2)
+                return -EINVAL;
+        cnt = *((u16 *) rsn_ie);
+        rsn_ie += (2 + cnt * 4);
+        rsn_ie_len -= (2 + cnt * 4);
+
+        if (rsn_ie_len < 2)
+                return -EINVAL;
+
+        memcpy(rsn_capab, rsn_ie, 2);
+
+        return 0;
+}
+
 static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
                            struct cfg80211_ap_settings *info)
 {
@@ -2405,6 +2608,7 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
         struct wmi_connect_cmd p;
         int res;
         int i, ret;
+        u16 rsn_capab = 0;
 
         ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s:\n", __func__);
 
@@ -2534,6 +2738,34 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
                 p.nw_subtype = SUBTYPE_NONE;
         }
 
+        if (info->inactivity_timeout) {
+                res = ath6kl_wmi_set_inact_period(ar->wmi, vif->fw_vif_idx,
+                                                  info->inactivity_timeout);
+                if (res < 0)
+                        return res;
+        }
+
+        if (ath6kl_set_htcap(vif, vif->next_ch_band,
+                             vif->next_ch_type != NL80211_CHAN_NO_HT))
+                return -EIO;
+
+        /*
+         * Get the PTKSA replay counter in the RSN IE. Supplicant
+         * will use the RSN IE in M3 message and firmware has to
+         * advertise the same in beacon/probe response. Send
+         * the complete RSN IE capability field to firmware
+         */
+        if (!ath6kl_get_rsn_capab(&info->beacon, (u8 *) &rsn_capab) &&
+            test_bit(ATH6KL_FW_CAPABILITY_RSN_CAP_OVERRIDE,
+                     ar->fw_capabilities)) {
+                res = ath6kl_wmi_set_ie_cmd(ar->wmi, vif->fw_vif_idx,
+                                            WLAN_EID_RSN, WMI_RSN_IE_CAPB,
+                                            (const u8 *) &rsn_capab,
+                                            sizeof(rsn_capab));
+                if (res < 0)
+                        return res;
+        }
+
         res = ath6kl_wmi_ap_profile_commit(ar->wmi, vif->fw_vif_idx, &p);
         if (res < 0)
                 return res;
@@ -2568,6 +2800,13 @@ static int ath6kl_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         ath6kl_wmi_disconnect_cmd(ar->wmi, vif->fw_vif_idx);
         clear_bit(CONNECTED, &vif->flags);
 
+        /* Restore ht setting in firmware */
+        if (ath6kl_set_htcap(vif, IEEE80211_BAND_2GHZ, true))
+                return -EIO;
+
+        if (ath6kl_set_htcap(vif, IEEE80211_BAND_5GHZ, true))
+                return -EIO;
+
         return 0;
 }
 
@@ -2749,6 +2988,21 @@ static bool ath6kl_mgmt_powersave_ap(struct ath6kl_vif *vif,
         return false;
 }
 
+/* Check if SSID length is greater than DIRECT- */
+static bool ath6kl_is_p2p_go_ssid(const u8 *buf, size_t len)
+{
+        const struct ieee80211_mgmt *mgmt;
+        mgmt = (const struct ieee80211_mgmt *) buf;
+
+        /* variable[1] contains the SSID tag length */
+        if (buf + len >= &mgmt->u.probe_resp.variable[1] &&
+            (mgmt->u.probe_resp.variable[1] > P2P_WILDCARD_SSID_LEN)) {
+                return true;
+        }
+
+        return false;
+}
+
 static int ath6kl_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                           struct ieee80211_channel *chan, bool offchan,
                           enum nl80211_channel_type channel_type,
@@ -2763,11 +3017,11 @@ static int ath6kl_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
         bool more_data, queued;
 
         mgmt = (const struct ieee80211_mgmt *) buf;
-        if (buf + len >= mgmt->u.probe_resp.variable &&
-            vif->nw_type == AP_NETWORK && test_bit(CONNECTED, &vif->flags) &&
-            ieee80211_is_probe_resp(mgmt->frame_control)) {
+        if (vif->nw_type == AP_NETWORK && test_bit(CONNECTED, &vif->flags) &&
+            ieee80211_is_probe_resp(mgmt->frame_control) &&
+            ath6kl_is_p2p_go_ssid(buf, len)) {
                 /*
-                 * Send Probe Response frame in AP mode using a separate WMI
+                 * Send Probe Response frame in GO mode using a separate WMI
                  * command to allow the target to fill in the generic IEs.
                  */
                 *cookie = 0; /* TX status not supported */
@@ -2835,6 +3089,8 @@ static int ath6kl_cfg80211_sscan_start(struct wiphy *wiphy,
         if (vif->sme_state != SME_DISCONNECTED)
                 return -EBUSY;
 
+        ath6kl_cfg80211_scan_complete_event(vif, true);
+
         for (i = 0; i < ar->wiphy->max_sched_scan_ssids; i++) {
                 ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx,
                                           i, DISABLE_SSID_FLAG,
@@ -3096,6 +3352,7 @@ struct net_device *ath6kl_interface_add(struct ath6kl *ar, char *name,
         vif->next_mode = nw_type;
         vif->listen_intvl_t = ATH6KL_DEFAULT_LISTEN_INTVAL;
         vif->bmiss_time_t = ATH6KL_DEFAULT_BMISS_TIME;
+        vif->htcap.ht_enable = true;
 
         memcpy(ndev->dev_addr, ar->mac_addr, ETH_ALEN);
         if (fw_vif_idx != 0)
@@ -3183,6 +3440,10 @@ int ath6kl_cfg80211_init(struct ath6kl *ar)
         if (test_bit(ATH6KL_FW_CAPABILITY_SCHED_SCAN, ar->fw_capabilities))
                 ar->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
 
+        if (test_bit(ATH6KL_FW_CAPABILITY_INACTIVITY_TIMEOUT,
+                     ar->fw_capabilities))
+                ar->wiphy->features = NL80211_FEATURE_INACTIVITY_TIMER;
+
         ar->wiphy->probe_resp_offload =
                 NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
                 NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
diff --git a/drivers/net/wireless/ath/ath6kl/common.h b/drivers/net/wireless/ath/ath6kl/common.h
index a60e78c0472f..98a886154d9c 100644
--- a/drivers/net/wireless/ath/ath6kl/common.h
+++ b/drivers/net/wireless/ath/ath6kl/common.h
@@ -22,7 +22,8 @@
 
 #define ATH6KL_MAX_IE                   256
 
-extern int ath6kl_printk(const char *level, const char *fmt, ...);
+extern __printf(2, 3)
+int ath6kl_printk(const char *level, const char *fmt, ...);
 
 /*
  * Reflects the version of binary interface exposed by ATH6KL target
@@ -77,6 +78,7 @@ enum crypto_type {
 
 struct htc_endpoint_credit_dist;
 struct ath6kl;
+struct ath6kl_htcap;
 enum htc_credit_dist_reason;
 struct ath6kl_htc_credit_info;
 
diff --git a/drivers/net/wireless/ath/ath6kl/core.c b/drivers/net/wireless/ath/ath6kl/core.c
index 45e641f3a41b..fdb3b1decc76 100644
--- a/drivers/net/wireless/ath/ath6kl/core.c
+++ b/drivers/net/wireless/ath/ath6kl/core.c
@@ -20,9 +20,11 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/export.h>
+#include <linux/vmalloc.h>
 
 #include "debug.h"
 #include "hif-ops.h"
+#include "htc-ops.h"
 #include "cfg80211.h"
 
 unsigned int debug_mask;
@@ -39,12 +41,36 @@ module_param(uart_debug, uint, 0644);
 module_param(ath6kl_p2p, uint, 0644);
 module_param(testmode, uint, 0644);
 
-int ath6kl_core_init(struct ath6kl *ar)
+void ath6kl_core_tx_complete(struct ath6kl *ar, struct sk_buff *skb)
+{
+        ath6kl_htc_tx_complete(ar, skb);
+}
+EXPORT_SYMBOL(ath6kl_core_tx_complete);
+
+void ath6kl_core_rx_complete(struct ath6kl *ar, struct sk_buff *skb, u8 pipe)
+{
+        ath6kl_htc_rx_complete(ar, skb, pipe);
+}
+EXPORT_SYMBOL(ath6kl_core_rx_complete);
+
+int ath6kl_core_init(struct ath6kl *ar, enum ath6kl_htc_type htc_type)
 {
         struct ath6kl_bmi_target_info targ_info;
         struct net_device *ndev;
         int ret = 0, i;
 
+        switch (htc_type) {
+        case ATH6KL_HTC_TYPE_MBOX:
+                ath6kl_htc_mbox_attach(ar);
+                break;
+        case ATH6KL_HTC_TYPE_PIPE:
+                ath6kl_htc_pipe_attach(ar);
+                break;
+        default:
+                WARN_ON(1);
+                return -ENOMEM;
+        }
+
         ar->ath6kl_wq = create_singlethread_workqueue("ath6kl");
         if (!ar->ath6kl_wq)
                 return -ENOMEM;
@@ -280,7 +306,7 @@ void ath6kl_core_cleanup(struct ath6kl *ar)
 
         kfree(ar->fw_board);
         kfree(ar->fw_otp);
-        kfree(ar->fw);
+        vfree(ar->fw);
         kfree(ar->fw_patch);
         kfree(ar->fw_testscript);
 
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index f1dd8906be45..9d67964a51dd 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -91,6 +91,15 @@ enum ath6kl_fw_capability {
          */
         ATH6KL_FW_CAPABILITY_STA_P2PDEV_DUPLEX,
 
+        /*
+         * Firmware has support to cleanup inactive stations
+         * in AP mode.
+         */
+        ATH6KL_FW_CAPABILITY_INACTIVITY_TIMEOUT,
+
+        /* Firmware has support to override rsn cap of rsn ie */
+        ATH6KL_FW_CAPABILITY_RSN_CAP_OVERRIDE,
+
         /* this needs to be last */
         ATH6KL_FW_CAPABILITY_MAX,
 };
@@ -205,6 +214,8 @@ struct ath6kl_fw_ie {
 #define ATH6KL_CONF_ENABLE_TX_BURST             BIT(3)
 #define ATH6KL_CONF_UART_DEBUG                  BIT(4)
 
+#define P2P_WILDCARD_SSID_LEN                   7 /* DIRECT- */
+
 enum wlan_low_pwr_state {
         WLAN_POWER_STATE_ON,
         WLAN_POWER_STATE_CUT_PWR,
@@ -454,6 +465,11 @@ enum ath6kl_hif_type {
         ATH6KL_HIF_TYPE_USB,
 };
 
+enum ath6kl_htc_type {
+        ATH6KL_HTC_TYPE_MBOX,
+        ATH6KL_HTC_TYPE_PIPE,
+};
+
 /* Max number of filters that hw supports */
 #define ATH6K_MAX_MC_FILTERS_PER_LIST 7
 struct ath6kl_mc_filter {
@@ -461,6 +477,12 @@ struct ath6kl_mc_filter {
         char hw_addr[ATH6KL_MCAST_FILTER_MAC_ADDR_SIZE];
 };
 
+struct ath6kl_htcap {
+        bool ht_enable;
+        u8 ampdu_factor;
+        unsigned short cap_info;
+};
+
 /*
  * Driver's maximum limit, note that some firmwares support only one vif
  * and the runtime (current) limit must be checked from ar->vif_max.
@@ -509,6 +531,7 @@ struct ath6kl_vif {
         struct ath6kl_wep_key wep_key_list[WMI_MAX_KEY_INDEX + 1];
         struct ath6kl_key keys[WMI_MAX_KEY_INDEX + 1];
         struct aggr_info *aggr_cntxt;
+        struct ath6kl_htcap htcap;
 
         struct timer_list disconnect_timer;
         struct timer_list sched_scan_timer;
@@ -521,6 +544,8 @@ struct ath6kl_vif {
         u32 send_action_id;
         bool probe_req_report;
         u16 next_chan;
+        enum nl80211_channel_type next_ch_type;
+        enum ieee80211_band next_ch_band;
         u16 assoc_bss_beacon_int;
         u16 listen_intvl_t;
         u16 bmiss_time_t;
@@ -568,6 +593,7 @@ struct ath6kl {
 
         struct ath6kl_bmi bmi;
         const struct ath6kl_hif_ops *hif_ops;
+        const struct ath6kl_htc_ops *htc_ops;
         struct wmi *wmi;
         int tx_pending[ENDPOINT_MAX];
         int total_tx_data_pend;
@@ -746,7 +772,8 @@ void init_netdev(struct net_device *dev);
 void ath6kl_cookie_init(struct ath6kl *ar);
 void ath6kl_cookie_cleanup(struct ath6kl *ar);
 void ath6kl_rx(struct htc_target *target, struct htc_packet *packet);
-void ath6kl_tx_complete(void *context, struct list_head *packet_queue);
+void ath6kl_tx_complete(struct htc_target *context,
+                        struct list_head *packet_queue);
 enum htc_send_full_action ath6kl_tx_queue_full(struct htc_target *target,
                                                struct htc_packet *packet);
 void ath6kl_stop_txrx(struct ath6kl *ar);
@@ -821,8 +848,11 @@ int ath6kl_init_hw_params(struct ath6kl *ar);
 
 void ath6kl_check_wow_status(struct ath6kl *ar);
 
+void ath6kl_core_tx_complete(struct ath6kl *ar, struct sk_buff *skb);
+void ath6kl_core_rx_complete(struct ath6kl *ar, struct sk_buff *skb, u8 pipe);
+
 struct ath6kl *ath6kl_core_create(struct device *dev);
-int ath6kl_core_init(struct ath6kl *ar);
+int ath6kl_core_init(struct ath6kl *ar, enum ath6kl_htc_type htc_type);
 void ath6kl_core_cleanup(struct ath6kl *ar);
 void ath6kl_core_destroy(struct ath6kl *ar);
 
diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c
index d01403a263ff..1b76aff78508 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.c
+++ b/drivers/net/wireless/ath/ath6kl/debug.c
@@ -616,6 +616,12 @@ static ssize_t read_file_tgt_stats(struct file *file, char __user *user_buf,
                          "Num disconnects", tgt_stats->cs_discon_cnt);
         len += scnprintf(buf + len, buf_len - len, "%20s %10d\n",
                          "Beacon avg rssi", tgt_stats->cs_ave_beacon_rssi);
+        len += scnprintf(buf + len, buf_len - len, "%20s %10d\n",
+                         "ARP pkt received", tgt_stats->arp_received);
+        len += scnprintf(buf + len, buf_len - len, "%20s %10d\n",
+                         "ARP pkt matched", tgt_stats->arp_matched);
+        len += scnprintf(buf + len, buf_len - len, "%20s %10d\n",
+                         "ARP pkt replied", tgt_stats->arp_replied);
 
         if (len > buf_len)
                 len = buf_len;
diff --git a/drivers/net/wireless/ath/ath6kl/debug.h b/drivers/net/wireless/ath/ath6kl/debug.h
index 1803a0baae82..49639d8266c2 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.h
+++ b/drivers/net/wireless/ath/ath6kl/debug.h
@@ -43,6 +43,7 @@ enum ATH6K_DEBUG_MASK {
         ATH6KL_DBG_WMI_DUMP     = BIT(19),
         ATH6KL_DBG_SUSPEND      = BIT(20),
         ATH6KL_DBG_USB          = BIT(21),
+        ATH6KL_DBG_USB_BULK     = BIT(22),
         ATH6KL_DBG_ANY          = 0xffffffff  /* enable all logs */
 };
 
diff --git a/drivers/net/wireless/ath/ath6kl/hif-ops.h b/drivers/net/wireless/ath/ath6kl/hif-ops.h
index fd84086638e3..8c9e72d5250d 100644
--- a/drivers/net/wireless/ath/ath6kl/hif-ops.h
+++ b/drivers/net/wireless/ath/ath6kl/hif-ops.h
@@ -150,4 +150,38 @@ static inline void ath6kl_hif_stop(struct ath6kl *ar)
         ar->hif_ops->stop(ar);
 }
 
+static inline int ath6kl_hif_pipe_send(struct ath6kl *ar,
+                                       u8 pipe, struct sk_buff *hdr_buf,
+                                       struct sk_buff *buf)
+{
+        ath6kl_dbg(ATH6KL_DBG_HIF, "hif pipe send\n");
+
+        return ar->hif_ops->pipe_send(ar, pipe, hdr_buf, buf);
+}
+
+static inline void ath6kl_hif_pipe_get_default(struct ath6kl *ar,
+                                               u8 *ul_pipe, u8 *dl_pipe)
+{
+        ath6kl_dbg(ATH6KL_DBG_HIF, "hif pipe get default\n");
+
+        ar->hif_ops->pipe_get_default(ar, ul_pipe, dl_pipe);
+}
+
+static inline int ath6kl_hif_pipe_map_service(struct ath6kl *ar,
+                                              u16 service_id, u8 *ul_pipe,
+                                              u8 *dl_pipe)
+{
+        ath6kl_dbg(ATH6KL_DBG_HIF, "hif pipe get default\n");
+
+        return ar->hif_ops->pipe_map_service(ar, service_id, ul_pipe, dl_pipe);
+}
+
+static inline u16 ath6kl_hif_pipe_get_free_queue_number(struct ath6kl *ar,
+                                                        u8 pipe)
+{
+        ath6kl_dbg(ATH6KL_DBG_HIF, "hif pipe get free queue number\n");
+
+        return ar->hif_ops->pipe_get_free_queue_number(ar, pipe);
+}
+
 #endif
diff --git a/drivers/net/wireless/ath/ath6kl/hif.h b/drivers/net/wireless/ath/ath6kl/hif.h
index 20ed6b73517b..61f6b21fb0ae 100644
--- a/drivers/net/wireless/ath/ath6kl/hif.h
+++ b/drivers/net/wireless/ath/ath6kl/hif.h
@@ -256,6 +256,12 @@ struct ath6kl_hif_ops {
         int (*power_on)(struct ath6kl *ar);
         int (*power_off)(struct ath6kl *ar);
         void (*stop)(struct ath6kl *ar);
+        int (*pipe_send)(struct ath6kl *ar, u8 pipe, struct sk_buff *hdr_buf,
+                         struct sk_buff *buf);
+        void (*pipe_get_default)(struct ath6kl *ar, u8 *pipe_ul, u8 *pipe_dl);
+        int (*pipe_map_service)(struct ath6kl *ar, u16 service_id, u8 *pipe_ul,
+                                u8 *pipe_dl);
+        u16 (*pipe_get_free_queue_number)(struct ath6kl *ar, u8 pipe);
 };
 
 int ath6kl_hif_setup(struct ath6kl_device *dev);
diff --git a/drivers/net/wireless/ath/ath6kl/htc-ops.h b/drivers/net/wireless/ath/ath6kl/htc-ops.h
new file mode 100644
index 000000000000..2d4eed55cfd1
--- /dev/null
+++ b/drivers/net/wireless/ath/ath6kl/htc-ops.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2004-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HTC_OPS_H
+#define HTC_OPS_H
+
+#include "htc.h"
+#include "debug.h"
+
+static inline void *ath6kl_htc_create(struct ath6kl *ar)
+{
+        return ar->htc_ops->create(ar);
+}
+
+static inline int ath6kl_htc_wait_target(struct htc_target *target)
+{
+        return target->dev->ar->htc_ops->wait_target(target);
+}
+
+static inline int ath6kl_htc_start(struct htc_target *target)
+{
+        return target->dev->ar->htc_ops->start(target);
+}
+
+static inline int ath6kl_htc_conn_service(struct htc_target *target,
+                                          struct htc_service_connect_req *req,
+                                          struct htc_service_connect_resp *resp)
+{
+        return target->dev->ar->htc_ops->conn_service(target, req, resp);
+}
+
+static inline int ath6kl_htc_tx(struct htc_target *target,
+                                struct htc_packet *packet)
+{
+        return target->dev->ar->htc_ops->tx(target, packet);
+}
+
+static inline void ath6kl_htc_stop(struct htc_target *target)
+{
+        return target->dev->ar->htc_ops->stop(target);
+}
+
+static inline void ath6kl_htc_cleanup(struct htc_target *target)
+{
+        return target->dev->ar->htc_ops->cleanup(target);
+}
+
+static inline void ath6kl_htc_flush_txep(struct htc_target *target,
+                                         enum htc_endpoint_id endpoint,
+                                         u16 tag)
+{
+        return target->dev->ar->htc_ops->flush_txep(target, endpoint, tag);
+}
+
+static inline void ath6kl_htc_flush_rx_buf(struct htc_target *target)
+{
+        return target->dev->ar->htc_ops->flush_rx_buf(target);
+}
+
+static inline void ath6kl_htc_activity_changed(struct htc_target *target,
+                                               enum htc_endpoint_id endpoint,
+                                               bool active)
+{
+        return target->dev->ar->htc_ops->activity_changed(target, endpoint,
+                                                          active);
+}
+
+static inline int ath6kl_htc_get_rxbuf_num(struct htc_target *target,
+                                           enum htc_endpoint_id endpoint)
+{
+        return target->dev->ar->htc_ops->get_rxbuf_num(target, endpoint);
+}
+
+static inline int ath6kl_htc_add_rxbuf_multiple(struct htc_target *target,
+                                                struct list_head *pktq)
+{
+        return target->dev->ar->htc_ops->add_rxbuf_multiple(target, pktq);
+}
+
+static inline int ath6kl_htc_credit_setup(struct htc_target *target,
+                                          struct ath6kl_htc_credit_info *info)
+{
+        return target->dev->ar->htc_ops->credit_setup(target, info);
+}
+
+static inline void ath6kl_htc_tx_complete(struct ath6kl *ar,
+                                          struct sk_buff *skb)
+{
+        ar->htc_ops->tx_complete(ar, skb);
+}
+
+
+static inline void ath6kl_htc_rx_complete(struct ath6kl *ar,
+                                          struct sk_buff *skb, u8 pipe)
+{
+        ar->htc_ops->rx_complete(ar, skb, pipe);
+}
+
+
+#endif
diff --git a/drivers/net/wireless/ath/ath6kl/htc.h b/drivers/net/wireless/ath/ath6kl/htc.h
index 5027ccc36b62..a2c8ff809793 100644
--- a/drivers/net/wireless/ath/ath6kl/htc.h
+++ b/drivers/net/wireless/ath/ath6kl/htc.h
@@ -25,6 +25,7 @@
 /* send direction */
 #define HTC_FLAGS_NEED_CREDIT_UPDATE (1 << 0)
 #define HTC_FLAGS_SEND_BUNDLE        (1 << 1)
+#define HTC_FLAGS_TX_FIXUP_NETBUF    (1 << 2)
 
 /* receive direction */
 #define HTC_FLG_RX_UNUSED        (1 << 0)
@@ -56,6 +57,10 @@
 #define HTC_CONN_FLGS_THRESH_LVL_THREE_QUAT     0x2
 #define HTC_CONN_FLGS_REDUCE_CRED_DRIB          0x4
 #define HTC_CONN_FLGS_THRESH_MASK               0x3
+/* disable credit flow control on a specific service */
+#define HTC_CONN_FLGS_DISABLE_CRED_FLOW_CTRL          (1 << 3)
+#define HTC_CONN_FLGS_SET_RECV_ALLOC_SHIFT    8
+#define HTC_CONN_FLGS_SET_RECV_ALLOC_MASK     0xFF00
 
 /* connect response status codes */
 #define HTC_SERVICE_SUCCESS      0
@@ -75,6 +80,7 @@
 #define HTC_RECORD_LOOKAHEAD_BUNDLE 3
 
 #define HTC_SETUP_COMP_FLG_RX_BNDL_EN     (1 << 0)
+#define HTC_SETUP_COMP_FLG_DISABLE_TX_CREDIT_FLOW (1 << 1)
 
 #define MAKE_SERVICE_ID(group, index) \
         (int)(((int)group << 8) | (int)(index))
@@ -109,6 +115,8 @@
 
 /* HTC operational parameters */
 #define HTC_TARGET_RESPONSE_TIMEOUT        2000 /* in ms */
+#define HTC_TARGET_RESPONSE_POLL_WAIT      10
+#define HTC_TARGET_RESPONSE_POLL_COUNT     200
 #define HTC_TARGET_DEBUG_INTR_MASK         0x01
 #define HTC_TARGET_CREDIT_INTR_MASK        0xF0
 
@@ -128,6 +136,7 @@
 
 #define HTC_RECV_WAIT_BUFFERS        (1 << 0)
 #define HTC_OP_STATE_STOPPING        (1 << 0)
+#define HTC_OP_STATE_SETUP_COMPLETE  (1 << 1)
 
 /*
  * The frame header length and message formats defined herein were selected
@@ -311,6 +320,14 @@ struct htc_packet {
 
         void (*completion) (struct htc_target *, struct htc_packet *);
         struct htc_target *context;
+
+        /*
+         * optimization for network-oriented data, the HTC packet
+         * can pass the network buffer corresponding to the HTC packet
+         * lower layers may optimized the transfer knowing this is
+         * a network buffer
+         */
+        struct sk_buff *skb;
 };
 
 enum htc_send_full_action {
@@ -319,12 +336,14 @@ enum htc_send_full_action {
 };
 
 struct htc_ep_callbacks {
+        void (*tx_complete) (struct htc_target *, struct htc_packet *);
         void (*rx) (struct htc_target *, struct htc_packet *);
         void (*rx_refill) (struct htc_target *, enum htc_endpoint_id endpoint);
         enum htc_send_full_action (*tx_full) (struct htc_target *,
                                               struct htc_packet *);
         struct htc_packet *(*rx_allocthresh) (struct htc_target *,
                                               enum htc_endpoint_id, int);
+        void (*tx_comp_multi) (struct htc_target *, struct list_head *);
         int rx_alloc_thresh;
         int rx_refill_thresh;
 };
@@ -502,6 +521,13 @@ struct htc_endpoint {
         u32 conn_flags;
         struct htc_endpoint_stats ep_st;
         u16 tx_drop_packet_threshold;
+
+        struct {
+                u8 pipeid_ul;
+                u8 pipeid_dl;
+                struct list_head tx_lookup_queue;
+                bool tx_credit_flow_enabled;
+        } pipe;
 };
 
 struct htc_control_buffer {
@@ -509,6 +535,42 @@ struct htc_control_buffer {
         u8 *buf;
 };
 
+struct htc_pipe_txcredit_alloc {
+        u16 service_id;
+        u8 credit_alloc;
+};
+
+enum htc_send_queue_result {
+        HTC_SEND_QUEUE_OK = 0,  /* packet was queued */
+        HTC_SEND_QUEUE_DROP = 1,        /* this packet should be dropped */
+};
+
+struct ath6kl_htc_ops {
+        void* (*create)(struct ath6kl *ar);
+        int (*wait_target)(struct htc_target *target);
+        int (*start)(struct htc_target *target);
+        int (*conn_service)(struct htc_target *target,
+                            struct htc_service_connect_req *req,
+                            struct htc_service_connect_resp *resp);
+        int  (*tx)(struct htc_target *target, struct htc_packet *packet);
+        void (*stop)(struct htc_target *target);
+        void (*cleanup)(struct htc_target *target);
+        void (*flush_txep)(struct htc_target *target,
+                           enum htc_endpoint_id endpoint, u16 tag);
+        void (*flush_rx_buf)(struct htc_target *target);
+        void (*activity_changed)(struct htc_target *target,
+                                 enum htc_endpoint_id endpoint,
+                                 bool active);
+        int (*get_rxbuf_num)(struct htc_target *target,
+                             enum htc_endpoint_id endpoint);
+        int (*add_rxbuf_multiple)(struct htc_target *target,
+                                  struct list_head *pktq);
+        int (*credit_setup)(struct htc_target *target,
+                            struct ath6kl_htc_credit_info *cred_info);
+        int (*tx_complete)(struct ath6kl *ar, struct sk_buff *skb);
+        int (*rx_complete)(struct ath6kl *ar, struct sk_buff *skb, u8 pipe);
+};
+
 struct ath6kl_device;
 
 /* our HTC target state */
@@ -557,36 +619,19 @@ struct htc_target {
 
         /* counts the number of Tx without bundling continously per AC */
         u32 ac_tx_count[WMM_NUM_AC];
+
+        struct {
+                struct htc_packet *htc_packet_pool;
+                u8 ctrl_response_buf[HTC_MAX_CTRL_MSG_LEN];
+                int ctrl_response_len;
+                bool ctrl_response_valid;
+                struct htc_pipe_txcredit_alloc txcredit_alloc[ENDPOINT_MAX];
+        } pipe;
 };
 
-void *ath6kl_htc_create(struct ath6kl *ar);
-void ath6kl_htc_set_credit_dist(struct htc_target *target,
-                                struct ath6kl_htc_credit_info *cred_info,
-                                u16 svc_pri_order[], int len);
-int ath6kl_htc_wait_target(struct htc_target *target);
-int ath6kl_htc_start(struct htc_target *target);
-int ath6kl_htc_conn_service(struct htc_target *target,
-                            struct htc_service_connect_req *req,
-                            struct htc_service_connect_resp *resp);
-int ath6kl_htc_tx(struct htc_target *target, struct htc_packet *packet);
-void ath6kl_htc_stop(struct htc_target *target);
-void ath6kl_htc_cleanup(struct htc_target *target);
-void ath6kl_htc_flush_txep(struct htc_target *target,
-                           enum htc_endpoint_id endpoint, u16 tag);
-void ath6kl_htc_flush_rx_buf(struct htc_target *target);
-void ath6kl_htc_indicate_activity_change(struct htc_target *target,
-                                         enum htc_endpoint_id endpoint,
-                                         bool active);
-int ath6kl_htc_get_rxbuf_num(struct htc_target *target,
-                             enum htc_endpoint_id endpoint);
-int ath6kl_htc_add_rxbuf_multiple(struct htc_target *target,
-                                  struct list_head *pktq);
 int ath6kl_htc_rxmsg_pending_handler(struct htc_target *target,
                                      u32 msg_look_ahead, int *n_pkts);
 
-int ath6kl_credit_setup(void *htc_handle,
-                        struct ath6kl_htc_credit_info *cred_info);
-
 static inline void set_htc_pkt_info(struct htc_packet *packet, void *context,
                                     u8 *buf, unsigned int len,
                                     enum htc_endpoint_id eid, u16 tag)
@@ -626,4 +671,7 @@ static inline int get_queue_depth(struct list_head *queue)
         return depth;
 }
 
+void ath6kl_htc_pipe_attach(struct ath6kl *ar);
+void ath6kl_htc_mbox_attach(struct ath6kl *ar);
+
 #endif
diff --git a/drivers/net/wireless/ath/ath6kl/htc.c b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
index 4849d99cce77..065e61516d7a 100644
--- a/drivers/net/wireless/ath/ath6kl/htc.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
@@ -23,6 +23,14 @@
 
 #define CALC_TXRX_PADDED_LEN(dev, len)  (__ALIGN_MASK((len), (dev)->block_mask))
 
+static void ath6kl_htc_mbox_cleanup(struct htc_target *target);
+static void ath6kl_htc_mbox_stop(struct htc_target *target);
+static int ath6kl_htc_mbox_add_rxbuf_multiple(struct htc_target *target,
+                                              struct list_head *pkt_queue);
+static void ath6kl_htc_set_credit_dist(struct htc_target *target,
+                                       struct ath6kl_htc_credit_info *cred_info,
+                                       u16 svc_pri_order[], int len);
+
 /* threshold to re-enable Tx bundling for an AC*/
 #define TX_RESUME_BUNDLE_THRESHOLD      1500
 
@@ -130,8 +138,8 @@ static void ath6kl_credit_init(struct ath6kl_htc_credit_info *cred_info,
 }
 
 /* initialize and setup credit distribution */
-int ath6kl_credit_setup(void *htc_handle,
-                        struct ath6kl_htc_credit_info *cred_info)
+static int ath6kl_htc_mbox_credit_setup(struct htc_target *htc_target,
+                               struct ath6kl_htc_credit_info *cred_info)
 {
         u16 servicepriority[5];
 
@@ -144,7 +152,7 @@ int ath6kl_credit_setup(void *htc_handle,
         servicepriority[4] = WMI_DATA_BK_SVC; /* lowest */
 
         /* set priority list */
-        ath6kl_htc_set_credit_dist(htc_handle, cred_info, servicepriority, 5);
+        ath6kl_htc_set_credit_dist(htc_target, cred_info, servicepriority, 5);
 
         return 0;
 }
@@ -432,7 +440,7 @@ static void htc_tx_complete(struct htc_endpoint *endpoint,
                    "htc tx complete ep %d pkts %d\n",
                    endpoint->eid, get_queue_depth(txq));
 
-        ath6kl_tx_complete(endpoint->target->dev->ar, txq);
+        ath6kl_tx_complete(endpoint->target, txq);
 }
 
 static void htc_tx_comp_handler(struct htc_target *target,
@@ -1065,7 +1073,7 @@ static int htc_setup_tx_complete(struct htc_target *target)
         return status;
 }
 
-void ath6kl_htc_set_credit_dist(struct htc_target *target,
+static void ath6kl_htc_set_credit_dist(struct htc_target *target,
                                 struct ath6kl_htc_credit_info *credit_info,
                                 u16 srvc_pri_order[], int list_len)
 {
@@ -1093,7 +1101,8 @@ void ath6kl_htc_set_credit_dist(struct htc_target *target,
         }
 }
 
-int ath6kl_htc_tx(struct htc_target *target, struct htc_packet *packet)
+static int ath6kl_htc_mbox_tx(struct htc_target *target,
+                              struct htc_packet *packet)
 {
         struct htc_endpoint *endpoint;
         struct list_head queue;
@@ -1121,7 +1130,7 @@ int ath6kl_htc_tx(struct htc_target *target, struct htc_packet *packet)
 }
 
 /* flush endpoint TX queue */
-void ath6kl_htc_flush_txep(struct htc_target *target,
+static void ath6kl_htc_mbox_flush_txep(struct htc_target *target,
                            enum htc_endpoint_id eid, u16 tag)
 {
         struct htc_packet *packet, *tmp_pkt;
@@ -1173,12 +1182,13 @@ static void ath6kl_htc_flush_txep_all(struct htc_target *target)
                 if (endpoint->svc_id == 0)
                         /* not in use.. */
                         continue;
-                ath6kl_htc_flush_txep(target, i, HTC_TX_PACKET_TAG_ALL);
+                ath6kl_htc_mbox_flush_txep(target, i, HTC_TX_PACKET_TAG_ALL);
         }
 }
 
-void ath6kl_htc_indicate_activity_change(struct htc_target *target,
-                                         enum htc_endpoint_id eid, bool active)
+static void ath6kl_htc_mbox_activity_changed(struct htc_target *target,
+                                             enum htc_endpoint_id eid,
+                                             bool active)
 {
         struct htc_endpoint *endpoint = &target->endpoint[eid];
         bool dist = false;
@@ -1246,7 +1256,7 @@ static int htc_add_rxbuf(struct htc_target *target, struct htc_packet *packet)
 
         INIT_LIST_HEAD(&queue);
         list_add_tail(&packet->list, &queue);
-        return ath6kl_htc_add_rxbuf_multiple(target, &queue);
+        return ath6kl_htc_mbox_add_rxbuf_multiple(target, &queue);
 }
 
 static void htc_reclaim_rxbuf(struct htc_target *target,
@@ -1353,7 +1363,9 @@ static int ath6kl_htc_rx_setup(struct htc_target *target,
                                         sizeof(*htc_hdr));
 
         if (!htc_valid_rx_frame_len(target, ep->eid, full_len)) {
-                ath6kl_warn("Rx buffer requested with invalid length\n");
+                ath6kl_warn("Rx buffer requested with invalid length htc_hdr:eid %d, flags 0x%x, len %d\n",
+                            htc_hdr->eid, htc_hdr->flags,
+                            le16_to_cpu(htc_hdr->payld_len));
                 return -EINVAL;
         }
 
@@ -2288,7 +2300,7 @@ fail_ctrl_rx:
         return NULL;
 }
 
-int ath6kl_htc_add_rxbuf_multiple(struct htc_target *target,
+static int ath6kl_htc_mbox_add_rxbuf_multiple(struct htc_target *target,
                                   struct list_head *pkt_queue)
 {
         struct htc_endpoint *endpoint;
@@ -2350,7 +2362,7 @@ int ath6kl_htc_add_rxbuf_multiple(struct htc_target *target,
         return status;
 }
 
-void ath6kl_htc_flush_rx_buf(struct htc_target *target)
+static void ath6kl_htc_mbox_flush_rx_buf(struct htc_target *target)
 {
         struct htc_endpoint *endpoint;
         struct htc_packet *packet, *tmp_pkt;
@@ -2392,7 +2404,7 @@ void ath6kl_htc_flush_rx_buf(struct htc_target *target)
         }
 }
 
-int ath6kl_htc_conn_service(struct htc_target *target,
+static int ath6kl_htc_mbox_conn_service(struct htc_target *target,
                             struct htc_service_connect_req *conn_req,
                             struct htc_service_connect_resp *conn_resp)
 {
@@ -2564,7 +2576,7 @@ static void reset_ep_state(struct htc_target *target)
         INIT_LIST_HEAD(&target->cred_dist_list);
 }
 
-int ath6kl_htc_get_rxbuf_num(struct htc_target *target,
+static int ath6kl_htc_mbox_get_rxbuf_num(struct htc_target *target,
                              enum htc_endpoint_id endpoint)
 {
         int num;
@@ -2624,7 +2636,7 @@ static void htc_setup_msg_bndl(struct htc_target *target)
         }
 }
 
-int ath6kl_htc_wait_target(struct htc_target *target)
+static int ath6kl_htc_mbox_wait_target(struct htc_target *target)
 {
         struct htc_packet *packet = NULL;
         struct htc_ready_ext_msg *rdy_msg;
@@ -2693,12 +2705,12 @@ int ath6kl_htc_wait_target(struct htc_target *target)
         connect.svc_id = HTC_CTRL_RSVD_SVC;
 
         /* connect fake service */
-        status = ath6kl_htc_conn_service((void *)target, &connect, &resp);
+        status = ath6kl_htc_mbox_conn_service((void *)target, &connect, &resp);
 
         if (status)
                 /*
                  * FIXME: this call doesn't make sense, the caller should
-                 * call ath6kl_htc_cleanup() when it wants remove htc
+                 * call ath6kl_htc_mbox_cleanup() when it wants remove htc
                  */
                 ath6kl_hif_cleanup_scatter(target->dev->ar);
 
@@ -2715,7 +2727,7 @@ fail_wait_target:
  * Start HTC, enable interrupts and let the target know
  * host has finished setup.
  */
-int ath6kl_htc_start(struct htc_target *target)
+static int ath6kl_htc_mbox_start(struct htc_target *target)
 {
         struct htc_packet *packet;
         int status;
@@ -2752,7 +2764,7 @@ int ath6kl_htc_start(struct htc_target *target)
         status = ath6kl_hif_unmask_intrs(target->dev);
 
         if (status)
-                ath6kl_htc_stop(target);
+                ath6kl_htc_mbox_stop(target);
 
         return status;
 }
@@ -2796,7 +2808,7 @@ static int ath6kl_htc_reset(struct htc_target *target)
 }
 
 /* htc_stop: stop interrupt reception, and flush all queued buffers */
-void ath6kl_htc_stop(struct htc_target *target)
+static void ath6kl_htc_mbox_stop(struct htc_target *target)
 {
         spin_lock_bh(&target->htc_lock);
         target->htc_flags |= HTC_OP_STATE_STOPPING;
@@ -2811,12 +2823,12 @@ void ath6kl_htc_stop(struct htc_target *target)
 
         ath6kl_htc_flush_txep_all(target);
 
-        ath6kl_htc_flush_rx_buf(target);
+        ath6kl_htc_mbox_flush_rx_buf(target);
 
         ath6kl_htc_reset(target);
 }
 
-void *ath6kl_htc_create(struct ath6kl *ar)
+static void *ath6kl_htc_mbox_create(struct ath6kl *ar)
 {
         struct htc_target *target = NULL;
         int status = 0;
@@ -2857,13 +2869,13 @@ void *ath6kl_htc_create(struct ath6kl *ar)
         return target;
 
 err_htc_cleanup:
-        ath6kl_htc_cleanup(target);
+        ath6kl_htc_mbox_cleanup(target);
 
         return NULL;
 }
 
 /* cleanup the HTC instance */
-void ath6kl_htc_cleanup(struct htc_target *target)
+static void ath6kl_htc_mbox_cleanup(struct htc_target *target)
 {
         struct htc_packet *packet, *tmp_packet;
 
@@ -2888,3 +2900,24 @@ void ath6kl_htc_cleanup(struct htc_target *target)
         kfree(target->dev);
         kfree(target);
 }
+
+static const struct ath6kl_htc_ops ath6kl_htc_mbox_ops = {
+        .create = ath6kl_htc_mbox_create,
+        .wait_target = ath6kl_htc_mbox_wait_target,
+        .start = ath6kl_htc_mbox_start,
+        .conn_service = ath6kl_htc_mbox_conn_service,
+        .tx = ath6kl_htc_mbox_tx,
+        .stop = ath6kl_htc_mbox_stop,
+        .cleanup = ath6kl_htc_mbox_cleanup,
+        .flush_txep = ath6kl_htc_mbox_flush_txep,
+        .flush_rx_buf = ath6kl_htc_mbox_flush_rx_buf,
+        .activity_changed = ath6kl_htc_mbox_activity_changed,
+        .get_rxbuf_num = ath6kl_htc_mbox_get_rxbuf_num,
+        .add_rxbuf_multiple = ath6kl_htc_mbox_add_rxbuf_multiple,
+        .credit_setup = ath6kl_htc_mbox_credit_setup,
+};
+
+void ath6kl_htc_mbox_attach(struct ath6kl *ar)
+{
+        ar->htc_ops = &ath6kl_htc_mbox_ops;
+}
diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
new file mode 100644
index 000000000000..b277b3446882
--- /dev/null
+++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
@@ -0,0 +1,1713 @@
+/*
+ * Copyright (c) 2007-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "core.h"
+#include "debug.h"
+#include "hif-ops.h"
+
+#define HTC_PACKET_CONTAINER_ALLOCATION 32
+#define HTC_CONTROL_BUFFER_SIZE (HTC_MAX_CTRL_MSG_LEN + HTC_HDR_LENGTH)
+
+static int ath6kl_htc_pipe_tx(struct htc_target *handle,
+                              struct htc_packet *packet);
+static void ath6kl_htc_pipe_cleanup(struct htc_target *handle);
+
+/* htc pipe tx path */
+static inline void restore_tx_packet(struct htc_packet *packet)
+{
+        if (packet->info.tx.flags & HTC_FLAGS_TX_FIXUP_NETBUF) {
+                skb_pull(packet->skb, sizeof(struct htc_frame_hdr));
+                packet->info.tx.flags &= ~HTC_FLAGS_TX_FIXUP_NETBUF;
+        }
+}
+
+static void do_send_completion(struct htc_endpoint *ep,
+                               struct list_head *queue_to_indicate)
+{
+        struct htc_packet *packet;
+
+        if (list_empty(queue_to_indicate)) {
+                /* nothing to indicate */
+                return;
+        }
+
+        if (ep->ep_cb.tx_comp_multi != NULL) {
+                ath6kl_dbg(ATH6KL_DBG_HTC,
+                           "%s: calling ep %d, send complete multiple callback (%d pkts)\n",
+                           __func__, ep->eid,
+                           get_queue_depth(queue_to_indicate));
+                /*
+                 * a multiple send complete handler is being used,
+                 * pass the queue to the handler
+                 */
+                ep->ep_cb.tx_comp_multi(ep->target, queue_to_indicate);
+                /*
+                 * all packets are now owned by the callback,
+                 * reset queue to be safe
+                 */
+                INIT_LIST_HEAD(queue_to_indicate);
+        } else {
+                /* using legacy EpTxComplete */
+                do {
+                        packet = list_first_entry(queue_to_indicate,
+                                                  struct htc_packet, list);
+
+                        list_del(&packet->list);
+                        ath6kl_dbg(ATH6KL_DBG_HTC,
+                                   "%s: calling ep %d send complete callback on packet 0x%p\n",
+                                   __func__, ep->eid, packet);
+                        ep->ep_cb.tx_complete(ep->target, packet);
+                } while (!list_empty(queue_to_indicate));
+        }
+}
+
+static void send_packet_completion(struct htc_target *target,
+                                   struct htc_packet *packet)
+{
+        struct htc_endpoint *ep = &target->endpoint[packet->endpoint];
+        struct list_head container;
+
+        restore_tx_packet(packet);
+        INIT_LIST_HEAD(&container);
+        list_add_tail(&packet->list, &container);
+
+        /* do completion */
+        do_send_completion(ep, &container);
+}
+
+static void get_htc_packet_credit_based(struct htc_target *target,
+                                        struct htc_endpoint *ep,
+                                        struct list_head *queue)
+{
+        int credits_required;
+        int remainder;
+        u8 send_flags;
+        struct htc_packet *packet;
+        unsigned int transfer_len;
+
+        /* NOTE : the TX lock is held when this function is called */
+
+        /* loop until we can grab as many packets out of the queue as we can */
+        while (true) {
+                send_flags = 0;
+                if (list_empty(&ep->txq))
+                        break;
+
+                /* get packet at head, but don't remove it */
+                packet = list_first_entry(&ep->txq, struct htc_packet, list);
+                if (packet == NULL)
+                        break;
+
+                ath6kl_dbg(ATH6KL_DBG_HTC,
+                           "%s: got head packet:0x%p , queue depth: %d\n",
+                           __func__, packet, get_queue_depth(&ep->txq));
+
+                transfer_len = packet->act_len + HTC_HDR_LENGTH;
+
+                if (transfer_len <= target->tgt_cred_sz) {
+                        credits_required = 1;
+                } else {
+                        /* figure out how many credits this message requires */
+                        credits_required = transfer_len / target->tgt_cred_sz;
+                        remainder = transfer_len % target->tgt_cred_sz;
+
+                        if (remainder)
+                                credits_required++;
+                }
+
+                ath6kl_dbg(ATH6KL_DBG_HTC, "%s: creds required:%d got:%d\n",
+                           __func__, credits_required, ep->cred_dist.credits);
+
+                if (ep->eid == ENDPOINT_0) {
+                        /*
+                         * endpoint 0 is special, it always has a credit and
+                         * does not require credit based flow control
+                         */
+                        credits_required = 0;
+
+                } else {
+
+                        if (ep->cred_dist.credits < credits_required)
+                                break;
+
+                        ep->cred_dist.credits -= credits_required;
+                        ep->ep_st.cred_cosumd += credits_required;
+
+                        /* check if we need credits back from the target */
+                        if (ep->cred_dist.credits <
+                                        ep->cred_dist.cred_per_msg) {
+                                /* tell the target we need credits ASAP! */
+                                send_flags |= HTC_FLAGS_NEED_CREDIT_UPDATE;
+                                ep->ep_st.cred_low_indicate += 1;
+                                ath6kl_dbg(ATH6KL_DBG_HTC,
+                                           "%s: host needs credits\n",
+                                           __func__);
+                        }
+                }
+
+                /* now we can fully dequeue */
+                packet = list_first_entry(&ep->txq, struct htc_packet, list);
+
+                list_del(&packet->list);
+                /* save the number of credits this packet consumed */
+                packet->info.tx.cred_used = credits_required;
+                /* save send flags */
+                packet->info.tx.flags = send_flags;
+                packet->info.tx.seqno = ep->seqno;
+                ep->seqno++;
+                /* queue this packet into the caller's queue */
+                list_add_tail(&packet->list, queue);
+        }
+
+}
+
+static void get_htc_packet(struct htc_target *target,
+                           struct htc_endpoint *ep,
+                           struct list_head *queue, int resources)
+{
+        struct htc_packet *packet;
+
+        /* NOTE : the TX lock is held when this function is called */
+
+        /* loop until we can grab as many packets out of the queue as we can */
+        while (resources) {
+                if (list_empty(&ep->txq))
+                        break;
+
+                packet = list_first_entry(&ep->txq, struct htc_packet, list);
+                list_del(&packet->list);
+
+                ath6kl_dbg(ATH6KL_DBG_HTC,
+                           "%s: got packet:0x%p , new queue depth: %d\n",
+                           __func__, packet, get_queue_depth(&ep->txq));
+                packet->info.tx.seqno = ep->seqno;
+                packet->info.tx.flags = 0;
+                packet->info.tx.cred_used = 0;
+                ep->seqno++;
+
+                /* queue this packet into the caller's queue */
+                list_add_tail(&packet->list, queue);
+                resources--;
+        }
+}
+
+static int htc_issue_packets(struct htc_target *target,
+                             struct htc_endpoint *ep,
+                             struct list_head *pkt_queue)
+{
+        int status = 0;
+        u16 payload_len;
+        struct sk_buff *skb;
+        struct htc_frame_hdr *htc_hdr;
+        struct htc_packet *packet;
+
+        ath6kl_dbg(ATH6KL_DBG_HTC,
+                   "%s: queue: 0x%p, pkts %d\n", __func__,
+                   pkt_queue, get_queue_depth(pkt_queue));
+
+        while (!list_empty(pkt_queue)) {
+                packet = list_first_entry(pkt_queue, struct htc_packet, list);
+                list_del(&packet->list);
+
+                skb = packet->skb;
+                if (!skb) {
+                        WARN_ON_ONCE(1);
+                        status = -EINVAL;
+                        break;
+                }
+
+                payload_len = packet->act_len;
+
+                /* setup HTC frame header */
+                htc_hdr = (struct htc_frame_hdr *) skb_push(skb,
+                                                            sizeof(*htc_hdr));
+                if (!htc_hdr) {
+                        WARN_ON_ONCE(1);
+                        status = -EINVAL;
+                        break;
+                }
+
+                packet->info.tx.flags |= HTC_FLAGS_TX_FIXUP_NETBUF;
+
+                /* Endianess? */
+                put_unaligned((u16) payload_len, &htc_hdr->payld_len);
+                htc_hdr->flags = packet->info.tx.flags;
+                htc_hdr->eid = (u8) packet->endpoint;
+                htc_hdr->ctrl[0] = 0;
+                htc_hdr->ctrl[1] = (u8) packet->info.tx.seqno;
+
+                spin_lock_bh(&target->tx_lock);
+
+                /* store in look up queue to match completions */
+                list_add_tail(&packet->list, &ep->pipe.tx_lookup_queue);
+                ep->ep_st.tx_issued += 1;
+                spin_unlock_bh(&target->tx_lock);
+
+                status = ath6kl_hif_pipe_send(target->dev->ar,
+                                              ep->pipe.pipeid_ul, NULL, skb);
+
+                if (status != 0) {
+                        if (status != -ENOMEM) {
+                                /* TODO: if more than 1 endpoint maps to the
+                                 * same PipeID, it is possible to run out of
+                                 * resources in the HIF layer.
+                                 * Don't emit the error
+                                 */
+                                ath6kl_dbg(ATH6KL_DBG_HTC,
+                                           "%s: failed status:%d\n",
+                                           __func__, status);
+                        }
+                        spin_lock_bh(&target->tx_lock);
+                        list_del(&packet->list);
+
+                        /* reclaim credits */
+                        ep->cred_dist.credits += packet->info.tx.cred_used;
+                        spin_unlock_bh(&target->tx_lock);
+
+                        /* put it back into the callers queue */
+                        list_add(&packet->list, pkt_queue);
+                        break;
+                }
+
+        }
+
+        if (status != 0) {
+                while (!list_empty(pkt_queue)) {
+                        if (status != -ENOMEM) {
+                                ath6kl_dbg(ATH6KL_DBG_HTC,
+                                           "%s: failed pkt:0x%p status:%d\n",
+                                           __func__, packet, status);
+                        }
+
+                        packet = list_first_entry(pkt_queue,
+                                                  struct htc_packet, list);
+                        list_del(&packet->list);
+                        packet->status = status;
+                        send_packet_completion(target, packet);
+                }
+        }
+
+        return status;
+}
+
+static enum htc_send_queue_result htc_try_send(struct htc_target *target,
+                                               struct htc_endpoint *ep,
+                                               struct list_head *txq)
+{
+        struct list_head send_queue;    /* temp queue to hold packets */
+        struct htc_packet *packet, *tmp_pkt;
+        struct ath6kl *ar = target->dev->ar;
+        enum htc_send_full_action action;
+        int tx_resources, overflow, txqueue_depth, i, good_pkts;
+        u8 pipeid;
+
+        ath6kl_dbg(ATH6KL_DBG_HTC, "%s: (queue:0x%p depth:%d)\n",
+                   __func__, txq,
+                   (txq == NULL) ? 0 : get_queue_depth(txq));
+
+        /* init the local send queue */
+        INIT_LIST_HEAD(&send_queue);
+
+        /*
+         * txq equals to NULL means
+         * caller didn't provide a queue, just wants us to
+         * check queues and send
+         */
+        if (txq != NULL) {
+                if (list_empty(txq)) {
+                        /* empty queue */
+                        return HTC_SEND_QUEUE_DROP;
+                }
+
+                spin_lock_bh(&target->tx_lock);
+                txqueue_depth = get_queue_depth(&ep->txq);
+                spin_unlock_bh(&target->tx_lock);
+
+                if (txqueue_depth >= ep->max_txq_depth) {
+                        /* we've already overflowed */
+                        overflow = get_queue_depth(txq);
+                } else {
+                        /* get how much we will overflow by */
+                        overflow = txqueue_depth;
+                        overflow += get_queue_depth(txq);
+                        /* get how much we will overflow the TX queue by */
+                        overflow -= ep->max_txq_depth;
+                }
+
+                /* if overflow is negative or zero, we are okay */
+                if (overflow > 0) {
+                        ath6kl_dbg(ATH6KL_DBG_HTC,
+                                   "%s: Endpoint %d, TX queue will overflow :%d, Tx Depth:%d, Max:%d\n",
+                                   __func__, ep->eid, overflow, txqueue_depth,
+                                   ep->max_txq_depth);
+                }
+                if ((overflow <= 0) ||
+                    (ep->ep_cb.tx_full == NULL)) {
+                        /*
+                         * all packets will fit or caller did not provide send
+                         * full indication handler -- just move all of them
+                         * to the local send_queue object
+                         */
+                        list_splice_tail_init(txq, &send_queue);
+                } else {
+                        good_pkts = get_queue_depth(txq) - overflow;
+                        if (good_pkts < 0) {
+                                WARN_ON_ONCE(1);
+                                return HTC_SEND_QUEUE_DROP;
+                        }
+
+                        /* we have overflowed, and a callback is provided */
+                        /* dequeue all non-overflow packets to the sendqueue */
+                        for (i = 0; i < good_pkts; i++) {
+                                /* pop off caller's queue */
+                                packet = list_first_entry(txq,
+                                                          struct htc_packet,
+                                                          list);
+                                list_del(&packet->list);
+                                /* insert into local queue */
+                                list_add_tail(&packet->list, &send_queue);
+                        }
+
+                        /*
+                         * the caller's queue has all the packets that won't fit
+                         * walk through the caller's queue and indicate each to
+                         * the send full handler
+                         */
+                        list_for_each_entry_safe(packet, tmp_pkt,
+                                                 txq, list) {
+
+                                ath6kl_dbg(ATH6KL_DBG_HTC,
+                                           "%s: Indicat overflowed TX pkts: %p\n",
+                                           __func__, packet);
+                                action = ep->ep_cb.tx_full(ep->target, packet);
+                                if (action == HTC_SEND_FULL_DROP) {
+                                        /* callback wants the packet dropped */
+                                        ep->ep_st.tx_dropped += 1;
+
+                                        /* leave this one in the caller's queue
+                                         * for cleanup */
+                                } else {
+                                        /* callback wants to keep this packet,
+                                         * remove from caller's queue */
+                                        list_del(&packet->list);
+                                        /* put it in the send queue */
+                                        list_add_tail(&packet->list,
+                                                      &send_queue);
+                                }
+
+                        }
+
+                        if (list_empty(&send_queue)) {
+                                /* no packets made it in, caller will cleanup */
+                                return HTC_SEND_QUEUE_DROP;
+                        }
+                }
+        }
+
+        if (!ep->pipe.tx_credit_flow_enabled) {
+                tx_resources =
+                    ath6kl_hif_pipe_get_free_queue_number(ar,
+                                                          ep->pipe.pipeid_ul);
+        } else {
+                tx_resources = 0;
+        }
+
+        spin_lock_bh(&target->tx_lock);
+        if (!list_empty(&send_queue)) {
+                /* transfer packets to tail */
+                list_splice_tail_init(&send_queue, &ep->txq);
+                if (!list_empty(&send_queue)) {
+                        WARN_ON_ONCE(1);
+                        spin_unlock_bh(&target->tx_lock);
+                        return HTC_SEND_QUEUE_DROP;
+                }
+                INIT_LIST_HEAD(&send_queue);
+        }
+
+        /* increment tx processing count on entry */
+        ep->tx_proc_cnt++;
+
+        if (ep->tx_proc_cnt > 1) {
+                /*
+                 * Another thread or task is draining the TX queues on this
+                 * endpoint that thread will reset the tx processing count
+                 * when the queue is drained.
+                 */
+                ep->tx_proc_cnt--;
+                spin_unlock_bh(&target->tx_lock);
+                return HTC_SEND_QUEUE_OK;
+        }
+
+        /***** beyond this point only 1 thread may enter ******/
+
+        /*
+         * Now drain the endpoint TX queue for transmission as long as we have
+         * enough transmit resources.
+         */
+        while (true) {
+
+                if (get_queue_depth(&ep->txq) == 0)
+                        break;
+
+                if (ep->pipe.tx_credit_flow_enabled) {
+                        /*
+                         * Credit based mechanism provides flow control
+                         * based on target transmit resource availability,
+                         * we assume that the HIF layer will always have
+                         * bus resources greater than target transmit
+                         * resources.
+                         */
+                        get_htc_packet_credit_based(target, ep, &send_queue);
+                } else {
+                        /*
+                         * Get all packets for this endpoint that we can
+                         * for this pass.
+                         */
+                        get_htc_packet(target, ep, &send_queue, tx_resources);
+                }
+
+                if (get_queue_depth(&send_queue) == 0) {
+                        /*
+                         * Didn't get packets due to out of resources or TX
+                         * queue was drained.
+                         */
+                        break;
+                }
+
+                spin_unlock_bh(&target->tx_lock);
+
+                /* send what we can */
+                htc_issue_packets(target, ep, &send_queue);
+
+                if (!ep->pipe.tx_credit_flow_enabled) {
+                        pipeid = ep->pipe.pipeid_ul;
+                        tx_resources =
+                            ath6kl_hif_pipe_get_free_queue_number(ar, pipeid);
+                }
+
+                spin_lock_bh(&target->tx_lock);
+
+        }
+        /* done with this endpoint, we can clear the count */
+        ep->tx_proc_cnt = 0;
+        spin_unlock_bh(&target->tx_lock);
+
+        return HTC_SEND_QUEUE_OK;
+}
+
+/* htc control packet manipulation */
+static void destroy_htc_txctrl_packet(struct htc_packet *packet)
+{
+        struct sk_buff *skb;
+        skb = packet->skb;
+        if (skb != NULL)
+                dev_kfree_skb(skb);
+
+        kfree(packet);
+}
+
+static struct htc_packet *build_htc_txctrl_packet(void)
+{
+        struct htc_packet *packet = NULL;
+        struct sk_buff *skb;
+
+        packet = kzalloc(sizeof(struct htc_packet), GFP_KERNEL);
+        if (packet == NULL)
+                return NULL;
+
+        skb = __dev_alloc_skb(HTC_CONTROL_BUFFER_SIZE, GFP_KERNEL);
+
+        if (skb == NULL) {
+                kfree(packet);
+                return NULL;
+        }
+        packet->skb = skb;
+
+        return packet;
+}
+
+static void htc_free_txctrl_packet(struct htc_target *target,
+                                   struct htc_packet *packet)
+{
+        destroy_htc_txctrl_packet(packet);
+}
+
+static struct htc_packet *htc_alloc_txctrl_packet(struct htc_target *target)
+{
+        return build_htc_txctrl_packet();
+}
+
+static void htc_txctrl_complete(struct htc_target *target,
+                                struct htc_packet *packet)
+{
+        htc_free_txctrl_packet(target, packet);
+}
+
+#define MAX_MESSAGE_SIZE 1536
+
+static int htc_setup_target_buffer_assignments(struct htc_target *target)
+{
+        int status, credits, credit_per_maxmsg, i;
+        struct htc_pipe_txcredit_alloc *entry;
+        unsigned int hif_usbaudioclass = 0;
+
+        credit_per_maxmsg = MAX_MESSAGE_SIZE / target->tgt_cred_sz;
+        if (MAX_MESSAGE_SIZE % target->tgt_cred_sz)
+                credit_per_maxmsg++;
+
+        /* TODO, this should be configured by the caller! */
+
+        credits = target->tgt_creds;
+        entry = &target->pipe.txcredit_alloc[0];
+
+        status = -ENOMEM;
+
+        /* FIXME: hif_usbaudioclass is always zero */
+        if (hif_usbaudioclass) {
+                ath6kl_dbg(ATH6KL_DBG_HTC,
+                           "%s: For USB Audio Class- Total:%d\n",
+                           __func__, credits);
+                entry++;
+                entry++;
+                /* Setup VO Service To have Max Credits */
+                entry->service_id = WMI_DATA_VO_SVC;
+                entry->credit_alloc = (credits - 6);
+                if (entry->credit_alloc == 0)
+                        entry->credit_alloc++;
+
+                credits -= (int) entry->credit_alloc;
+                if (credits <= 0)
+                        return status;
+
+                entry++;
+                entry->service_id = WMI_CONTROL_SVC;
+                entry->credit_alloc = credit_per_maxmsg;
+                credits -= (int) entry->credit_alloc;
+                if (credits <= 0)
+                        return status;
+
+                /* leftovers go to best effort */
+                entry++;
+                entry++;
+                entry->service_id = WMI_DATA_BE_SVC;
+                entry->credit_alloc = (u8) credits;
+                status = 0;
+        } else {
+                entry++;
+                entry->service_id = WMI_DATA_VI_SVC;
+                entry->credit_alloc = credits / 4;
+                if (entry->credit_alloc == 0)
+                        entry->credit_alloc++;
+
+                credits -= (int) entry->credit_alloc;
+                if (credits <= 0)
+                        return status;
+
+                entry++;
+                entry->service_id = WMI_DATA_VO_SVC;
+                entry->credit_alloc = credits / 4;
+                if (entry->credit_alloc == 0)
+                        entry->credit_alloc++;
+
+                credits -= (int) entry->credit_alloc;
+                if (credits <= 0)
+                        return status;
+
+                entry++;
+                entry->service_id = WMI_CONTROL_SVC;
+                entry->credit_alloc = credit_per_maxmsg;
+                credits -= (int) entry->credit_alloc;
+                if (credits <= 0)
+                        return status;
+
+                entry++;
+                entry->service_id = WMI_DATA_BK_SVC;
+                entry->credit_alloc = credit_per_maxmsg;
+                credits -= (int) entry->credit_alloc;
+                if (credits <= 0)
+                        return status;
+
+                /* leftovers go to best effort */
+                entry++;
+                entry->service_id = WMI_DATA_BE_SVC;
+                entry->credit_alloc = (u8) credits;
+                status = 0;
+        }
+
+        if (status == 0) {
+                for (i = 0; i < ENDPOINT_MAX; i++) {
+                        if (target->pipe.txcredit_alloc[i].service_id != 0) {
+                                ath6kl_dbg(ATH6KL_DBG_HTC,
+                                           "HTC Service Index : %d TX : 0x%2.2X : alloc:%d\n",
+                                           i,
+                                           target->pipe.txcredit_alloc[i].
+                                           service_id,
+                                           target->pipe.txcredit_alloc[i].
+                                           credit_alloc);
+                        }
+                }
+        }
+        return status;
+}
+
+/* process credit reports and call distribution function */
+static void htc_process_credit_report(struct htc_target *target,
+                                      struct htc_credit_report *rpt,
+                                      int num_entries,
+                                      enum htc_endpoint_id from_ep)
+{
+        int total_credits = 0, i;
+        struct htc_endpoint *ep;
+
+        /* lock out TX while we update credits */
+        spin_lock_bh(&target->tx_lock);
+
+        for (i = 0; i < num_entries; i++, rpt++) {
+                if (rpt->eid >= ENDPOINT_MAX) {
+                        WARN_ON_ONCE(1);
+                        spin_unlock_bh(&target->tx_lock);
+                        return;
+                }
+
+                ep = &target->endpoint[rpt->eid];
+                ep->cred_dist.credits += rpt->credits;
+
+                if (ep->cred_dist.credits && get_queue_depth(&ep->txq)) {
+                        spin_unlock_bh(&target->tx_lock);
+                        htc_try_send(target, ep, NULL);
+                        spin_lock_bh(&target->tx_lock);
+                }
+
+                total_credits += rpt->credits;
+        }
+        ath6kl_dbg(ATH6KL_DBG_HTC,
+                   "Report indicated %d credits to distribute\n",
+                   total_credits);
+
+        spin_unlock_bh(&target->tx_lock);
+}
+
+/* flush endpoint TX queue */
+static void htc_flush_tx_endpoint(struct htc_target *target,
+                                  struct htc_endpoint *ep, u16 tag)
+{
+        struct htc_packet *packet;
+
+        spin_lock_bh(&target->tx_lock);
+        while (get_queue_depth(&ep->txq)) {
+                packet = list_first_entry(&ep->txq, struct htc_packet, list);
+                list_del(&packet->list);
+                packet->status = 0;
+                send_packet_completion(target, packet);
+        }
+        spin_unlock_bh(&target->tx_lock);
+}
+
+/*
+ * In the adapted HIF layer, struct sk_buff * are passed between HIF and HTC,
+ * since upper layers expects struct htc_packet containers we use the completed
+ * skb and lookup it's corresponding HTC packet buffer from a lookup list.
+ * This is extra overhead that can be fixed by re-aligning HIF interfaces with
+ * HTC.
+ */
+static struct htc_packet *htc_lookup_tx_packet(struct htc_target *target,
+                                               struct htc_endpoint *ep,
+                                               struct sk_buff *skb)
+{
+        struct htc_packet *packet, *tmp_pkt, *found_packet = NULL;
+
+        spin_lock_bh(&target->tx_lock);
+
+        /*
+         * interate from the front of tx lookup queue
+         * this lookup should be fast since lower layers completes in-order and
+         * so the completed packet should be at the head of the list generally
+         */
+        list_for_each_entry_safe(packet, tmp_pkt, &ep->pipe.tx_lookup_queue,
+                                 list) {
+                /* check for removal */
+                if (skb == packet->skb) {
+                        /* found it */
+                        list_del(&packet->list);
+                        found_packet = packet;
+                        break;
+                }
+        }
+
+        spin_unlock_bh(&target->tx_lock);
+
+        return found_packet;
+}
+
+static int ath6kl_htc_pipe_tx_complete(struct ath6kl *ar, struct sk_buff *skb)
+{
+        struct htc_target *target = ar->htc_target;
+        struct htc_frame_hdr *htc_hdr;
+        struct htc_endpoint *ep;
+        struct htc_packet *packet;
+        u8 ep_id, *netdata;
+        u32 netlen;
+
+        netdata = skb->data;
+        netlen = skb->len;
+
+        htc_hdr = (struct htc_frame_hdr *) netdata;
+
+        ep_id = htc_hdr->eid;
+        ep = &target->endpoint[ep_id];
+
+        packet = htc_lookup_tx_packet(target, ep, skb);
+        if (packet == NULL) {
+                /* may have already been flushed and freed */
+                ath6kl_err("HTC TX lookup failed!\n");
+        } else {
+                /* will be giving this buffer back to upper layers */
+                packet->status = 0;
+                send_packet_completion(target, packet);
+        }
+        skb = NULL;
+
+        if (!ep->pipe.tx_credit_flow_enabled) {
+                /*
+                 * note: when using TX credit flow, the re-checking of queues
+                 * happens when credits flow back from the target. in the
+                 * non-TX credit case, we recheck after the packet completes
+                 */
+                htc_try_send(target, ep, NULL);
+        }
+
+        return 0;
+}
+
+static int htc_send_packets_multiple(struct htc_target *target,
+                                     struct list_head *pkt_queue)
+{
+        struct htc_endpoint *ep;
+        struct htc_packet *packet, *tmp_pkt;
+
+        if (list_empty(pkt_queue))
+                return -EINVAL;
+
+        /* get first packet to find out which ep the packets will go into */
+        packet = list_first_entry(pkt_queue, struct htc_packet, list);
+        if (packet == NULL)
+                return -EINVAL;
+
+        if (packet->endpoint >= ENDPOINT_MAX) {
+                WARN_ON_ONCE(1);
+                return -EINVAL;
+        }
+        ep = &target->endpoint[packet->endpoint];
+
+        htc_try_send(target, ep, pkt_queue);
+
+        /* do completion on any packets that couldn't get in */
+        if (!list_empty(pkt_queue)) {
+                list_for_each_entry_safe(packet, tmp_pkt, pkt_queue, list) {
+                        packet->status = -ENOMEM;
+                }
+
+                do_send_completion(ep, pkt_queue);
+        }
+
+        return 0;
+}
+
+/* htc pipe rx path */
+static struct htc_packet *alloc_htc_packet_container(struct htc_target *target)
+{
+        struct htc_packet *packet;
+        spin_lock_bh(&target->rx_lock);
+
+        if (target->pipe.htc_packet_pool == NULL) {
+                spin_unlock_bh(&target->rx_lock);
+                return NULL;
+        }
+
+        packet = target->pipe.htc_packet_pool;
+        target->pipe.htc_packet_pool = (struct htc_packet *) packet->list.next;
+
+        spin_unlock_bh(&target->rx_lock);
+
+        packet->list.next = NULL;
+        return packet;
+}
+
+static void free_htc_packet_container(struct htc_target *target,
+                                      struct htc_packet *packet)
+{
+        struct list_head *lh;
+
+        spin_lock_bh(&target->rx_lock);
+
+        if (target->pipe.htc_packet_pool == NULL) {
+                target->pipe.htc_packet_pool = packet;
+                packet->list.next = NULL;
+        } else {
+                lh = (struct list_head *) target->pipe.htc_packet_pool;
+                packet->list.next = lh;
+                target->pipe.htc_packet_pool = packet;
+        }
+
+        spin_unlock_bh(&target->rx_lock);
+}
+
+static int htc_process_trailer(struct htc_target *target, u8 *buffer,
+                               int len, enum htc_endpoint_id from_ep)
+{
+        struct htc_credit_report *report;
+        struct htc_record_hdr *record;
+        u8 *record_buf, *orig_buf;
+        int orig_len, status;
+
+        orig_buf = buffer;
+        orig_len = len;
+        status = 0;
+
+        while (len > 0) {
+                if (len < sizeof(struct htc_record_hdr)) {
+                        status = -EINVAL;
+                        break;
+                }
+
+                /* these are byte aligned structs */
+                record = (struct htc_record_hdr *) buffer;
+                len -= sizeof(struct htc_record_hdr);
+                buffer += sizeof(struct htc_record_hdr);
+
+                if (record->len > len) {
+                        /* no room left in buffer for record */
+                        ath6kl_dbg(ATH6KL_DBG_HTC,
+                                   "invalid length: %d (id:%d) buffer has: %d bytes left\n",
+                                   record->len, record->rec_id, len);
+                        status = -EINVAL;
+                        break;
+                }
+
+                /* start of record follows the header */
+                record_buf = buffer;
+
+                switch (record->rec_id) {
+                case HTC_RECORD_CREDITS:
+                        if (record->len < sizeof(struct htc_credit_report)) {
+                                WARN_ON_ONCE(1);
+                                return -EINVAL;
+                        }
+
+                        report = (struct htc_credit_report *) record_buf;
+                        htc_process_credit_report(target, report,
+                                                  record->len / sizeof(*report),
+                                                  from_ep);
+                        break;
+                default:
+                        ath6kl_dbg(ATH6KL_DBG_HTC,
+                                   "unhandled record: id:%d length:%d\n",
+                                   record->rec_id, record->len);
+                        break;
+                }
+
+                if (status != 0)
+                        break;
+
+                /* advance buffer past this record for next time around */
+                buffer += record->len;
+                len -= record->len;
+        }
+
+        return status;
+}
+
+static void do_recv_completion(struct htc_endpoint *ep,
+                               struct list_head *queue_to_indicate)
+{
+        struct htc_packet *packet;
+
+        if (list_empty(queue_to_indicate)) {
+                /* nothing to indicate */
+                return;
+        }
+
+        /* using legacy EpRecv */
+        while (!list_empty(queue_to_indicate)) {
+                packet = list_first_entry(queue_to_indicate,
+                                          struct htc_packet, list);
+                list_del(&packet->list);
+                ep->ep_cb.rx(ep->target, packet);
+        }
+
+        return;
+}
+
+static void recv_packet_completion(struct htc_target *target,
+                                   struct htc_endpoint *ep,
+                                   struct htc_packet *packet)
+{
+        struct list_head container;
+        INIT_LIST_HEAD(&container);
+        list_add_tail(&packet->list, &container);
+
+        /* do completion */
+        do_recv_completion(ep, &container);
+}
+
+static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
+                                       u8 pipeid)
+{
+        struct htc_target *target = ar->htc_target;
+        u8 *netdata, *trailer, hdr_info;
+        struct htc_frame_hdr *htc_hdr;
+        u32 netlen, trailerlen = 0;
+        struct htc_packet *packet;
+        struct htc_endpoint *ep;
+        u16 payload_len;
+        int status = 0;
+
+        netdata = skb->data;
+        netlen = skb->len;
+
+        htc_hdr = (struct htc_frame_hdr *) netdata;
+
+        ep = &target->endpoint[htc_hdr->eid];
+
+        if (htc_hdr->eid >= ENDPOINT_MAX) {
+                ath6kl_dbg(ATH6KL_DBG_HTC,
+                           "HTC Rx: invalid EndpointID=%d\n",
+                           htc_hdr->eid);
+                status = -EINVAL;
+                goto free_skb;
+        }
+
+        payload_len = le16_to_cpu(get_unaligned(&htc_hdr->payld_len));
+
+        if (netlen < (payload_len + HTC_HDR_LENGTH)) {
+                ath6kl_dbg(ATH6KL_DBG_HTC,
+                           "HTC Rx: insufficient length, got:%d expected =%u\n",
+                           netlen, payload_len + HTC_HDR_LENGTH);
+                status = -EINVAL;
+                goto free_skb;
+        }
+
+        /* get flags to check for trailer */
+        hdr_info = htc_hdr->flags;
+        if (hdr_info & HTC_FLG_RX_TRAILER) {
+                /* extract the trailer length */
+                hdr_info = htc_hdr->ctrl[0];
+                if ((hdr_info < sizeof(struct htc_record_hdr)) ||
+                    (hdr_info > payload_len)) {
+                        ath6kl_dbg(ATH6KL_DBG_HTC,
+                                   "invalid header: payloadlen should be %d, CB[0]: %d\n",
+                                   payload_len, hdr_info);
+                        status = -EINVAL;
+                        goto free_skb;
+                }
+
+                trailerlen = hdr_info;
+                /* process trailer after hdr/apps payload */
+                trailer = (u8 *) htc_hdr + HTC_HDR_LENGTH +
+                        payload_len - hdr_info;
+                status = htc_process_trailer(target, trailer, hdr_info,
+                                             htc_hdr->eid);
+                if (status != 0)
+                        goto free_skb;
+        }
+
+        if (((int) payload_len - (int) trailerlen) <= 0) {
+                /* zero length packet with trailer, just drop these */
+                goto free_skb;
+        }
+
+        if (htc_hdr->eid == ENDPOINT_0) {
+                /* handle HTC control message */
+                if (target->htc_flags & HTC_OP_STATE_SETUP_COMPLETE) {
+                        /*
+                         * fatal: target should not send unsolicited
+                         * messageson the endpoint 0
+                         */
+                        ath6kl_dbg(ATH6KL_DBG_HTC,
+                                   "HTC ignores Rx Ctrl after setup complete\n");
+                        status = -EINVAL;
+                        goto free_skb;
+                }
+
+                /* remove HTC header */
+                skb_pull(skb, HTC_HDR_LENGTH);
+
+                netdata = skb->data;
+                netlen = skb->len;
+
+                spin_lock_bh(&target->rx_lock);
+
+                target->pipe.ctrl_response_valid = true;
+                target->pipe.ctrl_response_len = min_t(int, netlen,
+                                                       HTC_MAX_CTRL_MSG_LEN);
+                memcpy(target->pipe.ctrl_response_buf, netdata,
+                       target->pipe.ctrl_response_len);
+
+                spin_unlock_bh(&target->rx_lock);
+
+                dev_kfree_skb(skb);
+                skb = NULL;
+                goto free_skb;
+        }
+
+        /*
+         * TODO: the message based HIF architecture allocates net bufs
+         * for recv packets since it bridges that HIF to upper layers,
+         * which expects HTC packets, we form the packets here
+         */
+        packet = alloc_htc_packet_container(target);
+        if (packet == NULL) {
+                status = -ENOMEM;
+                goto free_skb;
+        }
+
+        packet->status = 0;
+        packet->endpoint = htc_hdr->eid;
+        packet->pkt_cntxt = skb;
+
+        /* TODO: for backwards compatibility */
+        packet->buf = skb_push(skb, 0) + HTC_HDR_LENGTH;
+        packet->act_len = netlen - HTC_HDR_LENGTH - trailerlen;
+
+        /*
+         * TODO: this is a hack because the driver layer will set the
+         * actual len of the skb again which will just double the len
+         */
+        skb_trim(skb, 0);
+
+        recv_packet_completion(target, ep, packet);
+
+        /* recover the packet container */
+        free_htc_packet_container(target, packet);
+        skb = NULL;
+
+free_skb:
+        if (skb != NULL)
+                dev_kfree_skb(skb);
+
+        return status;
+
+}
+
+static void htc_flush_rx_queue(struct htc_target *target,
+                               struct htc_endpoint *ep)
+{
+        struct list_head container;
+        struct htc_packet *packet;
+
+        spin_lock_bh(&target->rx_lock);
+
+        while (1) {
+                if (list_empty(&ep->rx_bufq))
+                        break;
+
+                packet = list_first_entry(&ep->rx_bufq,
+                                          struct htc_packet, list);
+                list_del(&packet->list);
+
+                spin_unlock_bh(&target->rx_lock);
+                packet->status = -ECANCELED;
+                packet->act_len = 0;
+
+                ath6kl_dbg(ATH6KL_DBG_HTC,
+                           "Flushing RX packet:0x%p, length:%d, ep:%d\n",
+                           packet, packet->buf_len,
+                           packet->endpoint);
+
+                INIT_LIST_HEAD(&container);
+                list_add_tail(&packet->list, &container);
+
+                /* give the packet back */
+                do_recv_completion(ep, &container);
+                spin_lock_bh(&target->rx_lock);
+        }
+
+        spin_unlock_bh(&target->rx_lock);
+}
+
+/* polling routine to wait for a control packet to be received */
+static int htc_wait_recv_ctrl_message(struct htc_target *target)
+{
+        int count = HTC_TARGET_RESPONSE_POLL_COUNT;
+
+        while (count > 0) {
+                spin_lock_bh(&target->rx_lock);
+
+                if (target->pipe.ctrl_response_valid) {
+                        target->pipe.ctrl_response_valid = false;
+                        spin_unlock_bh(&target->rx_lock);
+                        break;
+                }
+
+                spin_unlock_bh(&target->rx_lock);
+
+                count--;
+
+                msleep_interruptible(HTC_TARGET_RESPONSE_POLL_WAIT);
+        }
+
+        if (count <= 0) {
+                ath6kl_dbg(ATH6KL_DBG_HTC, "%s: Timeout!\n", __func__);
+                return -ECOMM;
+        }
+
+        return 0;
+}
+
+static void htc_rxctrl_complete(struct htc_target *context,
+                                struct htc_packet *packet)
+{
+        /* TODO, can't really receive HTC control messages yet.... */
+        ath6kl_dbg(ATH6KL_DBG_HTC, "%s: invalid call function\n", __func__);
+}
+
+/* htc pipe initialization */
+static void reset_endpoint_states(struct htc_target *target)
+{
+        struct htc_endpoint *ep;
+        int i;
+
+        for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
+                ep = &target->endpoint[i];
+                ep->svc_id = 0;
+                ep->len_max = 0;
+                ep->max_txq_depth = 0;
+                ep->eid = i;
+                INIT_LIST_HEAD(&ep->txq);
+                INIT_LIST_HEAD(&ep->pipe.tx_lookup_queue);
+                INIT_LIST_HEAD(&ep->rx_bufq);
+                ep->target = target;
+                ep->pipe.tx_credit_flow_enabled = (bool) 1; /* FIXME */
+        }
+}
+
+/* start HTC, this is called after all services are connected */
+static int htc_config_target_hif_pipe(struct htc_target *target)
+{
+        return 0;
+}
+
+/* htc service functions */
+static u8 htc_get_credit_alloc(struct htc_target *target, u16 service_id)
+{
+        u8 allocation = 0;
+        int i;
+
+        for (i = 0; i < ENDPOINT_MAX; i++) {
+                if (target->pipe.txcredit_alloc[i].service_id == service_id)
+                        allocation =
+                                target->pipe.txcredit_alloc[i].credit_alloc;
+        }
+
+        if (allocation == 0) {
+                ath6kl_dbg(ATH6KL_DBG_HTC,
+                           "HTC Service TX : 0x%2.2X : allocation is zero!\n",
+                           service_id);
+        }
+
+        return allocation;
+}
+
+static int ath6kl_htc_pipe_conn_service(struct htc_target *target,
+                     struct htc_service_connect_req *conn_req,
+                     struct htc_service_connect_resp *conn_resp)
+{
+        struct ath6kl *ar = target->dev->ar;
+        struct htc_packet *packet = NULL;
+        struct htc_conn_service_resp *resp_msg;
+        struct htc_conn_service_msg *conn_msg;
+        enum htc_endpoint_id assigned_epid = ENDPOINT_MAX;
+        bool disable_credit_flowctrl = false;
+        unsigned int max_msg_size = 0;
+        struct htc_endpoint *ep;
+        int length, status = 0;
+        struct sk_buff *skb;
+        u8 tx_alloc;
+        u16 flags;
+
+        if (conn_req->svc_id == 0) {
+                WARN_ON_ONCE(1);
+                status = -EINVAL;
+                goto free_packet;
+        }
+
+        if (conn_req->svc_id == HTC_CTRL_RSVD_SVC) {
+                /* special case for pseudo control service */
+                assigned_epid = ENDPOINT_0;
+                max_msg_size = HTC_MAX_CTRL_MSG_LEN;
+                tx_alloc = 0;
+
+        } else {
+
+                tx_alloc = htc_get_credit_alloc(target, conn_req->svc_id);
+                if (tx_alloc == 0) {
+                        status = -ENOMEM;
+                        goto free_packet;
+                }
+
+                /* allocate a packet to send to the target */
+                packet = htc_alloc_txctrl_packet(target);
+
+                if (packet == NULL) {
+                        WARN_ON_ONCE(1);
+                        status = -ENOMEM;
+                        goto free_packet;
+                }
+
+                skb = packet->skb;
+                length = sizeof(struct htc_conn_service_msg);
+
+                /* assemble connect service message */
+                conn_msg = (struct htc_conn_service_msg *) skb_put(skb,
+                                                                   length);
+                if (conn_msg == NULL) {
+                        WARN_ON_ONCE(1);
+                        status = -EINVAL;
+                        goto free_packet;
+                }
+
+                memset(conn_msg, 0,
+                       sizeof(struct htc_conn_service_msg));
+                conn_msg->msg_id = cpu_to_le16(HTC_MSG_CONN_SVC_ID);
+                conn_msg->svc_id = cpu_to_le16(conn_req->svc_id);
+                conn_msg->conn_flags = cpu_to_le16(conn_req->conn_flags &
+                                        ~HTC_CONN_FLGS_SET_RECV_ALLOC_MASK);
+
+                /* tell target desired recv alloc for this ep */
+                flags = tx_alloc << HTC_CONN_FLGS_SET_RECV_ALLOC_SHIFT;
+                conn_msg->conn_flags |= cpu_to_le16(flags);
+
+                if (conn_req->conn_flags &
+                    HTC_CONN_FLGS_DISABLE_CRED_FLOW_CTRL) {
+                        disable_credit_flowctrl = true;
+                }
+
+                set_htc_pkt_info(packet, NULL, (u8 *) conn_msg,
+                                 length,
+                                 ENDPOINT_0, HTC_SERVICE_TX_PACKET_TAG);
+
+                status = ath6kl_htc_pipe_tx(target, packet);
+
+                /* we don't own it anymore */
+                packet = NULL;
+                if (status != 0)
+                        goto free_packet;
+
+                /* wait for response */
+                status = htc_wait_recv_ctrl_message(target);
+                if (status != 0)
+                        goto free_packet;
+
+                /* we controlled the buffer creation so it has to be
+                 * properly aligned
+                 */
+                resp_msg = (struct htc_conn_service_resp *)
+                    target->pipe.ctrl_response_buf;
+
+                if (resp_msg->msg_id != cpu_to_le16(HTC_MSG_CONN_SVC_RESP_ID) ||
+                    (target->pipe.ctrl_response_len < sizeof(*resp_msg))) {
+                        /* this message is not valid */
+                        WARN_ON_ONCE(1);
+                        status = -EINVAL;
+                        goto free_packet;
+                }
+
+                ath6kl_dbg(ATH6KL_DBG_TRC,
+                           "%s: service 0x%X conn resp: status: %d ep: %d\n",
+                           __func__, resp_msg->svc_id, resp_msg->status,
+                           resp_msg->eid);
+
+                conn_resp->resp_code = resp_msg->status;
+                /* check response status */
+                if (resp_msg->status != HTC_SERVICE_SUCCESS) {
+                        ath6kl_dbg(ATH6KL_DBG_HTC,
+                                   "Target failed service 0x%X connect request (status:%d)\n",
+                                   resp_msg->svc_id, resp_msg->status);
+                        status = -EINVAL;
+                        goto free_packet;
+                }
+
+                assigned_epid = (enum htc_endpoint_id) resp_msg->eid;
+                max_msg_size = le16_to_cpu(resp_msg->max_msg_sz);
+        }
+
+        /* the rest are parameter checks so set the error status */
+        status = -EINVAL;
+
+        if (assigned_epid >= ENDPOINT_MAX) {
+                WARN_ON_ONCE(1);
+                goto free_packet;
+        }
+
+        if (max_msg_size == 0) {
+                WARN_ON_ONCE(1);
+                goto free_packet;
+        }
+
+        ep = &target->endpoint[assigned_epid];
+        ep->eid = assigned_epid;
+        if (ep->svc_id != 0) {
+                /* endpoint already in use! */
+                WARN_ON_ONCE(1);
+                goto free_packet;
+        }
+
+        /* return assigned endpoint to caller */
+        conn_resp->endpoint = assigned_epid;
+        conn_resp->len_max = max_msg_size;
+
+        /* setup the endpoint */
+        ep->svc_id = conn_req->svc_id; /* this marks ep in use */
+        ep->max_txq_depth = conn_req->max_txq_depth;
+        ep->len_max = max_msg_size;
+        ep->cred_dist.credits = tx_alloc;
+        ep->cred_dist.cred_sz = target->tgt_cred_sz;
+        ep->cred_dist.cred_per_msg = max_msg_size / target->tgt_cred_sz;
+        if (max_msg_size % target->tgt_cred_sz)
+                ep->cred_dist.cred_per_msg++;
+
+        /* copy all the callbacks */
+        ep->ep_cb = conn_req->ep_cb;
+
+        status = ath6kl_hif_pipe_map_service(ar, ep->svc_id,
+                                             &ep->pipe.pipeid_ul,
+                                             &ep->pipe.pipeid_dl);
+        if (status != 0)
+                goto free_packet;
+
+        ath6kl_dbg(ATH6KL_DBG_HTC,
+                   "SVC Ready: 0x%4.4X: ULpipe:%d DLpipe:%d id:%d\n",
+                   ep->svc_id, ep->pipe.pipeid_ul,
+                   ep->pipe.pipeid_dl, ep->eid);
+
+        if (disable_credit_flowctrl && ep->pipe.tx_credit_flow_enabled) {
+                ep->pipe.tx_credit_flow_enabled = false;
+                ath6kl_dbg(ATH6KL_DBG_HTC,
+                           "SVC: 0x%4.4X ep:%d TX flow control off\n",
+                           ep->svc_id, assigned_epid);
+        }
+
+free_packet:
+        if (packet != NULL)
+                htc_free_txctrl_packet(target, packet);
+        return status;
+}
+
+/* htc export functions */
+static void *ath6kl_htc_pipe_create(struct ath6kl *ar)
+{
+        int status = 0;
+        struct htc_endpoint *ep = NULL;
+        struct htc_target *target = NULL;
+        struct htc_packet *packet;
+        int i;
+
+        target = kzalloc(sizeof(struct htc_target), GFP_KERNEL);
+        if (target == NULL) {
+                ath6kl_err("htc create unable to allocate memory\n");
+                status = -ENOMEM;
+                goto fail_htc_create;
+        }
+
+        spin_lock_init(&target->htc_lock);
+        spin_lock_init(&target->rx_lock);
+        spin_lock_init(&target->tx_lock);
+
+        reset_endpoint_states(target);
+
+        for (i = 0; i < HTC_PACKET_CONTAINER_ALLOCATION; i++) {
+                packet = kzalloc(sizeof(struct htc_packet), GFP_KERNEL);
+
+                if (packet != NULL)
+                        free_htc_packet_container(target, packet);
+        }
+
+        target->dev = kzalloc(sizeof(*target->dev), GFP_KERNEL);
+        if (!target->dev) {
+                ath6kl_err("unable to allocate memory\n");
+                status = -ENOMEM;
+                goto fail_htc_create;
+        }
+        target->dev->ar = ar;
+        target->dev->htc_cnxt = target;
+
+        /* Get HIF default pipe for HTC message exchange */
+        ep = &target->endpoint[ENDPOINT_0];
+
+        ath6kl_hif_pipe_get_default(ar, &ep->pipe.pipeid_ul,
+                                    &ep->pipe.pipeid_dl);
+
+        return target;
+
+fail_htc_create:
+        if (status != 0) {
+                if (target != NULL)
+                        ath6kl_htc_pipe_cleanup(target);
+
+                target = NULL;
+        }
+        return target;
+}
+
+/* cleanup the HTC instance */
+static void ath6kl_htc_pipe_cleanup(struct htc_target *target)
+{
+        struct htc_packet *packet;
+
+        while (true) {
+                packet = alloc_htc_packet_container(target);
+                if (packet == NULL)
+                        break;
+                kfree(packet);
+        }
+
+        kfree(target->dev);
+
+        /* kfree our instance */
+        kfree(target);
+}
+
+static int ath6kl_htc_pipe_start(struct htc_target *target)
+{
+        struct sk_buff *skb;
+        struct htc_setup_comp_ext_msg *setup;
+        struct htc_packet *packet;
+
+        htc_config_target_hif_pipe(target);
+
+        /* allocate a buffer to send */
+        packet = htc_alloc_txctrl_packet(target);
+        if (packet == NULL) {
+                WARN_ON_ONCE(1);
+                return -ENOMEM;
+        }
+
+        skb = packet->skb;
+
+        /* assemble setup complete message */
+        setup = (struct htc_setup_comp_ext_msg *) skb_put(skb,
+                                                          sizeof(*setup));
+        memset(setup, 0, sizeof(struct htc_setup_comp_ext_msg));
+        setup->msg_id = cpu_to_le16(HTC_MSG_SETUP_COMPLETE_EX_ID);
+
+        ath6kl_dbg(ATH6KL_DBG_HTC, "HTC using TX credit flow control\n");
+
+        set_htc_pkt_info(packet, NULL, (u8 *) setup,
+                         sizeof(struct htc_setup_comp_ext_msg),
+                         ENDPOINT_0, HTC_SERVICE_TX_PACKET_TAG);
+
+        target->htc_flags |= HTC_OP_STATE_SETUP_COMPLETE;
+
+        return ath6kl_htc_pipe_tx(target, packet);
+}
+
+static void ath6kl_htc_pipe_stop(struct htc_target *target)
+{
+        int i;
+        struct htc_endpoint *ep;
+
+        /* cleanup endpoints */
+        for (i = 0; i < ENDPOINT_MAX; i++) {
+                ep = &target->endpoint[i];
+                htc_flush_rx_queue(target, ep);
+                htc_flush_tx_endpoint(target, ep, HTC_TX_PACKET_TAG_ALL);
+        }
+
+        reset_endpoint_states(target);
+        target->htc_flags &= ~HTC_OP_STATE_SETUP_COMPLETE;
+}
+
+static int ath6kl_htc_pipe_get_rxbuf_num(struct htc_target *target,
+                                         enum htc_endpoint_id endpoint)
+{
+        int num;
+
+        spin_lock_bh(&target->rx_lock);
+        num = get_queue_depth(&(target->endpoint[endpoint].rx_bufq));
+        spin_unlock_bh(&target->rx_lock);
+
+        return num;
+}
+
+static int ath6kl_htc_pipe_tx(struct htc_target *target,
+                              struct htc_packet *packet)
+{
+        struct list_head queue;
+
+        ath6kl_dbg(ATH6KL_DBG_HTC,
+                   "%s: endPointId: %d, buffer: 0x%p, length: %d\n",
+                   __func__, packet->endpoint, packet->buf,
+                   packet->act_len);
+
+        INIT_LIST_HEAD(&queue);
+        list_add_tail(&packet->list, &queue);
+
+        return htc_send_packets_multiple(target, &queue);
+}
+
+static int ath6kl_htc_pipe_wait_target(struct htc_target *target)
+{
+        struct htc_ready_ext_msg *ready_msg;
+        struct htc_service_connect_req connect;
+        struct htc_service_connect_resp resp;
+        int status = 0;
+
+        status = htc_wait_recv_ctrl_message(target);
+
+        if (status != 0)
+                return status;
+
+        if (target->pipe.ctrl_response_len < sizeof(*ready_msg)) {
+                ath6kl_dbg(ATH6KL_DBG_HTC, "invalid htc ready msg len:%d!\n",
+                           target->pipe.ctrl_response_len);
+                return -ECOMM;
+        }
+
+        ready_msg = (struct htc_ready_ext_msg *) target->pipe.ctrl_response_buf;
+
+        if (ready_msg->ver2_0_info.msg_id != cpu_to_le16(HTC_MSG_READY_ID)) {
+                ath6kl_dbg(ATH6KL_DBG_HTC, "invalid htc ready msg : 0x%X !\n",
+                           ready_msg->ver2_0_info.msg_id);
+                return -ECOMM;
+        }
+
+        ath6kl_dbg(ATH6KL_DBG_HTC,
+                   "Target Ready! : transmit resources : %d size:%d\n",
+                   ready_msg->ver2_0_info.cred_cnt,
+                   ready_msg->ver2_0_info.cred_sz);
+
+        target->tgt_creds = le16_to_cpu(ready_msg->ver2_0_info.cred_cnt);
+        target->tgt_cred_sz = le16_to_cpu(ready_msg->ver2_0_info.cred_sz);
+
+        if ((target->tgt_creds == 0) || (target->tgt_cred_sz == 0))
+                return -ECOMM;
+
+        htc_setup_target_buffer_assignments(target);
+
+        /* setup our pseudo HTC control endpoint connection */
+        memset(&connect, 0, sizeof(connect));
+        memset(&resp, 0, sizeof(resp));
+        connect.ep_cb.tx_complete = htc_txctrl_complete;
+        connect.ep_cb.rx = htc_rxctrl_complete;
+        connect.max_txq_depth = NUM_CONTROL_TX_BUFFERS;
+        connect.svc_id = HTC_CTRL_RSVD_SVC;
+
+        /* connect fake service */
+        status = ath6kl_htc_pipe_conn_service(target, &connect, &resp);
+
+        return status;
+}
+
+static void ath6kl_htc_pipe_flush_txep(struct htc_target *target,
+                                       enum htc_endpoint_id endpoint, u16 tag)
+{
+        struct htc_endpoint *ep = &target->endpoint[endpoint];
+
+        if (ep->svc_id == 0) {
+                WARN_ON_ONCE(1);
+                /* not in use.. */
+                return;
+        }
+
+        htc_flush_tx_endpoint(target, ep, tag);
+}
+
+static int ath6kl_htc_pipe_add_rxbuf_multiple(struct htc_target *target,
+                                              struct list_head *pkt_queue)
+{
+        struct htc_packet *packet, *tmp_pkt, *first;
+        struct htc_endpoint *ep;
+        int status = 0;
+
+        if (list_empty(pkt_queue))
+                return -EINVAL;
+
+        first = list_first_entry(pkt_queue, struct htc_packet, list);
+        if (first == NULL) {
+                WARN_ON_ONCE(1);
+                return -EINVAL;
+        }
+
+        if (first->endpoint >= ENDPOINT_MAX) {
+                WARN_ON_ONCE(1);
+                return -EINVAL;
+        }
+
+        ath6kl_dbg(ATH6KL_DBG_HTC, "%s: epid: %d, cnt:%d, len: %d\n",
+                   __func__, first->endpoint, get_queue_depth(pkt_queue),
+                   first->buf_len);
+
+        ep = &target->endpoint[first->endpoint];
+
+        spin_lock_bh(&target->rx_lock);
+
+        /* store receive packets */
+        list_splice_tail_init(pkt_queue, &ep->rx_bufq);
+
+        spin_unlock_bh(&target->rx_lock);
+
+        if (status != 0) {
+                /* walk through queue and mark each one canceled */
+                list_for_each_entry_safe(packet, tmp_pkt, pkt_queue, list) {
+                        packet->status = -ECANCELED;
+                }
+
+                do_recv_completion(ep, pkt_queue);
+        }
+
+        return status;
+}
+
+static void ath6kl_htc_pipe_activity_changed(struct htc_target *target,
+                                             enum htc_endpoint_id ep,
+                                             bool active)
+{
+        /* TODO */
+}
+
+static void ath6kl_htc_pipe_flush_rx_buf(struct htc_target *target)
+{
+        /* TODO */
+}
+
+static int ath6kl_htc_pipe_credit_setup(struct htc_target *target,
+                                        struct ath6kl_htc_credit_info *info)
+{
+        return 0;
+}
+
+static const struct ath6kl_htc_ops ath6kl_htc_pipe_ops = {
+        .create = ath6kl_htc_pipe_create,
+        .wait_target = ath6kl_htc_pipe_wait_target,
+        .start = ath6kl_htc_pipe_start,
+        .conn_service = ath6kl_htc_pipe_conn_service,
+        .tx = ath6kl_htc_pipe_tx,
+        .stop = ath6kl_htc_pipe_stop,
+        .cleanup = ath6kl_htc_pipe_cleanup,
+        .flush_txep = ath6kl_htc_pipe_flush_txep,
+        .flush_rx_buf = ath6kl_htc_pipe_flush_rx_buf,
+        .activity_changed = ath6kl_htc_pipe_activity_changed,
+        .get_rxbuf_num = ath6kl_htc_pipe_get_rxbuf_num,
+        .add_rxbuf_multiple = ath6kl_htc_pipe_add_rxbuf_multiple,
+        .credit_setup = ath6kl_htc_pipe_credit_setup,
+        .tx_complete = ath6kl_htc_pipe_tx_complete,
+        .rx_complete = ath6kl_htc_pipe_rx_complete,
+};
+
+void ath6kl_htc_pipe_attach(struct ath6kl *ar)
+{
+        ar->htc_ops = &ath6kl_htc_pipe_ops;
+}
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index eb7cc2f5b96f..29ef50ea07d5 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -23,12 +23,14 @@
 #include <linux/export.h>
 #include <linux/of.h>
 #include <linux/mmc/sdio_func.h>
+#include <linux/vmalloc.h>
 
 #include "core.h"
 #include "cfg80211.h"
 #include "target.h"
 #include "debug.h"
 #include "hif-ops.h"
+#include "htc-ops.h"
 
 static const struct ath6kl_hw hw_list[] = {
         {
@@ -258,6 +260,7 @@ static int ath6kl_init_service_ep(struct ath6kl *ar)
         memset(&connect, 0, sizeof(connect));
 
         /* these fields are the same for all service endpoints */
+        connect.ep_cb.tx_comp_multi = ath6kl_tx_complete;
         connect.ep_cb.rx = ath6kl_rx;
         connect.ep_cb.rx_refill = ath6kl_rx_refill;
         connect.ep_cb.tx_full = ath6kl_tx_queue_full;
@@ -487,22 +490,31 @@ int ath6kl_configure_target(struct ath6kl *ar)
                 fw_mode |= fw_iftype << (i * HI_OPTION_FW_MODE_BITS);
 
         /*
-         * By default, submodes :
+         * Submodes when fw does not support dynamic interface
+         * switching:
          *              vif[0] - AP/STA/IBSS
          *              vif[1] - "P2P dev"/"P2P GO"/"P2P Client"
          *              vif[2] - "P2P dev"/"P2P GO"/"P2P Client"
+         * Otherwise, All the interface are initialized to p2p dev.
          */
 
-        for (i = 0; i < ar->max_norm_iface; i++)
-                fw_submode |= HI_OPTION_FW_SUBMODE_NONE <<
-                              (i * HI_OPTION_FW_SUBMODE_BITS);
+        if (test_bit(ATH6KL_FW_CAPABILITY_STA_P2PDEV_DUPLEX,
+                     ar->fw_capabilities)) {
+                for (i = 0; i < ar->vif_max; i++)
+                        fw_submode |= HI_OPTION_FW_SUBMODE_P2PDEV <<
+                                (i * HI_OPTION_FW_SUBMODE_BITS);
+        } else {
+                for (i = 0; i < ar->max_norm_iface; i++)
+                        fw_submode |= HI_OPTION_FW_SUBMODE_NONE <<
+                                (i * HI_OPTION_FW_SUBMODE_BITS);
 
-        for (i = ar->max_norm_iface; i < ar->vif_max; i++)
-                fw_submode |= HI_OPTION_FW_SUBMODE_P2PDEV <<
-                              (i * HI_OPTION_FW_SUBMODE_BITS);
+                for (i = ar->max_norm_iface; i < ar->vif_max; i++)
+                        fw_submode |= HI_OPTION_FW_SUBMODE_P2PDEV <<
+                                (i * HI_OPTION_FW_SUBMODE_BITS);
 
-        if (ar->p2p && ar->vif_max == 1)
-                fw_submode = HI_OPTION_FW_SUBMODE_P2PDEV;
+                if (ar->p2p && ar->vif_max == 1)
+                        fw_submode = HI_OPTION_FW_SUBMODE_P2PDEV;
+        }
 
         if (ath6kl_bmi_write_hi32(ar, hi_app_host_interest,
                                   HTC_PROTOCOL_VERSION) != 0) {
@@ -541,18 +553,20 @@ int ath6kl_configure_target(struct ath6kl *ar)
          * but possible in theory.
          */
 
-        param = ar->hw.board_ext_data_addr;
-        ram_reserved_size = ar->hw.reserved_ram_size;
+        if (ar->target_type == TARGET_TYPE_AR6003) {
+                param = ar->hw.board_ext_data_addr;
+                ram_reserved_size = ar->hw.reserved_ram_size;
 
-        if (ath6kl_bmi_write_hi32(ar, hi_board_ext_data, param) != 0) {
-                ath6kl_err("bmi_write_memory for hi_board_ext_data failed\n");
-                return -EIO;
-        }
+                if (ath6kl_bmi_write_hi32(ar, hi_board_ext_data, param) != 0) {
+                        ath6kl_err("bmi_write_memory for hi_board_ext_data failed\n");
+                        return -EIO;
+                }
 
-        if (ath6kl_bmi_write_hi32(ar, hi_end_ram_reserve_sz,
-                                  ram_reserved_size) != 0) {
-                ath6kl_err("bmi_write_memory for hi_end_ram_reserve_sz failed\n");
-                return -EIO;
+                if (ath6kl_bmi_write_hi32(ar, hi_end_ram_reserve_sz,
+                                          ram_reserved_size) != 0) {
+                        ath6kl_err("bmi_write_memory for hi_end_ram_reserve_sz failed\n");
+                        return -EIO;
+                }
         }
 
         /* set the block size for the target */
@@ -926,13 +940,14 @@ static int ath6kl_fetch_fw_apin(struct ath6kl *ar, const char *name)
                         if (ar->fw != NULL)
                                 break;
 
-                        ar->fw = kmemdup(data, ie_len, GFP_KERNEL);
+                        ar->fw = vmalloc(ie_len);
 
                         if (ar->fw == NULL) {
                                 ret = -ENOMEM;
                                 goto out;
                         }
 
+                        memcpy(ar->fw, data, ie_len);
                         ar->fw_len = ie_len;
                         break;
                 case ATH6KL_FW_IE_PATCH_IMAGE:
@@ -1509,7 +1524,7 @@ int ath6kl_init_hw_start(struct ath6kl *ar)
         }
 
         /* setup credit distribution */
-        ath6kl_credit_setup(ar->htc_target, &ar->credit_state_info);
+        ath6kl_htc_credit_setup(ar->htc_target, &ar->credit_state_info);
 
         /* start HTC */
         ret = ath6kl_htc_start(ar->htc_target);
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 07071fce8a0e..4d818f96c415 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -758,6 +758,10 @@ static void ath6kl_update_target_stats(struct ath6kl_vif *vif, u8 *ptr, u32 len)
         stats->wow_evt_discarded +=
                 le16_to_cpu(tgt_stats->wow_stats.wow_evt_discarded);
 
+        stats->arp_received = le32_to_cpu(tgt_stats->arp_stats.arp_received);
+        stats->arp_replied = le32_to_cpu(tgt_stats->arp_stats.arp_replied);
+        stats->arp_matched = le32_to_cpu(tgt_stats->arp_stats.arp_matched);
+
         if (test_bit(STATS_UPDATE_PEND, &vif->flags)) {
                 clear_bit(STATS_UPDATE_PEND, &vif->flags);
                 wake_up(&ar->event_wq);
diff --git a/drivers/net/wireless/ath/ath6kl/sdio.c b/drivers/net/wireless/ath/ath6kl/sdio.c
index 53528648b425..44ea7a742101 100644
--- a/drivers/net/wireless/ath/ath6kl/sdio.c
+++ b/drivers/net/wireless/ath/ath6kl/sdio.c
@@ -1362,7 +1362,7 @@ static int ath6kl_sdio_probe(struct sdio_func *func,
                 goto err_core_alloc;
         }
 
-        ret = ath6kl_core_init(ar);
+        ret = ath6kl_core_init(ar, ATH6KL_HTC_TYPE_MBOX);
         if (ret) {
                 ath6kl_err("Failed to init ath6kl core\n");
                 goto err_core_alloc;
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index 521f0be990f1..82f2f5cb475b 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -19,6 +19,7 @@
 
 #include "core.h"
 #include "debug.h"
+#include "htc-ops.h"
 
 /*
  * tid - tid_mux0..tid_mux3
@@ -324,6 +325,7 @@ int ath6kl_control_tx(void *devt, struct sk_buff *skb,
         cookie->map_no = 0;
         set_htc_pkt_info(&cookie->htc_pkt, cookie, skb->data, skb->len,
                          eid, ATH6KL_CONTROL_PKT_TAG);
+        cookie->htc_pkt.skb = skb;
 
         /*
          * This interface is asynchronous, if there is an error, cleanup
@@ -492,6 +494,7 @@ int ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)
         cookie->map_no = map_no;
         set_htc_pkt_info(&cookie->htc_pkt, cookie, skb->data, skb->len,
                          eid, htc_tag);
+        cookie->htc_pkt.skb = skb;
 
         ath6kl_dbg_dump(ATH6KL_DBG_RAW_BYTES, __func__, "tx ",
                         skb->data, skb->len);
@@ -572,7 +575,7 @@ void ath6kl_indicate_tx_activity(void *devt, u8 traffic_class, bool active)
 
 notify_htc:
         /* notify HTC, this may cause credit distribution changes */
-        ath6kl_htc_indicate_activity_change(ar->htc_target, eid, active);
+        ath6kl_htc_activity_changed(ar->htc_target, eid, active);
 }
 
 enum htc_send_full_action ath6kl_tx_queue_full(struct htc_target *target,
@@ -668,9 +671,10 @@ static void ath6kl_tx_clear_node_map(struct ath6kl_vif *vif,
         }
 }
 
-void ath6kl_tx_complete(void *context, struct list_head *packet_queue)
+void ath6kl_tx_complete(struct htc_target *target,
+                        struct list_head *packet_queue)
 {
-        struct ath6kl *ar = context;
+        struct ath6kl *ar = target->dev->ar;
         struct sk_buff_head skb_queue;
         struct htc_packet *packet;
         struct sk_buff *skb;
@@ -889,6 +893,7 @@ void ath6kl_rx_refill(struct htc_target *target, enum htc_endpoint_id endpoint)
                         skb->data = PTR_ALIGN(skb->data - 4, 4);
                 set_htc_rxpkt_info(packet, skb, skb->data,
                                    ATH6KL_BUFFER_SIZE, endpoint);
+                packet->skb = skb;
                 list_add_tail(&packet->list, &queue);
         }
 
@@ -911,6 +916,8 @@ void ath6kl_refill_amsdu_rxbufs(struct ath6kl *ar, int count)
                         skb->data = PTR_ALIGN(skb->data - 4, 4);
                 set_htc_rxpkt_info(packet, skb, skb->data,
                                    ATH6KL_AMSDU_BUFFER_SIZE, 0);
+                packet->skb = skb;
+
                 spin_lock_bh(&ar->lock);
                 list_add_tail(&packet->list, &ar->amsdu_rx_buffer_queue);
                 spin_unlock_bh(&ar->lock);
@@ -1283,6 +1290,7 @@ void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
         struct wmi_data_hdr *dhdr;
         int min_hdr_len;
         u8 meta_type, dot11_hdr = 0;
+        u8 pad_before_data_start;
         int status = packet->status;
         enum htc_endpoint_id ept = packet->endpoint;
         bool is_amsdu, prev_ps, ps_state = false;
@@ -1494,6 +1502,10 @@ void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
         seq_no = wmi_data_hdr_get_seqno(dhdr);
         meta_type = wmi_data_hdr_get_meta(dhdr);
         dot11_hdr = wmi_data_hdr_get_dot11(dhdr);
+        pad_before_data_start =
+                (le16_to_cpu(dhdr->info3) >> WMI_DATA_HDR_PAD_BEFORE_DATA_SHIFT)
+                        & WMI_DATA_HDR_PAD_BEFORE_DATA_MASK;
+
         skb_pull(skb, sizeof(struct wmi_data_hdr));
 
         switch (meta_type) {
@@ -1512,6 +1524,8 @@ void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
                 break;
         }
 
+        skb_pull(skb, pad_before_data_start);
+
         if (dot11_hdr)
                 status = ath6kl_wmi_dot11_hdr_remove(ar->wmi, skb);
         else if (!is_amsdu)
@@ -1581,7 +1595,8 @@ void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
                         /* aggregation code will handle the skb */
                         return;
                 }
-        }
+        } else if (!is_broadcast_ether_addr(datap->h_dest))
+                vif->net_stats.multicast++;
 
         ath6kl_deliver_frames_to_nw_stack(vif->ndev, skb);
 }
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 325b1224c2b1..ec7f1f5fd1ca 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -21,15 +21,77 @@
 #include "debug.h"
 #include "core.h"
 
+/* constants */
+#define TX_URB_COUNT            32
+#define RX_URB_COUNT            32
+#define ATH6KL_USB_RX_BUFFER_SIZE  1700
+
+/* tx/rx pipes for usb */
+enum ATH6KL_USB_PIPE_ID {
+        ATH6KL_USB_PIPE_TX_CTRL = 0,
+        ATH6KL_USB_PIPE_TX_DATA_LP,
+        ATH6KL_USB_PIPE_TX_DATA_MP,
+        ATH6KL_USB_PIPE_TX_DATA_HP,
+        ATH6KL_USB_PIPE_RX_CTRL,
+        ATH6KL_USB_PIPE_RX_DATA,
+        ATH6KL_USB_PIPE_RX_DATA2,
+        ATH6KL_USB_PIPE_RX_INT,
+        ATH6KL_USB_PIPE_MAX
+};
+
+#define ATH6KL_USB_PIPE_INVALID ATH6KL_USB_PIPE_MAX
+
+struct ath6kl_usb_pipe {
+        struct list_head urb_list_head;
+        struct usb_anchor urb_submitted;
+        u32 urb_alloc;
+        u32 urb_cnt;
+        u32 urb_cnt_thresh;
+        unsigned int usb_pipe_handle;
+        u32 flags;
+        u8 ep_address;
+        u8 logical_pipe_num;
+        struct ath6kl_usb *ar_usb;
+        u16 max_packet_size;
+        struct work_struct io_complete_work;
+        struct sk_buff_head io_comp_queue;
+        struct usb_endpoint_descriptor *ep_desc;
+};
+
+#define ATH6KL_USB_PIPE_FLAG_TX    (1 << 0)
+
 /* usb device object */
 struct ath6kl_usb {
+        /* protects pipe->urb_list_head and  pipe->urb_cnt */
+        spinlock_t cs_lock;
+
         struct usb_device *udev;
         struct usb_interface *interface;
+        struct ath6kl_usb_pipe pipes[ATH6KL_USB_PIPE_MAX];
         u8 *diag_cmd_buffer;
         u8 *diag_resp_buffer;
         struct ath6kl *ar;
 };
 
+/* usb urb object */
+struct ath6kl_urb_context {
+        struct list_head link;
+        struct ath6kl_usb_pipe *pipe;
+        struct sk_buff *skb;
+        struct ath6kl *ar;
+};
+
+/* USB endpoint definitions */
+#define ATH6KL_USB_EP_ADDR_APP_CTRL_IN          0x81
+#define ATH6KL_USB_EP_ADDR_APP_DATA_IN          0x82
+#define ATH6KL_USB_EP_ADDR_APP_DATA2_IN         0x83
+#define ATH6KL_USB_EP_ADDR_APP_INT_IN           0x84
+
+#define ATH6KL_USB_EP_ADDR_APP_CTRL_OUT         0x01
+#define ATH6KL_USB_EP_ADDR_APP_DATA_LP_OUT      0x02
+#define ATH6KL_USB_EP_ADDR_APP_DATA_MP_OUT      0x03
+#define ATH6KL_USB_EP_ADDR_APP_DATA_HP_OUT      0x04
+
 /* diagnostic command defnitions */
 #define ATH6KL_USB_CONTROL_REQ_SEND_BMI_CMD        1
 #define ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP       2
@@ -55,11 +117,493 @@ struct ath6kl_usb_ctrl_diag_resp_read {
         __le32 value;
 } __packed;
 
+/* function declarations */
+static void ath6kl_usb_recv_complete(struct urb *urb);
+
+#define ATH6KL_USB_IS_BULK_EP(attr) (((attr) & 3) == 0x02)
+#define ATH6KL_USB_IS_INT_EP(attr)  (((attr) & 3) == 0x03)
+#define ATH6KL_USB_IS_ISOC_EP(attr)  (((attr) & 3) == 0x01)
+#define ATH6KL_USB_IS_DIR_IN(addr)  ((addr) & 0x80)
+
+/* pipe/urb operations */
+static struct ath6kl_urb_context *
+ath6kl_usb_alloc_urb_from_pipe(struct ath6kl_usb_pipe *pipe)
+{
+        struct ath6kl_urb_context *urb_context = NULL;
+        unsigned long flags;
+
+        spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags);
+        if (!list_empty(&pipe->urb_list_head)) {
+                urb_context =
+                    list_first_entry(&pipe->urb_list_head,
+                                     struct ath6kl_urb_context, link);
+                list_del(&urb_context->link);
+                pipe->urb_cnt--;
+        }
+        spin_unlock_irqrestore(&pipe->ar_usb->cs_lock, flags);
+
+        return urb_context;
+}
+
+static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe,
+                                        struct ath6kl_urb_context *urb_context)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags);
+        pipe->urb_cnt++;
+
+        list_add(&urb_context->link, &pipe->urb_list_head);
+        spin_unlock_irqrestore(&pipe->ar_usb->cs_lock, flags);
+}
+
+static void ath6kl_usb_cleanup_recv_urb(struct ath6kl_urb_context *urb_context)
+{
+        if (urb_context->skb != NULL) {
+                dev_kfree_skb(urb_context->skb);
+                urb_context->skb = NULL;
+        }
+
+        ath6kl_usb_free_urb_to_pipe(urb_context->pipe, urb_context);
+}
+
+static inline struct ath6kl_usb *ath6kl_usb_priv(struct ath6kl *ar)
+{
+        return ar->hif_priv;
+}
+
+/* pipe resource allocation/cleanup */
+static int ath6kl_usb_alloc_pipe_resources(struct ath6kl_usb_pipe *pipe,
+                                           int urb_cnt)
+{
+        struct ath6kl_urb_context *urb_context;
+        int status = 0, i;
+
+        INIT_LIST_HEAD(&pipe->urb_list_head);
+        init_usb_anchor(&pipe->urb_submitted);
+
+        for (i = 0; i < urb_cnt; i++) {
+                urb_context = kzalloc(sizeof(struct ath6kl_urb_context),
+                                      GFP_KERNEL);
+                if (urb_context == NULL)
+                        /* FIXME: set status to -ENOMEM */
+                        break;
+
+                urb_context->pipe = pipe;
+
+                /*
+                 * we are only allocate the urb contexts here, the actual URB
+                 * is allocated from the kernel as needed to do a transaction
+                 */
+                pipe->urb_alloc++;
+                ath6kl_usb_free_urb_to_pipe(pipe, urb_context);
+        }
+
+        ath6kl_dbg(ATH6KL_DBG_USB,
+                   "ath6kl usb: alloc resources lpipe:%d hpipe:0x%X urbs:%d\n",
+                   pipe->logical_pipe_num, pipe->usb_pipe_handle,
+                   pipe->urb_alloc);
+
+        return status;
+}
+
+static void ath6kl_usb_free_pipe_resources(struct ath6kl_usb_pipe *pipe)
+{
+        struct ath6kl_urb_context *urb_context;
+
+        if (pipe->ar_usb == NULL) {
+                /* nothing allocated for this pipe */
+                return;
+        }
+
+        ath6kl_dbg(ATH6KL_DBG_USB,
+                   "ath6kl usb: free resources lpipe:%d"
+                   "hpipe:0x%X urbs:%d avail:%d\n",
+                   pipe->logical_pipe_num, pipe->usb_pipe_handle,
+                   pipe->urb_alloc, pipe->urb_cnt);
+
+        if (pipe->urb_alloc != pipe->urb_cnt) {
+                ath6kl_dbg(ATH6KL_DBG_USB,
+                           "ath6kl usb: urb leak! lpipe:%d"
+                           "hpipe:0x%X urbs:%d avail:%d\n",
+                           pipe->logical_pipe_num, pipe->usb_pipe_handle,
+                           pipe->urb_alloc, pipe->urb_cnt);
+        }
+
+        while (true) {
+                urb_context = ath6kl_usb_alloc_urb_from_pipe(pipe);
+                if (urb_context == NULL)
+                        break;
+                kfree(urb_context);
+        }
+
+}
+
+static void ath6kl_usb_cleanup_pipe_resources(struct ath6kl_usb *ar_usb)
+{
+        int i;
+
+        for (i = 0; i < ATH6KL_USB_PIPE_MAX; i++)
+                ath6kl_usb_free_pipe_resources(&ar_usb->pipes[i]);
+
+}
+
+static u8 ath6kl_usb_get_logical_pipe_num(struct ath6kl_usb *ar_usb,
+                                          u8 ep_address, int *urb_count)
+{
+        u8 pipe_num = ATH6KL_USB_PIPE_INVALID;
+
+        switch (ep_address) {
+        case ATH6KL_USB_EP_ADDR_APP_CTRL_IN:
+                pipe_num = ATH6KL_USB_PIPE_RX_CTRL;
+                *urb_count = RX_URB_COUNT;
+                break;
+        case ATH6KL_USB_EP_ADDR_APP_DATA_IN:
+                pipe_num = ATH6KL_USB_PIPE_RX_DATA;
+                *urb_count = RX_URB_COUNT;
+                break;
+        case ATH6KL_USB_EP_ADDR_APP_INT_IN:
+                pipe_num = ATH6KL_USB_PIPE_RX_INT;
+                *urb_count = RX_URB_COUNT;
+                break;
+        case ATH6KL_USB_EP_ADDR_APP_DATA2_IN:
+                pipe_num = ATH6KL_USB_PIPE_RX_DATA2;
+                *urb_count = RX_URB_COUNT;
+                break;
+        case ATH6KL_USB_EP_ADDR_APP_CTRL_OUT:
+                pipe_num = ATH6KL_USB_PIPE_TX_CTRL;
+                *urb_count = TX_URB_COUNT;
+                break;
+        case ATH6KL_USB_EP_ADDR_APP_DATA_LP_OUT:
+                pipe_num = ATH6KL_USB_PIPE_TX_DATA_LP;
+                *urb_count = TX_URB_COUNT;
+                break;
+        case ATH6KL_USB_EP_ADDR_APP_DATA_MP_OUT:
+                pipe_num = ATH6KL_USB_PIPE_TX_DATA_MP;
+                *urb_count = TX_URB_COUNT;
+                break;
+        case ATH6KL_USB_EP_ADDR_APP_DATA_HP_OUT:
+                pipe_num = ATH6KL_USB_PIPE_TX_DATA_HP;
+                *urb_count = TX_URB_COUNT;
+                break;
+        default:
+                /* note: there may be endpoints not currently used */
+                break;
+        }
+
+        return pipe_num;
+}
+
+static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb)
+{
+        struct usb_interface *interface = ar_usb->interface;
+        struct usb_host_interface *iface_desc = interface->cur_altsetting;
+        struct usb_endpoint_descriptor *endpoint;
+        struct ath6kl_usb_pipe *pipe;
+        int i, urbcount, status = 0;
+        u8 pipe_num;
+
+        ath6kl_dbg(ATH6KL_DBG_USB, "setting up USB Pipes using interface\n");
+
+        /* walk decriptors and setup pipes */
+        for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+                endpoint = &iface_desc->endpoint[i].desc;
+
+                if (ATH6KL_USB_IS_BULK_EP(endpoint->bmAttributes)) {
+                        ath6kl_dbg(ATH6KL_DBG_USB,
+                                   "%s Bulk Ep:0x%2.2X maxpktsz:%d\n",
+                                   ATH6KL_USB_IS_DIR_IN
+                                   (endpoint->bEndpointAddress) ?
+                                   "RX" : "TX", endpoint->bEndpointAddress,
+                                   le16_to_cpu(endpoint->wMaxPacketSize));
+                } else if (ATH6KL_USB_IS_INT_EP(endpoint->bmAttributes)) {
+                        ath6kl_dbg(ATH6KL_DBG_USB,
+                                   "%s Int Ep:0x%2.2X maxpktsz:%d interval:%d\n",
+                                   ATH6KL_USB_IS_DIR_IN
+                                   (endpoint->bEndpointAddress) ?
+                                   "RX" : "TX", endpoint->bEndpointAddress,
+                                   le16_to_cpu(endpoint->wMaxPacketSize),
+                                   endpoint->bInterval);
+                } else if (ATH6KL_USB_IS_ISOC_EP(endpoint->bmAttributes)) {
+                        /* TODO for ISO */
+                        ath6kl_dbg(ATH6KL_DBG_USB,
+                                   "%s ISOC Ep:0x%2.2X maxpktsz:%d interval:%d\n",
+                                   ATH6KL_USB_IS_DIR_IN
+                                   (endpoint->bEndpointAddress) ?
+                                   "RX" : "TX", endpoint->bEndpointAddress,
+                                   le16_to_cpu(endpoint->wMaxPacketSize),
+                                   endpoint->bInterval);
+                }
+                urbcount = 0;
+
+                pipe_num =
+                    ath6kl_usb_get_logical_pipe_num(ar_usb,
+                                                    endpoint->bEndpointAddress,
+                                                    &urbcount);
+                if (pipe_num == ATH6KL_USB_PIPE_INVALID)
+                        continue;
+
+                pipe = &ar_usb->pipes[pipe_num];
+                if (pipe->ar_usb != NULL) {
+                        /* hmmm..pipe was already setup */
+                        continue;
+                }
+
+                pipe->ar_usb = ar_usb;
+                pipe->logical_pipe_num = pipe_num;
+                pipe->ep_address = endpoint->bEndpointAddress;
+                pipe->max_packet_size = le16_to_cpu(endpoint->wMaxPacketSize);
+
+                if (ATH6KL_USB_IS_BULK_EP(endpoint->bmAttributes)) {
+                        if (ATH6KL_USB_IS_DIR_IN(pipe->ep_address)) {
+                                pipe->usb_pipe_handle =
+                                    usb_rcvbulkpipe(ar_usb->udev,
+                                                    pipe->ep_address);
+                        } else {
+                                pipe->usb_pipe_handle =
+                                    usb_sndbulkpipe(ar_usb->udev,
+                                                    pipe->ep_address);
+                        }
+                } else if (ATH6KL_USB_IS_INT_EP(endpoint->bmAttributes)) {
+                        if (ATH6KL_USB_IS_DIR_IN(pipe->ep_address)) {
+                                pipe->usb_pipe_handle =
+                                    usb_rcvintpipe(ar_usb->udev,
+                                                   pipe->ep_address);
+                        } else {
+                                pipe->usb_pipe_handle =
+                                    usb_sndintpipe(ar_usb->udev,
+                                                   pipe->ep_address);
+                        }
+                } else if (ATH6KL_USB_IS_ISOC_EP(endpoint->bmAttributes)) {
+                        /* TODO for ISO */
+                        if (ATH6KL_USB_IS_DIR_IN(pipe->ep_address)) {
+                                pipe->usb_pipe_handle =
+                                    usb_rcvisocpipe(ar_usb->udev,
+                                                    pipe->ep_address);
+                        } else {
+                                pipe->usb_pipe_handle =
+                                    usb_sndisocpipe(ar_usb->udev,
+                                                    pipe->ep_address);
+                        }
+                }
+
+                pipe->ep_desc = endpoint;
+
+                if (!ATH6KL_USB_IS_DIR_IN(pipe->ep_address))
+                        pipe->flags |= ATH6KL_USB_PIPE_FLAG_TX;
+
+                status = ath6kl_usb_alloc_pipe_resources(pipe, urbcount);
+                if (status != 0)
+                        break;
+        }
+
+        return status;
+}
+
+/* pipe operations */
+static void ath6kl_usb_post_recv_transfers(struct ath6kl_usb_pipe *recv_pipe,
+                                           int buffer_length)
+{
+        struct ath6kl_urb_context *urb_context;
+        struct urb *urb;
+        int usb_status;
+
+        while (true) {
+                urb_context = ath6kl_usb_alloc_urb_from_pipe(recv_pipe);
+                if (urb_context == NULL)
+                        break;
+
+                urb_context->skb = dev_alloc_skb(buffer_length);
+                if (urb_context->skb == NULL)
+                        goto err_cleanup_urb;
+
+                urb = usb_alloc_urb(0, GFP_ATOMIC);
+                if (urb == NULL)
+                        goto err_cleanup_urb;
+
+                usb_fill_bulk_urb(urb,
+                                  recv_pipe->ar_usb->udev,
+                                  recv_pipe->usb_pipe_handle,
+                                  urb_context->skb->data,
+                                  buffer_length,
+                                  ath6kl_usb_recv_complete, urb_context);
+
+                ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                           "ath6kl usb: bulk recv submit:%d, 0x%X (ep:0x%2.2X), %d bytes buf:0x%p\n",
+                           recv_pipe->logical_pipe_num,
+                           recv_pipe->usb_pipe_handle, recv_pipe->ep_address,
+                           buffer_length, urb_context->skb);
+
+                usb_anchor_urb(urb, &recv_pipe->urb_submitted);
+                usb_status = usb_submit_urb(urb, GFP_ATOMIC);
+
+                if (usb_status) {
+                        ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                                   "ath6kl usb : usb bulk recv failed %d\n",
+                                   usb_status);
+                        usb_unanchor_urb(urb);
+                        usb_free_urb(urb);
+                        goto err_cleanup_urb;
+                }
+                usb_free_urb(urb);
+        }
+        return;
+
+err_cleanup_urb:
+        ath6kl_usb_cleanup_recv_urb(urb_context);
+        return;
+}
+
+static void ath6kl_usb_flush_all(struct ath6kl_usb *ar_usb)
+{
+        int i;
+
+        for (i = 0; i < ATH6KL_USB_PIPE_MAX; i++) {
+                if (ar_usb->pipes[i].ar_usb != NULL)
+                        usb_kill_anchored_urbs(&ar_usb->pipes[i].urb_submitted);
+        }
+
+        /*
+         * Flushing any pending I/O may schedule work this call will block
+         * until all scheduled work runs to completion.
+         */
+        flush_scheduled_work();
+}
+
+static void ath6kl_usb_start_recv_pipes(struct ath6kl_usb *ar_usb)
+{
+        /*
+         * note: control pipe is no longer used
+         * ar_usb->pipes[ATH6KL_USB_PIPE_RX_CTRL].urb_cnt_thresh =
+         *      ar_usb->pipes[ATH6KL_USB_PIPE_RX_CTRL].urb_alloc/2;
+         * ath6kl_usb_post_recv_transfers(&ar_usb->
+         *              pipes[ATH6KL_USB_PIPE_RX_CTRL],
+         *              ATH6KL_USB_RX_BUFFER_SIZE);
+         */
+
+        ar_usb->pipes[ATH6KL_USB_PIPE_RX_DATA].urb_cnt_thresh =
+            ar_usb->pipes[ATH6KL_USB_PIPE_RX_DATA].urb_alloc / 2;
+        ath6kl_usb_post_recv_transfers(&ar_usb->pipes[ATH6KL_USB_PIPE_RX_DATA],
+                                       ATH6KL_USB_RX_BUFFER_SIZE);
+}
+
+/* hif usb rx/tx completion functions */
+static void ath6kl_usb_recv_complete(struct urb *urb)
+{
+        struct ath6kl_urb_context *urb_context = urb->context;
+        struct ath6kl_usb_pipe *pipe = urb_context->pipe;
+        struct sk_buff *skb = NULL;
+        int status = 0;
+
+        ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                   "%s: recv pipe: %d, stat:%d, len:%d urb:0x%p\n", __func__,
+                   pipe->logical_pipe_num, urb->status, urb->actual_length,
+                   urb);
+
+        if (urb->status != 0) {
+                status = -EIO;
+                switch (urb->status) {
+                case -ECONNRESET:
+                case -ENOENT:
+                case -ESHUTDOWN:
+                        /*
+                         * no need to spew these errors when device
+                         * removed or urb killed due to driver shutdown
+                         */
+                        status = -ECANCELED;
+                        break;
+                default:
+                        ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                                   "%s recv pipe: %d (ep:0x%2.2X), failed:%d\n",
+                                   __func__, pipe->logical_pipe_num,
+                                   pipe->ep_address, urb->status);
+                        break;
+                }
+                goto cleanup_recv_urb;
+        }
+
+        if (urb->actual_length == 0)
+                goto cleanup_recv_urb;
+
+        skb = urb_context->skb;
+
+        /* we are going to pass it up */
+        urb_context->skb = NULL;
+        skb_put(skb, urb->actual_length);
+
+        /* note: queue implements a lock */
+        skb_queue_tail(&pipe->io_comp_queue, skb);
+        schedule_work(&pipe->io_complete_work);
+
+cleanup_recv_urb:
+        ath6kl_usb_cleanup_recv_urb(urb_context);
+
+        if (status == 0 &&
+            pipe->urb_cnt >= pipe->urb_cnt_thresh) {
+                /* our free urbs are piling up, post more transfers */
+                ath6kl_usb_post_recv_transfers(pipe, ATH6KL_USB_RX_BUFFER_SIZE);
+        }
+}
+
+static void ath6kl_usb_usb_transmit_complete(struct urb *urb)
+{
+        struct ath6kl_urb_context *urb_context = urb->context;
+        struct ath6kl_usb_pipe *pipe = urb_context->pipe;
+        struct sk_buff *skb;
+
+        ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                   "%s: pipe: %d, stat:%d, len:%d\n",
+                   __func__, pipe->logical_pipe_num, urb->status,
+                   urb->actual_length);
+
+        if (urb->status != 0) {
+                ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                           "%s:  pipe: %d, failed:%d\n",
+                           __func__, pipe->logical_pipe_num, urb->status);
+        }
+
+        skb = urb_context->skb;
+        urb_context->skb = NULL;
+        ath6kl_usb_free_urb_to_pipe(urb_context->pipe, urb_context);
+
+        /* note: queue implements a lock */
+        skb_queue_tail(&pipe->io_comp_queue, skb);
+        schedule_work(&pipe->io_complete_work);
+}
+
+static void ath6kl_usb_io_comp_work(struct work_struct *work)
+{
+        struct ath6kl_usb_pipe *pipe = container_of(work,
+                                                    struct ath6kl_usb_pipe,
+                                                    io_complete_work);
+        struct ath6kl_usb *ar_usb;
+        struct sk_buff *skb;
+
+        ar_usb = pipe->ar_usb;
+
+        while ((skb = skb_dequeue(&pipe->io_comp_queue))) {
+                if (pipe->flags & ATH6KL_USB_PIPE_FLAG_TX) {
+                        ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                                   "ath6kl usb xmit callback buf:0x%p\n", skb);
+                        ath6kl_core_tx_complete(ar_usb->ar, skb);
+                } else {
+                        ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                                   "ath6kl usb recv callback buf:0x%p\n", skb);
+                        ath6kl_core_rx_complete(ar_usb->ar, skb,
+                                                pipe->logical_pipe_num);
+                }
+        }
+}
+
 #define ATH6KL_USB_MAX_DIAG_CMD (sizeof(struct ath6kl_usb_ctrl_diag_cmd_write))
 #define ATH6KL_USB_MAX_DIAG_RESP (sizeof(struct ath6kl_usb_ctrl_diag_resp_read))
 
 static void ath6kl_usb_destroy(struct ath6kl_usb *ar_usb)
 {
+        ath6kl_usb_flush_all(ar_usb);
+
+        ath6kl_usb_cleanup_pipe_resources(ar_usb);
+
         usb_set_intfdata(ar_usb->interface, NULL);
 
         kfree(ar_usb->diag_cmd_buffer);
@@ -70,19 +614,28 @@ static void ath6kl_usb_destroy(struct ath6kl_usb *ar_usb)
 
 static struct ath6kl_usb *ath6kl_usb_create(struct usb_interface *interface)
 {
-        struct ath6kl_usb *ar_usb = NULL;
         struct usb_device *dev = interface_to_usbdev(interface);
+        struct ath6kl_usb *ar_usb;
+        struct ath6kl_usb_pipe *pipe;
         int status = 0;
+        int i;
 
         ar_usb = kzalloc(sizeof(struct ath6kl_usb), GFP_KERNEL);
         if (ar_usb == NULL)
                 goto fail_ath6kl_usb_create;
 
-        memset(ar_usb, 0, sizeof(struct ath6kl_usb));
         usb_set_intfdata(interface, ar_usb);
+        spin_lock_init(&(ar_usb->cs_lock));
         ar_usb->udev = dev;
         ar_usb->interface = interface;
 
+        for (i = 0; i < ATH6KL_USB_PIPE_MAX; i++) {
+                pipe = &ar_usb->pipes[i];
+                INIT_WORK(&pipe->io_complete_work,
+                          ath6kl_usb_io_comp_work);
+                skb_queue_head_init(&pipe->io_comp_queue);
+        }
+
         ar_usb->diag_cmd_buffer = kzalloc(ATH6KL_USB_MAX_DIAG_CMD, GFP_KERNEL);
         if (ar_usb->diag_cmd_buffer == NULL) {
                 status = -ENOMEM;
@@ -96,6 +649,8 @@ static struct ath6kl_usb *ath6kl_usb_create(struct usb_interface *interface)
                 goto fail_ath6kl_usb_create;
         }
 
+        status = ath6kl_usb_setup_pipe_resources(ar_usb);
+
 fail_ath6kl_usb_create:
         if (status != 0) {
                 ath6kl_usb_destroy(ar_usb);
@@ -114,11 +669,177 @@ static void ath6kl_usb_device_detached(struct usb_interface *interface)
 
         ath6kl_stop_txrx(ar_usb->ar);
 
+        /* Delay to wait for the target to reboot */
+        mdelay(20);
         ath6kl_core_cleanup(ar_usb->ar);
-
         ath6kl_usb_destroy(ar_usb);
 }
 
+/* exported hif usb APIs for htc pipe */
+static void hif_start(struct ath6kl *ar)
+{
+        struct ath6kl_usb *device = ath6kl_usb_priv(ar);
+        int i;
+
+        ath6kl_usb_start_recv_pipes(device);
+
+        /* set the TX resource avail threshold for each TX pipe */
+        for (i = ATH6KL_USB_PIPE_TX_CTRL;
+             i <= ATH6KL_USB_PIPE_TX_DATA_HP; i++) {
+                device->pipes[i].urb_cnt_thresh =
+                    device->pipes[i].urb_alloc / 2;
+        }
+}
+
+static int ath6kl_usb_send(struct ath6kl *ar, u8 PipeID,
+                           struct sk_buff *hdr_skb, struct sk_buff *skb)
+{
+        struct ath6kl_usb *device = ath6kl_usb_priv(ar);
+        struct ath6kl_usb_pipe *pipe = &device->pipes[PipeID];
+        struct ath6kl_urb_context *urb_context;
+        int usb_status, status = 0;
+        struct urb *urb;
+        u8 *data;
+        u32 len;
+
+        ath6kl_dbg(ATH6KL_DBG_USB_BULK, "+%s pipe : %d, buf:0x%p\n",
+                   __func__, PipeID, skb);
+
+        urb_context = ath6kl_usb_alloc_urb_from_pipe(pipe);
+
+        if (urb_context == NULL) {
+                /*
+                 * TODO: it is possible to run out of urbs if
+                 * 2 endpoints map to the same pipe ID
+                 */
+                ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                           "%s pipe:%d no urbs left. URB Cnt : %d\n",
+                           __func__, PipeID, pipe->urb_cnt);
+                status = -ENOMEM;
+                goto fail_hif_send;
+        }
+
+        urb_context->skb = skb;
+
+        data = skb->data;
+        len = skb->len;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (urb == NULL) {
+                status = -ENOMEM;
+                ath6kl_usb_free_urb_to_pipe(urb_context->pipe,
+                                            urb_context);
+                goto fail_hif_send;
+        }
+
+        usb_fill_bulk_urb(urb,
+                          device->udev,
+                          pipe->usb_pipe_handle,
+                          data,
+                          len,
+                          ath6kl_usb_usb_transmit_complete, urb_context);
+
+        if ((len % pipe->max_packet_size) == 0) {
+                /* hit a max packet boundary on this pipe */
+                urb->transfer_flags |= URB_ZERO_PACKET;
+        }
+
+        ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                   "athusb bulk send submit:%d, 0x%X (ep:0x%2.2X), %d bytes\n",
+                   pipe->logical_pipe_num, pipe->usb_pipe_handle,
+                   pipe->ep_address, len);
+
+        usb_anchor_urb(urb, &pipe->urb_submitted);
+        usb_status = usb_submit_urb(urb, GFP_ATOMIC);
+
+        if (usb_status) {
+                ath6kl_dbg(ATH6KL_DBG_USB_BULK,
+                           "ath6kl usb : usb bulk transmit failed %d\n",
+                           usb_status);
+                usb_unanchor_urb(urb);
+                ath6kl_usb_free_urb_to_pipe(urb_context->pipe,
+                                            urb_context);
+                status = -EINVAL;
+        }
+        usb_free_urb(urb);
+
+fail_hif_send:
+        return status;
+}
+
+static void hif_stop(struct ath6kl *ar)
+{
+        struct ath6kl_usb *device = ath6kl_usb_priv(ar);
+
+        ath6kl_usb_flush_all(device);
+}
+
+static void ath6kl_usb_get_default_pipe(struct ath6kl *ar,
+                                        u8 *ul_pipe, u8 *dl_pipe)
+{
+        *ul_pipe = ATH6KL_USB_PIPE_TX_CTRL;
+        *dl_pipe = ATH6KL_USB_PIPE_RX_CTRL;
+}
+
+static int ath6kl_usb_map_service_pipe(struct ath6kl *ar, u16 svc_id,
+                                       u8 *ul_pipe, u8 *dl_pipe)
+{
+        int status = 0;
+
+        switch (svc_id) {
+        case HTC_CTRL_RSVD_SVC:
+        case WMI_CONTROL_SVC:
+                *ul_pipe = ATH6KL_USB_PIPE_TX_CTRL;
+                /* due to large control packets, shift to data pipe */
+                *dl_pipe = ATH6KL_USB_PIPE_RX_DATA;
+                break;
+        case WMI_DATA_BE_SVC:
+        case WMI_DATA_BK_SVC:
+                *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_LP;
+                /*
+                * Disable rxdata2 directly, it will be enabled
+                * if FW enable rxdata2
+                */
+                *dl_pipe = ATH6KL_USB_PIPE_RX_DATA;
+                break;
+        case WMI_DATA_VI_SVC:
+                *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_MP;
+                /*
+                * Disable rxdata2 directly, it will be enabled
+                * if FW enable rxdata2
+                */
+                *dl_pipe = ATH6KL_USB_PIPE_RX_DATA;
+                break;
+        case WMI_DATA_VO_SVC:
+                *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_HP;
+                /*
+                * Disable rxdata2 directly, it will be enabled
+                * if FW enable rxdata2
+                */
+                *dl_pipe = ATH6KL_USB_PIPE_RX_DATA;
+                break;
+        default:
+                status = -EPERM;
+                break;
+        }
+
+        return status;
+}
+
+static u16 ath6kl_usb_get_free_queue_number(struct ath6kl *ar, u8 pipe_id)
+{
+        struct ath6kl_usb *device = ath6kl_usb_priv(ar);
+
+        return device->pipes[pipe_id].urb_cnt;
+}
+
+static void hif_detach_htc(struct ath6kl *ar)
+{
+        struct ath6kl_usb *device = ath6kl_usb_priv(ar);
+
+        ath6kl_usb_flush_all(device);
+}
+
 static int ath6kl_usb_submit_ctrl_out(struct ath6kl_usb *ar_usb,
                                    u8 req, u16 value, u16 index, void *data,
                                    u32 size)
@@ -301,14 +1022,21 @@ static int ath6kl_usb_bmi_write(struct ath6kl *ar, u8 *buf, u32 len)
 
 static int ath6kl_usb_power_on(struct ath6kl *ar)
 {
+        hif_start(ar);
         return 0;
 }
 
 static int ath6kl_usb_power_off(struct ath6kl *ar)
 {
+        hif_detach_htc(ar);
         return 0;
 }
 
+static void ath6kl_usb_stop(struct ath6kl *ar)
+{
+        hif_stop(ar);
+}
+
 static const struct ath6kl_hif_ops ath6kl_usb_ops = {
         .diag_read32 = ath6kl_usb_diag_read32,
         .diag_write32 = ath6kl_usb_diag_write32,
@@ -316,6 +1044,11 @@ static const struct ath6kl_hif_ops ath6kl_usb_ops = {
         .bmi_write = ath6kl_usb_bmi_write,
         .power_on = ath6kl_usb_power_on,
         .power_off = ath6kl_usb_power_off,
+        .stop = ath6kl_usb_stop,
+        .pipe_send = ath6kl_usb_send,
+        .pipe_get_default = ath6kl_usb_get_default_pipe,
+        .pipe_map_service = ath6kl_usb_map_service_pipe,
+        .pipe_get_free_queue_number = ath6kl_usb_get_free_queue_number,
 };
 
 /* ath6kl usb driver registered functions */
@@ -368,7 +1101,7 @@ static int ath6kl_usb_probe(struct usb_interface *interface,
 
         ar_usb->ar = ar;
 
-        ret = ath6kl_core_init(ar);
+        ret = ath6kl_core_init(ar, ATH6KL_HTC_TYPE_PIPE);
         if (ret) {
                 ath6kl_err("Failed to init ath6kl core: %d\n", ret);
                 goto err_core_free;
@@ -392,6 +1125,46 @@ static void ath6kl_usb_remove(struct usb_interface *interface)
         ath6kl_usb_device_detached(interface);
 }
 
+#ifdef CONFIG_PM
+
+static int ath6kl_usb_suspend(struct usb_interface *interface,
+                              pm_message_t message)
+{
+        struct ath6kl_usb *device;
+        device = usb_get_intfdata(interface);
+
+        ath6kl_usb_flush_all(device);
+        return 0;
+}
+
+static int ath6kl_usb_resume(struct usb_interface *interface)
+{
+        struct ath6kl_usb *device;
+        device = usb_get_intfdata(interface);
+
+        ath6kl_usb_post_recv_transfers(&device->pipes[ATH6KL_USB_PIPE_RX_DATA],
+                                       ATH6KL_USB_RX_BUFFER_SIZE);
+        ath6kl_usb_post_recv_transfers(&device->pipes[ATH6KL_USB_PIPE_RX_DATA2],
+                                       ATH6KL_USB_RX_BUFFER_SIZE);
+
+        return 0;
+}
+
+static int ath6kl_usb_reset_resume(struct usb_interface *intf)
+{
+        if (usb_get_intfdata(intf))
+                ath6kl_usb_remove(intf);
+        return 0;
+}
+
+#else
+
+#define ath6kl_usb_suspend NULL
+#define ath6kl_usb_resume NULL
+#define ath6kl_usb_reset_resume NULL
+
+#endif
+
 /* table of devices that work with this driver */
 static struct usb_device_id ath6kl_usb_ids[] = {
         {USB_DEVICE(0x0cf3, 0x9374)},
@@ -403,8 +1176,12 @@ MODULE_DEVICE_TABLE(usb, ath6kl_usb_ids);
 static struct usb_driver ath6kl_usb_driver = {
         .name = "ath6kl_usb",
         .probe = ath6kl_usb_probe,
+        .suspend = ath6kl_usb_suspend,
+        .resume = ath6kl_usb_resume,
+        .reset_resume = ath6kl_usb_reset_resume,
         .disconnect = ath6kl_usb_remove,
         .id_table = ath6kl_usb_ids,
+        .supports_autosuspend = true,
 };
 
 static int ath6kl_usb_init(void)
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 2b442332cd0f..7c8a9977faf5 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -2882,6 +2882,43 @@ int ath6kl_wmi_set_keepalive_cmd(struct wmi *wmi, u8 if_idx,
         return ret;
 }
 
+int ath6kl_wmi_set_htcap_cmd(struct wmi *wmi, u8 if_idx,
+                             enum ieee80211_band band,
+                             struct ath6kl_htcap *htcap)
+{
+        struct sk_buff *skb;
+        struct wmi_set_htcap_cmd *cmd;
+
+        skb = ath6kl_wmi_get_new_buf(sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        cmd = (struct wmi_set_htcap_cmd *) skb->data;
+
+        /*
+         * NOTE: Band in firmware matches enum ieee80211_band, it is unlikely
+         * this will be changed in firmware. If at all there is any change in
+         * band value, the host needs to be fixed.
+         */
+        cmd->band = band;
+        cmd->ht_enable = !!htcap->ht_enable;
+        cmd->ht20_sgi = !!(htcap->cap_info & IEEE80211_HT_CAP_SGI_20);
+        cmd->ht40_supported =
+                !!(htcap->cap_info & IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+        cmd->ht40_sgi = !!(htcap->cap_info & IEEE80211_HT_CAP_SGI_40);
+        cmd->intolerant_40mhz =
+                !!(htcap->cap_info & IEEE80211_HT_CAP_40MHZ_INTOLERANT);
+        cmd->max_ampdu_len_exp = htcap->ampdu_factor;
+
+        ath6kl_dbg(ATH6KL_DBG_WMI,
+                   "Set htcap: band:%d ht_enable:%d 40mhz:%d sgi_20mhz:%d sgi_40mhz:%d 40mhz_intolerant:%d ampdu_len_exp:%d\n",
+                   cmd->band, cmd->ht_enable, cmd->ht40_supported,
+                   cmd->ht20_sgi, cmd->ht40_sgi, cmd->intolerant_40mhz,
+                   cmd->max_ampdu_len_exp);
+        return ath6kl_wmi_cmd_send(wmi, if_idx, skb, WMI_SET_HT_CAP_CMDID,
+                                   NO_SYNC_WMIFLAG);
+}
+
 int ath6kl_wmi_test_cmd(struct wmi *wmi, void *buf, size_t len)
 {
         struct sk_buff *skb;
@@ -3032,6 +3069,9 @@ int ath6kl_wmi_ap_set_mlme(struct wmi *wmip, u8 if_idx, u8 cmd, const u8 *mac,
         cm->reason = cpu_to_le16(reason);
         cm->cmd = cmd;
 
+        ath6kl_dbg(ATH6KL_DBG_WMI, "ap_set_mlme: cmd=%d reason=%d\n", cm->cmd,
+                   cm->reason);
+
         return ath6kl_wmi_cmd_send(wmip, if_idx, skb, WMI_AP_SET_MLME_CMDID,
                                    NO_SYNC_WMIFLAG);
 }
@@ -3181,6 +3221,29 @@ int ath6kl_wmi_set_appie_cmd(struct wmi *wmi, u8 if_idx, u8 mgmt_frm_type,
                                    NO_SYNC_WMIFLAG);
 }
 
+int ath6kl_wmi_set_ie_cmd(struct wmi *wmi, u8 if_idx, u8 ie_id, u8 ie_field,
+                          const u8 *ie_info, u8 ie_len)
+{
+        struct sk_buff *skb;
+        struct wmi_set_ie_cmd *p;
+
+        skb = ath6kl_wmi_get_new_buf(sizeof(*p) + ie_len);
+        if (!skb)
+                return -ENOMEM;
+
+        ath6kl_dbg(ATH6KL_DBG_WMI, "set_ie_cmd: ie_id=%u ie_ie_field=%u ie_len=%u\n",
+                   ie_id, ie_field, ie_len);
+        p = (struct wmi_set_ie_cmd *) skb->data;
+        p->ie_id = ie_id;
+        p->ie_field = ie_field;
+        p->ie_len = ie_len;
+        if (ie_info && ie_len > 0)
+                memcpy(p->ie_info, ie_info, ie_len);
+
+        return ath6kl_wmi_cmd_send(wmi, if_idx, skb, WMI_SET_IE_CMDID,
+                                   NO_SYNC_WMIFLAG);
+}
+
 int ath6kl_wmi_disable_11b_rates_cmd(struct wmi *wmi, bool disable)
 {
         struct sk_buff *skb;
@@ -3392,6 +3455,23 @@ int ath6kl_wmi_cancel_remain_on_chnl_cmd(struct wmi *wmi, u8 if_idx)
                                      WMI_CANCEL_REMAIN_ON_CHNL_CMDID);
 }
 
+int ath6kl_wmi_set_inact_period(struct wmi *wmi, u8 if_idx, int inact_timeout)
+{
+        struct sk_buff *skb;
+        struct wmi_set_inact_period_cmd *cmd;
+
+        skb = ath6kl_wmi_get_new_buf(sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        cmd = (struct wmi_set_inact_period_cmd *) skb->data;
+        cmd->inact_period = cpu_to_le32(inact_timeout);
+        cmd->num_null_func = 0;
+
+        return ath6kl_wmi_cmd_send(wmi, if_idx, skb, WMI_AP_CONN_INACT_CMDID,
+                                   NO_SYNC_WMIFLAG);
+}
+
 static int ath6kl_wmi_control_rx_xtnd(struct wmi *wmi, struct sk_buff *skb)
 {
         struct wmix_cmd_hdr *cmd;
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h
index 4092e3e80790..d3d2ab5c1689 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.h
+++ b/drivers/net/wireless/ath/ath6kl/wmi.h
@@ -182,6 +182,9 @@ enum wmi_data_hdr_flags {
 #define WMI_DATA_HDR_META_MASK      0x7
 #define WMI_DATA_HDR_META_SHIFT     13
 
+#define WMI_DATA_HDR_PAD_BEFORE_DATA_MASK               0xFF
+#define WMI_DATA_HDR_PAD_BEFORE_DATA_SHIFT              0x8
+
 /* Macros for operating on WMI_DATA_HDR (info3) field */
 #define WMI_DATA_HDR_IF_IDX_MASK    0xF
 
@@ -423,6 +426,7 @@ enum wmi_cmd_id {
         WMI_SET_FRAMERATES_CMDID,
         WMI_SET_AP_PS_CMDID,
         WMI_SET_QOS_SUPP_CMDID,
+        WMI_SET_IE_CMDID,
 
         /* WMI_THIN_RESERVED_... mark the start and end
          * values for WMI_THIN_RESERVED command IDs. These
@@ -629,6 +633,11 @@ enum wmi_mgmt_frame_type {
         WMI_NUM_MGMT_FRAME
 };
 
+enum wmi_ie_field_type {
+        WMI_RSN_IE_CAPB = 0x1,
+        WMI_IE_FULL     = 0xFF,  /* indicats full IE */
+};
+
 /* WMI_CONNECT_CMDID  */
 enum network_type {
         INFRA_NETWORK = 0x01,
@@ -1268,6 +1277,16 @@ struct wmi_mcast_filter_add_del_cmd {
         u8 mcast_mac[ATH6KL_MCAST_FILTER_MAC_ADDR_SIZE];
 } __packed;
 
+struct wmi_set_htcap_cmd {
+        u8 band;
+        u8 ht_enable;
+        u8 ht40_supported;
+        u8 ht20_sgi;
+        u8 ht40_sgi;
+        u8 intolerant_40mhz;
+        u8 max_ampdu_len_exp;
+} __packed;
+
 /* Command Replies */
 
 /* WMI_GET_CHANNEL_LIST_CMDID reply */
@@ -1913,6 +1932,14 @@ struct wmi_set_appie_cmd {
         u8 ie_info[0];
 } __packed;
 
+struct wmi_set_ie_cmd {
+        u8 ie_id;
+        u8 ie_field;    /* enum wmi_ie_field_type */
+        u8 ie_len;
+        u8 reserved;
+        u8 ie_info[0];
+} __packed;
+
 /* Notify the WSC registration status to the target */
 #define WSC_REG_ACTIVE     1
 #define WSC_REG_INACTIVE   0
@@ -2141,6 +2168,11 @@ struct wmi_ap_hidden_ssid_cmd {
         u8 hidden_ssid;
 } __packed;
 
+struct wmi_set_inact_period_cmd {
+        __le32 inact_period;
+        u8 num_null_func;
+} __packed;
+
 /* AP mode events */
 struct wmi_ap_set_apsd_cmd {
         u8 enable;
@@ -2465,6 +2497,9 @@ int ath6kl_wmi_get_roam_tbl_cmd(struct wmi *wmi);
 int ath6kl_wmi_set_wmm_txop(struct wmi *wmi, u8 if_idx, enum wmi_txop_cfg cfg);
 int ath6kl_wmi_set_keepalive_cmd(struct wmi *wmi, u8 if_idx,
                                  u8 keep_alive_intvl);
+int ath6kl_wmi_set_htcap_cmd(struct wmi *wmi, u8 if_idx,
+                             enum ieee80211_band band,
+                             struct ath6kl_htcap *htcap);
 int ath6kl_wmi_test_cmd(struct wmi *wmi, void *buf, size_t len);
 
 s32 ath6kl_wmi_get_rate(s8 rate_index);
@@ -2515,6 +2550,9 @@ int ath6kl_wmi_set_rx_frame_format_cmd(struct wmi *wmi, u8 if_idx,
 int ath6kl_wmi_set_appie_cmd(struct wmi *wmi, u8 if_idx, u8 mgmt_frm_type,
                              const u8 *ie, u8 ie_len);
 
+int ath6kl_wmi_set_ie_cmd(struct wmi *wmi, u8 if_idx, u8 ie_id, u8 ie_field,
+                          const u8 *ie_info, u8 ie_len);
+
 /* P2P */
 int ath6kl_wmi_disable_11b_rates_cmd(struct wmi *wmi, bool disable);
 
@@ -2538,6 +2576,8 @@ int ath6kl_wmi_cancel_remain_on_chnl_cmd(struct wmi *wmi, u8 if_idx);
 int ath6kl_wmi_set_appie_cmd(struct wmi *wmi, u8 if_idx, u8 mgmt_frm_type,
                              const u8 *ie, u8 ie_len);
 
+int ath6kl_wmi_set_inact_period(struct wmi *wmi, u8 if_idx, int inact_timeout);
+
 void ath6kl_wmi_sscan_timer(unsigned long ptr);
 
 struct ath6kl_vif *ath6kl_get_vif_by_index(struct ath6kl *ar, u8 if_idx);
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 47a9fb4a116a..b4c77f9d7470 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -274,7 +274,9 @@ static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel)
                 aniState->rssiThrLow, aniState->rssiThrHigh);
 
         if (aniState->update_ani)
-                aniState->ofdmNoiseImmunityLevel = immunityLevel;
+                aniState->ofdmNoiseImmunityLevel =
+                        (immunityLevel > ATH9K_ANI_OFDM_DEF_LEVEL) ?
+                        immunityLevel : ATH9K_ANI_OFDM_DEF_LEVEL;
 
         entry_ofdm = &ofdm_level_table[aniState->ofdmNoiseImmunityLevel];
         entry_cck = &cck_level_table[aniState->cckNoiseImmunityLevel];
@@ -340,7 +342,9 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel)
                 immunityLevel = ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI;
 
         if (aniState->update_ani)
-                aniState->cckNoiseImmunityLevel = immunityLevel;
+                aniState->cckNoiseImmunityLevel =
+                        (immunityLevel > ATH9K_ANI_CCK_DEF_LEVEL) ?
+                        immunityLevel : ATH9K_ANI_CCK_DEF_LEVEL;
 
         entry_ofdm = &ofdm_level_table[aniState->ofdmNoiseImmunityLevel];
         entry_cck = &cck_level_table[aniState->cckNoiseImmunityLevel];
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 52ff5caf2d0b..de30cb34b8f3 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -245,7 +245,6 @@ static int ar5008_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
         REG_WRITE(ah, AR_PHY(0x37), reg32);
 
         ah->curchan = chan;
-        ah->curchan_rad_index = -1;
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
index aa2abaf31cba..8d78253c26ce 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -136,6 +136,7 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
         }
 
         if (sync_cause) {
+                ath9k_debug_sync_cause(common, sync_cause);
                 fatal_int =
                         (sync_cause &
                          (AR_INTR_SYNC_HOST1_FATAL | AR_INTR_SYNC_HOST1_PERR))
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index 3cbbb033fcea..846dd7974eb8 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -152,7 +152,6 @@ static int ar9002_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
         REG_WRITE(ah, AR_PHY_SYNTH_CONTROL, reg32);
 
         ah->curchan = chan;
-        ah->curchan_rad_index = -1;
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 6bb4db052bb0..1188db205e32 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -30,11 +30,6 @@
 #define CTL_11A_EXT (CTL_11A | EXT_ADDITIVE)
 #define CTL_11G_EXT (CTL_11G | EXT_ADDITIVE)
 #define CTL_11B_EXT (CTL_11B | EXT_ADDITIVE)
-#define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6  /* 10*log10(2)*2 */
-#define REDUCE_SCALED_POWER_BY_THREE_CHAIN   9  /* 10*log10(3)*2 */
-#define PWRINCR_3_TO_1_CHAIN      9             /* 10*log(3)*2 */
-#define PWRINCR_3_TO_2_CHAIN      3             /* floor(10*log(3/2)*2) */
-#define PWRINCR_2_TO_1_CHAIN      6             /* 10*log(2)*2 */
 
 #define SUB_NUM_CTL_MODES_AT_5G_40 2    /* excluding HT40, EXT-OFDM */
 #define SUB_NUM_CTL_MODES_AT_2G_40 3    /* excluding HT40, EXT-OFDM, EXT-CCK */
@@ -2936,15 +2931,6 @@ static const struct ar9300_eeprom *ar9003_eeprom_struct_find_by_id(int id)
 #undef N_LOOP
 }
 
-
-static u16 ath9k_hw_fbin2freq(u8 fbin, bool is2GHz)
-{
-        if (fbin == AR5416_BCHAN_UNUSED)
-                return fbin;
-
-        return (u16) ((is2GHz) ? (2300 + fbin) : (4800 + 5 * fbin));
-}
-
 static int ath9k_hw_ar9300_check_eeprom(struct ath_hw *ah)
 {
         return 0;
@@ -4070,7 +4056,7 @@ static u8 ar9003_hw_eeprom_get_tgt_pwr(struct ath_hw *ah,
          * targetpower piers stored on eeprom
          */
         for (i = 0; i < numPiers; i++) {
-                freqArray[i] = FBIN2FREQ(pFreqBin[i], is2GHz);
+                freqArray[i] = ath9k_hw_fbin2freq(pFreqBin[i], is2GHz);
                 targetPowerArray[i] = pEepromTargetPwr[i].tPow2x[rateIndex];
         }
 
@@ -4106,7 +4092,7 @@ static u8 ar9003_hw_eeprom_get_ht20_tgt_pwr(struct ath_hw *ah,
          * from targetpower piers stored on eeprom
          */
         for (i = 0; i < numPiers; i++) {
-                freqArray[i] = FBIN2FREQ(pFreqBin[i], is2GHz);
+                freqArray[i] = ath9k_hw_fbin2freq(pFreqBin[i], is2GHz);
                 targetPowerArray[i] = pEepromTargetPwr[i].tPow2x[rateIndex];
         }
 
@@ -4142,7 +4128,7 @@ static u8 ar9003_hw_eeprom_get_ht40_tgt_pwr(struct ath_hw *ah,
          * targetpower piers stored on eeprom
          */
         for (i = 0; i < numPiers; i++) {
-                freqArray[i] = FBIN2FREQ(pFreqBin[i], is2GHz);
+                freqArray[i] = ath9k_hw_fbin2freq(pFreqBin[i], is2GHz);
                 targetPowerArray[i] = pEepromTargetPwr[i].tPow2x[rateIndex];
         }
 
@@ -4167,7 +4153,7 @@ static u8 ar9003_hw_eeprom_get_cck_tgt_pwr(struct ath_hw *ah,
          * targetpower piers stored on eeprom
          */
         for (i = 0; i < numPiers; i++) {
-                freqArray[i] = FBIN2FREQ(pFreqBin[i], 1);
+                freqArray[i] = ath9k_hw_fbin2freq(pFreqBin[i], 1);
                 targetPowerArray[i] = pEepromTargetPwr[i].tPow2x[rateIndex];
         }
 
@@ -4464,7 +4450,7 @@ static int ar9003_hw_cal_pier_get(struct ath_hw *ah,
                 is2GHz = 1;
         }
 
-        *pfrequency = FBIN2FREQ(*pCalPier, is2GHz);
+        *pfrequency = ath9k_hw_fbin2freq(*pCalPier, is2GHz);
         *pcorrection = pCalPierStruct->refPower;
         *ptemperature = pCalPierStruct->tempMeas;
         *pvoltage = pCalPierStruct->voltMeas;
@@ -4789,30 +4775,8 @@ static void ar9003_hw_set_power_per_rate_table(struct ath_hw *ah,
         bool is2ghz = IS_CHAN_2GHZ(chan);
 
         ath9k_hw_get_channel_centers(ah, chan, &centers);
-        scaledPower = powerLimit - antenna_reduction;
-
-        /*
-         * Reduce scaled Power by number of chains active to get
-         * to per chain tx power level
-         */
-        switch (ar5416_get_ntxchains(ah->txchainmask)) {
-        case 1:
-                break;
-        case 2:
-                if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
-                        scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
-                else
-                        scaledPower = 0;
-                break;
-        case 3:
-                if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
-                        scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
-                else
-                        scaledPower = 0;
-                break;
-        }
-
-        scaledPower = max((u16)0, scaledPower);
+        scaledPower = ath9k_hw_get_scaled_power(ah, powerLimit,
+                                                antenna_reduction);
 
         /*
          * Get target powers from EEPROM - our baseline for TX Power
@@ -5060,8 +5024,6 @@ static void ath9k_hw_ar9300_set_txpower(struct ath_hw *ah,
                         i, targetPowerValT2[i]);
         }
 
-        ah->txpower_limit = regulatory->max_power_level;
-
         /* Write target power array to registers */
         ar9003_hw_tx_power_regwrite(ah, targetPowerValT2);
         ar9003_hw_calibration_apply(ah, chan->channel);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index bb223fe82816..2505ac44f0c1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -42,7 +42,6 @@
 #define AR9300_EEPMISC_WOW           0x02
 #define AR9300_CUSTOMER_DATA_SIZE    20
 
-#define FBIN2FREQ(x, y) ((y) ? (2300 + x) : (4800 + 5 * x))
 #define AR9300_MAX_CHAINS            3
 #define AR9300_ANT_16S               25
 #define AR9300_FUTURE_MODAL_SZ       6
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 0f56e322dd3b..a0e3394b10dc 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -305,11 +305,6 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                                 ar9462_common_rx_gain_table_2p0,
                                 ARRAY_SIZE(ar9462_common_rx_gain_table_2p0), 2);
 
-                INIT_INI_ARRAY(&ah->ini_BTCOEX_MAX_TXPWR,
-                                ar9462_2p0_BTCOEX_MAX_TXPWR_table,
-                                ARRAY_SIZE(ar9462_2p0_BTCOEX_MAX_TXPWR_table),
-                                2);
-
                 /* Awake -> Sleep Setting */
                 INIT_INI_ARRAY(&ah->iniPcieSerdes,
                                 PCIE_PLL_ON_CREQ_DIS_L1_2P0,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index a66a13b76848..d9e0824af093 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -306,6 +306,8 @@ static bool ar9003_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                 ar9003_mci_get_isr(ah, masked);
 
         if (sync_cause) {
+                ath9k_debug_sync_cause(common, sync_cause);
+
                 if (sync_cause & AR_INTR_SYNC_RADM_CPL_TIMEOUT) {
                         REG_WRITE(ah, AR_RC, AR_RC_HOSTIF);
                         REG_WRITE(ah, AR_RC, 0);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 79070bf04eab..bbda25f4e9f0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -152,7 +152,6 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
         REG_WRITE(ah, AR_PHY_65NM_CH0_SYNTH7, reg32);
 
         ah->curchan = chan;
-        ah->curchan_rad_index = -1;
 
         return 0;
 }
@@ -209,11 +208,12 @@ static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
                         continue;
                 negative = 0;
                 if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah))
-                        cur_bb_spur = FBIN2FREQ(spur_fbin_ptr[i],
-                                        IS_CHAN_2GHZ(chan)) - synth_freq;
+                        cur_bb_spur = ath9k_hw_fbin2freq(spur_fbin_ptr[i],
+                                                         IS_CHAN_2GHZ(chan));
                 else
-                        cur_bb_spur = spur_freq[i] - synth_freq;
+                        cur_bb_spur = spur_freq[i];
 
+                cur_bb_spur -= synth_freq;
                 if (cur_bb_spur < 0) {
                         negative = 1;
                         cur_bb_spur = -cur_bb_spur;
@@ -443,7 +443,8 @@ static void ar9003_hw_spur_mitigate_ofdm(struct ath_hw *ah,
         ar9003_hw_spur_ofdm_clear(ah);
 
         for (i = 0; i < AR_EEPROM_MODAL_SPURS && spurChansPtr[i]; i++) {
-                freq_offset = FBIN2FREQ(spurChansPtr[i], mode) - synth_freq;
+                freq_offset = ath9k_hw_fbin2freq(spurChansPtr[i], mode);
+                freq_offset -= synth_freq;
                 if (abs(freq_offset) < range) {
                         ar9003_hw_spur_ofdm_work(ah, chan, freq_offset);
                         break;
@@ -684,9 +685,6 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
 
         REG_WRITE_ARRAY(&ah->iniAdditional, 1, regWrites);
 
-        if (AR_SREV_9462(ah))
-                ar9003_hw_prog_ini(ah, &ah->ini_BTCOEX_MAX_TXPWR, 1);
-
         if (chan->channel == 2484)
                 ar9003_hw_prog_ini(ah, &ah->ini_japan2484, 1);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index b6ba1e8149be..1d6658e139b5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -1115,9 +1115,9 @@ static const u32 ar9462_2p0_mac_core[][2] = {
         {0x000081f8, 0x00000000},
         {0x000081fc, 0x00000000},
         {0x00008240, 0x00100000},
-        {0x00008244, 0x0010f400},
+        {0x00008244, 0x0010f424},
         {0x00008248, 0x00000800},
-        {0x0000824c, 0x0001e800},
+        {0x0000824c, 0x0001e848},
         {0x00008250, 0x00000000},
         {0x00008254, 0x00000000},
         {0x00008258, 0x00000000},
@@ -1448,16 +1448,4 @@ static const u32 ar9462_common_mixed_rx_gain_table_2p0[][2] = {
         {0x0000b1fc, 0x00000196},
 };
 
-static const u32 ar9462_2p0_BTCOEX_MAX_TXPWR_table[][2] = {
-        /* Addr      allmodes  */
-        {0x000018c0, 0x10101010},
-        {0x000018c4, 0x10101010},
-        {0x000018c8, 0x10101010},
-        {0x000018cc, 0x10101010},
-        {0x000018d0, 0x10101010},
-        {0x000018d4, 0x10101010},
-        {0x000018d8, 0x10101010},
-        {0x000018dc, 0x10101010},
-};
-
 #endif /* INITVALS_9462_2P0_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 0a37631390db..a277cf6f339d 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -370,7 +370,7 @@ struct ath_vif {
  * number of beacon intervals, the game's up.
  */
 #define BSTUCK_THRESH                   9
-#define ATH_BCBUF                       4
+#define ATH_BCBUF                       8
 #define ATH_DEFAULT_BINTVAL             100 /* TU */
 #define ATH_DEFAULT_BMISS_LIMIT         10
 #define IEEE80211_MS_TO_TU(x)           (((x) * 1000) / 1024)
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 626418222c85..702e5abc38b2 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -91,7 +91,7 @@ static void ath_beacon_setup(struct ath_softc *sc, struct ieee80211_vif *vif,
         info.txpower = MAX_RATE_POWER;
         info.keyix = ATH9K_TXKEYIX_INVALID;
         info.keytype = ATH9K_KEY_TYPE_CLEAR;
-        info.flags = ATH9K_TXDESC_NOACK | ATH9K_TXDESC_INTREQ;
+        info.flags = ATH9K_TXDESC_NOACK | ATH9K_TXDESC_CLRDMASK;
 
         info.buf_addr[0] = bf->bf_buf_addr;
         info.buf_len[0] = roundup(skb->len, 4);
@@ -359,6 +359,11 @@ void ath_beacon_tasklet(unsigned long data)
         int slot;
         u32 bfaddr, bc = 0;
 
+        if (work_pending(&sc->hw_reset_work)) {
+                ath_dbg(common, RESET,
+                        "reset work is pending, skip beaconing now\n");
+                return;
+        }
         /*
          * Check if the previous beacon has gone out.  If
          * not don't try to post another, skip this period
@@ -369,6 +374,9 @@ void ath_beacon_tasklet(unsigned long data)
         if (ath9k_hw_numtxpending(ah, sc->beacon.beaconq) != 0) {
                 sc->beacon.bmisscnt++;
 
+                if (!ath9k_hw_check_alive(ah))
+                        ieee80211_queue_work(sc->hw, &sc->hw_check_work);
+
                 if (sc->beacon.bmisscnt < BSTUCK_THRESH * sc->nbcnvifs) {
                         ath_dbg(common, BSTUCK,
                                 "missed %u consecutive beacons\n",
@@ -378,6 +386,7 @@ void ath_beacon_tasklet(unsigned long data)
                                 ath9k_hw_bstuck_nfcal(ah);
                 } else if (sc->beacon.bmisscnt >= BSTUCK_THRESH) {
                         ath_dbg(common, BSTUCK, "beacon is officially stuck\n");
+                        sc->beacon.bmisscnt = 0;
                         sc->sc_flags |= SC_OP_TSF_RESET;
                         ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
                 }
@@ -650,6 +659,8 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
         u32 tsf, intval, nexttbtt;
 
         ath9k_reset_beacon_status(sc);
+        if (!(sc->sc_flags & SC_OP_BEACONS))
+                ath9k_hw_settsf64(ah, sc->beacon.bc_tstamp);
 
         intval = TU_TO_USEC(conf->beacon_interval);
         tsf = roundup(ath9k_hw_gettsf32(ah) + TU_TO_USEC(FUDGE), intval);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 04edce941cb7..fde700c4e490 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -380,63 +380,75 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
                                    size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
-        char buf[512];
         unsigned int len = 0;
+        int rv;
+        int mxlen = 4000;
+        char *buf = kmalloc(mxlen, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+#define PR_IS(a, s)                                             \
+        do {                                                    \
+                len += snprintf(buf + len, mxlen - len,         \
+                                "%21s: %10u\n", a,              \
+                                sc->debug.stats.istats.s);      \
+        } while (0)
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
-                len += snprintf(buf + len, sizeof(buf) - len,
-                        "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
-                len += snprintf(buf + len, sizeof(buf) - len,
-                        "%8s: %10u\n", "RXHP", sc->debug.stats.istats.rxhp);
-                len += snprintf(buf + len, sizeof(buf) - len,
-                        "%8s: %10u\n", "WATCHDOG",
-                        sc->debug.stats.istats.bb_watchdog);
+                PR_IS("RXLP", rxlp);
+                PR_IS("RXHP", rxhp);
+                PR_IS("WATHDOG", bb_watchdog);
         } else {
-                len += snprintf(buf + len, sizeof(buf) - len,
-                        "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
+                PR_IS("RX", rxok);
         }
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "RXEOL", sc->debug.stats.istats.rxeol);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "RXORN", sc->debug.stats.istats.rxorn);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "TX", sc->debug.stats.istats.txok);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "TXURN", sc->debug.stats.istats.txurn);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "MIB", sc->debug.stats.istats.mib);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "RXPHY", sc->debug.stats.istats.rxphyerr);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "RXKCM", sc->debug.stats.istats.rx_keycache_miss);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "SWBA", sc->debug.stats.istats.swba);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "BMISS", sc->debug.stats.istats.bmiss);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "BNR", sc->debug.stats.istats.bnr);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "CST", sc->debug.stats.istats.cst);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "GTT", sc->debug.stats.istats.gtt);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "TIM", sc->debug.stats.istats.tim);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "CABEND", sc->debug.stats.istats.cabend);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "DTIMSYNC", sc->debug.stats.istats.dtimsync);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "DTIM", sc->debug.stats.istats.dtim);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "TSFOOR", sc->debug.stats.istats.tsfoor);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "TOTAL", sc->debug.stats.istats.total);
-
-
-        if (len > sizeof(buf))
-                len = sizeof(buf);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        PR_IS("RXEOL", rxeol);
+        PR_IS("RXORN", rxorn);
+        PR_IS("TX", txok);
+        PR_IS("TXURN", txurn);
+        PR_IS("MIB", mib);
+        PR_IS("RXPHY", rxphyerr);
+        PR_IS("RXKCM", rx_keycache_miss);
+        PR_IS("SWBA", swba);
+        PR_IS("BMISS", bmiss);
+        PR_IS("BNR", bnr);
+        PR_IS("CST", cst);
+        PR_IS("GTT", gtt);
+        PR_IS("TIM", tim);
+        PR_IS("CABEND", cabend);
+        PR_IS("DTIMSYNC", dtimsync);
+        PR_IS("DTIM", dtim);
+        PR_IS("TSFOOR", tsfoor);
+        PR_IS("TOTAL", total);
+
+        len += snprintf(buf + len, mxlen - len,
+                        "SYNC_CAUSE stats:\n");
+
+        PR_IS("Sync-All", sync_cause_all);
+        PR_IS("RTC-IRQ", sync_rtc_irq);
+        PR_IS("MAC-IRQ", sync_mac_irq);
+        PR_IS("EEPROM-Illegal-Access", eeprom_illegal_access);
+        PR_IS("APB-Timeout", apb_timeout);
+        PR_IS("PCI-Mode-Conflict", pci_mode_conflict);
+        PR_IS("HOST1-Fatal", host1_fatal);
+        PR_IS("HOST1-Perr", host1_perr);
+        PR_IS("TRCV-FIFO-Perr", trcv_fifo_perr);
+        PR_IS("RADM-CPL-EP", radm_cpl_ep);
+        PR_IS("RADM-CPL-DLLP-Abort", radm_cpl_dllp_abort);
+        PR_IS("RADM-CPL-TLP-Abort", radm_cpl_tlp_abort);
+        PR_IS("RADM-CPL-ECRC-Err", radm_cpl_ecrc_err);
+        PR_IS("RADM-CPL-Timeout", radm_cpl_timeout);
+        PR_IS("Local-Bus-Timeout", local_timeout);
+        PR_IS("PM-Access", pm_access);
+        PR_IS("MAC-Awake", mac_awake);
+        PR_IS("MAC-Asleep", mac_asleep);
+        PR_IS("MAC-Sleep-Access", mac_sleep_access);
+
+        if (len > mxlen)
+                len = mxlen;
+
+        rv = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+        return rv;
 }
 
 static const struct file_operations fops_interrupt = {
@@ -881,6 +893,13 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         len += snprintf(buf + len, size - len, "%22s : %10u\n", s, \
                         sc->debug.stats.rxstats.phy_err_stats[p]);
 
+#define RXS_ERR(s, e)                                       \
+        do {                                                \
+                len += snprintf(buf + len, size - len,      \
+                                "%22s : %10u\n", s,         \
+                                sc->debug.stats.rxstats.e); \
+        } while (0)
+
         struct ath_softc *sc = file->private_data;
         char *buf;
         unsigned int len = 0, size = 1600;
@@ -890,42 +909,18 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "CRC ERR",
-                        sc->debug.stats.rxstats.crc_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "DECRYPT CRC ERR",
-                        sc->debug.stats.rxstats.decrypt_crc_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "PHY ERR",
-                        sc->debug.stats.rxstats.phy_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "MIC ERR",
-                        sc->debug.stats.rxstats.mic_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "PRE-DELIM CRC ERR",
-                        sc->debug.stats.rxstats.pre_delim_crc_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "POST-DELIM CRC ERR",
-                        sc->debug.stats.rxstats.post_delim_crc_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "DECRYPT BUSY ERR",
-                        sc->debug.stats.rxstats.decrypt_busy_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "RX-LENGTH-ERR",
-                        sc->debug.stats.rxstats.rx_len_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "RX-OOM-ERR",
-                        sc->debug.stats.rxstats.rx_oom_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "RX-RATE-ERR",
-                        sc->debug.stats.rxstats.rx_rate_err);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "RX-DROP-RXFLUSH",
-                        sc->debug.stats.rxstats.rx_drop_rxflush);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "RX-TOO-MANY-FRAGS",
-                        sc->debug.stats.rxstats.rx_too_many_frags_err);
+        RXS_ERR("CRC ERR", crc_err);
+        RXS_ERR("DECRYPT CRC ERR", decrypt_crc_err);
+        RXS_ERR("PHY ERR", phy_err);
+        RXS_ERR("MIC ERR", mic_err);
+        RXS_ERR("PRE-DELIM CRC ERR", pre_delim_crc_err);
+        RXS_ERR("POST-DELIM CRC ERR", post_delim_crc_err);
+        RXS_ERR("DECRYPT BUSY ERR", decrypt_busy_err);
+        RXS_ERR("RX-LENGTH-ERR", rx_len_err);
+        RXS_ERR("RX-OOM-ERR", rx_oom_err);
+        RXS_ERR("RX-RATE-ERR", rx_rate_err);
+        RXS_ERR("RX-DROP-RXFLUSH", rx_drop_rxflush);
+        RXS_ERR("RX-TOO-MANY-FRAGS", rx_too_many_frags_err);
 
         PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
         PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
@@ -954,18 +949,10 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
         PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
 
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "RX-Pkts-All",
-                        sc->debug.stats.rxstats.rx_pkts_all);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "RX-Bytes-All",
-                        sc->debug.stats.rxstats.rx_bytes_all);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "RX-Beacons",
-                        sc->debug.stats.rxstats.rx_beacons);
-        len += snprintf(buf + len, size - len,
-                        "%22s : %10u\n", "RX-Frags",
-                        sc->debug.stats.rxstats.rx_frags);
+        RXS_ERR("RX-Pkts-All", rx_pkts_all);
+        RXS_ERR("RX-Bytes-All", rx_bytes_all);
+        RXS_ERR("RX-Beacons", rx_beacons);
+        RXS_ERR("RX-Frags", rx_frags);
 
         if (len > size)
                 len = size;
@@ -975,6 +962,7 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
 
         return retval;
 
+#undef RXS_ERR
 #undef PHY_ERR
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 17f6cc27af32..c34da09d9103 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -60,6 +60,7 @@ struct ath_buf;
  * @tsfoor: TSF out of range, indicates that the corrected TSF received
  * from a beacon differs from the PCU's internal TSF by more than a
  * (programmable) threshold
+ * @local_timeout: Internal bus timeout.
  */
 struct ath_interrupt_stats {
         u32 total;
@@ -85,8 +86,30 @@ struct ath_interrupt_stats {
         u32 dtim;
         u32 bb_watchdog;
         u32 tsfoor;
+
+        /* Sync-cause stats */
+        u32 sync_cause_all;
+        u32 sync_rtc_irq;
+        u32 sync_mac_irq;
+        u32 eeprom_illegal_access;
+        u32 apb_timeout;
+        u32 pci_mode_conflict;
+        u32 host1_fatal;
+        u32 host1_perr;
+        u32 trcv_fifo_perr;
+        u32 radm_cpl_ep;
+        u32 radm_cpl_dllp_abort;
+        u32 radm_cpl_tlp_abort;
+        u32 radm_cpl_ecrc_err;
+        u32 radm_cpl_timeout;
+        u32 local_timeout;
+        u32 pm_access;
+        u32 mac_awake;
+        u32 mac_asleep;
+        u32 mac_sleep_access;
 };
 
+
 /**
  * struct ath_tx_stats - Statistics about TX
  * @tx_pkts_all:  No. of total frames transmitted, including ones that
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index c43523233319..0512397a293c 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -16,14 +16,6 @@
 
 #include "hw.h"
 
-static inline u16 ath9k_hw_fbin2freq(u8 fbin, bool is2GHz)
-{
-        if (fbin == AR5416_BCHAN_UNUSED)
-                return fbin;
-
-        return (u16) ((is2GHz) ? (2300 + fbin) : (4800 + 5 * fbin));
-}
-
 void ath9k_hw_analog_shift_regwrite(struct ath_hw *ah, u32 reg, u32 val)
 {
         REG_WRITE(ah, reg, val);
@@ -290,6 +282,34 @@ u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
         return twiceMaxEdgePower;
 }
 
+u16 ath9k_hw_get_scaled_power(struct ath_hw *ah, u16 power_limit,
+                              u8 antenna_reduction)
+{
+        u16 reduction = antenna_reduction;
+
+        /*
+         * Reduce scaled Power by number of chains active
+         * to get the per chain tx power level.
+         */
+        switch (ar5416_get_ntxchains(ah->txchainmask)) {
+        case 1:
+                break;
+        case 2:
+                reduction += POWER_CORRECTION_FOR_TWO_CHAIN;
+                break;
+        case 3:
+                reduction += POWER_CORRECTION_FOR_THREE_CHAIN;
+                break;
+        }
+
+        if (power_limit > reduction)
+                power_limit -= reduction;
+        else
+                power_limit = 0;
+
+        return power_limit;
+}
+
 void ath9k_hw_update_regulatory_maxpower(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -299,10 +319,10 @@ void ath9k_hw_update_regulatory_maxpower(struct ath_hw *ah)
         case 1:
                 break;
         case 2:
-                regulatory->max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
+                regulatory->max_power_level += POWER_CORRECTION_FOR_TWO_CHAIN;
                 break;
         case 3:
-                regulatory->max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
+                regulatory->max_power_level += POWER_CORRECTION_FOR_THREE_CHAIN;
                 break;
         default:
                 ath_dbg(common, EEPROM, "Invalid chainmask configuration\n");
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 5ff7ab965120..33acb920ed3f 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -79,8 +79,8 @@
 #define SUB_NUM_CTL_MODES_AT_5G_40 2
 #define SUB_NUM_CTL_MODES_AT_2G_40 3
 
-#define INCREASE_MAXPOW_BY_TWO_CHAIN     6  /* 10*log10(2)*2 */
-#define INCREASE_MAXPOW_BY_THREE_CHAIN   10 /* 10*log10(3)*2 */
+#define POWER_CORRECTION_FOR_TWO_CHAIN          6  /* 10*log10(2)*2 */
+#define POWER_CORRECTION_FOR_THREE_CHAIN        10 /* 10*log10(3)*2 */
 
 /*
  * For AR9285 and later chipsets, the following bits are not being programmed
@@ -686,6 +686,8 @@ void ath9k_hw_get_target_powers(struct ath_hw *ah,
                                 u16 numRates, bool isHt40Target);
 u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
                                 bool is2GHz, int num_band_edges);
+u16 ath9k_hw_get_scaled_power(struct ath_hw *ah, u16 power_limit,
+                              u8 antenna_reduction);
 void ath9k_hw_update_regulatory_maxpower(struct ath_hw *ah);
 int ath9k_hw_eeprom_init(struct ath_hw *ah);
 
@@ -697,6 +699,14 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
                                 u16 *pPdGainBoundaries, u8 *pPDADCValues,
                                 u16 numXpdGains);
 
+static inline u16 ath9k_hw_fbin2freq(u8 fbin, bool is2GHz)
+{
+        if (fbin == AR5416_BCHAN_UNUSED)
+                return fbin;
+
+        return (u16) ((is2GHz) ? (2300 + fbin) : (4800 + 5 * fbin));
+}
+
 #define ar5416_get_ntxchains(_txchainmask)                      \
         (((_txchainmask >> 2) & 1) +                            \
          ((_txchainmask >> 1) & 1) + (_txchainmask & 1))
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index f272236d8053..5ab0e6ed4655 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -564,9 +564,6 @@ static void ath9k_hw_set_ar9287_power_per_rate_table(struct ath_hw *ah,
         (((cfgCtl & ~CTL_MODE_M) | (pCtlMode[ctlMode] & CTL_MODE_M)) == \
          ((pEepData->ctlIndex[i] & CTL_MODE_M) | SD_NO_CTL))
 
-#define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6
-#define REDUCE_SCALED_POWER_BY_THREE_CHAIN   10
-
         u16 twiceMaxEdgePower;
         int i;
         struct cal_ctl_data_ar9287 *rep;
@@ -591,29 +588,8 @@ static void ath9k_hw_set_ar9287_power_per_rate_table(struct ath_hw *ah,
         tx_chainmask = ah->txchainmask;
 
         ath9k_hw_get_channel_centers(ah, chan, &centers);
-        scaledPower = powerLimit - antenna_reduction;
-
-        /*
-         * Reduce scaled Power by number of chains active
-         * to get the per chain tx power level.
-         */
-        switch (ar5416_get_ntxchains(tx_chainmask)) {
-        case 1:
-                break;
-        case 2:
-                if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
-                        scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
-                else
-                        scaledPower = 0;
-                break;
-        case 3:
-                if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
-                        scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
-                else
-                        scaledPower = 0;
-                break;
-        }
-        scaledPower = max((u16)0, scaledPower);
+        scaledPower = ath9k_hw_get_scaled_power(ah, powerLimit,
+                                                antenna_reduction);
 
         /*
          * Get TX power from EEPROM.
@@ -786,8 +762,6 @@ static void ath9k_hw_set_ar9287_power_per_rate_table(struct ath_hw *ah,
 
 #undef CMP_CTL
 #undef CMP_NO_CTL
-#undef REDUCE_SCALED_POWER_BY_TWO_CHAIN
-#undef REDUCE_SCALED_POWER_BY_THREE_CHAIN
 }
 
 static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 619b95d764ff..b5fba8b18b8b 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -991,9 +991,6 @@ static void ath9k_hw_set_def_power_per_rate_table(struct ath_hw *ah,
                                                   u16 antenna_reduction,
                                                   u16 powerLimit)
 {
-#define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6  /* 10*log10(2)*2 */
-#define REDUCE_SCALED_POWER_BY_THREE_CHAIN   9 /* 10*log10(3)*2 */
-
         struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
         u16 twiceMaxEdgePower;
         int i;
@@ -1027,24 +1024,8 @@ static void ath9k_hw_set_def_power_per_rate_table(struct ath_hw *ah,
 
         ath9k_hw_get_channel_centers(ah, chan, &centers);
 
-        scaledPower = powerLimit - antenna_reduction;
-
-        switch (ar5416_get_ntxchains(tx_chainmask)) {
-        case 1:
-                break;
-        case 2:
-                if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
-                        scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
-                else
-                        scaledPower = 0;
-                break;
-        case 3:
-                if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
-                        scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
-                else
-                        scaledPower = 0;
-                break;
-        }
+        scaledPower = ath9k_hw_get_scaled_power(ah, powerLimit,
+                                                antenna_reduction);
 
         if (IS_CHAN_2GHZ(chan)) {
                 numCtlModes = ARRAY_SIZE(ctlModesFor11g) -
@@ -1263,20 +1244,7 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
                         regulatory->max_power_level = ratesArray[i];
         }
 
-        switch(ar5416_get_ntxchains(ah->txchainmask)) {
-        case 1:
-                break;
-        case 2:
-                regulatory->max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
-                break;
-        case 3:
-                regulatory->max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
-                break;
-        default:
-                ath_dbg(ath9k_hw_common(ah), EEPROM,
-                        "Invalid chainmask configuration\n");
-                break;
-        }
+        ath9k_hw_update_regulatory_maxpower(ah);
 
         if (test)
                 return;
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index fbe23de1297f..dd10f4ac03ef 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -41,6 +41,9 @@ void ath_init_leds(struct ath_softc *sc)
 {
         int ret;
 
+        if (AR_SREV_9100(sc->sc_ah))
+                return;
+
         if (sc->sc_ah->led_pin < 0) {
                 if (AR_SREV_9287(sc->sc_ah))
                         sc->sc_ah->led_pin = ATH_LED_PIN_9287;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 424aabb2c730..f67cd952e741 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -53,6 +53,8 @@ static struct usb_device_id ath9k_hif_usb_ids[] = {
           .driver_info = AR9280_USB },  /* SMC Networks */
         { USB_DEVICE(0x0411, 0x017f),
           .driver_info = AR9280_USB },  /* Sony UWA-BR100 */
+        { USB_DEVICE(0x04da, 0x3904),
+          .driver_info = AR9280_USB },
 
         { USB_DEVICE(0x0cf3, 0x20ff),
           .driver_info = STORAGE_DEVICE },
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index d1345a8a2b15..72c5bcd4886d 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -24,6 +24,8 @@
 #include "rc.h"
 #include "ar9003_mac.h"
 #include "ar9003_mci.h"
+#include "debug.h"
+#include "ath9k.h"
 
 static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type);
 
@@ -83,6 +85,53 @@ static void ath9k_hw_ani_cache_ini_regs(struct ath_hw *ah)
 /* Helper Functions */
 /********************/
 
+#ifdef CONFIG_ATH9K_DEBUGFS
+
+void ath9k_debug_sync_cause(struct ath_common *common, u32 sync_cause)
+{
+        struct ath_softc *sc = common->priv;
+        if (sync_cause)
+                sc->debug.stats.istats.sync_cause_all++;
+        if (sync_cause & AR_INTR_SYNC_RTC_IRQ)
+                sc->debug.stats.istats.sync_rtc_irq++;
+        if (sync_cause & AR_INTR_SYNC_MAC_IRQ)
+                sc->debug.stats.istats.sync_mac_irq++;
+        if (sync_cause & AR_INTR_SYNC_EEPROM_ILLEGAL_ACCESS)
+                sc->debug.stats.istats.eeprom_illegal_access++;
+        if (sync_cause & AR_INTR_SYNC_APB_TIMEOUT)
+                sc->debug.stats.istats.apb_timeout++;
+        if (sync_cause & AR_INTR_SYNC_PCI_MODE_CONFLICT)
+                sc->debug.stats.istats.pci_mode_conflict++;
+        if (sync_cause & AR_INTR_SYNC_HOST1_FATAL)
+                sc->debug.stats.istats.host1_fatal++;
+        if (sync_cause & AR_INTR_SYNC_HOST1_PERR)
+                sc->debug.stats.istats.host1_perr++;
+        if (sync_cause & AR_INTR_SYNC_TRCV_FIFO_PERR)
+                sc->debug.stats.istats.trcv_fifo_perr++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_EP)
+                sc->debug.stats.istats.radm_cpl_ep++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_DLLP_ABORT)
+                sc->debug.stats.istats.radm_cpl_dllp_abort++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_TLP_ABORT)
+                sc->debug.stats.istats.radm_cpl_tlp_abort++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_ECRC_ERR)
+                sc->debug.stats.istats.radm_cpl_ecrc_err++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_TIMEOUT)
+                sc->debug.stats.istats.radm_cpl_timeout++;
+        if (sync_cause & AR_INTR_SYNC_LOCAL_TIMEOUT)
+                sc->debug.stats.istats.local_timeout++;
+        if (sync_cause & AR_INTR_SYNC_PM_ACCESS)
+                sc->debug.stats.istats.pm_access++;
+        if (sync_cause & AR_INTR_SYNC_MAC_AWAKE)
+                sc->debug.stats.istats.mac_awake++;
+        if (sync_cause & AR_INTR_SYNC_MAC_ASLEEP)
+                sc->debug.stats.istats.mac_asleep++;
+        if (sync_cause & AR_INTR_SYNC_MAC_SLEEP_ACCESS)
+                sc->debug.stats.istats.mac_sleep_access++;
+}
+#endif
+
+
 static void ath9k_hw_set_clockrate(struct ath_hw *ah)
 {
         struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
@@ -388,8 +437,8 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
 {
         int i;
 
-        ah->config.dma_beacon_response_time = 2;
-        ah->config.sw_beacon_response_time = 10;
+        ah->config.dma_beacon_response_time = 1;
+        ah->config.sw_beacon_response_time = 6;
         ah->config.additional_swba_backoff = 0;
         ah->config.ack_6mb = 0x0;
         ah->config.cwm_ignore_extcca = 0;
@@ -445,7 +494,6 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
                 AR_STA_ID1_MCAST_KSRCH;
         if (AR_SREV_9100(ah))
                 ah->sta_id1_defaults |= AR_STA_ID1_AR9100_BA_FIX;
-        ah->enable_32kHz_clock = DONT_USE_32KHZ;
         ah->slottime = ATH9K_SLOT_TIME_9;
         ah->globaltxtimeout = (u32) -1;
         ah->power_mode = ATH9K_PM_UNDEFINED;
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index aa1680a0c7fd..dd4b8f4097c8 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -708,7 +708,6 @@ struct ath_hw {
         struct ar5416Stats stats;
         struct ath9k_tx_queue_info txq[ATH9K_NUM_TX_QUEUES];
 
-        int16_t curchan_rad_index;
         enum ath9k_int imask;
         u32 imrs2_reg;
         u32 txok_interrupt_mask;
@@ -762,11 +761,6 @@ struct ath_hw {
 
         u32 sta_id1_defaults;
         u32 misc_mode;
-        enum {
-                AUTO_32KHZ,
-                USE_32KHZ,
-                DONT_USE_32KHZ,
-        } enable_32kHz_clock;
 
         /* Private to hardware code */
         struct ath_hw_private_ops private_ops;
@@ -783,7 +777,6 @@ struct ath_hw {
         u32 *analogBank7Data;
         u32 *bank6Temp;
 
-        u8 txpower_limit;
         int coverage_class;
         u32 slottime;
         u32 globaltxtimeout;
@@ -848,7 +841,6 @@ struct ath_hw {
         struct ath_gen_timer_table hw_gen_timers;
 
         struct ar9003_txs *ts_ring;
-        void *ts_start;
         u32 ts_paddr_start;
         u32 ts_paddr_end;
         u16 ts_tail;
@@ -915,7 +907,6 @@ static inline u8 get_streams(int mask)
 }
 
 /* Initialization, Detach, Reset */
-const char *ath9k_hw_probe(u16 vendorid, u16 devid);
 void ath9k_hw_deinit(struct ath_hw *ah);
 int ath9k_hw_init(struct ath_hw *ah);
 int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
@@ -965,6 +956,12 @@ bool ath9k_hw_check_alive(struct ath_hw *ah);
 
 bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
 
+#ifdef CONFIG_ATH9K_DEBUGFS
+void ath9k_debug_sync_cause(struct ath_common *common, u32 sync_cause);
+#else
+static void ath9k_debug_sync_cause(struct ath_common *common, u32 sync_cause) {}
+#endif
+
 /* Generic hw timer primitives */
 struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
                                           void (*trigger)(void *),
@@ -1011,7 +1008,6 @@ int ar9003_paprd_create_curve(struct ath_hw *ah,
 int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain);
 int ar9003_paprd_init_table(struct ath_hw *ah);
 bool ar9003_paprd_is_done(struct ath_hw *ah);
-void ar9003_hw_set_paprd_txdesc(struct ath_hw *ah, void *ds, u8 chains);
 
 /* Hardware family op attach helpers */
 void ar5008_hw_attach_phy_ops(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index c8d123957188..384e5c498440 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -692,17 +692,6 @@ void ath9k_tasklet(unsigned long data)
                 goto out;
         }
 
-        /*
-         * Only run the baseband hang check if beacons stop working in AP or
-         * IBSS mode, because it has a high false positive rate. For station
-         * mode it should not be necessary, since the upper layers will detect
-         * this through a beacon miss automatically and the following channel
-         * change will trigger a hardware reset anyway
-         */
-        if (ath9k_hw_numtxpending(ah, sc->beacon.beaconq) != 0 &&
-            !ath9k_hw_check_alive(ah))
-                ieee80211_queue_work(sc->hw, &sc->hw_check_work);
-
         if ((status & ATH9K_INT_TSFOOR) && sc->ps_enabled) {
                 /*
                  * TSF sync does not look correct; remain awake to sync with
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 6c87a823f5a9..d07c0301da6a 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -3989,8 +3989,7 @@ static int reset_atmel_card(struct net_device *dev)
                         atmel_copy_to_card(priv->dev, 0x8000, &fw[0x6000], len - 0x6000);
                 }
 
-                if (fw_entry)
-                        release_firmware(fw_entry);
+                release_firmware(fw_entry);
         }
 
         err = atmel_wakeup_firmware(priv);
diff --git a/drivers/net/wireless/atmel_pci.c b/drivers/net/wireless/atmel_pci.c
index 9ab1192004c0..51e33b53386e 100644
--- a/drivers/net/wireless/atmel_pci.c
+++ b/drivers/net/wireless/atmel_pci.c
@@ -74,15 +74,4 @@ static void __devexit atmel_pci_remove(struct pci_dev *pdev)
         stop_atmel_card(pci_get_drvdata(pdev));
 }
 
-static int __init atmel_init_module(void)
-{
-        return pci_register_driver(&atmel_driver);
-}
-
-static void __exit atmel_cleanup_module(void)
-{
-        pci_unregister_driver(&atmel_driver);
-}
-
-module_init(atmel_init_module);
-module_exit(atmel_cleanup_module);
+module_pci_driver(atmel_driver);
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index cba413536270..b31ccc02fa21 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -290,7 +290,8 @@ int b43_generate_txhdr(struct b43_wldev *dev,
                 txhdr->dur_fb = wlhdr->duration_id;
         } else {
                 txhdr->dur_fb = ieee80211_generic_frame_duration(
-                        dev->wl->hw, info->control.vif, fragment_len, fbrate);
+                        dev->wl->hw, info->control.vif, info->band,
+                        fragment_len, fbrate);
         }
 
         plcp_fragment_len = fragment_len + FCS_LEN;
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index df7e16dfb36c..1be214b815fb 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -1056,6 +1056,7 @@ static void b43legacy_write_probe_resp_plcp(struct b43legacy_wldev *dev,
         b43legacy_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
         dur = ieee80211_generic_frame_duration(dev->wl->hw,
                                                dev->wl->vif,
+                                               IEEE80211_BAND_2GHZ,
                                                size,
                                                rate);
         /* Write PLCP in two parts and timing for packet transfer */
@@ -1121,6 +1122,7 @@ static const u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
                                          IEEE80211_STYPE_PROBE_RESP);
         dur = ieee80211_generic_frame_duration(dev->wl->hw,
                                                dev->wl->vif,
+                                               IEEE80211_BAND_2GHZ,
                                                *dest_size,
                                                rate);
         hdr->duration_id = dur;
diff --git a/drivers/net/wireless/b43legacy/xmit.c b/drivers/net/wireless/b43legacy/xmit.c
index e6c573af494d..a8012f2749ee 100644
--- a/drivers/net/wireless/b43legacy/xmit.c
+++ b/drivers/net/wireless/b43legacy/xmit.c
@@ -228,6 +228,7 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
         } else {
                 txhdr->dur_fb = ieee80211_generic_frame_duration(dev->wl->hw,
                                                          info->control.vif,
+                                                         info->band,
                                                          fragment_len,
                                                          rate_fb);
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 07686a748d3c..9f637014486e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -632,7 +632,6 @@ extern const struct bcmevent_name bcmevent_names[];
 extern uint brcmf_c_mkiovar(char *name, char *data, uint datalen,
                           char *buf, uint len);
 
-extern int brcmf_net_attach(struct brcmf_pub *drvr, int idx);
 extern int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
 
 extern s32 brcmf_exec_dcmd(struct net_device *dev, u32 cmd, void *arg, u32 len);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
index b3e3b7f25d82..a5c15cac5e7d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
@@ -421,6 +421,7 @@ int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
         pktbuf->priority = h->priority & BDC_PRIORITY_MASK;
 
         skb_pull(pktbuf, BDC_HEADER_LEN);
+        skb_pull(pktbuf, h->data_offset << 2);
 
         return 0;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 4187435220f3..236cb9fa460c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -799,7 +799,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
 {
         char iovbuf[BRCMF_EVENTING_MASK_LEN + 12];      /*  Room for
                                  "event_msgs" + '\0' + bitvec  */
-        uint up = 0;
         char buf[128], *ptr;
         u32 dongle_align = drvr->bus_if->align;
         u32 glom = 0;
@@ -853,9 +852,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
         brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
                                   sizeof(iovbuf));
 
-        /* Force STA UP */
-        brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_UP, (char *)&up, sizeof(up));
-
         /* Setup event_msgs */
         brcmf_c_mkiovar("event_msgs", drvr->eventmask, BRCMF_EVENTING_MASK_LEN,
                       iovbuf, sizeof(iovbuf));
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 2a1e5ae0c402..8933f9b31a9a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -799,6 +799,7 @@ static int brcmf_netdev_open(struct net_device *ndev)
         struct brcmf_bus *bus_if = drvr->bus_if;
         u32 toe_ol;
         s32 ret = 0;
+        uint up = 0;
 
         brcmf_dbg(TRACE, "ifidx %d\n", ifp->idx);
 
@@ -822,6 +823,10 @@ static int brcmf_netdev_open(struct net_device *ndev)
                         drvr->iflist[ifp->idx]->ndev->features &=
                                 ~NETIF_F_IP_CSUM;
         }
+
+        /* make sure RF is ready for work */
+        brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_UP, (char *)&up, sizeof(up));
+
         /* Allow transmit calls */
         netif_start_queue(ndev);
         drvr->bus_if->drvr_up = true;
@@ -843,6 +848,63 @@ static const struct net_device_ops brcmf_netdev_ops_pri = {
         .ndo_set_rx_mode = brcmf_netdev_set_multicast_list
 };
 
+static int brcmf_net_attach(struct brcmf_if *ifp)
+{
+        struct brcmf_pub *drvr = ifp->drvr;
+        struct net_device *ndev;
+        u8 temp_addr[ETH_ALEN];
+
+        brcmf_dbg(TRACE, "ifidx %d\n", ifp->idx);
+
+        ndev = drvr->iflist[ifp->idx]->ndev;
+        ndev->netdev_ops = &brcmf_netdev_ops_pri;
+
+        /*
+         * determine mac address to use
+         */
+        if (is_valid_ether_addr(ifp->mac_addr))
+                memcpy(temp_addr, ifp->mac_addr, ETH_ALEN);
+        else
+                memcpy(temp_addr, drvr->mac, ETH_ALEN);
+
+        if (ifp->idx == 1) {
+                brcmf_dbg(TRACE, "ACCESS POINT MAC:\n");
+                /*  ACCESSPOINT INTERFACE CASE */
+                temp_addr[0] |= 0X02;   /* set bit 2 ,
+                         - Locally Administered address  */
+
+        }
+        ndev->hard_header_len = ETH_HLEN + drvr->hdrlen;
+        ndev->ethtool_ops = &brcmf_ethtool_ops;
+
+        drvr->rxsz = ndev->mtu + ndev->hard_header_len +
+                              drvr->hdrlen;
+
+        memcpy(ndev->dev_addr, temp_addr, ETH_ALEN);
+
+        /* attach to cfg80211 for primary interface */
+        if (!ifp->idx) {
+                drvr->config = brcmf_cfg80211_attach(ndev, drvr->dev, drvr);
+                if (drvr->config == NULL) {
+                        brcmf_dbg(ERROR, "wl_cfg80211_attach failed\n");
+                        goto fail;
+                }
+        }
+
+        if (register_netdev(ndev) != 0) {
+                brcmf_dbg(ERROR, "couldn't register the net device\n");
+                goto fail;
+        }
+
+        brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
+
+        return 0;
+
+fail:
+        ndev->netdev_ops = NULL;
+        return -EBADE;
+}
+
 int
 brcmf_add_if(struct device *dev, int ifidx, char *name, u8 *mac_addr)
 {
@@ -882,7 +944,7 @@ brcmf_add_if(struct device *dev, int ifidx, char *name, u8 *mac_addr)
         if (mac_addr != NULL)
                 memcpy(&ifp->mac_addr, mac_addr, ETH_ALEN);
 
-        if (brcmf_net_attach(drvr, ifp->idx)) {
+        if (brcmf_net_attach(ifp)) {
                 brcmf_dbg(ERROR, "brcmf_net_attach failed");
                 free_netdev(ifp->ndev);
                 drvr->iflist[ifidx] = NULL;
@@ -1016,69 +1078,16 @@ int brcmf_bus_start(struct device *dev)
         if (ret < 0)
                 return ret;
 
+        /* add primary networking interface */
+        ret = brcmf_add_if(dev, 0, "wlan%d", drvr->mac);
+        if (ret < 0)
+                return ret;
+
         /* signal bus ready */
         bus_if->state = BRCMF_BUS_DATA;
         return 0;
 }
 
-int brcmf_net_attach(struct brcmf_pub *drvr, int ifidx)
-{
-        struct net_device *ndev;
-        u8 temp_addr[ETH_ALEN] = {
-                0x00, 0x90, 0x4c, 0x11, 0x22, 0x33};
-
-        brcmf_dbg(TRACE, "ifidx %d\n", ifidx);
-
-        ndev = drvr->iflist[ifidx]->ndev;
-        ndev->netdev_ops = &brcmf_netdev_ops_pri;
-
-        /*
-         * We have to use the primary MAC for virtual interfaces
-         */
-        if (ifidx != 0) {
-                /* for virtual interfaces use the primary MAC  */
-                memcpy(temp_addr, drvr->mac, ETH_ALEN);
-
-        }
-
-        if (ifidx == 1) {
-                brcmf_dbg(TRACE, "ACCESS POINT MAC:\n");
-                /*  ACCESSPOINT INTERFACE CASE */
-                temp_addr[0] |= 0X02;   /* set bit 2 ,
-                         - Locally Administered address  */
-
-        }
-        ndev->hard_header_len = ETH_HLEN + drvr->hdrlen;
-        ndev->ethtool_ops = &brcmf_ethtool_ops;
-
-        drvr->rxsz = ndev->mtu + ndev->hard_header_len +
-                              drvr->hdrlen;
-
-        memcpy(ndev->dev_addr, temp_addr, ETH_ALEN);
-
-        /* attach to cfg80211 for primary interface */
-        if (!ifidx) {
-                drvr->config = brcmf_cfg80211_attach(ndev, drvr->dev, drvr);
-                if (drvr->config == NULL) {
-                        brcmf_dbg(ERROR, "wl_cfg80211_attach failed\n");
-                        goto fail;
-                }
-        }
-
-        if (register_netdev(ndev) != 0) {
-                brcmf_dbg(ERROR, "couldn't register the net device\n");
-                goto fail;
-        }
-
-        brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
-
-        return 0;
-
-fail:
-        ndev->netdev_ops = NULL;
-        return -EBADE;
-}
-
 static void brcmf_bus_detach(struct brcmf_pub *drvr)
 {
         brcmf_dbg(TRACE, "Enter\n");
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 2bf5dda29291..a83fbea04c04 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -3948,12 +3948,6 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
                 }
         }
 
-        /* add interface and open for business */
-        if (brcmf_add_if(bus->sdiodev->dev, 0, "wlan%d", NULL)) {
-                brcmf_dbg(ERROR, "Add primary net device interface failed!!\n");
-                goto fail;
-        }
-
         return bus;
 
 fail:
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 82364223e817..1d67ecf681b7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1383,14 +1383,6 @@ static int brcmf_usb_probe_cb(struct device *dev, const char *desc,
                 goto fail;
         }
 
-        /* add interface and open for business */
-        ret = brcmf_add_if(dev, 0, "wlan%d", NULL);
-        if (ret) {
-                brcmf_dbg(ERROR, "Add primary net device interface failed!!\n");
-                brcmf_detach(dev);
-                goto fail;
-        }
-
         return 0;
 fail:
         /* Release resources in reverse order */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index 55e9f45fce22..0efe88e25a9a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -628,6 +628,40 @@ brcms_c_country_aggregate_map(struct brcms_cm_info *wlc_cm, const char *ccode,
         return false;
 }
 
+/*
+ * Indicates whether the country provided is valid to pass
+ * to cfg80211 or not.
+ *
+ * returns true if valid; false if not.
+ */
+static bool brcms_c_country_valid(const char *ccode)
+{
+        /*
+         * only allow ascii alpha uppercase for the first 2
+         * chars.
+         */
+        if (!((0x80 & ccode[0]) == 0 && ccode[0] >= 0x41 && ccode[0] <= 0x5A &&
+              (0x80 & ccode[1]) == 0 && ccode[1] >= 0x41 && ccode[1] <= 0x5A &&
+              ccode[2] == '\0'))
+                return false;
+
+        /*
+         * do not match ISO 3166-1 user assigned country codes
+         * that may be in the driver table
+         */
+        if (!strcmp("AA", ccode) ||        /* AA */
+            !strcmp("ZZ", ccode) ||        /* ZZ */
+            ccode[0] == 'X' ||             /* XA - XZ */
+            (ccode[0] == 'Q' &&            /* QM - QZ */
+             (ccode[1] >= 'M' && ccode[1] <= 'Z')))
+                return false;
+
+        if (!strcmp("NA", ccode))
+                return false;
+
+        return true;
+}
+
 /* Lookup a country info structure from a null terminated country
  * abbreviation and regrev directly with no translation.
  */
@@ -1089,7 +1123,7 @@ struct brcms_cm_info *brcms_c_channel_mgr_attach(struct brcms_c_info *wlc)
 
         /* store the country code for passing up as a regulatory hint */
         ccode = getvar(wlc->hw->sih, BRCMS_SROM_CCODE);
-        if (ccode)
+        if (ccode && brcms_c_country_valid(ccode))
                 strncpy(wlc->pub->srom_ccode, ccode, BRCM_CNTRY_BUF_SZ - 1);
 
         /*
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 569ab8abd2a1..aa15558f75c8 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -1069,11 +1069,7 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
                 wiphy_err(wl->wiphy, "%s: ieee80211_register_hw failed, status"
                           "%d\n", __func__, err);
 
-        if (wl->pub->srom_ccode[0])
-                err = brcms_set_hint(wl, wl->pub->srom_ccode);
-        else
-                err = brcms_set_hint(wl, "US");
-        if (err)
+        if (wl->pub->srom_ccode[0] && brcms_set_hint(wl, wl->pub->srom_ccode))
                 wiphy_err(wl->wiphy, "%s: regulatory_hint failed, status %d\n",
                           __func__, err);
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index ce8562aa5db0..0fce56235f38 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -207,8 +207,7 @@ static const iqcal_gain_params_lcnphy *tbl_iqcal_gainparams_lcnphy[1] = {
 };
 
 static const u16 iqcal_gainparams_numgains_lcnphy[1] = {
-        sizeof(tbl_iqcal_gainparams_lcnphy_2G) /
-        sizeof(*tbl_iqcal_gainparams_lcnphy_2G),
+        ARRAY_SIZE(tbl_iqcal_gainparams_lcnphy_2G),
 };
 
 static const struct lcnphy_sfo_cfg lcnphy_sfo_cfg[] = {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
index 39095741fd05..812b6e38526e 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
@@ -16353,11 +16353,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
                         wlc_phy_set_rfseq_nphy(pi, NPHY_RFSEQ_RX2TX,
                                                rfseq_rx2tx_events_rev3_ipa,
                                                rfseq_rx2tx_dlys_rev3_ipa,
-                                               sizeof
-                                               (rfseq_rx2tx_events_rev3_ipa) /
-                                               sizeof
-                                               (rfseq_rx2tx_events_rev3_ipa
-                                                [0]));
+                                               ARRAY_SIZE(rfseq_rx2tx_events_rev3_ipa));
 
                 mod_phy_reg(pi, 0x299, (0x3 << 14), (0x1 << 14));
                 mod_phy_reg(pi, 0x29d, (0x3 << 14), (0x1 << 14));
@@ -16858,18 +16854,13 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
                 wlc_phy_set_rfseq_nphy(pi, NPHY_RFSEQ_TX2RX,
                                        rfseq_tx2rx_events_rev3,
                                        rfseq_tx2rx_dlys_rev3,
-                                       sizeof(rfseq_tx2rx_events_rev3) /
-                                       sizeof(rfseq_tx2rx_events_rev3[0]));
+                                       ARRAY_SIZE(rfseq_tx2rx_events_rev3));
 
                 if (PHY_IPA(pi))
                         wlc_phy_set_rfseq_nphy(pi, NPHY_RFSEQ_RX2TX,
                                                rfseq_rx2tx_events_rev3_ipa,
                                                rfseq_rx2tx_dlys_rev3_ipa,
-                                               sizeof
-                                               (rfseq_rx2tx_events_rev3_ipa) /
-                                               sizeof
-                                               (rfseq_rx2tx_events_rev3_ipa
-                                                [0]));
+                                               ARRAY_SIZE(rfseq_rx2tx_events_rev3_ipa));
 
                 if ((pi->sh->hw_phyrxchain != 0x3) &&
                     (pi->sh->hw_phyrxchain != pi->sh->hw_phytxchain)) {
@@ -16885,8 +16876,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
                                 pi, NPHY_RFSEQ_RX2TX,
                                 rfseq_rx2tx_events_rev3,
                                 rfseq_rx2tx_dlys_rev3,
-                                sizeof(rfseq_rx2tx_events_rev3) /
-                                sizeof(rfseq_rx2tx_events_rev3[0]));
+                                ARRAY_SIZE(rfseq_rx2tx_events_rev3));
                 }
 
                 if (CHSPEC_IS2G(pi->radio_chanspec))
@@ -17209,13 +17199,11 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
 
                 wlc_phy_set_rfseq_nphy(pi, NPHY_RFSEQ_RX2TX, rfseq_rx2tx_events,
                                        rfseq_rx2tx_dlys,
-                                       sizeof(rfseq_rx2tx_events) /
-                                       sizeof(rfseq_rx2tx_events[0]));
+                                       ARRAY_SIZE(rfseq_rx2tx_events));
 
                 wlc_phy_set_rfseq_nphy(pi, NPHY_RFSEQ_TX2RX, rfseq_tx2rx_events,
                                        rfseq_tx2rx_dlys,
-                                       sizeof(rfseq_tx2rx_events) /
-                                       sizeof(rfseq_tx2rx_events[0]));
+                                       ARRAY_SIZE(rfseq_tx2rx_events));
 
                 wlc_phy_workarounds_nphy_gainctrl(pi);
 
@@ -19357,8 +19345,7 @@ static void wlc_phy_spurwar_nphy(struct brcms_phy *pi)
                         }
 
                         if (isAdjustNoiseVar) {
-                                numTonesAdjust = sizeof(nphy_adj_tone_id_buf) /
-                                                sizeof(nphy_adj_tone_id_buf[0]);
+                                numTonesAdjust = ARRAY_SIZE(nphy_adj_tone_id_buf);
 
                                 wlc_phy_adjust_min_noisevar_nphy(
                                         pi,
@@ -25204,32 +25191,26 @@ static u8 wlc_phy_a3_nphy(struct brcms_phy *pi, u8 start_gain, u8 core)
 
                                 phy_a15 = pad_gain_codes_used_2057rev5;
                                 phy_a13 =
-                                        sizeof(pad_gain_codes_used_2057rev5) /
-                                        sizeof(pad_gain_codes_used_2057rev5
-                                                [0]) - 1;
+                                        ARRAY_SIZE(pad_gain_codes_used_2057rev5) - 1;
 
                         } else if ((pi->pubpi.radiorev == 7)
                                    || (pi->pubpi.radiorev == 8)) {
 
                                 phy_a15 = pad_gain_codes_used_2057rev7;
                                 phy_a13 =
-                                        sizeof(pad_gain_codes_used_2057rev7) /
-                                        sizeof(pad_gain_codes_used_2057rev7
-                                                [0]) - 1;
+                                        ARRAY_SIZE(pad_gain_codes_used_2057rev7) - 1;
 
                         } else {
 
                                 phy_a15 = pad_all_gain_codes_2057;
-                                phy_a13 = sizeof(pad_all_gain_codes_2057) /
-                                          sizeof(pad_all_gain_codes_2057[0]) -
+                                phy_a13 = ARRAY_SIZE(pad_all_gain_codes_2057) -
                                           1;
                         }
 
                 } else {
 
                         phy_a15 = pga_all_gain_codes_2057;
-                        phy_a13 = sizeof(pga_all_gain_codes_2057) /
-                                  sizeof(pga_all_gain_codes_2057[0]) - 1;
+                        phy_a13 = ARRAY_SIZE(pga_all_gain_codes_2057) - 1;
                 }
 
                 phy_a14 = 0;
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index 5fb17d53c9b2..333193f20e1c 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -17,17 +17,7 @@
 #ifndef _BRCM_HW_IDS_H_
 #define _BRCM_HW_IDS_H_
 
-#define BCM4325_D11DUAL_ID      0x431b
-#define BCM4325_D11G_ID         0x431c
-#define BCM4325_D11A_ID         0x431d
-
-#define BCM4329_D11N2G_ID       0x432f  /* 4329 802.11n 2.4G device */
-#define BCM4329_D11N5G_ID       0x4330  /* 4329 802.11n 5G device */
-#define BCM4329_D11NDUAL_ID     0x432e
-
-#define BCM4319_D11N_ID         0x4337  /* 4319 802.11n dualband device */
-#define BCM4319_D11N2G_ID       0x4338  /* 4319 802.11n 2.4G device */
-#define BCM4319_D11N5G_ID       0x4339  /* 4319 802.11n 5G device */
+#define BCM4313_D11N2G_ID       0x4727  /* 4313 802.11n 2.4G device */
 
 #define BCM43224_D11N_ID        0x4353  /* 43224 802.11n dualband device */
 #define BCM43224_D11N_ID_VEN1   0x0576  /* Vendor specific 43224 802.11n db */
@@ -37,23 +27,15 @@
 #define BCM43236_D11N_ID        0x4346  /* 43236 802.11n dualband device */
 #define BCM43236_D11N2G_ID      0x4347  /* 43236 802.11n 2.4GHz device */
 
-#define BCM4313_D11N2G_ID       0x4727  /* 4313 802.11n 2.4G device */
-
-/* Chip IDs */
-#define BCM4313_CHIP_ID         0x4313  /* 4313 chip id */
-#define BCM4319_CHIP_ID         0x4319  /* 4319 chip id */
-
-#define BCM43224_CHIP_ID        43224   /* 43224 chipcommon chipid */
-#define BCM43225_CHIP_ID        43225   /* 43225 chipcommon chipid */
-#define BCM43421_CHIP_ID        43421   /* 43421 chipcommon chipid */
-#define BCM43235_CHIP_ID        43235   /* 43235 chipcommon chipid */
-#define BCM43236_CHIP_ID        43236   /* 43236 chipcommon chipid */
-#define BCM43238_CHIP_ID        43238   /* 43238 chipcommon chipid */
-#define BCM4329_CHIP_ID         0x4329  /* 4329 chipcommon chipid */
-#define BCM4325_CHIP_ID         0x4325  /* 4325 chipcommon chipid */
-#define BCM4331_CHIP_ID         0x4331  /* 4331 chipcommon chipid */
-#define BCM4336_CHIP_ID         0x4336  /* 4336 chipcommon chipid */
-#define BCM4330_CHIP_ID         0x4330  /* 4330 chipcommon chipid */
-#define BCM6362_CHIP_ID         0x6362  /* 6362 chipcommon chipid */
+/* Chipcommon Core Chip IDs */
+#define BCM4313_CHIP_ID         0x4313
+#define BCM43224_CHIP_ID        43224
+#define BCM43225_CHIP_ID        43225
+#define BCM43235_CHIP_ID        43235
+#define BCM43236_CHIP_ID        43236
+#define BCM43238_CHIP_ID        43238
+#define BCM4329_CHIP_ID         0x4329
+#define BCM4330_CHIP_ID         0x4330
+#define BCM4331_CHIP_ID         0x4331
 
 #endif                          /* _BRCM_HW_IDS_H_ */
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index bfa0d54221e8..627bc12074c7 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -244,8 +244,7 @@ u16 hostap_tx_callback_register(local_info_t *local,
         unsigned long flags;
         struct hostap_tx_callback_info *entry;
 
-        entry = kmalloc(sizeof(*entry),
-                                                           GFP_ATOMIC);
+        entry = kmalloc(sizeof(*entry), GFP_KERNEL);
         if (entry == NULL)
                 return 0;
 
diff --git a/drivers/net/wireless/hostap/hostap_pci.c b/drivers/net/wireless/hostap/hostap_pci.c
index 972a9c3af39e..05ca3402dca7 100644
--- a/drivers/net/wireless/hostap/hostap_pci.c
+++ b/drivers/net/wireless/hostap/hostap_pci.c
@@ -457,18 +457,4 @@ static struct pci_driver prism2_pci_driver = {
 #endif /* CONFIG_PM */
 };
 
-
-static int __init init_prism2_pci(void)
-{
-        return pci_register_driver(&prism2_pci_driver);
-}
-
-
-static void __exit exit_prism2_pci(void)
-{
-        pci_unregister_driver(&prism2_pci_driver);
-}
-
-
-module_init(init_prism2_pci);
-module_exit(exit_prism2_pci);
+module_pci_driver(prism2_pci_driver);
diff --git a/drivers/net/wireless/hostap/hostap_plx.c b/drivers/net/wireless/hostap/hostap_plx.c
index 33e79037770b..c3d067ee4db9 100644
--- a/drivers/net/wireless/hostap/hostap_plx.c
+++ b/drivers/net/wireless/hostap/hostap_plx.c
@@ -616,18 +616,4 @@ static struct pci_driver prism2_plx_driver = {
         .remove         = prism2_plx_remove,
 };
 
-
-static int __init init_prism2_plx(void)
-{
-        return pci_register_driver(&prism2_plx_driver);
-}
-
-
-static void __exit exit_prism2_plx(void)
-{
-        pci_unregister_driver(&prism2_plx_driver);
-}
-
-
-module_init(init_prism2_plx);
-module_exit(exit_prism2_plx);
+module_pci_driver(prism2_plx_driver);
diff --git a/drivers/net/wireless/ipw2x00/ipw.h b/drivers/net/wireless/ipw2x00/ipw.h
new file mode 100644
index 000000000000..4007bf5ed6f3
--- /dev/null
+++ b/drivers/net/wireless/ipw2x00/ipw.h
@@ -0,0 +1,23 @@
+/*
+ * Intel Pro/Wireless 2100, 2200BG, 2915ABG network connection driver
+ *
+ * Copyright 2012 Stanislav Yakovlev <stas.yakovlev@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __IPW_H__
+#define __IPW_H__
+
+#include <linux/ieee80211.h>
+
+static const u32 ipw_cipher_suites[] = {
+        WLAN_CIPHER_SUITE_WEP40,
+        WLAN_CIPHER_SUITE_WEP104,
+        WLAN_CIPHER_SUITE_TKIP,
+        WLAN_CIPHER_SUITE_CCMP,
+};
+
+#endif
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 2662d46134d0..c72136c07774 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -166,6 +166,7 @@ that only one external action is invoked at a time.
 #include <net/lib80211.h>
 
 #include "ipw2100.h"
+#include "ipw.h"
 
 #define IPW2100_VERSION "git-1.2.2"
 
@@ -1958,6 +1959,9 @@ static int ipw2100_wdev_init(struct net_device *dev)
                 wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = bg_band;
         }
 
+        wdev->wiphy->cipher_suites = ipw_cipher_suites;
+        wdev->wiphy->n_cipher_suites = ARRAY_SIZE(ipw_cipher_suites);
+
         set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
         if (wiphy_register(wdev->wiphy)) {
                 ipw2100_down(priv);
@@ -8503,8 +8507,7 @@ static void ipw2100_release_firmware(struct ipw2100_priv *priv,
                                      struct ipw2100_fw *fw)
 {
         fw->version = 0;
-        if (fw->fw_entry)
-                release_firmware(fw->fw_entry);
+        release_firmware(fw->fw_entry);
         fw->fw_entry = NULL;
 }
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 809b7a70974b..d57522c64073 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -34,6 +34,7 @@
 #include <linux/slab.h>
 #include <net/cfg80211-wext.h>
 #include "ipw2200.h"
+#include "ipw.h"
 
 
 #ifndef KBUILD_EXTMOD
@@ -3657,8 +3658,7 @@ static int ipw_load(struct ipw_priv *priv)
                 priv->rxq = NULL;
         }
         ipw_tx_queue_free(priv);
-        if (raw)
-                release_firmware(raw);
+        release_firmware(raw);
 #ifdef CONFIG_PM
         fw_loaded = 0;
         raw = NULL;
@@ -11533,6 +11533,9 @@ static int ipw_wdev_init(struct net_device *dev)
                 wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = a_band;
         }
 
+        wdev->wiphy->cipher_suites = ipw_cipher_suites;
+        wdev->wiphy->n_cipher_suites = ARRAY_SIZE(ipw_cipher_suites);
+
         set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
 
         /* With that information in place, we can now register the wiphy... */
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 565611eef0d4..db6c6e528022 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -113,20 +113,21 @@ config IWLWIFI_DEVICE_TESTMODE
           generic netlink message via NL80211_TESTMODE channel.
 
 config IWLWIFI_P2P
-       bool "iwlwifi experimental P2P support"
-       depends on IWLWIFI
-       help
-         This option enables experimental P2P support for some devices
-         based on microcode support. Since P2P support is still under
-         development, this option may even enable it for some devices
-         now that turn out to not support it in the future due to
-         microcode restrictions.
-
-         To determine if your microcode supports the experimental P2P
-         offered by this option, check if the driver advertises AP
-         support when it is loaded.
-
-         Say Y only if you want to experiment with P2P.
+        def_bool y
+        bool "iwlwifi experimental P2P support"
+        depends on IWLWIFI
+        help
+          This option enables experimental P2P support for some devices
+          based on microcode support. Since P2P support is still under
+          development, this option may even enable it for some devices
+          now that turn out to not support it in the future due to
+          microcode restrictions.
+
+          To determine if your microcode supports the experimental P2P
+          offered by this option, check if the driver advertises AP
+          support when it is loaded.
+
+          Say Y only if you want to experiment with P2P.
 
 config IWLWIFI_EXPERIMENTAL_MFP
         bool "support MFP (802.11w) even if uCode doesn't advertise"
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index c7c4a995dfe5..f2cd67874cf4 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -7,7 +7,7 @@ iwlwifi-objs		+= iwl-agn-tt.o iwl-agn-sta.o iwl-agn-rx.o
 
 iwlwifi-objs            += iwl-core.o iwl-eeprom.o iwl-power.o
 iwlwifi-objs            += iwl-scan.o iwl-led.o
-iwlwifi-objs            += iwl-agn-rxon.o
+iwlwifi-objs            += iwl-agn-rxon.o iwl-agn-devices.o
 iwlwifi-objs            += iwl-5000.o
 iwlwifi-objs            += iwl-6000.o
 iwlwifi-objs            += iwl-1000.o
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 95c59e39b803..e9006078f4e2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -24,26 +24,11 @@
  *
  *****************************************************************************/
 
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
-#include <linux/delay.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <net/mac80211.h>
-#include <linux/etherdevice.h>
-#include <asm/unaligned.h>
 #include <linux/stringify.h>
-
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
-#include "iwl-core.h"
-#include "iwl-io.h"
-#include "iwl-agn.h"
-#include "iwl-agn-hw.h"
-#include "iwl-shared.h"
+#include "iwl-config.h"
 #include "iwl-cfg.h"
-#include "iwl-prph.h"
+#include "iwl-dev.h" /* still needed */
 
 /* Highest firmware API version supported */
 #define IWL1000_UCODE_API_MAX 6
@@ -64,97 +49,6 @@
 #define IWL100_MODULE_FIRMWARE(api) IWL100_FW_PRE __stringify(api) ".ucode"
 
 
-/*
- * For 1000, use advance thermal throttling critical temperature threshold,
- * but legacy thermal management implementation for now.
- * This is for the reason of 1000 uCode using advance thermal throttling API
- * but not implement ct_kill_exit based on ct_kill exit temperature
- * so the thermal throttling will still based on legacy thermal throttling
- * management.
- * The code here need to be modified once 1000 uCode has the advanced thermal
- * throttling algorithm in place
- */
-static void iwl1000_set_ct_threshold(struct iwl_priv *priv)
-{
-        /* want Celsius */
-        hw_params(priv).ct_kill_threshold = CT_KILL_THRESHOLD_LEGACY;
-        hw_params(priv).ct_kill_exit_threshold = CT_KILL_EXIT_THRESHOLD;
-}
-
-/* NIC configuration for 1000 series */
-static void iwl1000_nic_config(struct iwl_priv *priv)
-{
-        /* set CSR_HW_CONFIG_REG for uCode use */
-        iwl_set_bit(trans(priv), CSR_HW_IF_CONFIG_REG,
-                    CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
-                    CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
-
-        /* Setting digital SVR for 1000 card to 1.32V */
-        /* locking is acquired in iwl_set_bits_mask_prph() function */
-        iwl_set_bits_mask_prph(trans(priv), APMG_DIGITAL_SVR_REG,
-                                APMG_SVR_DIGITAL_VOLTAGE_1_32,
-                                ~APMG_SVR_VOLTAGE_CONFIG_BIT_MSK);
-}
-
-static const struct iwl_sensitivity_ranges iwl1000_sensitivity = {
-        .min_nrg_cck = 95,
-        .auto_corr_min_ofdm = 90,
-        .auto_corr_min_ofdm_mrc = 170,
-        .auto_corr_min_ofdm_x1 = 120,
-        .auto_corr_min_ofdm_mrc_x1 = 240,
-
-        .auto_corr_max_ofdm = 120,
-        .auto_corr_max_ofdm_mrc = 210,
-        .auto_corr_max_ofdm_x1 = 155,
-        .auto_corr_max_ofdm_mrc_x1 = 290,
-
-        .auto_corr_min_cck = 125,
-        .auto_corr_max_cck = 200,
-        .auto_corr_min_cck_mrc = 170,
-        .auto_corr_max_cck_mrc = 400,
-        .nrg_th_cck = 95,
-        .nrg_th_ofdm = 95,
-
-        .barker_corr_th_min = 190,
-        .barker_corr_th_min_mrc = 390,
-        .nrg_th_cca = 62,
-};
-
-static void iwl1000_hw_set_hw_params(struct iwl_priv *priv)
-{
-        hw_params(priv).ht40_channel =  BIT(IEEE80211_BAND_2GHZ);
-
-        hw_params(priv).tx_chains_num =
-                num_of_ant(hw_params(priv).valid_tx_ant);
-        if (cfg(priv)->rx_with_siso_diversity)
-                hw_params(priv).rx_chains_num = 1;
-        else
-                hw_params(priv).rx_chains_num =
-                        num_of_ant(hw_params(priv).valid_rx_ant);
-
-        iwl1000_set_ct_threshold(priv);
-
-        /* Set initial sensitivity parameters */
-        hw_params(priv).sens = &iwl1000_sensitivity;
-}
-
-static struct iwl_lib_ops iwl1000_lib = {
-        .set_hw_params = iwl1000_hw_set_hw_params,
-        .nic_config = iwl1000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REGULATORY_BAND_NO_HT40,
-                },
-        },
-        .temperature = iwlagn_temperature,
-};
-
 static const struct iwl_base_params iwl1000_base_params = {
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
@@ -165,9 +59,8 @@ static const struct iwl_base_params iwl1000_base_params = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
-        .wd_timeout = IWL_DEF_WD_TIMEOUT,
+        .wd_timeout = IWL_WATCHHDOG_DISABLED,
         .max_event_log_size = 128,
-        .wd_disable = true,
 };
 
 static const struct iwl_ht_params iwl1000_ht_params = {
@@ -181,11 +74,11 @@ static const struct iwl_ht_params iwl1000_ht_params = {
         .ucode_api_max = IWL1000_UCODE_API_MAX,                 \
         .ucode_api_ok = IWL1000_UCODE_API_OK,                   \
         .ucode_api_min = IWL1000_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_1000,                \
         .max_inst_size = IWLAGN_RTC_INST_SIZE,                  \
         .max_data_size = IWLAGN_RTC_DATA_SIZE,                  \
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,       \
-        .lib = &iwl1000_lib,                                    \
         .base_params = &iwl1000_base_params,                    \
         .led_mode = IWL_LED_BLINK
 
@@ -205,11 +98,11 @@ const struct iwl_cfg iwl1000_bg_cfg = {
         .ucode_api_max = IWL100_UCODE_API_MAX,                  \
         .ucode_api_ok = IWL100_UCODE_API_OK,                    \
         .ucode_api_min = IWL100_UCODE_API_MIN,                  \
+        .device_family = IWL_DEVICE_FAMILY_100,                 \
         .max_inst_size = IWLAGN_RTC_INST_SIZE,                  \
         .max_data_size = IWLAGN_RTC_DATA_SIZE,                  \
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,       \
-        .lib = &iwl1000_lib,                                    \
         .base_params = &iwl1000_base_params,                    \
         .led_mode = IWL_LED_RF_STATE,                           \
         .rx_with_siso_diversity = true
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index e1329a13f0fd..3d4a36cf0408 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -24,25 +24,11 @@
  *
  *****************************************************************************/
 
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
-#include <linux/delay.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <net/mac80211.h>
-#include <linux/etherdevice.h>
-#include <asm/unaligned.h>
 #include <linux/stringify.h>
-
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
-#include "iwl-core.h"
-#include "iwl-io.h"
-#include "iwl-agn.h"
-#include "iwl-agn-hw.h"
-#include "iwl-shared.h"
+#include "iwl-config.h"
 #include "iwl-cfg.h"
+#include "iwl-dev.h" /* still needed */
 
 /* Highest firmware API version supported */
 #define IWL2030_UCODE_API_MAX 6
@@ -74,100 +60,6 @@
 #define IWL135_FW_PRE "iwlwifi-135-"
 #define IWL135_MODULE_FIRMWARE(api) IWL135_FW_PRE __stringify(api) ".ucode"
 
-static void iwl2000_set_ct_threshold(struct iwl_priv *priv)
-{
-        /* want Celsius */
-        hw_params(priv).ct_kill_threshold = CT_KILL_THRESHOLD;
-        hw_params(priv).ct_kill_exit_threshold = CT_KILL_EXIT_THRESHOLD;
-}
-
-/* NIC configuration for 2000 series */
-static void iwl2000_nic_config(struct iwl_priv *priv)
-{
-        iwl_rf_config(priv);
-
-        iwl_set_bit(trans(priv), CSR_GP_DRIVER_REG,
-                    CSR_GP_DRIVER_REG_BIT_RADIO_IQ_INVER);
-}
-
-static const struct iwl_sensitivity_ranges iwl2000_sensitivity = {
-        .min_nrg_cck = 97,
-        .auto_corr_min_ofdm = 80,
-        .auto_corr_min_ofdm_mrc = 128,
-        .auto_corr_min_ofdm_x1 = 105,
-        .auto_corr_min_ofdm_mrc_x1 = 192,
-
-        .auto_corr_max_ofdm = 145,
-        .auto_corr_max_ofdm_mrc = 232,
-        .auto_corr_max_ofdm_x1 = 110,
-        .auto_corr_max_ofdm_mrc_x1 = 232,
-
-        .auto_corr_min_cck = 125,
-        .auto_corr_max_cck = 175,
-        .auto_corr_min_cck_mrc = 160,
-        .auto_corr_max_cck_mrc = 310,
-        .nrg_th_cck = 97,
-        .nrg_th_ofdm = 100,
-
-        .barker_corr_th_min = 190,
-        .barker_corr_th_min_mrc = 390,
-        .nrg_th_cca = 62,
-};
-
-static void iwl2000_hw_set_hw_params(struct iwl_priv *priv)
-{
-        hw_params(priv).ht40_channel =  BIT(IEEE80211_BAND_2GHZ);
-
-        hw_params(priv).tx_chains_num =
-                num_of_ant(hw_params(priv).valid_tx_ant);
-        if (cfg(priv)->rx_with_siso_diversity)
-                hw_params(priv).rx_chains_num = 1;
-        else
-                hw_params(priv).rx_chains_num =
-                        num_of_ant(hw_params(priv).valid_rx_ant);
-
-        iwl2000_set_ct_threshold(priv);
-
-        /* Set initial sensitivity parameters */
-        hw_params(priv).sens = &iwl2000_sensitivity;
-}
-
-static struct iwl_lib_ops iwl2000_lib = {
-        .set_hw_params = iwl2000_hw_set_hw_params,
-        .nic_config = iwl2000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REGULATORY_BAND_NO_HT40,
-                },
-                .enhanced_txpower = true,
-        },
-        .temperature = iwlagn_temperature,
-};
-
-static struct iwl_lib_ops iwl2030_lib = {
-        .set_hw_params = iwl2000_hw_set_hw_params,
-        .nic_config = iwl2000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REGULATORY_BAND_NO_HT40,
-                },
-                .enhanced_txpower = true,
-        },
-        .temperature = iwlagn_temperature,
-};
-
 static const struct iwl_base_params iwl2000_base_params = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .num_of_queues = IWLAGN_NUM_QUEUES,
@@ -223,11 +115,11 @@ static const struct iwl_bt_params iwl2030_bt_params = {
         .ucode_api_max = IWL2000_UCODE_API_MAX,                 \
         .ucode_api_ok = IWL2000_UCODE_API_OK,                   \
         .ucode_api_min = IWL2000_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_2000,                \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
-        .lib = &iwl2000_lib,                                    \
         .base_params = &iwl2000_base_params,                    \
         .need_temp_offset_calib = true,                         \
         .temp_offset_v2 = true,                                 \
@@ -250,11 +142,11 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
         .ucode_api_max = IWL2030_UCODE_API_MAX,                 \
         .ucode_api_ok = IWL2030_UCODE_API_OK,                   \
         .ucode_api_min = IWL2030_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_2030,                \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
-        .lib = &iwl2030_lib,                                    \
         .base_params = &iwl2030_base_params,                    \
         .bt_params = &iwl2030_bt_params,                        \
         .need_temp_offset_calib = true,                         \
@@ -273,11 +165,11 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
         .ucode_api_max = IWL105_UCODE_API_MAX,                  \
         .ucode_api_ok = IWL105_UCODE_API_OK,                    \
         .ucode_api_min = IWL105_UCODE_API_MIN,                  \
+        .device_family = IWL_DEVICE_FAMILY_105,                 \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
-        .lib = &iwl2000_lib,                                    \
         .base_params = &iwl2000_base_params,                    \
         .need_temp_offset_calib = true,                         \
         .temp_offset_v2 = true,                                 \
@@ -302,11 +194,11 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
         .ucode_api_max = IWL135_UCODE_API_MAX,                  \
         .ucode_api_ok = IWL135_UCODE_API_OK,                    \
         .ucode_api_min = IWL135_UCODE_API_MIN,                  \
+        .device_family = IWL_DEVICE_FAMILY_135,                 \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
-        .lib = &iwl2030_lib,                                    \
         .base_params = &iwl2030_base_params,                    \
         .bt_params = &iwl2030_bt_params,                        \
         .need_temp_offset_calib = true,                         \
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 34bc8dd0064b..ffa9ac5fe086 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -24,28 +24,11 @@
  *
  *****************************************************************************/
 
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
-#include <linux/delay.h>
-#include <linux/sched.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <net/mac80211.h>
-#include <linux/etherdevice.h>
-#include <asm/unaligned.h>
 #include <linux/stringify.h>
-
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
-#include "iwl-core.h"
-#include "iwl-io.h"
-#include "iwl-agn.h"
-#include "iwl-agn-hw.h"
-#include "iwl-trans.h"
-#include "iwl-shared.h"
+#include "iwl-config.h"
 #include "iwl-cfg.h"
-#include "iwl-prph.h"
+#include "iwl-dev.h" /* still needed */
 
 /* Highest firmware API version supported */
 #define IWL5000_UCODE_API_MAX 5
@@ -61,250 +44,6 @@
 #define IWL5150_FW_PRE "iwlwifi-5150-"
 #define IWL5150_MODULE_FIRMWARE(api) IWL5150_FW_PRE __stringify(api) ".ucode"
 
-/* NIC configuration for 5000 series */
-static void iwl5000_nic_config(struct iwl_priv *priv)
-{
-        iwl_rf_config(priv);
-
-        /* W/A : NIC is stuck in a reset state after Early PCIe power off
-         * (PCIe power is lost before PERST# is asserted),
-         * causing ME FW to lose ownership and not being able to obtain it back.
-         */
-        iwl_set_bits_mask_prph(trans(priv), APMG_PS_CTRL_REG,
-                                APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS,
-                                ~APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS);
-}
-
-static const struct iwl_sensitivity_ranges iwl5000_sensitivity = {
-        .min_nrg_cck = 100,
-        .auto_corr_min_ofdm = 90,
-        .auto_corr_min_ofdm_mrc = 170,
-        .auto_corr_min_ofdm_x1 = 105,
-        .auto_corr_min_ofdm_mrc_x1 = 220,
-
-        .auto_corr_max_ofdm = 120,
-        .auto_corr_max_ofdm_mrc = 210,
-        .auto_corr_max_ofdm_x1 = 120,
-        .auto_corr_max_ofdm_mrc_x1 = 240,
-
-        .auto_corr_min_cck = 125,
-        .auto_corr_max_cck = 200,
-        .auto_corr_min_cck_mrc = 200,
-        .auto_corr_max_cck_mrc = 400,
-        .nrg_th_cck = 100,
-        .nrg_th_ofdm = 100,
-
-        .barker_corr_th_min = 190,
-        .barker_corr_th_min_mrc = 390,
-        .nrg_th_cca = 62,
-};
-
-static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
-        .min_nrg_cck = 95,
-        .auto_corr_min_ofdm = 90,
-        .auto_corr_min_ofdm_mrc = 170,
-        .auto_corr_min_ofdm_x1 = 105,
-        .auto_corr_min_ofdm_mrc_x1 = 220,
-
-        .auto_corr_max_ofdm = 120,
-        .auto_corr_max_ofdm_mrc = 210,
-        /* max = min for performance bug in 5150 DSP */
-        .auto_corr_max_ofdm_x1 = 105,
-        .auto_corr_max_ofdm_mrc_x1 = 220,
-
-        .auto_corr_min_cck = 125,
-        .auto_corr_max_cck = 200,
-        .auto_corr_min_cck_mrc = 170,
-        .auto_corr_max_cck_mrc = 400,
-        .nrg_th_cck = 95,
-        .nrg_th_ofdm = 95,
-
-        .barker_corr_th_min = 190,
-        .barker_corr_th_min_mrc = 390,
-        .nrg_th_cca = 62,
-};
-
-#define IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF   (-5)
-
-static s32 iwl_temp_calib_to_offset(struct iwl_shared *shrd)
-{
-        u16 temperature, voltage;
-        __le16 *temp_calib = (__le16 *)iwl_eeprom_query_addr(shrd,
-                                EEPROM_KELVIN_TEMPERATURE);
-
-        temperature = le16_to_cpu(temp_calib[0]);
-        voltage = le16_to_cpu(temp_calib[1]);
-
-        /* offset = temp - volt / coeff */
-        return (s32)(temperature - voltage / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
-}
-
-static void iwl5150_set_ct_threshold(struct iwl_priv *priv)
-{
-        const s32 volt2temp_coef = IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF;
-        s32 threshold = (s32)CELSIUS_TO_KELVIN(CT_KILL_THRESHOLD_LEGACY) -
-                        iwl_temp_calib_to_offset(priv->shrd);
-
-        hw_params(priv).ct_kill_threshold = threshold * volt2temp_coef;
-}
-
-static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
-{
-        /* want Celsius */
-        hw_params(priv).ct_kill_threshold = CT_KILL_THRESHOLD_LEGACY;
-}
-
-static void iwl5000_hw_set_hw_params(struct iwl_priv *priv)
-{
-        hw_params(priv).ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
-                                        BIT(IEEE80211_BAND_5GHZ);
-
-        hw_params(priv).tx_chains_num =
-                num_of_ant(hw_params(priv).valid_tx_ant);
-        hw_params(priv).rx_chains_num =
-                num_of_ant(hw_params(priv).valid_rx_ant);
-
-        iwl5000_set_ct_threshold(priv);
-
-        /* Set initial sensitivity parameters */
-        hw_params(priv).sens = &iwl5000_sensitivity;
-}
-
-static void iwl5150_hw_set_hw_params(struct iwl_priv *priv)
-{
-        hw_params(priv).ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
-                                        BIT(IEEE80211_BAND_5GHZ);
-
-        hw_params(priv).tx_chains_num =
-                num_of_ant(hw_params(priv).valid_tx_ant);
-        hw_params(priv).rx_chains_num =
-                num_of_ant(hw_params(priv).valid_rx_ant);
-
-        iwl5150_set_ct_threshold(priv);
-
-        /* Set initial sensitivity parameters */
-        hw_params(priv).sens = &iwl5150_sensitivity;
-}
-
-static void iwl5150_temperature(struct iwl_priv *priv)
-{
-        u32 vt = 0;
-        s32 offset =  iwl_temp_calib_to_offset(priv->shrd);
-
-        vt = le32_to_cpu(priv->statistics.common.temperature);
-        vt = vt / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF + offset;
-        /* now vt hold the temperature in Kelvin */
-        priv->temperature = KELVIN_TO_CELSIUS(vt);
-        iwl_tt_handler(priv);
-}
-
-static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
-                                     struct ieee80211_channel_switch *ch_switch)
-{
-        /*
-         * MULTI-FIXME
-         * See iwlagn_mac_channel_switch.
-         */
-        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
-        struct iwl5000_channel_switch_cmd cmd;
-        const struct iwl_channel_info *ch_info;
-        u32 switch_time_in_usec, ucode_switch_time;
-        u16 ch;
-        u32 tsf_low;
-        u8 switch_count;
-        u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval);
-        struct ieee80211_vif *vif = ctx->vif;
-        struct iwl_host_cmd hcmd = {
-                .id = REPLY_CHANNEL_SWITCH,
-                .len = { sizeof(cmd), },
-                .flags = CMD_SYNC,
-                .data = { &cmd, },
-        };
-
-        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
-        ch = ch_switch->channel->hw_value;
-        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
-                      ctx->active.channel, ch);
-        cmd.channel = cpu_to_le16(ch);
-        cmd.rxon_flags = ctx->staging.flags;
-        cmd.rxon_filter_flags = ctx->staging.filter_flags;
-        switch_count = ch_switch->count;
-        tsf_low = ch_switch->timestamp & 0x0ffffffff;
-        /*
-         * calculate the ucode channel switch time
-         * adding TSF as one of the factor for when to switch
-         */
-        if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) {
-                if (switch_count > ((priv->ucode_beacon_time - tsf_low) /
-                    beacon_interval)) {
-                        switch_count -= (priv->ucode_beacon_time -
-                                tsf_low) / beacon_interval;
-                } else
-                        switch_count = 0;
-        }
-        if (switch_count <= 1)
-                cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
-        else {
-                switch_time_in_usec =
-                        vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
-                ucode_switch_time = iwl_usecs_to_beacons(priv,
-                                                         switch_time_in_usec,
-                                                         beacon_interval);
-                cmd.switch_time = iwl_add_beacon_time(priv,
-                                                      priv->ucode_beacon_time,
-                                                      ucode_switch_time,
-                                                      beacon_interval);
-        }
-        IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
-                      cmd.switch_time);
-        ch_info = iwl_get_channel_info(priv, priv->band, ch);
-        if (ch_info)
-                cmd.expect_beacon = is_channel_radar(ch_info);
-        else {
-                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        ctx->active.channel, ch);
-                return -EFAULT;
-        }
-
-        return iwl_dvm_send_cmd(priv, &hcmd);
-}
-
-static struct iwl_lib_ops iwl5000_lib = {
-        .set_hw_params = iwl5000_hw_set_hw_params,
-        .set_channel_switch = iwl5000_hw_channel_switch,
-        .nic_config = iwl5000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REG_BAND_52_HT40_CHANNELS
-                },
-        },
-        .temperature = iwlagn_temperature,
-};
-
-static struct iwl_lib_ops iwl5150_lib = {
-        .set_hw_params = iwl5150_hw_set_hw_params,
-        .set_channel_switch = iwl5000_hw_channel_switch,
-        .nic_config = iwl5000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REG_BAND_52_HT40_CHANNELS
-                },
-        },
-        .temperature = iwl5150_temperature,
-};
-
 static const struct iwl_base_params iwl5000_base_params = {
         .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .num_of_queues = IWLAGN_NUM_QUEUES,
@@ -312,10 +51,9 @@ static const struct iwl_base_params iwl5000_base_params = {
         .led_compensation = 51,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
-        .wd_timeout = IWL_LONG_WD_TIMEOUT,
+        .wd_timeout = IWL_WATCHHDOG_DISABLED,
         .max_event_log_size = 512,
         .no_idle_support = true,
-        .wd_disable = true,
 };
 
 static const struct iwl_ht_params iwl5000_ht_params = {
@@ -326,11 +64,11 @@ static const struct iwl_ht_params iwl5000_ht_params = {
         .fw_name_pre = IWL5000_FW_PRE,                          \
         .ucode_api_max = IWL5000_UCODE_API_MAX,                 \
         .ucode_api_min = IWL5000_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_5000,                \
         .max_inst_size = IWLAGN_RTC_INST_SIZE,                  \
         .max_data_size = IWLAGN_RTC_DATA_SIZE,                  \
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,       \
-        .lib = &iwl5000_lib,                                    \
         .base_params = &iwl5000_base_params,                    \
         .led_mode = IWL_LED_BLINK
 
@@ -371,11 +109,11 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
+        .device_family = IWL_DEVICE_FAMILY_5000,
         .max_inst_size = IWLAGN_RTC_INST_SIZE,
         .max_data_size = IWLAGN_RTC_DATA_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .lib = &iwl5000_lib,
         .base_params = &iwl5000_base_params,
         .ht_params = &iwl5000_ht_params,
         .led_mode = IWL_LED_BLINK,
@@ -386,11 +124,11 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .fw_name_pre = IWL5150_FW_PRE,                          \
         .ucode_api_max = IWL5150_UCODE_API_MAX,                 \
         .ucode_api_min = IWL5150_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_5150,                \
         .max_inst_size = IWLAGN_RTC_INST_SIZE,                  \
         .max_data_size = IWLAGN_RTC_DATA_SIZE,                  \
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,       \
-        .lib = &iwl5150_lib,                                    \
         .base_params = &iwl5000_base_params,                    \
         .no_xtal_calib = true,                                  \
         .led_mode = IWL_LED_BLINK,                              \
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 7075570a0f2c..00da2520a4b7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -24,26 +24,11 @@
  *
  *****************************************************************************/
 
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
-#include <linux/delay.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <net/mac80211.h>
-#include <linux/etherdevice.h>
-#include <asm/unaligned.h>
 #include <linux/stringify.h>
-
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
-#include "iwl-core.h"
-#include "iwl-io.h"
-#include "iwl-agn.h"
-#include "iwl-agn-hw.h"
-#include "iwl-trans.h"
-#include "iwl-shared.h"
+#include "iwl-config.h"
 #include "iwl-cfg.h"
+#include "iwl-dev.h" /* still needed */
 
 /* Highest firmware API version supported */
 #define IWL6000_UCODE_API_MAX 6
@@ -71,201 +56,6 @@
 #define IWL6030_FW_PRE "iwlwifi-6000g2b-"
 #define IWL6030_MODULE_FIRMWARE(api) IWL6030_FW_PRE __stringify(api) ".ucode"
 
-static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
-{
-        /* want Celsius */
-        hw_params(priv).ct_kill_threshold = CT_KILL_THRESHOLD;
-        hw_params(priv).ct_kill_exit_threshold = CT_KILL_EXIT_THRESHOLD;
-}
-
-static void iwl6050_additional_nic_config(struct iwl_priv *priv)
-{
-        /* Indicate calibration version to uCode. */
-        if (iwl_eeprom_calib_version(priv->shrd) >= 6)
-                iwl_set_bit(trans(priv), CSR_GP_DRIVER_REG,
-                                CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6);
-}
-
-static void iwl6150_additional_nic_config(struct iwl_priv *priv)
-{
-        /* Indicate calibration version to uCode. */
-        if (iwl_eeprom_calib_version(priv->shrd) >= 6)
-                iwl_set_bit(trans(priv), CSR_GP_DRIVER_REG,
-                                CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6);
-        iwl_set_bit(trans(priv), CSR_GP_DRIVER_REG,
-                    CSR_GP_DRIVER_REG_BIT_6050_1x2);
-}
-
-static void iwl6000i_additional_nic_config(struct iwl_priv *priv)
-{
-        /* 2x2 IPA phy type */
-        iwl_write32(trans(priv), CSR_GP_DRIVER_REG,
-                     CSR_GP_DRIVER_REG_BIT_RADIO_SKU_2x2_IPA);
-}
-
-/* NIC configuration for 6000 series */
-static void iwl6000_nic_config(struct iwl_priv *priv)
-{
-        iwl_rf_config(priv);
-
-        /* do additional nic configuration if needed */
-        if (cfg(priv)->additional_nic_config)
-                cfg(priv)->additional_nic_config(priv);
-}
-
-static const struct iwl_sensitivity_ranges iwl6000_sensitivity = {
-        .min_nrg_cck = 110,
-        .auto_corr_min_ofdm = 80,
-        .auto_corr_min_ofdm_mrc = 128,
-        .auto_corr_min_ofdm_x1 = 105,
-        .auto_corr_min_ofdm_mrc_x1 = 192,
-
-        .auto_corr_max_ofdm = 145,
-        .auto_corr_max_ofdm_mrc = 232,
-        .auto_corr_max_ofdm_x1 = 110,
-        .auto_corr_max_ofdm_mrc_x1 = 232,
-
-        .auto_corr_min_cck = 125,
-        .auto_corr_max_cck = 175,
-        .auto_corr_min_cck_mrc = 160,
-        .auto_corr_max_cck_mrc = 310,
-        .nrg_th_cck = 110,
-        .nrg_th_ofdm = 110,
-
-        .barker_corr_th_min = 190,
-        .barker_corr_th_min_mrc = 336,
-        .nrg_th_cca = 62,
-};
-
-static void iwl6000_hw_set_hw_params(struct iwl_priv *priv)
-{
-        hw_params(priv).ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
-                                        BIT(IEEE80211_BAND_5GHZ);
-
-        hw_params(priv).tx_chains_num =
-                num_of_ant(hw_params(priv).valid_tx_ant);
-        if (cfg(priv)->rx_with_siso_diversity)
-                hw_params(priv).rx_chains_num = 1;
-        else
-                hw_params(priv).rx_chains_num =
-                        num_of_ant(hw_params(priv).valid_rx_ant);
-
-        iwl6000_set_ct_threshold(priv);
-
-        /* Set initial sensitivity parameters */
-        hw_params(priv).sens = &iwl6000_sensitivity;
-
-}
-
-static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
-                                     struct ieee80211_channel_switch *ch_switch)
-{
-        /*
-         * MULTI-FIXME
-         * See iwlagn_mac_channel_switch.
-         */
-        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
-        struct iwl6000_channel_switch_cmd cmd;
-        const struct iwl_channel_info *ch_info;
-        u32 switch_time_in_usec, ucode_switch_time;
-        u16 ch;
-        u32 tsf_low;
-        u8 switch_count;
-        u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval);
-        struct ieee80211_vif *vif = ctx->vif;
-        struct iwl_host_cmd hcmd = {
-                .id = REPLY_CHANNEL_SWITCH,
-                .len = { sizeof(cmd), },
-                .flags = CMD_SYNC,
-                .data = { &cmd, },
-        };
-
-        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
-        ch = ch_switch->channel->hw_value;
-        IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
-                      ctx->active.channel, ch);
-        cmd.channel = cpu_to_le16(ch);
-        cmd.rxon_flags = ctx->staging.flags;
-        cmd.rxon_filter_flags = ctx->staging.filter_flags;
-        switch_count = ch_switch->count;
-        tsf_low = ch_switch->timestamp & 0x0ffffffff;
-        /*
-         * calculate the ucode channel switch time
-         * adding TSF as one of the factor for when to switch
-         */
-        if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) {
-                if (switch_count > ((priv->ucode_beacon_time - tsf_low) /
-                    beacon_interval)) {
-                        switch_count -= (priv->ucode_beacon_time -
-                                tsf_low) / beacon_interval;
-                } else
-                        switch_count = 0;
-        }
-        if (switch_count <= 1)
-                cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
-        else {
-                switch_time_in_usec =
-                        vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
-                ucode_switch_time = iwl_usecs_to_beacons(priv,
-                                                         switch_time_in_usec,
-                                                         beacon_interval);
-                cmd.switch_time = iwl_add_beacon_time(priv,
-                                                      priv->ucode_beacon_time,
-                                                      ucode_switch_time,
-                                                      beacon_interval);
-        }
-        IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
-                      cmd.switch_time);
-        ch_info = iwl_get_channel_info(priv, priv->band, ch);
-        if (ch_info)
-                cmd.expect_beacon = is_channel_radar(ch_info);
-        else {
-                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        ctx->active.channel, ch);
-                return -EFAULT;
-        }
-
-        return iwl_dvm_send_cmd(priv, &hcmd);
-}
-
-static struct iwl_lib_ops iwl6000_lib = {
-        .set_hw_params = iwl6000_hw_set_hw_params,
-        .set_channel_switch = iwl6000_hw_channel_switch,
-        .nic_config = iwl6000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REG_BAND_52_HT40_CHANNELS
-                },
-                .enhanced_txpower = true,
-        },
-        .temperature = iwlagn_temperature,
-};
-
-static struct iwl_lib_ops iwl6030_lib = {
-        .set_hw_params = iwl6000_hw_set_hw_params,
-        .set_channel_switch = iwl6000_hw_channel_switch,
-        .nic_config = iwl6000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REG_BAND_52_HT40_CHANNELS
-                },
-                .enhanced_txpower = true,
-        },
-        .temperature = iwlagn_temperature,
-};
-
 static const struct iwl_base_params iwl6000_base_params = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .num_of_queues = IWLAGN_NUM_QUEUES,
@@ -333,11 +123,11 @@ static const struct iwl_bt_params iwl6000_bt_params = {
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,               \
         .ucode_api_ok = IWL6000G2_UCODE_API_OK,                 \
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,               \
+        .device_family = IWL_DEVICE_FAMILY_6005,                \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
         .eeprom_ver = EEPROM_6005_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6005_TX_POWER_VERSION,       \
-        .lib = &iwl6000_lib,                                    \
         .base_params = &iwl6000_g2_base_params,                 \
         .need_temp_offset_calib = true,                         \
         .led_mode = IWL_LED_RF_STATE
@@ -387,11 +177,11 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,               \
         .ucode_api_ok = IWL6000G2_UCODE_API_OK,                 \
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,               \
+        .device_family = IWL_DEVICE_FAMILY_6030,                \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
         .eeprom_ver = EEPROM_6030_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION,       \
-        .lib = &iwl6030_lib,                                    \
         .base_params = &iwl6000_g2_base_params,                 \
         .bt_params = &iwl6000_bt_params,                        \
         .need_temp_offset_calib = true,                         \
@@ -458,14 +248,13 @@ const struct iwl_cfg iwl130_bg_cfg = {
         .ucode_api_max = IWL6000_UCODE_API_MAX,                 \
         .ucode_api_ok = IWL6000_UCODE_API_OK,                   \
         .ucode_api_min = IWL6000_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_6000i,               \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
         .valid_tx_ant = ANT_BC,         /* .cfg overwrite */    \
         .valid_rx_ant = ANT_BC,         /* .cfg overwrite */    \
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,       \
-        .lib = &iwl6000_lib,                                    \
-        .additional_nic_config = iwl6000i_additional_nic_config,\
         .base_params = &iwl6000_base_params,                    \
         .led_mode = IWL_LED_BLINK
 
@@ -489,12 +278,11 @@ const struct iwl_cfg iwl6000i_2bg_cfg = {
         .fw_name_pre = IWL6050_FW_PRE,                          \
         .ucode_api_max = IWL6050_UCODE_API_MAX,                 \
         .ucode_api_min = IWL6050_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_6050,                \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
         .valid_tx_ant = ANT_AB,         /* .cfg overwrite */    \
         .valid_rx_ant = ANT_AB,         /* .cfg overwrite */    \
-        .lib = &iwl6000_lib,                                    \
-        .additional_nic_config = iwl6050_additional_nic_config, \
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,       \
         .base_params = &iwl6050_base_params,                    \
@@ -516,10 +304,9 @@ const struct iwl_cfg iwl6050_2abg_cfg = {
         .fw_name_pre = IWL6050_FW_PRE,                          \
         .ucode_api_max = IWL6050_UCODE_API_MAX,                 \
         .ucode_api_min = IWL6050_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_6150,                \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
-        .lib = &iwl6000_lib,                                    \
-        .additional_nic_config = iwl6150_additional_nic_config, \
         .eeprom_ver = EEPROM_6150_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6150_TX_POWER_VERSION,       \
         .base_params = &iwl6050_base_params,                    \
@@ -543,11 +330,11 @@ const struct iwl_cfg iwl6000_3agn_cfg = {
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_ok = IWL6000_UCODE_API_OK,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
+        .device_family = IWL_DEVICE_FAMILY_6000,
         .max_inst_size = IWL60_RTC_INST_SIZE,
         .max_data_size = IWL60_RTC_DATA_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
-        .lib = &iwl6000_lib,
         .base_params = &iwl6000_base_params,
         .ht_params = &iwl6000_ht_params,
         .led_mode = IWL_LED_BLINK,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
index 84cbe7bb504c..61c243f7395f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
@@ -190,7 +190,7 @@ static int iwl_sens_energy_cck(struct iwl_priv *priv,
         u32 max_false_alarms = MAX_FA_CCK * rx_enable_time;
         u32 min_false_alarms = MIN_FA_CCK * rx_enable_time;
         struct iwl_sensitivity_data *data = NULL;
-        const struct iwl_sensitivity_ranges *ranges = hw_params(priv).sens;
+        const struct iwl_sensitivity_ranges *ranges = priv->hw_params.sens;
 
         data = &(priv->sensitivity_data);
 
@@ -373,7 +373,7 @@ static int iwl_sens_auto_corr_ofdm(struct iwl_priv *priv,
         u32 max_false_alarms = MAX_FA_OFDM * rx_enable_time;
         u32 min_false_alarms = MIN_FA_OFDM * rx_enable_time;
         struct iwl_sensitivity_data *data = NULL;
-        const struct iwl_sensitivity_ranges *ranges = hw_params(priv).sens;
+        const struct iwl_sensitivity_ranges *ranges = priv->hw_params.sens;
 
         data = &(priv->sensitivity_data);
 
@@ -597,9 +597,9 @@ void iwl_init_sensitivity(struct iwl_priv *priv)
         int ret = 0;
         int i;
         struct iwl_sensitivity_data *data = NULL;
-        const struct iwl_sensitivity_ranges *ranges = hw_params(priv).sens;
+        const struct iwl_sensitivity_ranges *ranges = priv->hw_params.sens;
 
-        if (priv->disable_sens_cal)
+        if (priv->calib_disabled & IWL_SENSITIVITY_CALIB_DISABLED)
                 return;
 
         IWL_DEBUG_CALIB(priv, "Start iwl_init_sensitivity\n");
@@ -663,7 +663,7 @@ void iwl_sensitivity_calibration(struct iwl_priv *priv)
         struct statistics_rx_phy *ofdm, *cck;
         struct statistics_general_data statis;
 
-        if (priv->disable_sens_cal)
+        if (priv->calib_disabled & IWL_SENSITIVITY_CALIB_DISABLED)
                 return;
 
         data = &(priv->sensitivity_data);
@@ -833,28 +833,28 @@ static void iwl_find_disconn_antenna(struct iwl_priv *priv, u32* average_sig,
          * To be safe, simply mask out any chains that we know
          * are not on the device.
          */
-        active_chains &= hw_params(priv).valid_rx_ant;
+        active_chains &= priv->hw_params.valid_rx_ant;
 
         num_tx_chains = 0;
         for (i = 0; i < NUM_RX_CHAINS; i++) {
                 /* loops on all the bits of
                  * priv->hw_setting.valid_tx_ant */
                 u8 ant_msk = (1 << i);
-                if (!(hw_params(priv).valid_tx_ant & ant_msk))
+                if (!(priv->hw_params.valid_tx_ant & ant_msk))
                         continue;
 
                 num_tx_chains++;
                 if (data->disconn_array[i] == 0)
                         /* there is a Tx antenna connected */
                         break;
-                if (num_tx_chains == hw_params(priv).tx_chains_num &&
+                if (num_tx_chains == priv->hw_params.tx_chains_num &&
                     data->disconn_array[i]) {
                         /*
                          * If all chains are disconnected
                          * connect the first valid tx chain
                          */
                         first_chain =
-                                find_first_chain(hw_params(priv).valid_tx_ant);
+                                find_first_chain(priv->hw_params.valid_tx_ant);
                         data->disconn_array[first_chain] = 0;
                         active_chains |= BIT(first_chain);
                         IWL_DEBUG_CALIB(priv,
@@ -864,13 +864,13 @@ static void iwl_find_disconn_antenna(struct iwl_priv *priv, u32* average_sig,
                 }
         }
 
-        if (active_chains != hw_params(priv).valid_rx_ant &&
+        if (active_chains != priv->hw_params.valid_rx_ant &&
             active_chains != priv->chain_noise_data.active_chains)
                 IWL_DEBUG_CALIB(priv,
                                 "Detected that not all antennas are connected! "
                                 "Connected: %#x, valid: %#x.\n",
                                 active_chains,
-                                hw_params(priv).valid_rx_ant);
+                                priv->hw_params.valid_rx_ant);
 
         /* Save for use within RXON, TX, SCAN commands, etc. */
         data->active_chains = active_chains;
@@ -970,7 +970,7 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv)
          */
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
-        if (priv->disable_chain_noise_cal)
+        if (priv->calib_disabled & IWL_CHAIN_NOISE_CALIB_DISABLED)
                 return;
 
         data = &(priv->chain_noise_data);
@@ -1055,7 +1055,7 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv)
             cfg(priv)->bt_params->advanced_bt_coexist) {
                 /* Disable disconnected antenna algorithm for advanced
                    bt coex, assuming valid antennas are connected */
-                data->active_chains = hw_params(priv).valid_rx_ant;
+                data->active_chains = priv->hw_params.valid_rx_ant;
                 for (i = 0; i < NUM_RX_CHAINS; i++)
                         if (!(data->active_chains & (1<<i)))
                                 data->disconn_array[i] = 1;
@@ -1085,7 +1085,7 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv)
                         min_average_noise, min_average_noise_antenna_i);
 
         iwlagn_gain_computation(priv, average_noise,
-                                find_first_chain(hw_params(priv).valid_rx_ant));
+                                find_first_chain(priv->hw_params.valid_rx_ant));
 
         /* Some power changes may have been made during the calibration.
          * Update and commit the RXON
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-devices.c b/drivers/net/wireless/iwlwifi/iwl-agn-devices.c
new file mode 100644
index 000000000000..08718caf4aa9
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-devices.c
@@ -0,0 +1,756 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2008 - 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+/*
+ * DVM device-specific data & functions
+ */
+#include "iwl-core.h"
+#include "iwl-agn.h"
+#include "iwl-dev.h"
+#include "iwl-commands.h"
+#include "iwl-io.h"
+#include "iwl-prph.h"
+
+/*
+ * 1000 series
+ * ===========
+ */
+
+/*
+ * For 1000, use advance thermal throttling critical temperature threshold,
+ * but legacy thermal management implementation for now.
+ * This is for the reason of 1000 uCode using advance thermal throttling API
+ * but not implement ct_kill_exit based on ct_kill exit temperature
+ * so the thermal throttling will still based on legacy thermal throttling
+ * management.
+ * The code here need to be modified once 1000 uCode has the advanced thermal
+ * throttling algorithm in place
+ */
+static void iwl1000_set_ct_threshold(struct iwl_priv *priv)
+{
+        /* want Celsius */
+        priv->hw_params.ct_kill_threshold = CT_KILL_THRESHOLD_LEGACY;
+        priv->hw_params.ct_kill_exit_threshold = CT_KILL_EXIT_THRESHOLD;
+}
+
+/* NIC configuration for 1000 series */
+static void iwl1000_nic_config(struct iwl_priv *priv)
+{
+        /* set CSR_HW_CONFIG_REG for uCode use */
+        iwl_set_bit(trans(priv), CSR_HW_IF_CONFIG_REG,
+                    CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
+                    CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
+
+        /* Setting digital SVR for 1000 card to 1.32V */
+        /* locking is acquired in iwl_set_bits_mask_prph() function */
+        iwl_set_bits_mask_prph(trans(priv), APMG_DIGITAL_SVR_REG,
+                                APMG_SVR_DIGITAL_VOLTAGE_1_32,
+                                ~APMG_SVR_VOLTAGE_CONFIG_BIT_MSK);
+}
+
+/**
+ * iwl_beacon_time_mask_low - mask of lower 32 bit of beacon time
+ * @priv -- pointer to iwl_priv data structure
+ * @tsf_bits -- number of bits need to shift for masking)
+ */
+static inline u32 iwl_beacon_time_mask_low(struct iwl_priv *priv,
+                                           u16 tsf_bits)
+{
+        return (1 << tsf_bits) - 1;
+}
+
+/**
+ * iwl_beacon_time_mask_high - mask of higher 32 bit of beacon time
+ * @priv -- pointer to iwl_priv data structure
+ * @tsf_bits -- number of bits need to shift for masking)
+ */
+static inline u32 iwl_beacon_time_mask_high(struct iwl_priv *priv,
+                                            u16 tsf_bits)
+{
+        return ((1 << (32 - tsf_bits)) - 1) << tsf_bits;
+}
+
+/*
+ * extended beacon time format
+ * time in usec will be changed into a 32-bit value in extended:internal format
+ * the extended part is the beacon counts
+ * the internal part is the time in usec within one beacon interval
+ */
+static u32 iwl_usecs_to_beacons(struct iwl_priv *priv, u32 usec,
+                                u32 beacon_interval)
+{
+        u32 quot;
+        u32 rem;
+        u32 interval = beacon_interval * TIME_UNIT;
+
+        if (!interval || !usec)
+                return 0;
+
+        quot = (usec / interval) &
+                (iwl_beacon_time_mask_high(priv, IWLAGN_EXT_BEACON_TIME_POS) >>
+                IWLAGN_EXT_BEACON_TIME_POS);
+        rem = (usec % interval) & iwl_beacon_time_mask_low(priv,
+                                   IWLAGN_EXT_BEACON_TIME_POS);
+
+        return (quot << IWLAGN_EXT_BEACON_TIME_POS) + rem;
+}
+
+/* base is usually what we get from ucode with each received frame,
+ * the same as HW timer counter counting down
+ */
+static __le32 iwl_add_beacon_time(struct iwl_priv *priv, u32 base,
+                           u32 addon, u32 beacon_interval)
+{
+        u32 base_low = base & iwl_beacon_time_mask_low(priv,
+                                IWLAGN_EXT_BEACON_TIME_POS);
+        u32 addon_low = addon & iwl_beacon_time_mask_low(priv,
+                                IWLAGN_EXT_BEACON_TIME_POS);
+        u32 interval = beacon_interval * TIME_UNIT;
+        u32 res = (base & iwl_beacon_time_mask_high(priv,
+                                IWLAGN_EXT_BEACON_TIME_POS)) +
+                                (addon & iwl_beacon_time_mask_high(priv,
+                                IWLAGN_EXT_BEACON_TIME_POS));
+
+        if (base_low > addon_low)
+                res += base_low - addon_low;
+        else if (base_low < addon_low) {
+                res += interval + base_low - addon_low;
+                res += (1 << IWLAGN_EXT_BEACON_TIME_POS);
+        } else
+                res += (1 << IWLAGN_EXT_BEACON_TIME_POS);
+
+        return cpu_to_le32(res);
+}
+
+static const struct iwl_sensitivity_ranges iwl1000_sensitivity = {
+        .min_nrg_cck = 95,
+        .auto_corr_min_ofdm = 90,
+        .auto_corr_min_ofdm_mrc = 170,
+        .auto_corr_min_ofdm_x1 = 120,
+        .auto_corr_min_ofdm_mrc_x1 = 240,
+
+        .auto_corr_max_ofdm = 120,
+        .auto_corr_max_ofdm_mrc = 210,
+        .auto_corr_max_ofdm_x1 = 155,
+        .auto_corr_max_ofdm_mrc_x1 = 290,
+
+        .auto_corr_min_cck = 125,
+        .auto_corr_max_cck = 200,
+        .auto_corr_min_cck_mrc = 170,
+        .auto_corr_max_cck_mrc = 400,
+        .nrg_th_cck = 95,
+        .nrg_th_ofdm = 95,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
+};
+
+static void iwl1000_hw_set_hw_params(struct iwl_priv *priv)
+{
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ);
+
+        priv->hw_params.tx_chains_num =
+                num_of_ant(priv->hw_params.valid_tx_ant);
+        if (cfg(priv)->rx_with_siso_diversity)
+                priv->hw_params.rx_chains_num = 1;
+        else
+                priv->hw_params.rx_chains_num =
+                        num_of_ant(priv->hw_params.valid_rx_ant);
+
+        iwl1000_set_ct_threshold(priv);
+
+        /* Set initial sensitivity parameters */
+        priv->hw_params.sens = &iwl1000_sensitivity;
+}
+
+struct iwl_lib_ops iwl1000_lib = {
+        .set_hw_params = iwl1000_hw_set_hw_params,
+        .nic_config = iwl1000_nic_config,
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REGULATORY_BAND_NO_HT40,
+                },
+        },
+        .temperature = iwlagn_temperature,
+};
+
+
+/*
+ * 2000 series
+ * ===========
+ */
+
+static void iwl2000_set_ct_threshold(struct iwl_priv *priv)
+{
+        /* want Celsius */
+        priv->hw_params.ct_kill_threshold = CT_KILL_THRESHOLD;
+        priv->hw_params.ct_kill_exit_threshold = CT_KILL_EXIT_THRESHOLD;
+}
+
+/* NIC configuration for 2000 series */
+static void iwl2000_nic_config(struct iwl_priv *priv)
+{
+        iwl_rf_config(priv);
+
+        iwl_set_bit(trans(priv), CSR_GP_DRIVER_REG,
+                    CSR_GP_DRIVER_REG_BIT_RADIO_IQ_INVER);
+}
+
+static const struct iwl_sensitivity_ranges iwl2000_sensitivity = {
+        .min_nrg_cck = 97,
+        .auto_corr_min_ofdm = 80,
+        .auto_corr_min_ofdm_mrc = 128,
+        .auto_corr_min_ofdm_x1 = 105,
+        .auto_corr_min_ofdm_mrc_x1 = 192,
+
+        .auto_corr_max_ofdm = 145,
+        .auto_corr_max_ofdm_mrc = 232,
+        .auto_corr_max_ofdm_x1 = 110,
+        .auto_corr_max_ofdm_mrc_x1 = 232,
+
+        .auto_corr_min_cck = 125,
+        .auto_corr_max_cck = 175,
+        .auto_corr_min_cck_mrc = 160,
+        .auto_corr_max_cck_mrc = 310,
+        .nrg_th_cck = 97,
+        .nrg_th_ofdm = 100,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
+};
+
+static void iwl2000_hw_set_hw_params(struct iwl_priv *priv)
+{
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ);
+
+        priv->hw_params.tx_chains_num =
+                num_of_ant(priv->hw_params.valid_tx_ant);
+        if (cfg(priv)->rx_with_siso_diversity)
+                priv->hw_params.rx_chains_num = 1;
+        else
+                priv->hw_params.rx_chains_num =
+                        num_of_ant(priv->hw_params.valid_rx_ant);
+
+        iwl2000_set_ct_threshold(priv);
+
+        /* Set initial sensitivity parameters */
+        priv->hw_params.sens = &iwl2000_sensitivity;
+}
+
+struct iwl_lib_ops iwl2000_lib = {
+        .set_hw_params = iwl2000_hw_set_hw_params,
+        .nic_config = iwl2000_nic_config,
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REGULATORY_BAND_NO_HT40,
+                },
+                .enhanced_txpower = true,
+        },
+        .temperature = iwlagn_temperature,
+};
+
+struct iwl_lib_ops iwl2030_lib = {
+        .set_hw_params = iwl2000_hw_set_hw_params,
+        .nic_config = iwl2000_nic_config,
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REGULATORY_BAND_NO_HT40,
+                },
+                .enhanced_txpower = true,
+        },
+        .temperature = iwlagn_temperature,
+};
+
+/*
+ * 5000 series
+ * ===========
+ */
+
+/* NIC configuration for 5000 series */
+static void iwl5000_nic_config(struct iwl_priv *priv)
+{
+        iwl_rf_config(priv);
+
+        /* W/A : NIC is stuck in a reset state after Early PCIe power off
+         * (PCIe power is lost before PERST# is asserted),
+         * causing ME FW to lose ownership and not being able to obtain it back.
+         */
+        iwl_set_bits_mask_prph(trans(priv), APMG_PS_CTRL_REG,
+                                APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS,
+                                ~APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS);
+}
+
+static const struct iwl_sensitivity_ranges iwl5000_sensitivity = {
+        .min_nrg_cck = 100,
+        .auto_corr_min_ofdm = 90,
+        .auto_corr_min_ofdm_mrc = 170,
+        .auto_corr_min_ofdm_x1 = 105,
+        .auto_corr_min_ofdm_mrc_x1 = 220,
+
+        .auto_corr_max_ofdm = 120,
+        .auto_corr_max_ofdm_mrc = 210,
+        .auto_corr_max_ofdm_x1 = 120,
+        .auto_corr_max_ofdm_mrc_x1 = 240,
+
+        .auto_corr_min_cck = 125,
+        .auto_corr_max_cck = 200,
+        .auto_corr_min_cck_mrc = 200,
+        .auto_corr_max_cck_mrc = 400,
+        .nrg_th_cck = 100,
+        .nrg_th_ofdm = 100,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
+};
+
+static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
+        .min_nrg_cck = 95,
+        .auto_corr_min_ofdm = 90,
+        .auto_corr_min_ofdm_mrc = 170,
+        .auto_corr_min_ofdm_x1 = 105,
+        .auto_corr_min_ofdm_mrc_x1 = 220,
+
+        .auto_corr_max_ofdm = 120,
+        .auto_corr_max_ofdm_mrc = 210,
+        /* max = min for performance bug in 5150 DSP */
+        .auto_corr_max_ofdm_x1 = 105,
+        .auto_corr_max_ofdm_mrc_x1 = 220,
+
+        .auto_corr_min_cck = 125,
+        .auto_corr_max_cck = 200,
+        .auto_corr_min_cck_mrc = 170,
+        .auto_corr_max_cck_mrc = 400,
+        .nrg_th_cck = 95,
+        .nrg_th_ofdm = 95,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
+};
+
+#define IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF   (-5)
+
+static s32 iwl_temp_calib_to_offset(struct iwl_priv *priv)
+{
+        u16 temperature, voltage;
+        __le16 *temp_calib = (__le16 *)iwl_eeprom_query_addr(priv,
+                                EEPROM_KELVIN_TEMPERATURE);
+
+        temperature = le16_to_cpu(temp_calib[0]);
+        voltage = le16_to_cpu(temp_calib[1]);
+
+        /* offset = temp - volt / coeff */
+        return (s32)(temperature -
+                        voltage / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
+}
+
+static void iwl5150_set_ct_threshold(struct iwl_priv *priv)
+{
+        const s32 volt2temp_coef = IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF;
+        s32 threshold = (s32)CELSIUS_TO_KELVIN(CT_KILL_THRESHOLD_LEGACY) -
+                        iwl_temp_calib_to_offset(priv);
+
+        priv->hw_params.ct_kill_threshold = threshold * volt2temp_coef;
+}
+
+static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
+{
+        /* want Celsius */
+        priv->hw_params.ct_kill_threshold = CT_KILL_THRESHOLD_LEGACY;
+}
+
+static void iwl5000_hw_set_hw_params(struct iwl_priv *priv)
+{
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+
+        priv->hw_params.tx_chains_num =
+                num_of_ant(priv->hw_params.valid_tx_ant);
+        priv->hw_params.rx_chains_num =
+                num_of_ant(priv->hw_params.valid_rx_ant);
+
+        iwl5000_set_ct_threshold(priv);
+
+        /* Set initial sensitivity parameters */
+        priv->hw_params.sens = &iwl5000_sensitivity;
+}
+
+static void iwl5150_hw_set_hw_params(struct iwl_priv *priv)
+{
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+
+        priv->hw_params.tx_chains_num =
+                num_of_ant(priv->hw_params.valid_tx_ant);
+        priv->hw_params.rx_chains_num =
+                num_of_ant(priv->hw_params.valid_rx_ant);
+
+        iwl5150_set_ct_threshold(priv);
+
+        /* Set initial sensitivity parameters */
+        priv->hw_params.sens = &iwl5150_sensitivity;
+}
+
+static void iwl5150_temperature(struct iwl_priv *priv)
+{
+        u32 vt = 0;
+        s32 offset =  iwl_temp_calib_to_offset(priv);
+
+        vt = le32_to_cpu(priv->statistics.common.temperature);
+        vt = vt / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF + offset;
+        /* now vt hold the temperature in Kelvin */
+        priv->temperature = KELVIN_TO_CELSIUS(vt);
+        iwl_tt_handler(priv);
+}
+
+static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
+                                     struct ieee80211_channel_switch *ch_switch)
+{
+        /*
+         * MULTI-FIXME
+         * See iwlagn_mac_channel_switch.
+         */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+        struct iwl5000_channel_switch_cmd cmd;
+        const struct iwl_channel_info *ch_info;
+        u32 switch_time_in_usec, ucode_switch_time;
+        u16 ch;
+        u32 tsf_low;
+        u8 switch_count;
+        u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval);
+        struct ieee80211_vif *vif = ctx->vif;
+        struct iwl_host_cmd hcmd = {
+                .id = REPLY_CHANNEL_SWITCH,
+                .len = { sizeof(cmd), },
+                .flags = CMD_SYNC,
+                .data = { &cmd, },
+        };
+
+        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        ch = ch_switch->channel->hw_value;
+        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+                      ctx->active.channel, ch);
+        cmd.channel = cpu_to_le16(ch);
+        cmd.rxon_flags = ctx->staging.flags;
+        cmd.rxon_filter_flags = ctx->staging.filter_flags;
+        switch_count = ch_switch->count;
+        tsf_low = ch_switch->timestamp & 0x0ffffffff;
+        /*
+         * calculate the ucode channel switch time
+         * adding TSF as one of the factor for when to switch
+         */
+        if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) {
+                if (switch_count > ((priv->ucode_beacon_time - tsf_low) /
+                    beacon_interval)) {
+                        switch_count -= (priv->ucode_beacon_time -
+                                tsf_low) / beacon_interval;
+                } else
+                        switch_count = 0;
+        }
+        if (switch_count <= 1)
+                cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        else {
+                switch_time_in_usec =
+                        vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
+                ucode_switch_time = iwl_usecs_to_beacons(priv,
+                                                         switch_time_in_usec,
+                                                         beacon_interval);
+                cmd.switch_time = iwl_add_beacon_time(priv,
+                                                      priv->ucode_beacon_time,
+                                                      ucode_switch_time,
+                                                      beacon_interval);
+        }
+        IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+                      cmd.switch_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, ch);
+        if (ch_info)
+                cmd.expect_beacon = is_channel_radar(ch_info);
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        ctx->active.channel, ch);
+                return -EFAULT;
+        }
+
+        return iwl_dvm_send_cmd(priv, &hcmd);
+}
+
+struct iwl_lib_ops iwl5000_lib = {
+        .set_hw_params = iwl5000_hw_set_hw_params,
+        .set_channel_switch = iwl5000_hw_channel_switch,
+        .nic_config = iwl5000_nic_config,
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
+                },
+        },
+        .temperature = iwlagn_temperature,
+};
+
+struct iwl_lib_ops iwl5150_lib = {
+        .set_hw_params = iwl5150_hw_set_hw_params,
+        .set_channel_switch = iwl5000_hw_channel_switch,
+        .nic_config = iwl5000_nic_config,
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
+                },
+        },
+        .temperature = iwl5150_temperature,
+};
+
+
+
+/*
+ * 6000 series
+ * ===========
+ */
+
+static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
+{
+        /* want Celsius */
+        priv->hw_params.ct_kill_threshold = CT_KILL_THRESHOLD;
+        priv->hw_params.ct_kill_exit_threshold = CT_KILL_EXIT_THRESHOLD;
+}
+
+/* NIC configuration for 6000 series */
+static void iwl6000_nic_config(struct iwl_priv *priv)
+{
+        iwl_rf_config(priv);
+
+        switch (cfg(priv)->device_family) {
+        case IWL_DEVICE_FAMILY_6005:
+        case IWL_DEVICE_FAMILY_6030:
+        case IWL_DEVICE_FAMILY_6000:
+                break;
+        case IWL_DEVICE_FAMILY_6000i:
+                /* 2x2 IPA phy type */
+                iwl_write32(trans(priv), CSR_GP_DRIVER_REG,
+                             CSR_GP_DRIVER_REG_BIT_RADIO_SKU_2x2_IPA);
+                break;
+        case IWL_DEVICE_FAMILY_6050:
+                /* Indicate calibration version to uCode. */
+                if (iwl_eeprom_calib_version(priv) >= 6)
+                        iwl_set_bit(trans(priv), CSR_GP_DRIVER_REG,
+                                        CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6);
+                break;
+        case IWL_DEVICE_FAMILY_6150:
+                /* Indicate calibration version to uCode. */
+                if (iwl_eeprom_calib_version(priv) >= 6)
+                        iwl_set_bit(trans(priv), CSR_GP_DRIVER_REG,
+                                        CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6);
+                iwl_set_bit(trans(priv), CSR_GP_DRIVER_REG,
+                            CSR_GP_DRIVER_REG_BIT_6050_1x2);
+                break;
+        default:
+                WARN_ON(1);
+        }
+}
+
+static const struct iwl_sensitivity_ranges iwl6000_sensitivity = {
+        .min_nrg_cck = 110,
+        .auto_corr_min_ofdm = 80,
+        .auto_corr_min_ofdm_mrc = 128,
+        .auto_corr_min_ofdm_x1 = 105,
+        .auto_corr_min_ofdm_mrc_x1 = 192,
+
+        .auto_corr_max_ofdm = 145,
+        .auto_corr_max_ofdm_mrc = 232,
+        .auto_corr_max_ofdm_x1 = 110,
+        .auto_corr_max_ofdm_mrc_x1 = 232,
+
+        .auto_corr_min_cck = 125,
+        .auto_corr_max_cck = 175,
+        .auto_corr_min_cck_mrc = 160,
+        .auto_corr_max_cck_mrc = 310,
+        .nrg_th_cck = 110,
+        .nrg_th_ofdm = 110,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 336,
+        .nrg_th_cca = 62,
+};
+
+static void iwl6000_hw_set_hw_params(struct iwl_priv *priv)
+{
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+
+        priv->hw_params.tx_chains_num =
+                num_of_ant(priv->hw_params.valid_tx_ant);
+        if (cfg(priv)->rx_with_siso_diversity)
+                priv->hw_params.rx_chains_num = 1;
+        else
+                priv->hw_params.rx_chains_num =
+                        num_of_ant(priv->hw_params.valid_rx_ant);
+
+        iwl6000_set_ct_threshold(priv);
+
+        /* Set initial sensitivity parameters */
+        priv->hw_params.sens = &iwl6000_sensitivity;
+
+}
+
+static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
+                                     struct ieee80211_channel_switch *ch_switch)
+{
+        /*
+         * MULTI-FIXME
+         * See iwlagn_mac_channel_switch.
+         */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+        struct iwl6000_channel_switch_cmd cmd;
+        const struct iwl_channel_info *ch_info;
+        u32 switch_time_in_usec, ucode_switch_time;
+        u16 ch;
+        u32 tsf_low;
+        u8 switch_count;
+        u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval);
+        struct ieee80211_vif *vif = ctx->vif;
+        struct iwl_host_cmd hcmd = {
+                .id = REPLY_CHANNEL_SWITCH,
+                .len = { sizeof(cmd), },
+                .flags = CMD_SYNC,
+                .data = { &cmd, },
+        };
+
+        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        ch = ch_switch->channel->hw_value;
+        IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
+                      ctx->active.channel, ch);
+        cmd.channel = cpu_to_le16(ch);
+        cmd.rxon_flags = ctx->staging.flags;
+        cmd.rxon_filter_flags = ctx->staging.filter_flags;
+        switch_count = ch_switch->count;
+        tsf_low = ch_switch->timestamp & 0x0ffffffff;
+        /*
+         * calculate the ucode channel switch time
+         * adding TSF as one of the factor for when to switch
+         */
+        if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) {
+                if (switch_count > ((priv->ucode_beacon_time - tsf_low) /
+                    beacon_interval)) {
+                        switch_count -= (priv->ucode_beacon_time -
+                                tsf_low) / beacon_interval;
+                } else
+                        switch_count = 0;
+        }
+        if (switch_count <= 1)
+                cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        else {
+                switch_time_in_usec =
+                        vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
+                ucode_switch_time = iwl_usecs_to_beacons(priv,
+                                                         switch_time_in_usec,
+                                                         beacon_interval);
+                cmd.switch_time = iwl_add_beacon_time(priv,
+                                                      priv->ucode_beacon_time,
+                                                      ucode_switch_time,
+                                                      beacon_interval);
+        }
+        IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+                      cmd.switch_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, ch);
+        if (ch_info)
+                cmd.expect_beacon = is_channel_radar(ch_info);
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        ctx->active.channel, ch);
+                return -EFAULT;
+        }
+
+        return iwl_dvm_send_cmd(priv, &hcmd);
+}
+
+struct iwl_lib_ops iwl6000_lib = {
+        .set_hw_params = iwl6000_hw_set_hw_params,
+        .set_channel_switch = iwl6000_hw_channel_switch,
+        .nic_config = iwl6000_nic_config,
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
+                },
+                .enhanced_txpower = true,
+        },
+        .temperature = iwlagn_temperature,
+};
+
+struct iwl_lib_ops iwl6030_lib = {
+        .set_hw_params = iwl6000_hw_set_hw_params,
+        .set_channel_switch = iwl6000_hw_channel_switch,
+        .nic_config = iwl6000_nic_config,
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
+                },
+                .enhanced_txpower = true,
+        },
+        .temperature = iwlagn_temperature,
+};
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 4da4ab23cce7..4e0c248a0050 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -94,77 +94,13 @@ void iwlagn_temperature(struct iwl_priv *priv)
         iwl_tt_handler(priv);
 }
 
-u16 iwl_eeprom_calib_version(struct iwl_shared *shrd)
-{
-        struct iwl_eeprom_calib_hdr *hdr;
-
-        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(shrd,
-                                                        EEPROM_CALIB_ALL);
-        return hdr->version;
-
-}
-
-/*
- * EEPROM
- */
-static u32 eeprom_indirect_address(const struct iwl_shared *shrd, u32 address)
-{
-        u16 offset = 0;
-
-        if ((address & INDIRECT_ADDRESS) == 0)
-                return address;
-
-        switch (address & INDIRECT_TYPE_MSK) {
-        case INDIRECT_HOST:
-                offset = iwl_eeprom_query16(shrd, EEPROM_LINK_HOST);
-                break;
-        case INDIRECT_GENERAL:
-                offset = iwl_eeprom_query16(shrd, EEPROM_LINK_GENERAL);
-                break;
-        case INDIRECT_REGULATORY:
-                offset = iwl_eeprom_query16(shrd, EEPROM_LINK_REGULATORY);
-                break;
-        case INDIRECT_TXP_LIMIT:
-                offset = iwl_eeprom_query16(shrd, EEPROM_LINK_TXP_LIMIT);
-                break;
-        case INDIRECT_TXP_LIMIT_SIZE:
-                offset = iwl_eeprom_query16(shrd, EEPROM_LINK_TXP_LIMIT_SIZE);
-                break;
-        case INDIRECT_CALIBRATION:
-                offset = iwl_eeprom_query16(shrd, EEPROM_LINK_CALIBRATION);
-                break;
-        case INDIRECT_PROCESS_ADJST:
-                offset = iwl_eeprom_query16(shrd, EEPROM_LINK_PROCESS_ADJST);
-                break;
-        case INDIRECT_OTHERS:
-                offset = iwl_eeprom_query16(shrd, EEPROM_LINK_OTHERS);
-                break;
-        default:
-                IWL_ERR(shrd->trans, "illegal indirect type: 0x%X\n",
-                address & INDIRECT_TYPE_MSK);
-                break;
-        }
-
-        /* translate the offset from words to byte */
-        return (address & ADDRESS_MSK) + (offset << 1);
-}
-
-const u8 *iwl_eeprom_query_addr(const struct iwl_shared *shrd, size_t offset)
-{
-        u32 address = eeprom_indirect_address(shrd, offset);
-        BUG_ON(address >= shrd->cfg->base_params->eeprom_size);
-        return &shrd->eeprom[address];
-}
-
 struct iwl_mod_params iwlagn_mod_params = {
         .amsdu_size_8K = 1,
         .restart_fw = 1,
         .plcp_check = true,
         .bt_coex_active = true,
-        .no_sleep_autoadjust = true,
         .power_level = IWL_POWER_INDEX_1,
         .bt_ch_announce = true,
-        .wanted_ucode_alternative = 1,
         .auto_agg = true,
         /* the rest are 0 by default */
 };
@@ -234,7 +170,7 @@ int iwlagn_txfifo_flush(struct iwl_priv *priv, u16 flush_control)
                                 IWL_PAN_SCD_BK_MSK | IWL_PAN_SCD_MGMT_MSK |
                                 IWL_PAN_SCD_MULTICAST_MSK;
 
-        if (hw_params(priv).sku & EEPROM_SKU_CAP_11N_ENABLE)
+        if (priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE)
                 flush_cmd.fifo_control |= IWL_AGG_TX_QUEUE_MSK;
 
         IWL_DEBUG_INFO(priv, "fifo queue control: 0X%x\n",
@@ -369,24 +305,30 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
                 .bt3_prio_sample_time = IWLAGN_BT3_PRIO_SAMPLE_DEFAULT,
                 .bt3_timer_t2_value = IWLAGN_BT3_T2_DEFAULT,
         };
-        struct iwl6000_bt_cmd bt_cmd_6000;
-        struct iwl2000_bt_cmd bt_cmd_2000;
+        struct iwl_bt_cmd_v1 bt_cmd_v1;
+        struct iwl_bt_cmd_v2 bt_cmd_v2;
         int ret;
 
         BUILD_BUG_ON(sizeof(iwlagn_def_3w_lookup) !=
                         sizeof(basic.bt3_lookup_table));
 
         if (cfg(priv)->bt_params) {
+                /*
+                 * newer generation of devices (2000 series and newer)
+                 * use the version 2 of the bt command
+                 * we need to make sure sending the host command
+                 * with correct data structure to avoid uCode assert
+                 */
                 if (cfg(priv)->bt_params->bt_session_2) {
-                        bt_cmd_2000.prio_boost = cpu_to_le32(
+                        bt_cmd_v2.prio_boost = cpu_to_le32(
                                 cfg(priv)->bt_params->bt_prio_boost);
-                        bt_cmd_2000.tx_prio_boost = 0;
-                        bt_cmd_2000.rx_prio_boost = 0;
+                        bt_cmd_v2.tx_prio_boost = 0;
+                        bt_cmd_v2.rx_prio_boost = 0;
                 } else {
-                        bt_cmd_6000.prio_boost =
+                        bt_cmd_v1.prio_boost =
                                 cfg(priv)->bt_params->bt_prio_boost;
-                        bt_cmd_6000.tx_prio_boost = 0;
-                        bt_cmd_6000.rx_prio_boost = 0;
+                        bt_cmd_v1.tx_prio_boost = 0;
+                        bt_cmd_v1.rx_prio_boost = 0;
                 }
         } else {
                 IWL_ERR(priv, "failed to construct BT Coex Config\n");
@@ -433,15 +375,15 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
                        "full concurrency" : "3-wire");
 
         if (cfg(priv)->bt_params->bt_session_2) {
-                memcpy(&bt_cmd_2000.basic, &basic,
+                memcpy(&bt_cmd_v2.basic, &basic,
                         sizeof(basic));
                 ret = iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                        CMD_SYNC, sizeof(bt_cmd_2000), &bt_cmd_2000);
+                        CMD_SYNC, sizeof(bt_cmd_v2), &bt_cmd_v2);
         } else {
-                memcpy(&bt_cmd_6000.basic, &basic,
+                memcpy(&bt_cmd_v1.basic, &basic,
                         sizeof(basic));
                 ret = iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                        CMD_SYNC, sizeof(bt_cmd_6000), &bt_cmd_6000);
+                        CMD_SYNC, sizeof(bt_cmd_v1), &bt_cmd_v1);
         }
         if (ret)
                 IWL_ERR(priv, "failed to send BT Coex Config\n");
@@ -868,7 +810,7 @@ void iwlagn_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         if (priv->chain_noise_data.active_chains)
                 active_chains = priv->chain_noise_data.active_chains;
         else
-                active_chains = hw_params(priv).valid_rx_ant;
+                active_chains = priv->hw_params.valid_rx_ant;
 
         if (cfg(priv)->bt_params &&
             cfg(priv)->bt_params->advanced_bt_coexist &&
@@ -1300,7 +1242,7 @@ int iwl_dvm_send_cmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
 
         if (test_bit(STATUS_FW_ERROR, &priv->status)) {
                 IWL_ERR(priv, "Command %s failed: FW Error\n",
-                        get_cmd_string(cmd->id));
+                        iwl_dvm_get_cmd_string(cmd->id));
                 return -EIO;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index b936ae7e00a3..8b13b6cf940a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -819,7 +819,7 @@ static u32 rs_get_lower_rate(struct iwl_lq_sta *lq_sta,
 
                 if (num_of_ant(tbl->ant_type) > 1)
                         tbl->ant_type =
-                            first_antenna(hw_params(priv).valid_tx_ant);
+                            first_antenna(priv->hw_params.valid_tx_ant);
 
                 tbl->is_ht40 = 0;
                 tbl->is_SGI = 0;
@@ -1291,7 +1291,7 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
-        if (hw_params(priv).tx_chains_num < 2)
+        if (priv->hw_params.tx_chains_num < 2)
                 return -1;
 
         IWL_DEBUG_RATE(priv, "LQ: try to switch to MIMO2\n");
@@ -1347,7 +1347,7 @@ static int rs_switch_to_mimo3(struct iwl_priv *priv,
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
-        if (hw_params(priv).tx_chains_num < 3)
+        if (priv->hw_params.tx_chains_num < 3)
                 return -1;
 
         IWL_DEBUG_RATE(priv, "LQ: try to switch to MIMO3\n");
@@ -1446,8 +1446,8 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = hw_params(priv).valid_tx_ant;
-        u8 tx_chains_num = hw_params(priv).tx_chains_num;
+        u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
+        u8 tx_chains_num = priv->hw_params.tx_chains_num;
         int ret = 0;
         u8 update_search_tbl_counter = 0;
 
@@ -1464,7 +1464,7 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
         case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
                 /* avoid antenna B and MIMO */
                 valid_tx_ant =
-                        first_antenna(hw_params(priv).valid_tx_ant);
+                        first_antenna(priv->hw_params.valid_tx_ant);
                 if (tbl->action >= IWL_LEGACY_SWITCH_ANTENNA2 &&
                     tbl->action != IWL_LEGACY_SWITCH_SISO)
                         tbl->action = IWL_LEGACY_SWITCH_SISO;
@@ -1488,7 +1488,7 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
                 else if (tbl->action >= IWL_LEGACY_SWITCH_ANTENNA2)
                         tbl->action = IWL_LEGACY_SWITCH_SISO;
                 valid_tx_ant =
-                        first_antenna(hw_params(priv).valid_tx_ant);
+                        first_antenna(priv->hw_params.valid_tx_ant);
         }
 
         start_action = tbl->action;
@@ -1622,8 +1622,8 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = hw_params(priv).valid_tx_ant;
-        u8 tx_chains_num = hw_params(priv).tx_chains_num;
+        u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
+        u8 tx_chains_num = priv->hw_params.tx_chains_num;
         u8 update_search_tbl_counter = 0;
         int ret;
 
@@ -1640,7 +1640,7 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
         case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
                 /* avoid antenna B and MIMO */
                 valid_tx_ant =
-                        first_antenna(hw_params(priv).valid_tx_ant);
+                        first_antenna(priv->hw_params.valid_tx_ant);
                 if (tbl->action != IWL_SISO_SWITCH_ANTENNA1)
                         tbl->action = IWL_SISO_SWITCH_ANTENNA1;
                 break;
@@ -1658,7 +1658,7 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
         /* configure as 1x1 if bt full concurrency */
         if (priv->bt_full_concurrent) {
                 valid_tx_ant =
-                        first_antenna(hw_params(priv).valid_tx_ant);
+                        first_antenna(priv->hw_params.valid_tx_ant);
                 if (tbl->action >= IWL_LEGACY_SWITCH_ANTENNA2)
                         tbl->action = IWL_SISO_SWITCH_ANTENNA1;
         }
@@ -1794,8 +1794,8 @@ static int rs_move_mimo2_to_other(struct iwl_priv *priv,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = hw_params(priv).valid_tx_ant;
-        u8 tx_chains_num = hw_params(priv).tx_chains_num;
+        u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
+        u8 tx_chains_num = priv->hw_params.tx_chains_num;
         u8 update_search_tbl_counter = 0;
         int ret;
 
@@ -1964,8 +1964,8 @@ static int rs_move_mimo3_to_other(struct iwl_priv *priv,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = hw_params(priv).valid_tx_ant;
-        u8 tx_chains_num = hw_params(priv).tx_chains_num;
+        u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
+        u8 tx_chains_num = priv->hw_params.tx_chains_num;
         int ret;
         u8 update_search_tbl_counter = 0;
 
@@ -2698,7 +2698,7 @@ static void rs_initialize_lq(struct iwl_priv *priv,
 
         i = lq_sta->last_txrate_idx;
 
-        valid_tx_ant = hw_params(priv).valid_tx_ant;
+        valid_tx_ant = priv->hw_params.valid_tx_ant;
 
         if (!lq_sta->search_better_tbl)
                 active_tbl = lq_sta->active_tbl;
@@ -2826,6 +2826,7 @@ void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_i
         struct iwl_station_priv *sta_priv;
         struct iwl_lq_sta *lq_sta;
         struct ieee80211_supported_band *sband;
+        unsigned long supp; /* must be unsigned long for for_each_set_bit */
 
         sta_priv = (struct iwl_station_priv *) sta->drv_priv;
         lq_sta = &sta_priv->lq_sta;
@@ -2855,8 +2856,15 @@ void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_i
         lq_sta->max_rate_idx = -1;
         lq_sta->missed_rate_counter = IWL_MISSED_RATE_MAX;
         lq_sta->is_green = rs_use_green(sta);
-        lq_sta->active_legacy_rate = priv->active_rate & ~(0x1000);
-        lq_sta->band = priv->band;
+        lq_sta->band = sband->band;
+        /*
+         * active legacy rates as per supported rates bitmap
+         */
+        supp = sta->supp_rates[sband->band];
+        lq_sta->active_legacy_rate = 0;
+        for_each_set_bit(i, &supp, BITS_PER_LONG)
+                lq_sta->active_legacy_rate |= BIT(sband->bitrates[i].hw_value);
+
         /*
          * active_siso_rate mask includes 9 MBits (bit 5), and CCK (bits 0-3),
          * supp_rates[] does not; shift to convert format, force 9 MBits off.
@@ -2884,15 +2892,15 @@ void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_i
 
         /* These values will be overridden later */
         lq_sta->lq.general_params.single_stream_ant_msk =
-                first_antenna(hw_params(priv).valid_tx_ant);
+                first_antenna(priv->hw_params.valid_tx_ant);
         lq_sta->lq.general_params.dual_stream_ant_msk =
-                hw_params(priv).valid_tx_ant &
-                ~first_antenna(hw_params(priv).valid_tx_ant);
+                priv->hw_params.valid_tx_ant &
+                ~first_antenna(priv->hw_params.valid_tx_ant);
         if (!lq_sta->lq.general_params.dual_stream_ant_msk) {
                 lq_sta->lq.general_params.dual_stream_ant_msk = ANT_AB;
-        } else if (num_of_ant(hw_params(priv).valid_tx_ant) == 2) {
+        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
                 lq_sta->lq.general_params.dual_stream_ant_msk =
-                        hw_params(priv).valid_tx_ant;
+                        priv->hw_params.valid_tx_ant;
         }
 
         /* as default allow aggregation for all tids */
@@ -2938,7 +2946,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
         if (priv && priv->bt_full_concurrent) {
                 /* 1x1 only */
                 tbl_type.ant_type =
-                        first_antenna(hw_params(priv).valid_tx_ant);
+                        first_antenna(priv->hw_params.valid_tx_ant);
         }
 
         /* How many times should we repeat the initial rate? */
@@ -2970,7 +2978,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
                 if (priv->bt_full_concurrent)
                         valid_tx_ant = ANT_A;
                 else
-                        valid_tx_ant = hw_params(priv).valid_tx_ant;
+                        valid_tx_ant = priv->hw_params.valid_tx_ant;
         }
 
         /* Fill rest of rate table */
@@ -3004,7 +3012,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
                 if (priv && priv->bt_full_concurrent) {
                         /* 1x1 only */
                         tbl_type.ant_type =
-                            first_antenna(hw_params(priv).valid_tx_ant);
+                            first_antenna(priv->hw_params.valid_tx_ant);
                 }
 
                 /* Indicate to uCode which entries might be MIMO.
@@ -3091,7 +3099,7 @@ static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
         u8 ant_sel_tx;
 
         priv = lq_sta->drv;
-        valid_tx_ant = hw_params(priv).valid_tx_ant;
+        valid_tx_ant = priv->hw_params.valid_tx_ant;
         if (lq_sta->dbg_fixed_rate) {
                 ant_sel_tx =
                   ((lq_sta->dbg_fixed_rate & RATE_MCS_ANT_ABC_MSK)
@@ -3162,9 +3170,9 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
         desc += sprintf(buff+desc, "fixed rate 0x%X\n",
                         lq_sta->dbg_fixed_rate);
         desc += sprintf(buff+desc, "valid_tx_ant %s%s%s\n",
-            (hw_params(priv).valid_tx_ant & ANT_A) ? "ANT_A," : "",
-            (hw_params(priv).valid_tx_ant & ANT_B) ? "ANT_B," : "",
-            (hw_params(priv).valid_tx_ant & ANT_C) ? "ANT_C" : "");
+            (priv->hw_params.valid_tx_ant & ANT_A) ? "ANT_A," : "",
+            (priv->hw_params.valid_tx_ant & ANT_B) ? "ANT_B," : "",
+            (priv->hw_params.valid_tx_ant & ANT_C) ? "ANT_C" : "");
         desc += sprintf(buff+desc, "lq type %s\n",
            (is_legacy(tbl->lq_type)) ? "legacy" : "HT");
         if (is_Ht(tbl->lq_type)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
index e12f11d50b88..db6c90f6affe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
@@ -40,89 +40,86 @@
 #include "iwl-agn.h"
 #include "iwl-shared.h"
 
-const char *get_cmd_string(u8 cmd)
-{
-        switch (cmd) {
-                IWL_CMD(REPLY_ALIVE);
-                IWL_CMD(REPLY_ERROR);
-                IWL_CMD(REPLY_ECHO);
-                IWL_CMD(REPLY_RXON);
-                IWL_CMD(REPLY_RXON_ASSOC);
-                IWL_CMD(REPLY_QOS_PARAM);
-                IWL_CMD(REPLY_RXON_TIMING);
-                IWL_CMD(REPLY_ADD_STA);
-                IWL_CMD(REPLY_REMOVE_STA);
-                IWL_CMD(REPLY_REMOVE_ALL_STA);
-                IWL_CMD(REPLY_TXFIFO_FLUSH);
-                IWL_CMD(REPLY_WEPKEY);
-                IWL_CMD(REPLY_TX);
-                IWL_CMD(REPLY_LEDS_CMD);
-                IWL_CMD(REPLY_TX_LINK_QUALITY_CMD);
-                IWL_CMD(COEX_PRIORITY_TABLE_CMD);
-                IWL_CMD(COEX_MEDIUM_NOTIFICATION);
-                IWL_CMD(COEX_EVENT_CMD);
-                IWL_CMD(REPLY_QUIET_CMD);
-                IWL_CMD(REPLY_CHANNEL_SWITCH);
-                IWL_CMD(CHANNEL_SWITCH_NOTIFICATION);
-                IWL_CMD(REPLY_SPECTRUM_MEASUREMENT_CMD);
-                IWL_CMD(SPECTRUM_MEASURE_NOTIFICATION);
-                IWL_CMD(POWER_TABLE_CMD);
-                IWL_CMD(PM_SLEEP_NOTIFICATION);
-                IWL_CMD(PM_DEBUG_STATISTIC_NOTIFIC);
-                IWL_CMD(REPLY_SCAN_CMD);
-                IWL_CMD(REPLY_SCAN_ABORT_CMD);
-                IWL_CMD(SCAN_START_NOTIFICATION);
-                IWL_CMD(SCAN_RESULTS_NOTIFICATION);
-                IWL_CMD(SCAN_COMPLETE_NOTIFICATION);
-                IWL_CMD(BEACON_NOTIFICATION);
-                IWL_CMD(REPLY_TX_BEACON);
-                IWL_CMD(WHO_IS_AWAKE_NOTIFICATION);
-                IWL_CMD(QUIET_NOTIFICATION);
-                IWL_CMD(REPLY_TX_PWR_TABLE_CMD);
-                IWL_CMD(MEASURE_ABORT_NOTIFICATION);
-                IWL_CMD(REPLY_BT_CONFIG);
-                IWL_CMD(REPLY_STATISTICS_CMD);
-                IWL_CMD(STATISTICS_NOTIFICATION);
-                IWL_CMD(REPLY_CARD_STATE_CMD);
-                IWL_CMD(CARD_STATE_NOTIFICATION);
-                IWL_CMD(MISSED_BEACONS_NOTIFICATION);
-                IWL_CMD(REPLY_CT_KILL_CONFIG_CMD);
-                IWL_CMD(SENSITIVITY_CMD);
-                IWL_CMD(REPLY_PHY_CALIBRATION_CMD);
-                IWL_CMD(REPLY_RX_PHY_CMD);
-                IWL_CMD(REPLY_RX_MPDU_CMD);
-                IWL_CMD(REPLY_RX);
-                IWL_CMD(REPLY_COMPRESSED_BA);
-                IWL_CMD(CALIBRATION_CFG_CMD);
-                IWL_CMD(CALIBRATION_RES_NOTIFICATION);
-                IWL_CMD(CALIBRATION_COMPLETE_NOTIFICATION);
-                IWL_CMD(REPLY_TX_POWER_DBM_CMD);
-                IWL_CMD(TEMPERATURE_NOTIFICATION);
-                IWL_CMD(TX_ANT_CONFIGURATION_CMD);
-                IWL_CMD(REPLY_BT_COEX_PROFILE_NOTIF);
-                IWL_CMD(REPLY_BT_COEX_PRIO_TABLE);
-                IWL_CMD(REPLY_BT_COEX_PROT_ENV);
-                IWL_CMD(REPLY_WIPAN_PARAMS);
-                IWL_CMD(REPLY_WIPAN_RXON);
-                IWL_CMD(REPLY_WIPAN_RXON_TIMING);
-                IWL_CMD(REPLY_WIPAN_RXON_ASSOC);
-                IWL_CMD(REPLY_WIPAN_QOS_PARAM);
-                IWL_CMD(REPLY_WIPAN_WEPKEY);
-                IWL_CMD(REPLY_WIPAN_P2P_CHANNEL_SWITCH);
-                IWL_CMD(REPLY_WIPAN_NOA_NOTIFICATION);
-                IWL_CMD(REPLY_WIPAN_DEACTIVATION_COMPLETE);
-                IWL_CMD(REPLY_WOWLAN_PATTERNS);
-                IWL_CMD(REPLY_WOWLAN_WAKEUP_FILTER);
-                IWL_CMD(REPLY_WOWLAN_TSC_RSC_PARAMS);
-                IWL_CMD(REPLY_WOWLAN_TKIP_PARAMS);
-                IWL_CMD(REPLY_WOWLAN_KEK_KCK_MATERIAL);
-                IWL_CMD(REPLY_WOWLAN_GET_STATUS);
-                IWL_CMD(REPLY_D3_CONFIG);
-        default:
-                return "UNKNOWN";
-
-        }
-}
+#define IWL_CMD_ENTRY(x) [x] = #x
+
+const char *iwl_dvm_cmd_strings[REPLY_MAX] = {
+        IWL_CMD_ENTRY(REPLY_ALIVE),
+        IWL_CMD_ENTRY(REPLY_ERROR),
+        IWL_CMD_ENTRY(REPLY_ECHO),
+        IWL_CMD_ENTRY(REPLY_RXON),
+        IWL_CMD_ENTRY(REPLY_RXON_ASSOC),
+        IWL_CMD_ENTRY(REPLY_QOS_PARAM),
+        IWL_CMD_ENTRY(REPLY_RXON_TIMING),
+        IWL_CMD_ENTRY(REPLY_ADD_STA),
+        IWL_CMD_ENTRY(REPLY_REMOVE_STA),
+        IWL_CMD_ENTRY(REPLY_REMOVE_ALL_STA),
+        IWL_CMD_ENTRY(REPLY_TXFIFO_FLUSH),
+        IWL_CMD_ENTRY(REPLY_WEPKEY),
+        IWL_CMD_ENTRY(REPLY_TX),
+        IWL_CMD_ENTRY(REPLY_LEDS_CMD),
+        IWL_CMD_ENTRY(REPLY_TX_LINK_QUALITY_CMD),
+        IWL_CMD_ENTRY(COEX_PRIORITY_TABLE_CMD),
+        IWL_CMD_ENTRY(COEX_MEDIUM_NOTIFICATION),
+        IWL_CMD_ENTRY(COEX_EVENT_CMD),
+        IWL_CMD_ENTRY(REPLY_QUIET_CMD),
+        IWL_CMD_ENTRY(REPLY_CHANNEL_SWITCH),
+        IWL_CMD_ENTRY(CHANNEL_SWITCH_NOTIFICATION),
+        IWL_CMD_ENTRY(REPLY_SPECTRUM_MEASUREMENT_CMD),
+        IWL_CMD_ENTRY(SPECTRUM_MEASURE_NOTIFICATION),
+        IWL_CMD_ENTRY(POWER_TABLE_CMD),
+        IWL_CMD_ENTRY(PM_SLEEP_NOTIFICATION),
+        IWL_CMD_ENTRY(PM_DEBUG_STATISTIC_NOTIFIC),
+        IWL_CMD_ENTRY(REPLY_SCAN_CMD),
+        IWL_CMD_ENTRY(REPLY_SCAN_ABORT_CMD),
+        IWL_CMD_ENTRY(SCAN_START_NOTIFICATION),
+        IWL_CMD_ENTRY(SCAN_RESULTS_NOTIFICATION),
+        IWL_CMD_ENTRY(SCAN_COMPLETE_NOTIFICATION),
+        IWL_CMD_ENTRY(BEACON_NOTIFICATION),
+        IWL_CMD_ENTRY(REPLY_TX_BEACON),
+        IWL_CMD_ENTRY(WHO_IS_AWAKE_NOTIFICATION),
+        IWL_CMD_ENTRY(QUIET_NOTIFICATION),
+        IWL_CMD_ENTRY(REPLY_TX_PWR_TABLE_CMD),
+        IWL_CMD_ENTRY(MEASURE_ABORT_NOTIFICATION),
+        IWL_CMD_ENTRY(REPLY_BT_CONFIG),
+        IWL_CMD_ENTRY(REPLY_STATISTICS_CMD),
+        IWL_CMD_ENTRY(STATISTICS_NOTIFICATION),
+        IWL_CMD_ENTRY(REPLY_CARD_STATE_CMD),
+        IWL_CMD_ENTRY(CARD_STATE_NOTIFICATION),
+        IWL_CMD_ENTRY(MISSED_BEACONS_NOTIFICATION),
+        IWL_CMD_ENTRY(REPLY_CT_KILL_CONFIG_CMD),
+        IWL_CMD_ENTRY(SENSITIVITY_CMD),
+        IWL_CMD_ENTRY(REPLY_PHY_CALIBRATION_CMD),
+        IWL_CMD_ENTRY(REPLY_RX_PHY_CMD),
+        IWL_CMD_ENTRY(REPLY_RX_MPDU_CMD),
+        IWL_CMD_ENTRY(REPLY_RX),
+        IWL_CMD_ENTRY(REPLY_COMPRESSED_BA),
+        IWL_CMD_ENTRY(CALIBRATION_CFG_CMD),
+        IWL_CMD_ENTRY(CALIBRATION_RES_NOTIFICATION),
+        IWL_CMD_ENTRY(CALIBRATION_COMPLETE_NOTIFICATION),
+        IWL_CMD_ENTRY(REPLY_TX_POWER_DBM_CMD),
+        IWL_CMD_ENTRY(TEMPERATURE_NOTIFICATION),
+        IWL_CMD_ENTRY(TX_ANT_CONFIGURATION_CMD),
+        IWL_CMD_ENTRY(REPLY_BT_COEX_PROFILE_NOTIF),
+        IWL_CMD_ENTRY(REPLY_BT_COEX_PRIO_TABLE),
+        IWL_CMD_ENTRY(REPLY_BT_COEX_PROT_ENV),
+        IWL_CMD_ENTRY(REPLY_WIPAN_PARAMS),
+        IWL_CMD_ENTRY(REPLY_WIPAN_RXON),
+        IWL_CMD_ENTRY(REPLY_WIPAN_RXON_TIMING),
+        IWL_CMD_ENTRY(REPLY_WIPAN_RXON_ASSOC),
+        IWL_CMD_ENTRY(REPLY_WIPAN_QOS_PARAM),
+        IWL_CMD_ENTRY(REPLY_WIPAN_WEPKEY),
+        IWL_CMD_ENTRY(REPLY_WIPAN_P2P_CHANNEL_SWITCH),
+        IWL_CMD_ENTRY(REPLY_WIPAN_NOA_NOTIFICATION),
+        IWL_CMD_ENTRY(REPLY_WIPAN_DEACTIVATION_COMPLETE),
+        IWL_CMD_ENTRY(REPLY_WOWLAN_PATTERNS),
+        IWL_CMD_ENTRY(REPLY_WOWLAN_WAKEUP_FILTER),
+        IWL_CMD_ENTRY(REPLY_WOWLAN_TSC_RSC_PARAMS),
+        IWL_CMD_ENTRY(REPLY_WOWLAN_TKIP_PARAMS),
+        IWL_CMD_ENTRY(REPLY_WOWLAN_KEK_KCK_MATERIAL),
+        IWL_CMD_ENTRY(REPLY_WOWLAN_GET_STATUS),
+        IWL_CMD_ENTRY(REPLY_D3_CONFIG),
+};
+#undef IWL_CMD_ENTRY
 
 /******************************************************************************
  *
@@ -137,10 +134,9 @@ static int iwlagn_rx_reply_error(struct iwl_priv *priv,
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_error_resp *err_resp = (void *)pkt->data;
 
-        IWL_ERR(priv, "Error Reply type 0x%08X cmd %s (0x%02X) "
+        IWL_ERR(priv, "Error Reply type 0x%08X cmd REPLY_ERROR (0x%02X) "
                 "seq 0x%04X ser 0x%08X\n",
                 le32_to_cpu(err_resp->error_type),
-                get_cmd_string(err_resp->cmd_id),
                 err_resp->cmd_id,
                 le16_to_cpu(err_resp->bad_cmd_seq_num),
                 le32_to_cpu(err_resp->error_info));
@@ -216,8 +212,7 @@ static int iwlagn_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
         u32 __maybe_unused len =
                 le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
         IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
-                        "notification for %s:\n", len,
-                        get_cmd_string(pkt->hdr.cmd));
+                        "notification for PM_DEBUG_STATISTIC_NOTIFIC:\n", len);
         iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->data, len);
         return 0;
 }
@@ -246,69 +241,6 @@ static int iwlagn_rx_beacon_notif(struct iwl_priv *priv,
         return 0;
 }
 
-/* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
-#define ACK_CNT_RATIO (50)
-#define BA_TIMEOUT_CNT (5)
-#define BA_TIMEOUT_MAX (16)
-
-/**
- * iwl_good_ack_health - checks for ACK count ratios, BA timeout retries.
- *
- * When the ACK count ratio is low and aggregated BA timeout retries exceeding
- * the BA_TIMEOUT_MAX, reload firmware and bring system back to normal
- * operation state.
- */
-static bool iwlagn_good_ack_health(struct iwl_priv *priv,
-                                struct statistics_tx *cur)
-{
-        int actual_delta, expected_delta, ba_timeout_delta;
-        struct statistics_tx *old;
-
-        if (priv->agg_tids_count)
-                return true;
-
-        lockdep_assert_held(&priv->statistics.lock);
-
-        old = &priv->statistics.tx;
-
-        actual_delta = le32_to_cpu(cur->actual_ack_cnt) -
-                       le32_to_cpu(old->actual_ack_cnt);
-        expected_delta = le32_to_cpu(cur->expected_ack_cnt) -
-                         le32_to_cpu(old->expected_ack_cnt);
-
-        /* Values should not be negative, but we do not trust the firmware */
-        if (actual_delta <= 0 || expected_delta <= 0)
-                return true;
-
-        ba_timeout_delta = le32_to_cpu(cur->agg.ba_timeout) -
-                           le32_to_cpu(old->agg.ba_timeout);
-
-        if ((actual_delta * 100 / expected_delta) < ACK_CNT_RATIO &&
-            ba_timeout_delta > BA_TIMEOUT_CNT) {
-                IWL_DEBUG_RADIO(priv,
-                        "deltas: actual %d expected %d ba_timeout %d\n",
-                        actual_delta, expected_delta, ba_timeout_delta);
-
-#ifdef CONFIG_IWLWIFI_DEBUGFS
-                /*
-                 * This is ifdef'ed on DEBUGFS because otherwise the
-                 * statistics aren't available. If DEBUGFS is set but
-                 * DEBUG is not, these will just compile out.
-                 */
-                IWL_DEBUG_RADIO(priv, "rx_detected_cnt delta %d\n",
-                                priv->delta_stats.tx.rx_detected_cnt);
-                IWL_DEBUG_RADIO(priv,
-                                "ack_or_ba_timeout_collision delta %d\n",
-                                priv->delta_stats.tx.ack_or_ba_timeout_collision);
-#endif
-
-                if (ba_timeout_delta >= BA_TIMEOUT_MAX)
-                        return false;
-        }
-
-        return true;
-}
-
 /**
  * iwl_good_plcp_health - checks for plcp error.
  *
@@ -347,6 +279,45 @@ static bool iwlagn_good_plcp_health(struct iwl_priv *priv,
         return true;
 }
 
+int iwl_force_rf_reset(struct iwl_priv *priv, bool external)
+{
+        struct iwl_rf_reset *rf_reset;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return -EAGAIN;
+
+        if (!iwl_is_any_associated(priv)) {
+                IWL_DEBUG_SCAN(priv, "force reset rejected: not associated\n");
+                return -ENOLINK;
+        }
+
+        rf_reset = &priv->rf_reset;
+        rf_reset->reset_request_count++;
+        if (!external && rf_reset->last_reset_jiffies &&
+            time_after(rf_reset->last_reset_jiffies +
+                       IWL_DELAY_NEXT_FORCE_RF_RESET, jiffies)) {
+                IWL_DEBUG_INFO(priv, "RF reset rejected\n");
+                rf_reset->reset_reject_count++;
+                return -EAGAIN;
+        }
+        rf_reset->reset_success_count++;
+        rf_reset->last_reset_jiffies = jiffies;
+
+        /*
+         * There is no easy and better way to force reset the radio,
+         * the only known method is switching channel which will force to
+         * reset and tune the radio.
+         * Use internal short scan (single channel) operation to should
+         * achieve this objective.
+         * Driver should reset the radio when number of consecutive missed
+         * beacon, or any other uCode error condition detected.
+         */
+        IWL_DEBUG_INFO(priv, "perform radio reset.\n");
+        iwl_internal_short_hw_scan(priv);
+        return 0;
+}
+
+
 static void iwlagn_recover_from_statistics(struct iwl_priv *priv,
                                 struct statistics_rx_phy *cur_ofdm,
                                 struct statistics_rx_ht_phy *cur_ofdm_ht,
@@ -368,15 +339,9 @@ static void iwlagn_recover_from_statistics(struct iwl_priv *priv,
         if (msecs < 99)
                 return;
 
-        if (iwlagn_mod_params.ack_check && !iwlagn_good_ack_health(priv, tx)) {
-                IWL_ERR(priv, "low ack count detected, restart firmware\n");
-                if (!iwl_force_reset(priv, IWL_FW_RESET, false))
-                        return;
-        }
-
         if (iwlagn_mod_params.plcp_check &&
             !iwlagn_good_plcp_health(priv, cur_ofdm, cur_ofdm_ht, msecs))
-                iwl_force_reset(priv, IWL_RF_RESET, false);
+                iwl_force_rf_reset(priv, false);
 }
 
 /* Calculate noise level, based on measurements during network silence just
@@ -589,8 +554,8 @@ static int iwlagn_rx_statistics(struct iwl_priv *priv,
                 iwlagn_rx_calc_noise(priv);
                 queue_work(priv->workqueue, &priv->run_time_calib_work);
         }
-        if (cfg(priv)->lib->temperature && change)
-                cfg(priv)->lib->temperature(priv);
+        if (priv->lib->temperature && change)
+                priv->lib->temperature(priv);
 
         spin_unlock(&priv->statistics.lock);
 
@@ -1182,9 +1147,9 @@ int iwl_rx_dispatch(struct iwl_op_mode *op_mode, struct iwl_rx_cmd_buffer *rxb,
                         err = priv->rx_handlers[pkt->hdr.cmd] (priv, rxb, cmd);
                 } else {
                         /* No handling needed */
-                        IWL_DEBUG_RX(priv,
-                                "No handler needed for %s, 0x%02x\n",
-                                get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
+                        IWL_DEBUG_RX(priv, "No handler needed for %s, 0x%02x\n",
+                                     iwl_dvm_get_cmd_string(pkt->hdr.cmd),
+                                     pkt->hdr.cmd);
                 }
         }
         return err;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
index 79d857d81b41..5c7bddd5cfef 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
@@ -32,6 +32,78 @@
 #include "iwl-trans.h"
 #include "iwl-shared.h"
 
+/*
+ * initialize rxon structure with default values from eeprom
+ */
+void iwl_connection_init_rx_config(struct iwl_priv *priv,
+                                   struct iwl_rxon_context *ctx)
+{
+        const struct iwl_channel_info *ch_info;
+
+        memset(&ctx->staging, 0, sizeof(ctx->staging));
+
+        if (!ctx->vif) {
+                ctx->staging.dev_type = ctx->unused_devtype;
+        } else
+        switch (ctx->vif->type) {
+        case NL80211_IFTYPE_AP:
+                ctx->staging.dev_type = ctx->ap_devtype;
+                break;
+
+        case NL80211_IFTYPE_STATION:
+                ctx->staging.dev_type = ctx->station_devtype;
+                ctx->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
+                break;
+
+        case NL80211_IFTYPE_ADHOC:
+                ctx->staging.dev_type = ctx->ibss_devtype;
+                ctx->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
+                ctx->staging.filter_flags = RXON_FILTER_BCON_AWARE_MSK |
+                                                  RXON_FILTER_ACCEPT_GRP_MSK;
+                break;
+
+        default:
+                IWL_ERR(priv, "Unsupported interface type %d\n",
+                        ctx->vif->type);
+                break;
+        }
+
+#if 0
+        /* TODO:  Figure out when short_preamble would be set and cache from
+         * that */
+        if (!hw_to_local(priv->hw)->short_preamble)
+                ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
+        else
+                ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
+#endif
+
+        ch_info = iwl_get_channel_info(priv, priv->band,
+                                       le16_to_cpu(ctx->active.channel));
+
+        if (!ch_info)
+                ch_info = &priv->channel_info[0];
+
+        ctx->staging.channel = cpu_to_le16(ch_info->channel);
+        priv->band = ch_info->band;
+
+        iwl_set_flags_for_band(priv, ctx, priv->band, ctx->vif);
+
+        ctx->staging.ofdm_basic_rates =
+            (IWL_OFDM_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
+        ctx->staging.cck_basic_rates =
+            (IWL_CCK_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
+
+        /* clear both MIX and PURE40 mode flag */
+        ctx->staging.flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED |
+                                        RXON_FLG_CHANNEL_MODE_PURE_40);
+        if (ctx->vif)
+                memcpy(ctx->staging.node_addr, ctx->vif->addr, ETH_ALEN);
+
+        ctx->staging.ofdm_ht_single_stream_basic_rates = 0xff;
+        ctx->staging.ofdm_ht_dual_stream_basic_rates = 0xff;
+        ctx->staging.ofdm_ht_triple_stream_basic_rates = 0xff;
+}
+
 static int iwlagn_disable_bss(struct iwl_priv *priv,
                               struct iwl_rxon_context *ctx,
                               struct iwl_rxon_cmd *send)
@@ -105,8 +177,7 @@ static int iwlagn_disconn_pan(struct iwl_priv *priv,
         return ret;
 }
 
-static void iwlagn_update_qos(struct iwl_priv *priv,
-                              struct iwl_rxon_context *ctx)
+void iwlagn_update_qos(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         int ret;
 
@@ -133,8 +204,8 @@ static void iwlagn_update_qos(struct iwl_priv *priv,
                 IWL_DEBUG_QUIET_RFKILL(priv, "Failed to update QoS\n");
 }
 
-static int iwlagn_update_beacon(struct iwl_priv *priv,
-                                struct ieee80211_vif *vif)
+int iwlagn_update_beacon(struct iwl_priv *priv,
+                         struct ieee80211_vif *vif)
 {
         lockdep_assert_held(&priv->mutex);
 
@@ -335,6 +406,64 @@ static int iwlagn_rxon_disconn(struct iwl_priv *priv,
         return 0;
 }
 
+static int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
+{
+        int ret;
+        s8 prev_tx_power;
+        bool defer;
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+
+        if (priv->calib_disabled & IWL_TX_POWER_CALIB_DISABLED)
+                return 0;
+
+        lockdep_assert_held(&priv->mutex);
+
+        if (priv->tx_power_user_lmt == tx_power && !force)
+                return 0;
+
+        if (tx_power < IWLAGN_TX_POWER_TARGET_POWER_MIN) {
+                IWL_WARN(priv,
+                         "Requested user TXPOWER %d below lower limit %d.\n",
+                         tx_power,
+                         IWLAGN_TX_POWER_TARGET_POWER_MIN);
+                return -EINVAL;
+        }
+
+        if (tx_power > priv->tx_power_device_lmt) {
+                IWL_WARN(priv,
+                        "Requested user TXPOWER %d above upper limit %d.\n",
+                         tx_power, priv->tx_power_device_lmt);
+                return -EINVAL;
+        }
+
+        if (!iwl_is_ready_rf(priv))
+                return -EIO;
+
+        /* scan complete and commit_rxon use tx_power_next value,
+         * it always need to be updated for newest request */
+        priv->tx_power_next = tx_power;
+
+        /* do not set tx power when scanning or channel changing */
+        defer = test_bit(STATUS_SCANNING, &priv->status) ||
+                memcmp(&ctx->active, &ctx->staging, sizeof(ctx->staging));
+        if (defer && !force) {
+                IWL_DEBUG_INFO(priv, "Deferring tx power set\n");
+                return 0;
+        }
+
+        prev_tx_power = priv->tx_power_user_lmt;
+        priv->tx_power_user_lmt = tx_power;
+
+        ret = iwlagn_send_tx_power(priv);
+
+        /* if fail to set tx_power, restore the orig. tx power */
+        if (ret) {
+                priv->tx_power_user_lmt = prev_tx_power;
+                priv->tx_power_next = prev_tx_power;
+        }
+        return ret;
+}
+
 static int iwlagn_rxon_connect(struct iwl_priv *priv,
                                struct iwl_rxon_context *ctx)
 {
@@ -501,6 +630,161 @@ int iwlagn_set_pan_params(struct iwl_priv *priv)
         return ret;
 }
 
+static void _iwl_set_rxon_ht(struct iwl_priv *priv,
+                             struct iwl_ht_config *ht_conf,
+                             struct iwl_rxon_context *ctx)
+{
+        struct iwl_rxon_cmd *rxon = &ctx->staging;
+
+        if (!ctx->ht.enabled) {
+                rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
+                        RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK |
+                        RXON_FLG_HT40_PROT_MSK |
+                        RXON_FLG_HT_PROT_MSK);
+                return;
+        }
+
+        /* FIXME: if the definition of ht.protection changed, the "translation"
+         * will be needed for rxon->flags
+         */
+        rxon->flags |= cpu_to_le32(ctx->ht.protection <<
+                                   RXON_FLG_HT_OPERATING_MODE_POS);
+
+        /* Set up channel bandwidth:
+         * 20 MHz only, 20/40 mixed or pure 40 if ht40 ok */
+        /* clear the HT channel mode before set the mode */
+        rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
+                         RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
+        if (iwl_is_ht40_tx_allowed(priv, ctx, NULL)) {
+                /* pure ht40 */
+                if (ctx->ht.protection ==
+                    IEEE80211_HT_OP_MODE_PROTECTION_20MHZ) {
+                        rxon->flags |= RXON_FLG_CHANNEL_MODE_PURE_40;
+                        /*
+                         * Note: control channel is opposite of extension
+                         * channel
+                         */
+                        switch (ctx->ht.extension_chan_offset) {
+                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                                rxon->flags &=
+                                        ~RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                                rxon->flags |=
+                                        RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
+                                break;
+                        }
+                } else {
+                        /*
+                         * Note: control channel is opposite of extension
+                         * channel
+                         */
+                        switch (ctx->ht.extension_chan_offset) {
+                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                                rxon->flags &=
+                                        ~(RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
+                                rxon->flags |= RXON_FLG_CHANNEL_MODE_MIXED;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                                rxon->flags |= RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
+                                rxon->flags |= RXON_FLG_CHANNEL_MODE_MIXED;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_NONE:
+                        default:
+                                /*
+                                 * channel location only valid if in Mixed
+                                 * mode
+                                 */
+                                IWL_ERR(priv,
+                                        "invalid extension channel offset\n");
+                                break;
+                        }
+                }
+        } else {
+                rxon->flags |= RXON_FLG_CHANNEL_MODE_LEGACY;
+        }
+
+        iwlagn_set_rxon_chain(priv, ctx);
+
+        IWL_DEBUG_ASSOC(priv, "rxon flags 0x%X operation mode :0x%X "
+                        "extension channel offset 0x%x\n",
+                        le32_to_cpu(rxon->flags), ctx->ht.protection,
+                        ctx->ht.extension_chan_offset);
+}
+
+void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
+{
+        struct iwl_rxon_context *ctx;
+
+        for_each_context(priv, ctx)
+                _iwl_set_rxon_ht(priv, ht_conf, ctx);
+}
+
+/**
+ * iwl_set_rxon_channel - Set the band and channel values in staging RXON
+ * @ch: requested channel as a pointer to struct ieee80211_channel
+
+ * NOTE:  Does not commit to the hardware; it sets appropriate bit fields
+ * in the staging RXON flag structure based on the ch->band
+ */
+void iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch,
+                         struct iwl_rxon_context *ctx)
+{
+        enum ieee80211_band band = ch->band;
+        u16 channel = ch->hw_value;
+
+        if ((le16_to_cpu(ctx->staging.channel) == channel) &&
+            (priv->band == band))
+                return;
+
+        ctx->staging.channel = cpu_to_le16(channel);
+        if (band == IEEE80211_BAND_5GHZ)
+                ctx->staging.flags &= ~RXON_FLG_BAND_24G_MSK;
+        else
+                ctx->staging.flags |= RXON_FLG_BAND_24G_MSK;
+
+        priv->band = band;
+
+        IWL_DEBUG_INFO(priv, "Staging channel set to %d [%d]\n", channel, band);
+
+}
+
+void iwl_set_flags_for_band(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
+                            enum ieee80211_band band,
+                            struct ieee80211_vif *vif)
+{
+        if (band == IEEE80211_BAND_5GHZ) {
+                ctx->staging.flags &=
+                    ~(RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK
+                      | RXON_FLG_CCK_MSK);
+                ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
+        } else {
+                /* Copied from iwl_post_associate() */
+                if (vif && vif->bss_conf.use_short_slot)
+                        ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
+                else
+                        ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
+
+                ctx->staging.flags |= RXON_FLG_BAND_24G_MSK;
+                ctx->staging.flags |= RXON_FLG_AUTO_DETECT_MSK;
+                ctx->staging.flags &= ~RXON_FLG_CCK_MSK;
+        }
+}
+
+void iwl_set_rate(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx;
+
+        for_each_context(priv, ctx) {
+                ctx->staging.cck_basic_rates =
+                    (IWL_CCK_BASIC_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
+
+                ctx->staging.ofdm_basic_rates =
+                   (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
+        }
+}
+
 static void iwl_set_rxon_hwcrypto(struct iwl_priv *priv,
                                   struct iwl_rxon_context *ctx, int hw_decrypt)
 {
@@ -594,8 +878,8 @@ static int iwl_check_rxon_cmd(struct iwl_priv *priv,
  * or is clearing the RXON_FILTER_ASSOC_MSK, then return 1 to indicate that
  * a new tune (full RXON command, rather than RXON_ASSOC cmd) is required.
  */
-static int iwl_full_rxon_required(struct iwl_priv *priv,
-                                  struct iwl_rxon_context *ctx)
+int iwl_full_rxon_required(struct iwl_priv *priv,
+                           struct iwl_rxon_context *ctx)
 {
         const struct iwl_rxon_cmd *staging = &ctx->staging;
         const struct iwl_rxon_cmd *active = &ctx->active;
@@ -649,6 +933,33 @@ static int iwl_full_rxon_required(struct iwl_priv *priv,
         return 0;
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUG
+void iwl_print_rx_config_cmd(struct iwl_priv *priv,
+                             enum iwl_rxon_context_id ctxid)
+{
+        struct iwl_rxon_context *ctx = &priv->contexts[ctxid];
+        struct iwl_rxon_cmd *rxon = &ctx->staging;
+
+        IWL_DEBUG_RADIO(priv, "RX CONFIG:\n");
+        iwl_print_hex_dump(priv, IWL_DL_RADIO, (u8 *) rxon, sizeof(*rxon));
+        IWL_DEBUG_RADIO(priv, "u16 channel: 0x%x\n",
+                        le16_to_cpu(rxon->channel));
+        IWL_DEBUG_RADIO(priv, "u32 flags: 0x%08X\n",
+                        le32_to_cpu(rxon->flags));
+        IWL_DEBUG_RADIO(priv, "u32 filter_flags: 0x%08x\n",
+                        le32_to_cpu(rxon->filter_flags));
+        IWL_DEBUG_RADIO(priv, "u8 dev_type: 0x%x\n", rxon->dev_type);
+        IWL_DEBUG_RADIO(priv, "u8 ofdm_basic_rates: 0x%02x\n",
+                        rxon->ofdm_basic_rates);
+        IWL_DEBUG_RADIO(priv, "u8 cck_basic_rates: 0x%02x\n",
+                        rxon->cck_basic_rates);
+        IWL_DEBUG_RADIO(priv, "u8[6] node_addr: %pM\n", rxon->node_addr);
+        IWL_DEBUG_RADIO(priv, "u8[6] bssid_addr: %pM\n", rxon->bssid_addr);
+        IWL_DEBUG_RADIO(priv, "u16 assoc_id: 0x%x\n",
+                        le16_to_cpu(rxon->assoc_id));
+}
+#endif
+
 /**
  * iwlagn_commit_rxon - commit staging_rxon to hardware
  *
@@ -692,7 +1003,7 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
          * force CTS-to-self frames protection if RTS-CTS is not preferred
          * one aggregation protection method
          */
-        if (!hw_params(priv).use_rts_for_aggregation)
+        if (!priv->hw_params.use_rts_for_aggregation)
                 ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
 
         if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
@@ -911,9 +1222,9 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
         return ret;
 }
 
-static void iwlagn_check_needed_chains(struct iwl_priv *priv,
-                                       struct iwl_rxon_context *ctx,
-                                       struct ieee80211_bss_conf *bss_conf)
+void iwlagn_check_needed_chains(struct iwl_priv *priv,
+                                struct iwl_rxon_context *ctx,
+                                struct ieee80211_bss_conf *bss_conf)
 {
         struct ieee80211_vif *vif = ctx->vif;
         struct iwl_rxon_context *tmp;
@@ -1005,11 +1316,14 @@ static void iwlagn_check_needed_chains(struct iwl_priv *priv,
         ht_conf->single_chain_sufficient = !need_multiple;
 }
 
-static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
+void iwlagn_chain_noise_reset(struct iwl_priv *priv)
 {
         struct iwl_chain_noise_data *data = &priv->chain_noise_data;
         int ret;
 
+        if (!(priv->calib_disabled & IWL_CHAIN_NOISE_CALIB_DISABLED))
+                return;
+
         if ((data->state == IWL_CHAIN_NOISE_ALIVE) &&
             iwl_is_any_associated(priv)) {
                 struct iwl_calib_chain_noise_reset_cmd cmd;
@@ -1162,8 +1476,7 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
                         iwl_power_update_mode(priv, false);
 
                 /* Enable RX differential gain and sensitivity calibrations */
-                if (!priv->disable_chain_noise_cal)
-                        iwlagn_chain_noise_reset(priv);
+                iwlagn_chain_noise_reset(priv);
                 priv->start_calib = 1;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index c4175603864b..0119e7a7b78d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -34,6 +34,8 @@
 #include "iwl-agn.h"
 #include "iwl-trans.h"
 
+const u8 iwl_bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
+
 static int iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
 {
         lockdep_assert_held(&priv->sta_lock);
@@ -170,6 +172,50 @@ int iwl_send_add_sta(struct iwl_priv *priv,
         return cmd.handler_status;
 }
 
+static bool iwl_is_channel_extension(struct iwl_priv *priv,
+                                     enum ieee80211_band band,
+                                     u16 channel, u8 extension_chan_offset)
+{
+        const struct iwl_channel_info *ch_info;
+
+        ch_info = iwl_get_channel_info(priv, band, channel);
+        if (!is_channel_valid(ch_info))
+                return false;
+
+        if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_ABOVE)
+                return !(ch_info->ht40_extension_channel &
+                                        IEEE80211_CHAN_NO_HT40PLUS);
+        else if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_BELOW)
+                return !(ch_info->ht40_extension_channel &
+                                        IEEE80211_CHAN_NO_HT40MINUS);
+
+        return false;
+}
+
+bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
+                            struct ieee80211_sta_ht_cap *ht_cap)
+{
+        if (!ctx->ht.enabled || !ctx->ht.is_40mhz)
+                return false;
+
+        /*
+         * We do not check for IEEE80211_HT_CAP_SUP_WIDTH_20_40
+         * the bit will not set if it is pure 40MHz case
+         */
+        if (ht_cap && !ht_cap->ht_supported)
+                return false;
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (priv->disable_ht40)
+                return false;
+#endif
+
+        return iwl_is_channel_extension(priv, priv->band,
+                        le16_to_cpu(ctx->staging.channel),
+                        ctx->ht.extension_chan_offset);
+}
+
 static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
                                   struct ieee80211_sta *sta,
                                   struct iwl_rxon_context *ctx,
@@ -581,6 +627,56 @@ void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id,
         spin_unlock_bh(&priv->sta_lock);
 }
 
+static void iwl_sta_fill_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                            u8 sta_id, struct iwl_link_quality_cmd *link_cmd)
+{
+        int i, r;
+        u32 rate_flags = 0;
+        __le32 rate_n_flags;
+
+        lockdep_assert_held(&priv->mutex);
+
+        memset(link_cmd, 0, sizeof(*link_cmd));
+
+        /* Set up the rate scaling to start at selected rate, fall back
+         * all the way down to 1M in IEEE order, and then spin on 1M */
+        if (priv->band == IEEE80211_BAND_5GHZ)
+                r = IWL_RATE_6M_INDEX;
+        else if (ctx && ctx->vif && ctx->vif->p2p)
+                r = IWL_RATE_6M_INDEX;
+        else
+                r = IWL_RATE_1M_INDEX;
+
+        if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
+                rate_flags |= RATE_MCS_CCK_MSK;
+
+        rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
+                                RATE_MCS_ANT_POS;
+        rate_n_flags = iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
+        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
+                link_cmd->rs_table[i].rate_n_flags = rate_n_flags;
+
+        link_cmd->general_params.single_stream_ant_msk =
+                        first_antenna(priv->hw_params.valid_tx_ant);
+
+        link_cmd->general_params.dual_stream_ant_msk =
+                priv->hw_params.valid_tx_ant &
+                ~first_antenna(priv->hw_params.valid_tx_ant);
+        if (!link_cmd->general_params.dual_stream_ant_msk) {
+                link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
+        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
+                link_cmd->general_params.dual_stream_ant_msk =
+                        priv->hw_params.valid_tx_ant;
+        }
+
+        link_cmd->agg_params.agg_dis_start_th =
+                LINK_QUAL_AGG_DISABLE_START_DEF;
+        link_cmd->agg_params.agg_time_limit =
+                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
+
+        link_cmd->sta_id = sta_id;
+}
+
 /**
  * iwl_clear_ucode_stations - clear ucode station table bits
  *
@@ -841,56 +937,6 @@ int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
 }
 
 
-void iwl_sta_fill_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                     u8 sta_id, struct iwl_link_quality_cmd *link_cmd)
-{
-        int i, r;
-        u32 rate_flags = 0;
-        __le32 rate_n_flags;
-
-        lockdep_assert_held(&priv->mutex);
-
-        memset(link_cmd, 0, sizeof(*link_cmd));
-
-        /* Set up the rate scaling to start at selected rate, fall back
-         * all the way down to 1M in IEEE order, and then spin on 1M */
-        if (priv->band == IEEE80211_BAND_5GHZ)
-                r = IWL_RATE_6M_INDEX;
-        else if (ctx && ctx->vif && ctx->vif->p2p)
-                r = IWL_RATE_6M_INDEX;
-        else
-                r = IWL_RATE_1M_INDEX;
-
-        if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
-                rate_flags |= RATE_MCS_CCK_MSK;
-
-        rate_flags |= first_antenna(hw_params(priv).valid_tx_ant) <<
-                                RATE_MCS_ANT_POS;
-        rate_n_flags = iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
-        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
-                link_cmd->rs_table[i].rate_n_flags = rate_n_flags;
-
-        link_cmd->general_params.single_stream_ant_msk =
-                        first_antenna(hw_params(priv).valid_tx_ant);
-
-        link_cmd->general_params.dual_stream_ant_msk =
-                hw_params(priv).valid_tx_ant &
-                ~first_antenna(hw_params(priv).valid_tx_ant);
-        if (!link_cmd->general_params.dual_stream_ant_msk) {
-                link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
-        } else if (num_of_ant(hw_params(priv).valid_tx_ant) == 2) {
-                link_cmd->general_params.dual_stream_ant_msk =
-                        hw_params(priv).valid_tx_ant;
-        }
-
-        link_cmd->agg_params.agg_dis_start_th =
-                LINK_QUAL_AGG_DISABLE_START_DEF;
-        link_cmd->agg_params.agg_time_limit =
-                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
-
-        link_cmd->sta_id = sta_id;
-}
-
 static struct iwl_link_quality_cmd *
 iwl_sta_alloc_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                  u8 sta_id)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index 697f2032bfd6..ad21b5ddf59d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -208,10 +208,10 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
              priv->bt_full_concurrent) {
                 /* operated as 1x1 in full concurrency mode */
                 priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
-                                first_antenna(hw_params(priv).valid_tx_ant));
+                                first_antenna(priv->hw_params.valid_tx_ant));
         } else
                 priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
-                                                hw_params(priv).valid_tx_ant);
+                                                priv->hw_params.valid_tx_ant);
         rate_flags |= iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
 
         /* Set the rate in the TX cmd */
@@ -689,7 +689,7 @@ int iwlagn_tx_agg_oper(struct iwl_priv *priv, struct ieee80211_vif *vif,
         sta_priv->max_agg_bufsize =
                 min(sta_priv->max_agg_bufsize, buf_size);
 
-        if (hw_params(priv).use_rts_for_aggregation) {
+        if (priv->hw_params.use_rts_for_aggregation) {
                 /*
                  * switch to RTS/CTS if it is the prefer protection
                  * method for HT traffic
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 22c953d65be5..7db39866bdc4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -180,7 +180,7 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
                 rate = info->control.rates[0].idx;
 
         priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
-                                              hw_params(priv).valid_tx_ant);
+                                              priv->hw_params.valid_tx_ant);
         rate_flags = iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
 
         /* In mac80211, rates for 5 GHz start at 0 */
@@ -289,6 +289,25 @@ out:
         mutex_unlock(&priv->mutex);
 }
 
+int iwl_send_statistics_request(struct iwl_priv *priv, u8 flags, bool clear)
+{
+        struct iwl_statistics_cmd statistics_cmd = {
+                .configuration_flags =
+                        clear ? IWL_STATS_CONF_CLEAR_STATS : 0,
+        };
+
+        if (flags & CMD_ASYNC)
+                return iwl_dvm_send_cmd_pdu(priv, REPLY_STATISTICS_CMD,
+                                        CMD_ASYNC,
+                                        sizeof(struct iwl_statistics_cmd),
+                                        &statistics_cmd);
+        else
+                return iwl_dvm_send_cmd_pdu(priv, REPLY_STATISTICS_CMD,
+                                        CMD_SYNC,
+                                        sizeof(struct iwl_statistics_cmd),
+                                        &statistics_cmd);
+}
+
 /**
  * iwl_bg_statistics_periodic - Timer callback to queue statistics
  *
@@ -578,7 +597,7 @@ static const u8 iwlagn_pan_queue_to_ac[] = {
         IEEE80211_AC_VO,
 };
 
-static void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags)
+void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags)
 {
         int i;
 
@@ -645,7 +664,7 @@ static void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags)
         BUILD_BUG_ON(NUM_IWL_RXON_CTX != 2);
 }
 
-static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
+void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 {
         struct iwl_ct_kill_config cmd;
         struct iwl_ct_kill_throttling_config adv_cmd;
@@ -658,9 +677,9 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 
         if (cfg(priv)->base_params->support_ct_kill_exit) {
                 adv_cmd.critical_temperature_enter =
-                        cpu_to_le32(hw_params(priv).ct_kill_threshold);
+                        cpu_to_le32(priv->hw_params.ct_kill_threshold);
                 adv_cmd.critical_temperature_exit =
-                        cpu_to_le32(hw_params(priv).ct_kill_exit_threshold);
+                        cpu_to_le32(priv->hw_params.ct_kill_exit_threshold);
 
                 ret = iwl_dvm_send_cmd_pdu(priv,
                                        REPLY_CT_KILL_CONFIG_CMD,
@@ -671,11 +690,11 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
                         IWL_DEBUG_INFO(priv, "REPLY_CT_KILL_CONFIG_CMD "
                                 "succeeded, critical temperature enter is %d,"
                                 "exit is %d\n",
-                                hw_params(priv).ct_kill_threshold,
-                                hw_params(priv).ct_kill_exit_threshold);
+                                priv->hw_params.ct_kill_threshold,
+                                priv->hw_params.ct_kill_exit_threshold);
         } else {
                 cmd.critical_temperature_R =
-                        cpu_to_le32(hw_params(priv).ct_kill_threshold);
+                        cpu_to_le32(priv->hw_params.ct_kill_threshold);
 
                 ret = iwl_dvm_send_cmd_pdu(priv,
                                        REPLY_CT_KILL_CONFIG_CMD,
@@ -686,7 +705,7 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
                         IWL_DEBUG_INFO(priv, "REPLY_CT_KILL_CONFIG_CMD "
                                 "succeeded, "
                                 "critical temperature is %d\n",
-                                hw_params(priv).ct_kill_threshold);
+                                priv->hw_params.ct_kill_threshold);
         }
 }
 
@@ -726,6 +745,29 @@ static int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
         }
 }
 
+void iwl_send_bt_config(struct iwl_priv *priv)
+{
+        struct iwl_bt_cmd bt_cmd = {
+                .lead_time = BT_LEAD_TIME_DEF,
+                .max_kill = BT_MAX_KILL_DEF,
+                .kill_ack_mask = 0,
+                .kill_cts_mask = 0,
+        };
+
+        if (!iwlagn_mod_params.bt_coex_active)
+                bt_cmd.flags = BT_COEX_DISABLE;
+        else
+                bt_cmd.flags = BT_COEX_ENABLE;
+
+        priv->bt_enable_flag = bt_cmd.flags;
+        IWL_DEBUG_INFO(priv, "BT coex %s\n",
+                (bt_cmd.flags == BT_COEX_DISABLE) ? "disable" : "active");
+
+        if (iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
+                             CMD_SYNC, sizeof(struct iwl_bt_cmd), &bt_cmd))
+                IWL_ERR(priv, "failed to send BT Coex Config\n");
+}
+
 /**
  * iwl_alive_start - called after REPLY_ALIVE notification received
  *                   from protocol/runtime uCode (initialization uCode's
@@ -741,9 +783,6 @@ int iwl_alive_start(struct iwl_priv *priv)
         /* After the ALIVE response, we can send host commands to the uCode */
         set_bit(STATUS_ALIVE, &priv->status);
 
-        /* Enable watchdog to monitor the driver tx queues */
-        iwl_setup_watchdog(priv);
-
         if (iwl_is_rfkill(priv))
                 return -ERFKILL;
 
@@ -793,10 +832,8 @@ int iwl_alive_start(struct iwl_priv *priv)
 
         ieee80211_wake_queues(priv->hw);
 
-        priv->active_rate = IWL_RATES_MASK;
-
         /* Configure Tx antenna selection based on H/W config */
-        iwlagn_send_tx_ant_config(priv, hw_params(priv).valid_tx_ant);
+        iwlagn_send_tx_ant_config(priv, priv->hw_params.valid_tx_ant);
 
         if (iwl_is_associated_ctx(ctx) && !priv->wowlan) {
                 struct iwl_rxon_cmd *active_rxon =
@@ -887,10 +924,6 @@ void iwl_down(struct iwl_priv *priv)
         exit_pending =
                 test_and_set_bit(STATUS_EXIT_PENDING, &priv->status);
 
-        /* Stop TX queues watchdog. We need to have STATUS_EXIT_PENDING bit set
-         * to prevent rearm timer */
-        del_timer_sync(&priv->watchdog);
-
         iwl_clear_ucode_stations(priv, NULL);
         iwl_dealloc_bcast_stations(priv);
         iwl_clear_driver_stations(priv);
@@ -1067,7 +1100,7 @@ static void iwlagn_disable_roc_work(struct work_struct *work)
  *
  *****************************************************************************/
 
-static void iwl_setup_deferred_work(struct iwl_priv *priv)
+void iwl_setup_deferred_work(struct iwl_priv *priv)
 {
         priv->workqueue = create_singlethread_workqueue(DRV_NAME);
 
@@ -1092,10 +1125,6 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         init_timer(&priv->ucode_trace);
         priv->ucode_trace.data = (unsigned long)priv;
         priv->ucode_trace.function = iwl_bg_ucode_trace;
-
-        init_timer(&priv->watchdog);
-        priv->watchdog.data = (unsigned long)priv;
-        priv->watchdog.function = iwl_bg_watchdog;
 }
 
 void iwl_cancel_deferred_work(struct iwl_priv *priv)
@@ -1143,8 +1172,8 @@ static void iwl_init_ht_hw_capab(const struct iwl_priv *priv,
                               enum ieee80211_band band)
 {
         u16 max_bit_rate = 0;
-        u8 rx_chains_num = hw_params(priv).rx_chains_num;
-        u8 tx_chains_num = hw_params(priv).tx_chains_num;
+        u8 rx_chains_num = priv->hw_params.rx_chains_num;
+        u8 tx_chains_num = priv->hw_params.tx_chains_num;
 
         ht_info->cap = 0;
         memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
@@ -1156,7 +1185,7 @@ static void iwl_init_ht_hw_capab(const struct iwl_priv *priv,
                 ht_info->cap |= IEEE80211_HT_CAP_GRN_FLD;
         ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
         max_bit_rate = MAX_BIT_RATE_20_MHZ;
-        if (hw_params(priv).ht40_channel & BIT(band)) {
+        if (priv->hw_params.ht40_channel & BIT(band)) {
                 ht_info->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                 ht_info->cap |= IEEE80211_HT_CAP_SGI_40;
                 ht_info->mcs.rx_mask[4] = 0x01;
@@ -1228,7 +1257,7 @@ static int iwl_init_geos(struct iwl_priv *priv)
         sband->bitrates = &rates[IWL_FIRST_OFDM_RATE];
         sband->n_bitrates = IWL_RATE_COUNT_LEGACY - IWL_FIRST_OFDM_RATE;
 
-        if (hw_params(priv).sku & EEPROM_SKU_CAP_11N_ENABLE)
+        if (priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE)
                 iwl_init_ht_hw_capab(priv, &sband->ht_cap,
                                          IEEE80211_BAND_5GHZ);
 
@@ -1238,7 +1267,7 @@ static int iwl_init_geos(struct iwl_priv *priv)
         sband->bitrates = rates;
         sband->n_bitrates = IWL_RATE_COUNT_LEGACY;
 
-        if (hw_params(priv).sku & EEPROM_SKU_CAP_11N_ENABLE)
+        if (priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE)
                 iwl_init_ht_hw_capab(priv, &sband->ht_cap,
                                          IEEE80211_BAND_2GHZ);
 
@@ -1293,11 +1322,11 @@ static int iwl_init_geos(struct iwl_priv *priv)
         priv->tx_power_next = max_tx_power;
 
         if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) &&
-             hw_params(priv).sku & EEPROM_SKU_CAP_BAND_52GHZ) {
+             priv->hw_params.sku & EEPROM_SKU_CAP_BAND_52GHZ) {
                 IWL_INFO(priv, "Incorrectly detected BG card as ABG. "
                         "Please send your %s to maintainer.\n",
                         trans(priv)->hw_id_str);
-                hw_params(priv).sku &= ~EEPROM_SKU_CAP_BAND_52GHZ;
+                priv->hw_params.sku &= ~EEPROM_SKU_CAP_BAND_52GHZ;
         }
 
         IWL_INFO(priv, "Tunable channels: %d 802.11bg, %d 802.11a channels\n",
@@ -1319,7 +1348,7 @@ static void iwl_free_geos(struct iwl_priv *priv)
         clear_bit(STATUS_GEO_CONFIGURED, &priv->status);
 }
 
-static int iwl_init_drv(struct iwl_priv *priv)
+int iwl_init_drv(struct iwl_priv *priv)
 {
         int ret;
 
@@ -1343,12 +1372,6 @@ static int iwl_init_drv(struct iwl_priv *priv)
 
         priv->ucode_owner = IWL_OWNERSHIP_DRIVER;
 
-        /* initialize force reset */
-        priv->force_reset[IWL_RF_RESET].reset_duration =
-                IWL_DELAY_NEXT_FORCE_RF_RESET;
-        priv->force_reset[IWL_FW_RESET].reset_duration =
-                IWL_DELAY_NEXT_FORCE_FW_RELOAD;
-
         priv->rx_statistics_jiffies = jiffies;
 
         /* Choose which receivers/antennas to use */
@@ -1388,7 +1411,7 @@ err:
         return ret;
 }
 
-static void iwl_uninit_drv(struct iwl_priv *priv)
+void iwl_uninit_drv(struct iwl_priv *priv)
 {
         iwl_free_geos(priv);
         iwl_free_channel_map(priv);
@@ -1401,35 +1424,22 @@ static void iwl_uninit_drv(struct iwl_priv *priv)
 #endif
 }
 
-/* Size of one Rx buffer in host DRAM */
-#define IWL_RX_BUF_SIZE_4K (4 * 1024)
-#define IWL_RX_BUF_SIZE_8K (8 * 1024)
-
-static void iwl_set_hw_params(struct iwl_priv *priv)
+void iwl_set_hw_params(struct iwl_priv *priv)
 {
         if (cfg(priv)->ht_params)
-                hw_params(priv).use_rts_for_aggregation =
+                priv->hw_params.use_rts_for_aggregation =
                         cfg(priv)->ht_params->use_rts_for_aggregation;
 
-        if (iwlagn_mod_params.amsdu_size_8K)
-                hw_params(priv).rx_page_order =
-                        get_order(IWL_RX_BUF_SIZE_8K);
-        else
-                hw_params(priv).rx_page_order =
-                        get_order(IWL_RX_BUF_SIZE_4K);
-
         if (iwlagn_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
-                hw_params(priv).sku &= ~EEPROM_SKU_CAP_11N_ENABLE;
-
-        hw_params(priv).wd_timeout = cfg(priv)->base_params->wd_timeout;
+                priv->hw_params.sku &= ~EEPROM_SKU_CAP_11N_ENABLE;
 
         /* Device-specific setup */
-        cfg(priv)->lib->set_hw_params(priv);
+        priv->lib->set_hw_params(priv);
 }
 
 
 
-static void iwl_debug_config(struct iwl_priv *priv)
+void iwl_debug_config(struct iwl_priv *priv)
 {
         dev_printk(KERN_INFO, trans(priv)->dev, "CONFIG_IWLWIFI_DEBUG "
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -1501,6 +1511,42 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         priv->shrd = trans->shrd;
         priv->fw = fw;
 
+        switch (cfg(priv)->device_family) {
+        case IWL_DEVICE_FAMILY_1000:
+        case IWL_DEVICE_FAMILY_100:
+                priv->lib = &iwl1000_lib;
+                break;
+        case IWL_DEVICE_FAMILY_2000:
+        case IWL_DEVICE_FAMILY_105:
+                priv->lib = &iwl2000_lib;
+                break;
+        case IWL_DEVICE_FAMILY_2030:
+        case IWL_DEVICE_FAMILY_135:
+                priv->lib = &iwl2030_lib;
+                break;
+        case IWL_DEVICE_FAMILY_5000:
+                priv->lib = &iwl5000_lib;
+                break;
+        case IWL_DEVICE_FAMILY_5150:
+                priv->lib = &iwl5150_lib;
+                break;
+        case IWL_DEVICE_FAMILY_6000:
+        case IWL_DEVICE_FAMILY_6005:
+        case IWL_DEVICE_FAMILY_6000i:
+        case IWL_DEVICE_FAMILY_6050:
+        case IWL_DEVICE_FAMILY_6150:
+                priv->lib = &iwl6000_lib;
+                break;
+        case IWL_DEVICE_FAMILY_6030:
+                priv->lib = &iwl6030_lib;
+                break;
+        default:
+                break;
+        }
+
+        if (WARN_ON(!priv->lib))
+                goto out_free_traffic_mem;
+
         /*
          * Populate the state variables that the transport layer needs
          * to know about.
@@ -1508,11 +1554,18 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         trans_cfg.op_mode = op_mode;
         trans_cfg.no_reclaim_cmds = no_reclaim_cmds;
         trans_cfg.n_no_reclaim_cmds = ARRAY_SIZE(no_reclaim_cmds);
+        trans_cfg.rx_buf_size_8k = iwlagn_mod_params.amsdu_size_8K;
+        if (!iwlagn_mod_params.wd_disable)
+                trans_cfg.queue_watchdog_timeout =
+                        cfg(priv)->base_params->wd_timeout;
+        else
+                trans_cfg.queue_watchdog_timeout = IWL_WATCHHDOG_DISABLED;
+        trans_cfg.command_names = iwl_dvm_cmd_strings;
 
         ucode_flags = fw->ucode_capa.flags;
 
 #ifndef CONFIG_IWLWIFI_P2P
-        ucode_flags &= ~IWL_UCODE_TLV_FLAGS_PAN;
+        ucode_flags &= ~IWL_UCODE_TLV_FLAGS_P2P;
 #endif
 
         if (ucode_flags & IWL_UCODE_TLV_FLAGS_PAN) {
@@ -1574,11 +1627,8 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         if (iwl_trans_start_hw(trans(priv)))
                 goto out_free_traffic_mem;
 
-        /*****************
-         * 3. Read EEPROM
-         *****************/
         /* Read the EEPROM */
-        if (iwl_eeprom_init(trans(priv), trans(priv)->hw_rev)) {
+        if (iwl_eeprom_init(priv, trans(priv)->hw_rev)) {
                 IWL_ERR(priv, "Unable to init EEPROM\n");
                 goto out_free_traffic_mem;
         }
@@ -1592,11 +1642,11 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
                 goto out_free_eeprom;
 
         /* extract MAC Address */
-        iwl_eeprom_get_mac(priv->shrd, priv->addresses[0].addr);
+        iwl_eeprom_get_mac(priv, priv->addresses[0].addr);
         IWL_DEBUG_INFO(priv, "MAC address: %pM\n", priv->addresses[0].addr);
         priv->hw->wiphy->addresses = priv->addresses;
         priv->hw->wiphy->n_addresses = 1;
-        num_mac = iwl_eeprom_query16(priv->shrd, EEPROM_NUM_MAC_ADDRESS);
+        num_mac = iwl_eeprom_query16(priv, EEPROM_NUM_MAC_ADDRESS);
         if (num_mac > 1) {
                 memcpy(priv->addresses[1].addr, priv->addresses[0].addr,
                        ETH_ALEN);
@@ -1609,7 +1659,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
          ************************/
         iwl_set_hw_params(priv);
 
-        if (!(hw_params(priv).sku & EEPROM_SKU_CAP_IPAN_ENABLE)) {
+        if (!(priv->hw_params.sku & EEPROM_SKU_CAP_IPAN_ENABLE)) {
                 IWL_DEBUG_INFO(priv, "Your EEPROM disabled PAN");
                 ucode_flags &= ~IWL_UCODE_TLV_FLAGS_PAN;
                 /*
@@ -1694,7 +1744,7 @@ out_destroy_workqueue:
         priv->workqueue = NULL;
         iwl_uninit_drv(priv);
 out_free_eeprom:
-        iwl_eeprom_free(priv->shrd);
+        iwl_eeprom_free(priv);
 out_free_traffic_mem:
         iwl_free_traffic_mem(priv);
         ieee80211_free_hw(priv->hw);
@@ -1703,7 +1753,7 @@ out:
         return op_mode;
 }
 
-static void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
+void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
 
@@ -1720,7 +1770,7 @@ static void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
         priv->ucode_loaded = false;
         iwl_trans_stop_device(trans(priv));
 
-        iwl_eeprom_free(priv->shrd);
+        iwl_eeprom_free(priv);
 
         /*netif_stop_queue(dev); */
         flush_workqueue(priv->workqueue);
@@ -1838,7 +1888,7 @@ static void iwl_dump_nic_error_log(struct iwl_priv *priv)
         if (ERROR_START_OFFSET <= table.valid * ERROR_ELEM_SIZE) {
                 IWL_ERR(trans, "Start IWL Error Log Dump:\n");
                 IWL_ERR(trans, "Status: 0x%08lX, count: %d\n",
-                        priv->shrd->status, table.valid);
+                        priv->status, table.valid);
         }
 
         trace_iwlwifi_dev_ucode_error(trans->dev, table.error_id, table.tsf_low,
@@ -2112,7 +2162,63 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
         return pos;
 }
 
-static void iwl_nic_error(struct iwl_op_mode *op_mode)
+static void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand)
+{
+        unsigned int reload_msec;
+        unsigned long reload_jiffies;
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (iwl_have_debug_level(IWL_DL_FW_ERRORS))
+                iwl_print_rx_config_cmd(priv, IWL_RXON_CTX_BSS);
+#endif
+
+        /* uCode is no longer loaded. */
+        priv->ucode_loaded = false;
+
+        /* Set the FW error flag -- cleared on iwl_down */
+        set_bit(STATUS_FW_ERROR, &priv->status);
+
+        iwl_abort_notification_waits(&priv->notif_wait);
+
+        /* Keep the restart process from trying to send host
+         * commands by clearing the ready bit */
+        clear_bit(STATUS_READY, &priv->status);
+
+        wake_up(&trans(priv)->wait_command_queue);
+
+        if (!ondemand) {
+                /*
+                 * If firmware keep reloading, then it indicate something
+                 * serious wrong and firmware having problem to recover
+                 * from it. Instead of keep trying which will fill the syslog
+                 * and hang the system, let's just stop it
+                 */
+                reload_jiffies = jiffies;
+                reload_msec = jiffies_to_msecs((long) reload_jiffies -
+                                        (long) priv->reload_jiffies);
+                priv->reload_jiffies = reload_jiffies;
+                if (reload_msec <= IWL_MIN_RELOAD_DURATION) {
+                        priv->reload_count++;
+                        if (priv->reload_count >= IWL_MAX_CONTINUE_RELOAD_CNT) {
+                                IWL_ERR(priv, "BUG_ON, Stop restarting\n");
+                                return;
+                        }
+                } else
+                        priv->reload_count = 0;
+        }
+
+        if (!test_bit(STATUS_EXIT_PENDING, &priv->status)) {
+                if (iwlagn_mod_params.restart_fw) {
+                        IWL_DEBUG_FW_ERRORS(priv,
+                                  "Restarting adapter due to uCode error.\n");
+                        queue_work(priv->workqueue, &priv->restart);
+                } else
+                        IWL_DEBUG_FW_ERRORS(priv,
+                                  "Detected FW error, but not restarting\n");
+        }
+}
+
+void iwl_nic_error(struct iwl_op_mode *op_mode)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
 
@@ -2125,7 +2231,7 @@ static void iwl_nic_error(struct iwl_op_mode *op_mode)
         iwlagn_fw_error(priv, false);
 }
 
-static void iwl_cmd_queue_full(struct iwl_op_mode *op_mode)
+void iwl_cmd_queue_full(struct iwl_op_mode *op_mode)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
 
@@ -2135,14 +2241,22 @@ static void iwl_cmd_queue_full(struct iwl_op_mode *op_mode)
         }
 }
 
-static void iwl_nic_config(struct iwl_op_mode *op_mode)
+void iwl_nic_config(struct iwl_op_mode *op_mode)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
 
-        cfg(priv)->lib->nic_config(priv);
+        priv->lib->nic_config(priv);
 }
 
-static void iwl_stop_sw_queue(struct iwl_op_mode *op_mode, int queue)
+static void iwl_wimax_active(struct iwl_op_mode *op_mode)
+{
+        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
+
+        clear_bit(STATUS_READY, &priv->status);
+        IWL_ERR(priv, "RF is used by WiMAX\n");
+}
+
+void iwl_stop_sw_queue(struct iwl_op_mode *op_mode, int queue)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
         int ac = priv->queue_to_ac[queue];
@@ -2161,7 +2275,7 @@ static void iwl_stop_sw_queue(struct iwl_op_mode *op_mode, int queue)
         ieee80211_stop_queue(priv->hw, ac);
 }
 
-static void iwl_wake_sw_queue(struct iwl_op_mode *op_mode, int queue)
+void iwl_wake_sw_queue(struct iwl_op_mode *op_mode, int queue)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
         int ac = priv->queue_to_ac[queue];
@@ -2201,6 +2315,27 @@ void iwlagn_lift_passive_no_rx(struct iwl_priv *priv)
         priv->passive_no_rx = false;
 }
 
+void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *info;
+
+        info = IEEE80211_SKB_CB(skb);
+        kmem_cache_free(iwl_tx_cmd_pool, (info->driver_data[1]));
+        dev_kfree_skb_any(skb);
+}
+
+void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
+{
+        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
+
+        if (state)
+                set_bit(STATUS_RF_KILL_HW, &priv->status);
+        else
+                clear_bit(STATUS_RF_KILL_HW, &priv->status);
+
+        wiphy_rfkill_set_hw_state(priv->hw->wiphy, state);
+}
+
 const struct iwl_op_mode_ops iwl_dvm_ops = {
         .start = iwl_op_mode_dvm_start,
         .stop = iwl_op_mode_dvm_stop,
@@ -2212,6 +2347,7 @@ const struct iwl_op_mode_ops iwl_dvm_ops = {
         .nic_error = iwl_nic_error,
         .cmd_queue_full = iwl_cmd_queue_full,
         .nic_config = iwl_nic_config,
+        .wimax_active = iwl_wimax_active,
 };
 
 /*****************************************************************************
@@ -2280,12 +2416,6 @@ MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size");
 module_param_named(fw_restart, iwlagn_mod_params.restart_fw, int, S_IRUGO);
 MODULE_PARM_DESC(fw_restart, "restart firmware in case of error");
 
-module_param_named(ucode_alternative,
-                   iwlagn_mod_params.wanted_ucode_alternative,
-                   int, S_IRUGO);
-MODULE_PARM_DESC(ucode_alternative,
-                 "specify ucode alternative to use from ucode file");
-
 module_param_named(antenna_coupling, iwlagn_mod_params.ant_coupling,
                    int, S_IRUGO);
 MODULE_PARM_DESC(antenna_coupling,
@@ -2299,9 +2429,6 @@ MODULE_PARM_DESC(bt_ch_inhibition,
 module_param_named(plcp_check, iwlagn_mod_params.plcp_check, bool, S_IRUGO);
 MODULE_PARM_DESC(plcp_check, "Check plcp health (default: 1 [enabled])");
 
-module_param_named(ack_check, iwlagn_mod_params.ack_check, bool, S_IRUGO);
-MODULE_PARM_DESC(ack_check, "Check ack health (default: 0 [disabled])");
-
 module_param_named(wd_disable, iwlagn_mod_params.wd_disable, int, S_IRUGO);
 MODULE_PARM_DESC(wd_disable,
                 "Disable stuck queue watchdog timer 0=system default, "
@@ -2345,13 +2472,3 @@ module_param_named(auto_agg, iwlagn_mod_params.auto_agg,
                 bool, S_IRUGO);
 MODULE_PARM_DESC(auto_agg,
                  "enable agg w/o check traffic load (default: enable)");
-
-/*
- * For now, keep using power level 1 instead of automatically
- * adjusting ...
- */
-module_param_named(no_sleep_autoadjust, iwlagn_mod_params.no_sleep_autoadjust,
-                bool, S_IRUGO);
-MODULE_PARM_DESC(no_sleep_autoadjust,
-                 "don't automatically adjust sleep level "
-                 "according to maximum network latency (default: true)");
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index 51001622430b..20100c72ec6b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -71,6 +71,34 @@
 /* AUX (TX during scan dwell) queue */
 #define IWL_AUX_QUEUE           10
 
+/* device operations */
+extern struct iwl_lib_ops iwl1000_lib;
+extern struct iwl_lib_ops iwl2000_lib;
+extern struct iwl_lib_ops iwl2030_lib;
+extern struct iwl_lib_ops iwl5000_lib;
+extern struct iwl_lib_ops iwl5150_lib;
+extern struct iwl_lib_ops iwl6000_lib;
+extern struct iwl_lib_ops iwl6030_lib;
+
+
+
+/*****************************************************
+* DRIVER STATUS FUNCTIONS
+******************************************************/
+#define STATUS_RF_KILL_HW       0
+#define STATUS_CT_KILL          1
+#define STATUS_ALIVE            2
+#define STATUS_READY            3
+#define STATUS_GEO_CONFIGURED   4
+#define STATUS_EXIT_PENDING     5
+#define STATUS_STATISTICS       6
+#define STATUS_SCANNING         7
+#define STATUS_SCAN_ABORTING    8
+#define STATUS_SCAN_HW          9
+#define STATUS_FW_ERROR         10
+#define STATUS_CHANNEL_SWITCH_PENDING 11
+#define STATUS_SCAN_COMPLETE    12
+#define STATUS_POWER_PMI        13
 
 struct iwl_ucode_capabilities;
 
@@ -87,11 +115,9 @@ static inline void iwl_set_calib_hdr(struct iwl_calib_hdr *hdr, u8 cmd)
 void iwl_down(struct iwl_priv *priv);
 void iwl_cancel_deferred_work(struct iwl_priv *priv);
 void iwlagn_prepare_restart(struct iwl_priv *priv);
-void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb);
 int __must_check iwl_rx_dispatch(struct iwl_op_mode *op_mode,
                                  struct iwl_rx_cmd_buffer *rxb,
                                  struct iwl_device_cmd *cmd);
-void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state);
 
 bool iwl_check_for_ct_kill(struct iwl_priv *priv);
 
@@ -109,6 +135,8 @@ int iwl_dvm_send_cmd_pdu(struct iwl_priv *priv, u8 id,
                          u32 flags, u16 len, const void *data);
 
 /* RXON */
+void iwl_connection_init_rx_config(struct iwl_priv *priv,
+                                   struct iwl_rxon_context *ctx);
 int iwlagn_set_pan_params(struct iwl_priv *priv);
 int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
 void iwlagn_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
@@ -119,6 +147,14 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
                              u32 changes);
 void iwlagn_config_ht40(struct ieee80211_conf *conf,
                         struct iwl_rxon_context *ctx);
+void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf);
+void iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch,
+                         struct iwl_rxon_context *ctx);
+void iwl_set_flags_for_band(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
+                            enum ieee80211_band band,
+                            struct ieee80211_vif *vif);
+void iwl_set_rate(struct iwl_priv *priv);
 
 /* uCode */
 int iwl_send_bt_env(struct iwl_priv *priv, u8 action, u8 type);
@@ -131,17 +167,25 @@ int iwl_send_calib_results(struct iwl_priv *priv);
 int iwl_calib_set(struct iwl_priv *priv,
                   const struct iwl_calib_hdr *cmd, int len);
 void iwl_calib_free_results(struct iwl_priv *priv);
-void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand);
 int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
                             char **buf, bool display);
+int iwlagn_hw_valid_rtc_data_addr(u32 addr);
 
 /* lib */
 int iwlagn_send_tx_power(struct iwl_priv *priv);
 void iwlagn_temperature(struct iwl_priv *priv);
-u16 iwl_eeprom_calib_version(struct iwl_shared *shrd);
 int iwlagn_txfifo_flush(struct iwl_priv *priv, u16 flush_control);
 void iwlagn_dev_txfifo_flush(struct iwl_priv *priv, u16 flush_control);
 int iwlagn_send_beacon_cmd(struct iwl_priv *priv);
+int iwl_send_statistics_request(struct iwl_priv *priv,
+                                u8 flags, bool clear);
+
+static inline const struct ieee80211_supported_band *iwl_get_hw_mode(
+                        struct iwl_priv *priv, enum ieee80211_band band)
+{
+        return priv->hw->wiphy->bands[band];
+}
+
 #ifdef CONFIG_PM_SLEEP
 int iwlagn_send_patterns(struct iwl_priv *priv,
                          struct cfg80211_wowlan *wowlan);
@@ -151,6 +195,7 @@ int iwlagn_suspend(struct iwl_priv *priv, struct cfg80211_wowlan *wowlan);
 /* rx */
 int iwlagn_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band);
 void iwl_setup_rx_handlers(struct iwl_priv *priv);
+void iwl_chswitch_done(struct iwl_priv *priv, bool is_success);
 
 
 /* tx */
@@ -195,6 +240,31 @@ u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant_idx, u8 valid);
 /* scan */
 void iwlagn_post_scan(struct iwl_priv *priv);
 void iwlagn_disable_roc(struct iwl_priv *priv);
+int iwl_force_rf_reset(struct iwl_priv *priv, bool external);
+void iwl_init_scan_params(struct iwl_priv *priv);
+int iwl_scan_cancel(struct iwl_priv *priv);
+void iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
+void iwl_force_scan_end(struct iwl_priv *priv);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
+void iwl_setup_rx_scan_handlers(struct iwl_priv *priv);
+void iwl_setup_scan_deferred_work(struct iwl_priv *priv);
+void iwl_cancel_scan_deferred_work(struct iwl_priv *priv);
+int __must_check iwl_scan_initiate(struct iwl_priv *priv,
+                                   struct ieee80211_vif *vif,
+                                   enum iwl_scan_type scan_type,
+                                   enum ieee80211_band band);
+
+/* For faster active scanning, scan will move to the next channel if fewer than
+ * PLCP_QUIET_THRESH packets are heard on this channel within
+ * ACTIVE_QUIET_TIME after sending probe request.  This shortens the dwell
+ * time if it's a quiet channel (nothing responded to our probe, and there's
+ * no other traffic).
+ * Disable "quiet" feature by setting PLCP_QUIET_THRESH to 0. */
+#define IWL_ACTIVE_QUIET_TIME       cpu_to_le16(10)  /* msec */
+#define IWL_PLCP_QUIET_THRESH       cpu_to_le16(1)  /* packets */
+
+#define IWL_SCAN_CHECK_WATCHDOG         (HZ * 7)
+
 
 /* bt coex */
 void iwlagn_send_advance_bt_config(struct iwl_priv *priv);
@@ -207,6 +277,12 @@ void iwlagn_bt_cancel_deferred_work(struct iwl_priv *priv);
 void iwlagn_bt_coex_rssi_monitor(struct iwl_priv *priv);
 void iwlagn_bt_adjust_rssi_monitor(struct iwl_priv *priv, bool rssi_ena);
 
+static inline bool iwl_advanced_bt_coexist(struct iwl_priv *priv)
+{
+        return cfg(priv)->bt_params &&
+               cfg(priv)->bt_params->advanced_bt_coexist;
+}
+
 #ifdef CONFIG_IWLWIFI_DEBUG
 const char *iwl_get_tx_fail_reason(u32 status);
 const char *iwl_get_agg_tx_fail_reason(u16 status);
@@ -245,8 +321,6 @@ void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id,
 u8 iwl_prep_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                     const u8 *addr, bool is_ap, struct ieee80211_sta *sta);
 
-void iwl_sta_fill_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                     u8 sta_id, struct iwl_link_quality_cmd *link_cmd);
 int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                     struct iwl_link_quality_cmd *lq, u8 flags, bool init);
 int iwl_add_sta_callback(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
@@ -254,6 +328,9 @@ int iwl_add_sta_callback(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
 int iwl_sta_update_ht(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                       struct ieee80211_sta *sta);
 
+bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
+                            struct ieee80211_sta_ht_cap *ht_cap);
 
 static inline int iwl_sta_id(struct ieee80211_sta *sta)
 {
@@ -311,9 +388,6 @@ static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
         return cpu_to_le32(flags|(u32)rate);
 }
 
-/* eeprom */
-void iwl_eeprom_get_mac(const struct iwl_shared *shrd, u8 *mac);
-
 extern int iwl_alive_start(struct iwl_priv *priv);
 /* svtool */
 #ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
@@ -421,4 +495,95 @@ do {									\
 } while (0)
 #endif                          /* CONFIG_IWLWIFI_DEBUG */
 
+extern const char *iwl_dvm_cmd_strings[REPLY_MAX];
+
+static inline const char *iwl_dvm_get_cmd_string(u8 cmd)
+{
+        const char *s = iwl_dvm_cmd_strings[cmd];
+        if (s)
+                return s;
+        return "UNKNOWN";
+}
+
+/* API method exported for mvm hybrid state */
+void iwl_setup_deferred_work(struct iwl_priv *priv);
+int iwl_send_wimax_coex(struct iwl_priv *priv);
+int iwl_send_bt_env(struct iwl_priv *priv, u8 action, u8 type);
+void iwl_debug_config(struct iwl_priv *priv);
+int iwl_alloc_traffic_mem(struct iwl_priv *priv);
+void iwl_set_hw_params(struct iwl_priv *priv);
+void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags);
+int iwl_init_drv(struct iwl_priv *priv);
+void iwl_uninit_drv(struct iwl_priv *priv);
+void iwl_send_bt_config(struct iwl_priv *priv);
+void iwl_rf_kill_ct_config(struct iwl_priv *priv);
+int iwl_setup_interface(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+void iwl_teardown_interface(struct iwl_priv *priv,
+                            struct ieee80211_vif *vif,
+                            bool mode_change);
+int iwl_full_rxon_required(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+void iwlagn_update_qos(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+void iwlagn_check_needed_chains(struct iwl_priv *priv,
+                                struct iwl_rxon_context *ctx,
+                                struct ieee80211_bss_conf *bss_conf);
+void iwlagn_chain_noise_reset(struct iwl_priv *priv);
+int iwlagn_update_beacon(struct iwl_priv *priv,
+                         struct ieee80211_vif *vif);
+void iwl_tt_handler(struct iwl_priv *priv);
+void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode);
+void iwl_stop_sw_queue(struct iwl_op_mode *op_mode, int queue);
+void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state);
+void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb);
+void iwl_nic_error(struct iwl_op_mode *op_mode);
+void iwl_cmd_queue_full(struct iwl_op_mode *op_mode);
+void iwl_nic_config(struct iwl_op_mode *op_mode);
+int iwlagn_mac_set_tim(struct ieee80211_hw *hw,
+                       struct ieee80211_sta *sta, bool set);
+void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
+                              enum ieee80211_rssi_event rssi_event);
+int iwlagn_mac_cancel_remain_on_channel(struct ieee80211_hw *hw);
+int iwlagn_mac_tx_last_beacon(struct ieee80211_hw *hw);
+void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop);
+void iwl_wake_sw_queue(struct iwl_op_mode *op_mode, int queue);
+void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+                               struct ieee80211_channel_switch *ch_switch);
+int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
+                         struct ieee80211_vif *vif,
+                         struct ieee80211_sta *sta,
+                         enum ieee80211_sta_state old_state,
+                         enum ieee80211_sta_state new_state);
+int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif,
+                            enum ieee80211_ampdu_mlme_action action,
+                            struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                            u8 buf_size);
+int iwlagn_mac_hw_scan(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif,
+                       struct cfg80211_scan_request *req);
+void iwlagn_mac_sta_notify(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif,
+                           enum sta_notify_cmd cmd,
+                           struct ieee80211_sta *sta);
+void iwlagn_configure_filter(struct ieee80211_hw *hw,
+                             unsigned int changed_flags,
+                             unsigned int *total_flags,
+                             u64 multicast);
+int iwlagn_mac_conf_tx(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif, u16 queue,
+                       const struct ieee80211_tx_queue_params *params);
+void iwlagn_mac_set_rekey_data(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct cfg80211_gtk_rekey_data *data);
+void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_key_conf *keyconf,
+                                struct ieee80211_sta *sta,
+                                u32 iv32, u16 *phase1key);
+int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta,
+                       struct ieee80211_key_conf *key);
+void iwlagn_mac_stop(struct ieee80211_hw *hw);
+void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
+int iwlagn_mac_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan);
 #endif /* __iwl_agn_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 9ed73e5154be..296347a8290f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -1918,7 +1918,7 @@ struct iwl_basic_bt_cmd {
         __le16 valid;
 };
 
-struct iwl6000_bt_cmd {
+struct iwl_bt_cmd_v1 {
         struct iwl_basic_bt_cmd basic;
         u8 prio_boost;
         /*
@@ -1929,7 +1929,7 @@ struct iwl6000_bt_cmd {
         __le16 rx_prio_boost;   /* SW boost of WiFi rx priority */
 };
 
-struct iwl2000_bt_cmd {
+struct iwl_bt_cmd_v2 {
         struct iwl_basic_bt_cmd basic;
         __le32 prio_boost;
         /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
new file mode 100644
index 000000000000..47bfd5e59575
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -0,0 +1,227 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2007 - 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2012 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#ifndef __IWL_CONFIG_H__
+#define __IWL_CONFIG_H__
+
+#include <linux/types.h>
+#include <net/mac80211.h>
+
+
+enum iwl_device_family {
+        IWL_DEVICE_FAMILY_UNDEFINED,
+        IWL_DEVICE_FAMILY_1000,
+        IWL_DEVICE_FAMILY_100,
+        IWL_DEVICE_FAMILY_2000,
+        IWL_DEVICE_FAMILY_2030,
+        IWL_DEVICE_FAMILY_105,
+        IWL_DEVICE_FAMILY_135,
+        IWL_DEVICE_FAMILY_5000,
+        IWL_DEVICE_FAMILY_5150,
+        IWL_DEVICE_FAMILY_6000,
+        IWL_DEVICE_FAMILY_6000i,
+        IWL_DEVICE_FAMILY_6005,
+        IWL_DEVICE_FAMILY_6030,
+        IWL_DEVICE_FAMILY_6050,
+        IWL_DEVICE_FAMILY_6150,
+};
+
+/*
+ * LED mode
+ *    IWL_LED_DEFAULT:  use device default
+ *    IWL_LED_RF_STATE: turn LED on/off based on RF state
+ *                      LED ON  = RF ON
+ *                      LED OFF = RF OFF
+ *    IWL_LED_BLINK:    adjust led blink rate based on blink table
+ *    IWL_LED_DISABLE:  led disabled
+ */
+enum iwl_led_mode {
+        IWL_LED_DEFAULT,
+        IWL_LED_RF_STATE,
+        IWL_LED_BLINK,
+        IWL_LED_DISABLE,
+};
+
+/*
+ * @max_ll_items: max number of OTP blocks
+ * @shadow_ram_support: shadow support for OTP memory
+ * @led_compensation: compensate on the led on/off time per HW according
+ *      to the deviation to achieve the desired led frequency.
+ *      The detail algorithm is described in iwl-led.c
+ * @chain_noise_num_beacons: number of beacons used to compute chain noise
+ * @adv_thermal_throttle: support advance thermal throttle
+ * @support_ct_kill_exit: support ct kill exit condition
+ * @plcp_delta_threshold: plcp error rate threshold used to trigger
+ *      radio tuning when there is a high receiving plcp error rate
+ * @chain_noise_scale: default chain noise scale used for gain computation
+ * @wd_timeout: TX queues watchdog timeout
+ * @max_event_log_size: size of event log buffer size for ucode event logging
+ * @shadow_reg_enable: HW shadhow register bit
+ * @hd_v2: v2 of enhanced sensitivity value, used for 2000 series and up
+ * @no_idle_support: do not support idle mode
+ */
+struct iwl_base_params {
+        int eeprom_size;
+        int num_of_queues;      /* def: HW dependent */
+        /* for iwl_apm_init() */
+        u32 pll_cfg_val;
+
+        const u16 max_ll_items;
+        const bool shadow_ram_support;
+        u16 led_compensation;
+        bool adv_thermal_throttle;
+        bool support_ct_kill_exit;
+        u8 plcp_delta_threshold;
+        s32 chain_noise_scale;
+        unsigned int wd_timeout;
+        u32 max_event_log_size;
+        const bool shadow_reg_enable;
+        const bool hd_v2;
+        const bool no_idle_support;
+};
+
+/*
+ * @advanced_bt_coexist: support advanced bt coexist
+ * @bt_init_traffic_load: specify initial bt traffic load
+ * @bt_prio_boost: default bt priority boost value
+ * @agg_time_limit: maximum number of uSec in aggregation
+ * @bt_sco_disable: uCode should not response to BT in SCO/ESCO mode
+ */
+struct iwl_bt_params {
+        bool advanced_bt_coexist;
+        u8 bt_init_traffic_load;
+        u8 bt_prio_boost;
+        u16 agg_time_limit;
+        bool bt_sco_disable;
+        bool bt_session_2;
+};
+/*
+ * @use_rts_for_aggregation: use rts/cts protection for HT traffic
+ */
+struct iwl_ht_params {
+        const bool ht_greenfield_support; /* if used set to true */
+        bool use_rts_for_aggregation;
+        enum ieee80211_smps_mode smps_mode;
+};
+
+/**
+ * struct iwl_cfg
+ * @name: Offical name of the device
+ * @fw_name_pre: Firmware filename prefix. The api version and extension
+ *      (.ucode) will be added to filename before loading from disk. The
+ *      filename is constructed as fw_name_pre<api>.ucode.
+ * @ucode_api_max: Highest version of uCode API supported by driver.
+ * @ucode_api_ok: oldest version of the uCode API that is OK to load
+ *      without a warning, for use in transitions
+ * @ucode_api_min: Lowest version of uCode API supported by driver.
+ * @max_inst_size: The maximal length of the fw inst section
+ * @max_data_size: The maximal length of the fw data section
+ * @valid_tx_ant: valid transmit antenna
+ * @valid_rx_ant: valid receive antenna
+ * @eeprom_ver: EEPROM version
+ * @eeprom_calib_ver: EEPROM calibration version
+ * @lib: pointer to the lib ops
+ * @base_params: pointer to basic parameters
+ * @ht_params: point to ht patameters
+ * @bt_params: pointer to bt parameters
+ * @need_temp_offset_calib: need to perform temperature offset calibration
+ * @no_xtal_calib: some devices do not need crystal calibration data,
+ *      don't send it to those
+ * @led_mode: 0=blinking, 1=On(RF On)/Off(RF Off)
+ * @adv_pm: advance power management
+ * @rx_with_siso_diversity: 1x1 device with rx antenna diversity
+ * @internal_wimax_coex: internal wifi/wimax combo device
+ * @temp_offset_v2: support v2 of temperature offset calibration
+ *
+ * We enable the driver to be backward compatible wrt. hardware features.
+ * API differences in uCode shouldn't be handled here but through TLVs
+ * and/or the uCode API version instead.
+ */
+struct iwl_cfg {
+        /* params specific to an individual device within a device family */
+        const char *name;
+        const char *fw_name_pre;
+        const unsigned int ucode_api_max;
+        const unsigned int ucode_api_ok;
+        const unsigned int ucode_api_min;
+        const enum iwl_device_family device_family;
+        const u32 max_data_size;
+        const u32 max_inst_size;
+        u8   valid_tx_ant;
+        u8   valid_rx_ant;
+        u16  eeprom_ver;
+        u16  eeprom_calib_ver;
+        /* params not likely to change within a device family */
+        const struct iwl_base_params *base_params;
+        /* params likely to change within a device family */
+        const struct iwl_ht_params *ht_params;
+        const struct iwl_bt_params *bt_params;
+        const bool need_temp_offset_calib; /* if used set to true */
+        const bool no_xtal_calib;
+        enum iwl_led_mode led_mode;
+        const bool adv_pm;
+        const bool rx_with_siso_diversity;
+        const bool internal_wimax_coex;
+        const bool temp_offset_v2;
+};
+
+#endif /* __IWL_CONFIG_H__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 88ea31d9eb75..d7a8cde249ff 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -41,477 +41,6 @@
 #include "iwl-agn.h"
 #include "iwl-trans.h"
 
-const u8 iwl_bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
-
-static bool iwl_is_channel_extension(struct iwl_priv *priv,
-                                     enum ieee80211_band band,
-                                     u16 channel, u8 extension_chan_offset)
-{
-        const struct iwl_channel_info *ch_info;
-
-        ch_info = iwl_get_channel_info(priv, band, channel);
-        if (!is_channel_valid(ch_info))
-                return false;
-
-        if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_ABOVE)
-                return !(ch_info->ht40_extension_channel &
-                                        IEEE80211_CHAN_NO_HT40PLUS);
-        else if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_BELOW)
-                return !(ch_info->ht40_extension_channel &
-                                        IEEE80211_CHAN_NO_HT40MINUS);
-
-        return false;
-}
-
-bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
-                            struct iwl_rxon_context *ctx,
-                            struct ieee80211_sta_ht_cap *ht_cap)
-{
-        if (!ctx->ht.enabled || !ctx->ht.is_40mhz)
-                return false;
-
-        /*
-         * We do not check for IEEE80211_HT_CAP_SUP_WIDTH_20_40
-         * the bit will not set if it is pure 40MHz case
-         */
-        if (ht_cap && !ht_cap->ht_supported)
-                return false;
-
-#ifdef CONFIG_IWLWIFI_DEBUGFS
-        if (priv->disable_ht40)
-                return false;
-#endif
-
-        return iwl_is_channel_extension(priv, priv->band,
-                        le16_to_cpu(ctx->staging.channel),
-                        ctx->ht.extension_chan_offset);
-}
-
-static void _iwl_set_rxon_ht(struct iwl_priv *priv,
-                             struct iwl_ht_config *ht_conf,
-                             struct iwl_rxon_context *ctx)
-{
-        struct iwl_rxon_cmd *rxon = &ctx->staging;
-
-        if (!ctx->ht.enabled) {
-                rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
-                        RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK |
-                        RXON_FLG_HT40_PROT_MSK |
-                        RXON_FLG_HT_PROT_MSK);
-                return;
-        }
-
-        /* FIXME: if the definition of ht.protection changed, the "translation"
-         * will be needed for rxon->flags
-         */
-        rxon->flags |= cpu_to_le32(ctx->ht.protection << RXON_FLG_HT_OPERATING_MODE_POS);
-
-        /* Set up channel bandwidth:
-         * 20 MHz only, 20/40 mixed or pure 40 if ht40 ok */
-        /* clear the HT channel mode before set the mode */
-        rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
-                         RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
-        if (iwl_is_ht40_tx_allowed(priv, ctx, NULL)) {
-                /* pure ht40 */
-                if (ctx->ht.protection == IEEE80211_HT_OP_MODE_PROTECTION_20MHZ) {
-                        rxon->flags |= RXON_FLG_CHANNEL_MODE_PURE_40;
-                        /* Note: control channel is opposite of extension channel */
-                        switch (ctx->ht.extension_chan_offset) {
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                                rxon->flags &= ~RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                                rxon->flags |= RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
-                                break;
-                        }
-                } else {
-                        /* Note: control channel is opposite of extension channel */
-                        switch (ctx->ht.extension_chan_offset) {
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                                rxon->flags &= ~(RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
-                                rxon->flags |= RXON_FLG_CHANNEL_MODE_MIXED;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                                rxon->flags |= RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
-                                rxon->flags |= RXON_FLG_CHANNEL_MODE_MIXED;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_NONE:
-                        default:
-                                /* channel location only valid if in Mixed mode */
-                                IWL_ERR(priv, "invalid extension channel offset\n");
-                                break;
-                        }
-                }
-        } else {
-                rxon->flags |= RXON_FLG_CHANNEL_MODE_LEGACY;
-        }
-
-        iwlagn_set_rxon_chain(priv, ctx);
-
-        IWL_DEBUG_ASSOC(priv, "rxon flags 0x%X operation mode :0x%X "
-                        "extension channel offset 0x%x\n",
-                        le32_to_cpu(rxon->flags), ctx->ht.protection,
-                        ctx->ht.extension_chan_offset);
-}
-
-void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
-{
-        struct iwl_rxon_context *ctx;
-
-        for_each_context(priv, ctx)
-                _iwl_set_rxon_ht(priv, ht_conf, ctx);
-}
-
-/**
- * iwl_set_rxon_channel - Set the band and channel values in staging RXON
- * @ch: requested channel as a pointer to struct ieee80211_channel
-
- * NOTE:  Does not commit to the hardware; it sets appropriate bit fields
- * in the staging RXON flag structure based on the ch->band
- */
-void iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch,
-                         struct iwl_rxon_context *ctx)
-{
-        enum ieee80211_band band = ch->band;
-        u16 channel = ch->hw_value;
-
-        if ((le16_to_cpu(ctx->staging.channel) == channel) &&
-            (priv->band == band))
-                return;
-
-        ctx->staging.channel = cpu_to_le16(channel);
-        if (band == IEEE80211_BAND_5GHZ)
-                ctx->staging.flags &= ~RXON_FLG_BAND_24G_MSK;
-        else
-                ctx->staging.flags |= RXON_FLG_BAND_24G_MSK;
-
-        priv->band = band;
-
-        IWL_DEBUG_INFO(priv, "Staging channel set to %d [%d]\n", channel, band);
-
-}
-
-void iwl_set_flags_for_band(struct iwl_priv *priv,
-                            struct iwl_rxon_context *ctx,
-                            enum ieee80211_band band,
-                            struct ieee80211_vif *vif)
-{
-        if (band == IEEE80211_BAND_5GHZ) {
-                ctx->staging.flags &=
-                    ~(RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK
-                      | RXON_FLG_CCK_MSK);
-                ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
-        } else {
-                /* Copied from iwl_post_associate() */
-                if (vif && vif->bss_conf.use_short_slot)
-                        ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
-                else
-                        ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
-
-                ctx->staging.flags |= RXON_FLG_BAND_24G_MSK;
-                ctx->staging.flags |= RXON_FLG_AUTO_DETECT_MSK;
-                ctx->staging.flags &= ~RXON_FLG_CCK_MSK;
-        }
-}
-
-/*
- * initialize rxon structure with default values from eeprom
- */
-void iwl_connection_init_rx_config(struct iwl_priv *priv,
-                                   struct iwl_rxon_context *ctx)
-{
-        const struct iwl_channel_info *ch_info;
-
-        memset(&ctx->staging, 0, sizeof(ctx->staging));
-
-        if (!ctx->vif) {
-                ctx->staging.dev_type = ctx->unused_devtype;
-        } else switch (ctx->vif->type) {
-        case NL80211_IFTYPE_AP:
-                ctx->staging.dev_type = ctx->ap_devtype;
-                break;
-
-        case NL80211_IFTYPE_STATION:
-                ctx->staging.dev_type = ctx->station_devtype;
-                ctx->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
-                break;
-
-        case NL80211_IFTYPE_ADHOC:
-                ctx->staging.dev_type = ctx->ibss_devtype;
-                ctx->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
-                ctx->staging.filter_flags = RXON_FILTER_BCON_AWARE_MSK |
-                                                  RXON_FILTER_ACCEPT_GRP_MSK;
-                break;
-
-        default:
-                IWL_ERR(priv, "Unsupported interface type %d\n",
-                        ctx->vif->type);
-                break;
-        }
-
-#if 0
-        /* TODO:  Figure out when short_preamble would be set and cache from
-         * that */
-        if (!hw_to_local(priv->hw)->short_preamble)
-                ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
-        else
-                ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
-#endif
-
-        ch_info = iwl_get_channel_info(priv, priv->band,
-                                       le16_to_cpu(ctx->active.channel));
-
-        if (!ch_info)
-                ch_info = &priv->channel_info[0];
-
-        ctx->staging.channel = cpu_to_le16(ch_info->channel);
-        priv->band = ch_info->band;
-
-        iwl_set_flags_for_band(priv, ctx, priv->band, ctx->vif);
-
-        ctx->staging.ofdm_basic_rates =
-            (IWL_OFDM_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
-        ctx->staging.cck_basic_rates =
-            (IWL_CCK_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
-
-        /* clear both MIX and PURE40 mode flag */
-        ctx->staging.flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED |
-                                        RXON_FLG_CHANNEL_MODE_PURE_40);
-        if (ctx->vif)
-                memcpy(ctx->staging.node_addr, ctx->vif->addr, ETH_ALEN);
-
-        ctx->staging.ofdm_ht_single_stream_basic_rates = 0xff;
-        ctx->staging.ofdm_ht_dual_stream_basic_rates = 0xff;
-        ctx->staging.ofdm_ht_triple_stream_basic_rates = 0xff;
-}
-
-void iwl_set_rate(struct iwl_priv *priv)
-{
-        const struct ieee80211_supported_band *hw = NULL;
-        struct ieee80211_rate *rate;
-        struct iwl_rxon_context *ctx;
-        int i;
-
-        hw = iwl_get_hw_mode(priv, priv->band);
-        if (!hw) {
-                IWL_ERR(priv, "Failed to set rate: unable to get hw mode\n");
-                return;
-        }
-
-        priv->active_rate = 0;
-
-        for (i = 0; i < hw->n_bitrates; i++) {
-                rate = &(hw->bitrates[i]);
-                if (rate->hw_value < IWL_RATE_COUNT_LEGACY)
-                        priv->active_rate |= (1 << rate->hw_value);
-        }
-
-        IWL_DEBUG_RATE(priv, "Set active_rate = %0x\n", priv->active_rate);
-
-        for_each_context(priv, ctx) {
-                ctx->staging.cck_basic_rates =
-                    (IWL_CCK_BASIC_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
-
-                ctx->staging.ofdm_basic_rates =
-                   (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
-        }
-}
-
-void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
-{
-        /*
-         * MULTI-FIXME
-         * See iwlagn_mac_channel_switch.
-         */
-        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
-                ieee80211_chswitch_done(ctx->vif, is_success);
-}
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-void iwl_print_rx_config_cmd(struct iwl_priv *priv,
-                             enum iwl_rxon_context_id ctxid)
-{
-        struct iwl_rxon_context *ctx = &priv->contexts[ctxid];
-        struct iwl_rxon_cmd *rxon = &ctx->staging;
-
-        IWL_DEBUG_RADIO(priv, "RX CONFIG:\n");
-        iwl_print_hex_dump(priv, IWL_DL_RADIO, (u8 *) rxon, sizeof(*rxon));
-        IWL_DEBUG_RADIO(priv, "u16 channel: 0x%x\n", le16_to_cpu(rxon->channel));
-        IWL_DEBUG_RADIO(priv, "u32 flags: 0x%08X\n", le32_to_cpu(rxon->flags));
-        IWL_DEBUG_RADIO(priv, "u32 filter_flags: 0x%08x\n",
-                        le32_to_cpu(rxon->filter_flags));
-        IWL_DEBUG_RADIO(priv, "u8 dev_type: 0x%x\n", rxon->dev_type);
-        IWL_DEBUG_RADIO(priv, "u8 ofdm_basic_rates: 0x%02x\n",
-                        rxon->ofdm_basic_rates);
-        IWL_DEBUG_RADIO(priv, "u8 cck_basic_rates: 0x%02x\n", rxon->cck_basic_rates);
-        IWL_DEBUG_RADIO(priv, "u8[6] node_addr: %pM\n", rxon->node_addr);
-        IWL_DEBUG_RADIO(priv, "u8[6] bssid_addr: %pM\n", rxon->bssid_addr);
-        IWL_DEBUG_RADIO(priv, "u16 assoc_id: 0x%x\n", le16_to_cpu(rxon->assoc_id));
-}
-#endif
-
-void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand)
-{
-        unsigned int reload_msec;
-        unsigned long reload_jiffies;
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_have_debug_level(IWL_DL_FW_ERRORS))
-                iwl_print_rx_config_cmd(priv, IWL_RXON_CTX_BSS);
-#endif
-
-        /* uCode is no longer loaded. */
-        priv->ucode_loaded = false;
-
-        /* Set the FW error flag -- cleared on iwl_down */
-        set_bit(STATUS_FW_ERROR, &priv->status);
-
-        /* Cancel currently queued command. */
-        clear_bit(STATUS_HCMD_ACTIVE, &priv->shrd->status);
-
-        iwl_abort_notification_waits(&priv->notif_wait);
-
-        /* Keep the restart process from trying to send host
-         * commands by clearing the ready bit */
-        clear_bit(STATUS_READY, &priv->status);
-
-        wake_up(&trans(priv)->wait_command_queue);
-
-        if (!ondemand) {
-                /*
-                 * If firmware keep reloading, then it indicate something
-                 * serious wrong and firmware having problem to recover
-                 * from it. Instead of keep trying which will fill the syslog
-                 * and hang the system, let's just stop it
-                 */
-                reload_jiffies = jiffies;
-                reload_msec = jiffies_to_msecs((long) reload_jiffies -
-                                        (long) priv->reload_jiffies);
-                priv->reload_jiffies = reload_jiffies;
-                if (reload_msec <= IWL_MIN_RELOAD_DURATION) {
-                        priv->reload_count++;
-                        if (priv->reload_count >= IWL_MAX_CONTINUE_RELOAD_CNT) {
-                                IWL_ERR(priv, "BUG_ON, Stop restarting\n");
-                                return;
-                        }
-                } else
-                        priv->reload_count = 0;
-        }
-
-        if (!test_bit(STATUS_EXIT_PENDING, &priv->status)) {
-                if (iwlagn_mod_params.restart_fw) {
-                        IWL_DEBUG_FW_ERRORS(priv,
-                                  "Restarting adapter due to uCode error.\n");
-                        queue_work(priv->workqueue, &priv->restart);
-                } else
-                        IWL_DEBUG_FW_ERRORS(priv,
-                                  "Detected FW error, but not restarting\n");
-        }
-}
-
-int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
-{
-        int ret;
-        s8 prev_tx_power;
-        bool defer;
-        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
-
-        lockdep_assert_held(&priv->mutex);
-
-        if (priv->tx_power_user_lmt == tx_power && !force)
-                return 0;
-
-        if (tx_power < IWLAGN_TX_POWER_TARGET_POWER_MIN) {
-                IWL_WARN(priv,
-                         "Requested user TXPOWER %d below lower limit %d.\n",
-                         tx_power,
-                         IWLAGN_TX_POWER_TARGET_POWER_MIN);
-                return -EINVAL;
-        }
-
-        if (tx_power > priv->tx_power_device_lmt) {
-                IWL_WARN(priv,
-                        "Requested user TXPOWER %d above upper limit %d.\n",
-                         tx_power, priv->tx_power_device_lmt);
-                return -EINVAL;
-        }
-
-        if (!iwl_is_ready_rf(priv))
-                return -EIO;
-
-        /* scan complete and commit_rxon use tx_power_next value,
-         * it always need to be updated for newest request */
-        priv->tx_power_next = tx_power;
-
-        /* do not set tx power when scanning or channel changing */
-        defer = test_bit(STATUS_SCANNING, &priv->status) ||
-                memcmp(&ctx->active, &ctx->staging, sizeof(ctx->staging));
-        if (defer && !force) {
-                IWL_DEBUG_INFO(priv, "Deferring tx power set\n");
-                return 0;
-        }
-
-        prev_tx_power = priv->tx_power_user_lmt;
-        priv->tx_power_user_lmt = tx_power;
-
-        ret = iwlagn_send_tx_power(priv);
-
-        /* if fail to set tx_power, restore the orig. tx power */
-        if (ret) {
-                priv->tx_power_user_lmt = prev_tx_power;
-                priv->tx_power_next = prev_tx_power;
-        }
-        return ret;
-}
-
-void iwl_send_bt_config(struct iwl_priv *priv)
-{
-        struct iwl_bt_cmd bt_cmd = {
-                .lead_time = BT_LEAD_TIME_DEF,
-                .max_kill = BT_MAX_KILL_DEF,
-                .kill_ack_mask = 0,
-                .kill_cts_mask = 0,
-        };
-
-        if (!iwlagn_mod_params.bt_coex_active)
-                bt_cmd.flags = BT_COEX_DISABLE;
-        else
-                bt_cmd.flags = BT_COEX_ENABLE;
-
-        priv->bt_enable_flag = bt_cmd.flags;
-        IWL_DEBUG_INFO(priv, "BT coex %s\n",
-                (bt_cmd.flags == BT_COEX_DISABLE) ? "disable" : "active");
-
-        if (iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                             CMD_SYNC, sizeof(struct iwl_bt_cmd), &bt_cmd))
-                IWL_ERR(priv, "failed to send BT Coex Config\n");
-}
-
-int iwl_send_statistics_request(struct iwl_priv *priv, u8 flags, bool clear)
-{
-        struct iwl_statistics_cmd statistics_cmd = {
-                .configuration_flags =
-                        clear ? IWL_STATS_CONF_CLEAR_STATS : 0,
-        };
-
-        if (flags & CMD_ASYNC)
-                return iwl_dvm_send_cmd_pdu(priv, REPLY_STATISTICS_CMD,
-                                              CMD_ASYNC,
-                                               sizeof(struct iwl_statistics_cmd),
-                                               &statistics_cmd);
-        else
-                return iwl_dvm_send_cmd_pdu(priv, REPLY_STATISTICS_CMD,
-                                        CMD_SYNC,
-                                        sizeof(struct iwl_statistics_cmd),
-                                        &statistics_cmd);
-}
-
-
 
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -611,6 +140,7 @@ void iwl_dbg_log_rx_data_frame(struct iwl_priv *priv,
 
 const char *get_mgmt_string(int cmd)
 {
+#define IWL_CMD(x) case x: return #x
         switch (cmd) {
                 IWL_CMD(MANAGEMENT_ASSOC_REQ);
                 IWL_CMD(MANAGEMENT_ASSOC_RESP);
@@ -628,10 +158,12 @@ const char *get_mgmt_string(int cmd)
                 return "UNKNOWN";
 
         }
+#undef IWL_CMD
 }
 
 const char *get_ctrl_string(int cmd)
 {
+#define IWL_CMD(x) case x: return #x
         switch (cmd) {
                 IWL_CMD(CONTROL_BACK_REQ);
                 IWL_CMD(CONTROL_BACK);
@@ -645,6 +177,7 @@ const char *get_ctrl_string(int cmd)
                 return "UNKNOWN";
 
         }
+#undef IWL_CMD
 }
 
 void iwl_clear_traffic_stats(struct iwl_priv *priv)
@@ -746,80 +279,6 @@ void iwl_update_stats(struct iwl_priv *priv, bool is_tx, __le16 fc, u16 len)
 }
 #endif
 
-static void iwl_force_rf_reset(struct iwl_priv *priv)
-{
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        if (!iwl_is_any_associated(priv)) {
-                IWL_DEBUG_SCAN(priv, "force reset rejected: not associated\n");
-                return;
-        }
-        /*
-         * There is no easy and better way to force reset the radio,
-         * the only known method is switching channel which will force to
-         * reset and tune the radio.
-         * Use internal short scan (single channel) operation to should
-         * achieve this objective.
-         * Driver should reset the radio when number of consecutive missed
-         * beacon, or any other uCode error condition detected.
-         */
-        IWL_DEBUG_INFO(priv, "perform radio reset.\n");
-        iwl_internal_short_hw_scan(priv);
-}
-
-
-int iwl_force_reset(struct iwl_priv *priv, int mode, bool external)
-{
-        struct iwl_force_reset *force_reset;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return -EINVAL;
-
-        if (mode >= IWL_MAX_FORCE_RESET) {
-                IWL_DEBUG_INFO(priv, "invalid reset request.\n");
-                return -EINVAL;
-        }
-        force_reset = &priv->force_reset[mode];
-        force_reset->reset_request_count++;
-        if (!external) {
-                if (force_reset->last_force_reset_jiffies &&
-                    time_after(force_reset->last_force_reset_jiffies +
-                    force_reset->reset_duration, jiffies)) {
-                        IWL_DEBUG_INFO(priv, "force reset rejected\n");
-                        force_reset->reset_reject_count++;
-                        return -EAGAIN;
-                }
-        }
-        force_reset->reset_success_count++;
-        force_reset->last_force_reset_jiffies = jiffies;
-        IWL_DEBUG_INFO(priv, "perform force reset (%d)\n", mode);
-        switch (mode) {
-        case IWL_RF_RESET:
-                iwl_force_rf_reset(priv);
-                break;
-        case IWL_FW_RESET:
-                /*
-                 * if the request is from external(ex: debugfs),
-                 * then always perform the request in regardless the module
-                 * parameter setting
-                 * if the request is from internal (uCode error or driver
-                 * detect failure), then fw_restart module parameter
-                 * need to be check before performing firmware reload
-                 */
-                if (!external && !iwlagn_mod_params.restart_fw) {
-                        IWL_DEBUG_INFO(priv, "Cancel firmware reload based on "
-                                       "module parameter setting\n");
-                        break;
-                }
-                IWL_ERR(priv, "On demand firmware reload\n");
-                iwlagn_fw_error(priv, true);
-                break;
-        }
-        return 0;
-}
-
-
 int iwl_cmd_echo_test(struct iwl_priv *priv)
 {
         int ret;
@@ -836,165 +295,3 @@ int iwl_cmd_echo_test(struct iwl_priv *priv)
                 IWL_DEBUG_INFO(priv, "echo testing pass\n");
         return ret;
 }
-
-static inline int iwl_check_stuck_queue(struct iwl_priv *priv, int txq)
-{
-        if (iwl_trans_check_stuck_queue(trans(priv), txq)) {
-                int ret;
-                ret = iwl_force_reset(priv, IWL_FW_RESET, false);
-                return (ret == -EAGAIN) ? 0 : 1;
-        }
-        return 0;
-}
-
-/*
- * Making watchdog tick be a quarter of timeout assure we will
- * discover the queue hung between timeout and 1.25*timeout
- */
-#define IWL_WD_TICK(timeout) ((timeout) / 4)
-
-/*
- * Watchdog timer callback, we check each tx queue for stuck, if if hung
- * we reset the firmware. If everything is fine just rearm the timer.
- */
-void iwl_bg_watchdog(unsigned long data)
-{
-        struct iwl_priv *priv = (struct iwl_priv *)data;
-        int cnt;
-        unsigned long timeout;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        if (iwl_is_rfkill(priv))
-                return;
-
-        timeout = hw_params(priv).wd_timeout;
-        if (timeout == 0)
-                return;
-
-        /* monitor and check for stuck queues */
-        for (cnt = 0; cnt < cfg(priv)->base_params->num_of_queues; cnt++)
-                if (iwl_check_stuck_queue(priv, cnt))
-                        return;
-
-        mod_timer(&priv->watchdog, jiffies +
-                  msecs_to_jiffies(IWL_WD_TICK(timeout)));
-}
-
-void iwl_setup_watchdog(struct iwl_priv *priv)
-{
-        unsigned int timeout = hw_params(priv).wd_timeout;
-
-        if (!iwlagn_mod_params.wd_disable) {
-                /* use system default */
-                if (timeout && !cfg(priv)->base_params->wd_disable)
-                        mod_timer(&priv->watchdog,
-                                jiffies +
-                                msecs_to_jiffies(IWL_WD_TICK(timeout)));
-                else
-                        del_timer(&priv->watchdog);
-        } else {
-                /* module parameter overwrite default configuration */
-                if (timeout && iwlagn_mod_params.wd_disable == 2)
-                        mod_timer(&priv->watchdog,
-                                jiffies +
-                                msecs_to_jiffies(IWL_WD_TICK(timeout)));
-                else
-                        del_timer(&priv->watchdog);
-        }
-}
-
-/**
- * iwl_beacon_time_mask_low - mask of lower 32 bit of beacon time
- * @priv -- pointer to iwl_priv data structure
- * @tsf_bits -- number of bits need to shift for masking)
- */
-static inline u32 iwl_beacon_time_mask_low(struct iwl_priv *priv,
-                                           u16 tsf_bits)
-{
-        return (1 << tsf_bits) - 1;
-}
-
-/**
- * iwl_beacon_time_mask_high - mask of higher 32 bit of beacon time
- * @priv -- pointer to iwl_priv data structure
- * @tsf_bits -- number of bits need to shift for masking)
- */
-static inline u32 iwl_beacon_time_mask_high(struct iwl_priv *priv,
-                                            u16 tsf_bits)
-{
-        return ((1 << (32 - tsf_bits)) - 1) << tsf_bits;
-}
-
-/*
- * extended beacon time format
- * time in usec will be changed into a 32-bit value in extended:internal format
- * the extended part is the beacon counts
- * the internal part is the time in usec within one beacon interval
- */
-u32 iwl_usecs_to_beacons(struct iwl_priv *priv, u32 usec, u32 beacon_interval)
-{
-        u32 quot;
-        u32 rem;
-        u32 interval = beacon_interval * TIME_UNIT;
-
-        if (!interval || !usec)
-                return 0;
-
-        quot = (usec / interval) &
-                (iwl_beacon_time_mask_high(priv, IWLAGN_EXT_BEACON_TIME_POS) >>
-                IWLAGN_EXT_BEACON_TIME_POS);
-        rem = (usec % interval) & iwl_beacon_time_mask_low(priv,
-                                   IWLAGN_EXT_BEACON_TIME_POS);
-
-        return (quot << IWLAGN_EXT_BEACON_TIME_POS) + rem;
-}
-
-/* base is usually what we get from ucode with each received frame,
- * the same as HW timer counter counting down
- */
-__le32 iwl_add_beacon_time(struct iwl_priv *priv, u32 base,
-                           u32 addon, u32 beacon_interval)
-{
-        u32 base_low = base & iwl_beacon_time_mask_low(priv,
-                                IWLAGN_EXT_BEACON_TIME_POS);
-        u32 addon_low = addon & iwl_beacon_time_mask_low(priv,
-                                IWLAGN_EXT_BEACON_TIME_POS);
-        u32 interval = beacon_interval * TIME_UNIT;
-        u32 res = (base & iwl_beacon_time_mask_high(priv,
-                                IWLAGN_EXT_BEACON_TIME_POS)) +
-                                (addon & iwl_beacon_time_mask_high(priv,
-                                IWLAGN_EXT_BEACON_TIME_POS));
-
-        if (base_low > addon_low)
-                res += base_low - addon_low;
-        else if (base_low < addon_low) {
-                res += interval + base_low - addon_low;
-                res += (1 << IWLAGN_EXT_BEACON_TIME_POS);
-        } else
-                res += (1 << IWLAGN_EXT_BEACON_TIME_POS);
-
-        return cpu_to_le32(res);
-}
-
-void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
-{
-        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
-
-        if (state)
-                set_bit(STATUS_RF_KILL_HW, &priv->status);
-        else
-                clear_bit(STATUS_RF_KILL_HW, &priv->status);
-
-        wiphy_rfkill_set_hw_state(priv->hw->wiphy, state);
-}
-
-void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
-{
-        struct ieee80211_tx_info *info;
-
-        info = IEEE80211_SKB_CB(skb);
-        kmem_cache_free(iwl_tx_cmd_pool, (info->driver_data[1]));
-        dev_kfree_skb_any(skb);
-}
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 7aa3060fc6b5..199a0c03774c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -74,38 +74,10 @@ struct iwl_cmd;
 
 #define TIME_UNIT               1024
 
-struct iwl_lib_ops {
-        /* set hw dependent parameters */
-        void (*set_hw_params)(struct iwl_priv *priv);
-        int (*set_channel_switch)(struct iwl_priv *priv,
-                                  struct ieee80211_channel_switch *ch_switch);
-        /* device specific configuration */
-        void (*nic_config)(struct iwl_priv *priv);
-
-        /* eeprom operations (as defined in iwl-eeprom.h) */
-        struct iwl_eeprom_ops eeprom_ops;
-
-        /* temperature */
-        void (*temperature)(struct iwl_priv *priv);
-};
-
 /***************************
  *   L i b                 *
  ***************************/
 
-void iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch,
-                         struct iwl_rxon_context *ctx);
-void iwl_set_flags_for_band(struct iwl_priv *priv,
-                            struct iwl_rxon_context *ctx,
-                            enum ieee80211_band band,
-                            struct ieee80211_vif *vif);
-void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf);
-bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
-                            struct iwl_rxon_context *ctx,
-                            struct ieee80211_sta_ht_cap *ht_cap);
-void iwl_connection_init_rx_config(struct iwl_priv *priv,
-                                   struct iwl_rxon_context *ctx);
-void iwl_set_rate(struct iwl_priv *priv);
 int iwl_cmd_echo_test(struct iwl_priv *priv);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_alloc_traffic_mem(struct iwl_priv *priv);
@@ -146,45 +118,9 @@ static inline void iwl_update_stats(struct iwl_priv *priv, bool is_tx,
 }
 #endif
 
-/*****************************************************
-* RX
-******************************************************/
-void iwl_chswitch_done(struct iwl_priv *priv, bool is_success);
-
-void iwl_setup_watchdog(struct iwl_priv *priv);
-/*****************************************************
- * TX power
- ****************************************************/
-int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force);
-
 /*******************************************************************************
  * Scanning
  ******************************************************************************/
-void iwl_init_scan_params(struct iwl_priv *priv);
-int iwl_scan_cancel(struct iwl_priv *priv);
-void iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
-void iwl_force_scan_end(struct iwl_priv *priv);
-void iwl_internal_short_hw_scan(struct iwl_priv *priv);
-int iwl_force_reset(struct iwl_priv *priv, int mode, bool external);
-void iwl_setup_rx_scan_handlers(struct iwl_priv *priv);
-void iwl_setup_scan_deferred_work(struct iwl_priv *priv);
-void iwl_cancel_scan_deferred_work(struct iwl_priv *priv);
-int __must_check iwl_scan_initiate(struct iwl_priv *priv,
-                                   struct ieee80211_vif *vif,
-                                   enum iwl_scan_type scan_type,
-                                   enum ieee80211_band band);
-
-/* For faster active scanning, scan will move to the next channel if fewer than
- * PLCP_QUIET_THRESH packets are heard on this channel within
- * ACTIVE_QUIET_TIME after sending probe request.  This shortens the dwell
- * time if it's a quiet channel (nothing responded to our probe, and there's
- * no other traffic).
- * Disable "quiet" feature by setting PLCP_QUIET_THRESH to 0. */
-#define IWL_ACTIVE_QUIET_TIME       cpu_to_le16(10)  /* msec */
-#define IWL_PLCP_QUIET_THRESH       cpu_to_le16(1)  /* packets */
-
-#define IWL_SCAN_CHECK_WATCHDOG         (HZ * 7)
-
 /* traffic log definitions */
 #define IWL_TRAFFIC_ENTRIES     (256)
 #define IWL_TRAFFIC_ENTRY_SIZE  (64)
@@ -192,28 +128,6 @@ int __must_check iwl_scan_initiate(struct iwl_priv *priv,
 /*****************************************************
  *   S e n d i n g     H o s t     C o m m a n d s   *
  *****************************************************/
-
-void iwl_bg_watchdog(unsigned long data);
-u32 iwl_usecs_to_beacons(struct iwl_priv *priv, u32 usec, u32 beacon_interval);
-__le32 iwl_add_beacon_time(struct iwl_priv *priv, u32 base,
-                           u32 addon, u32 beacon_interval);
-
-extern void iwl_send_bt_config(struct iwl_priv *priv);
-extern int iwl_send_statistics_request(struct iwl_priv *priv,
-                                       u8 flags, bool clear);
-
-static inline const struct ieee80211_supported_band *iwl_get_hw_mode(
-                        struct iwl_priv *priv, enum ieee80211_band band)
-{
-        return priv->hw->wiphy->bands[band];
-}
-
-static inline bool iwl_advanced_bt_coexist(struct iwl_priv *priv)
-{
-        return cfg(priv)->bt_params &&
-               cfg(priv)->bt_params->advanced_bt_coexist;
-}
-
 extern bool bt_siso_mode;
 
 #endif /* __iwl_core_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 5f96ce105f08..59750543fce7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -430,6 +430,9 @@
 #define HBUS_TARG_PRPH_WDAT     (HBUS_BASE+0x04c)
 #define HBUS_TARG_PRPH_RDAT     (HBUS_BASE+0x050)
 
+/* Used to enable DBGM */
+#define HBUS_TARG_TEST_REG      (HBUS_BASE+0x05c)
+
 /*
  * Per-Tx-queue write pointer (index, really!)
  * Indicates index to next TFD that driver will fill (1 past latest filled).
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index d109d1bbb3a2..32834a797d11 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -416,7 +416,7 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                 return -ENODATA;
         }
 
-        ptr = priv->shrd->eeprom;
+        ptr = priv->eeprom;
         if (!ptr) {
                 IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
                 return -ENOMEM;
@@ -428,10 +428,10 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                 IWL_ERR(priv, "Can not allocate Buffer\n");
                 return -ENOMEM;
         }
-        eeprom_ver = iwl_eeprom_query16(priv->shrd, EEPROM_VERSION);
+        eeprom_ver = iwl_eeprom_query16(priv, EEPROM_VERSION);
         pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s, "
                         "version: 0x%x\n",
-                        (trans(priv)->nvm_device_type == NVM_DEVICE_TYPE_OTP)
+                        (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
                          ? "OTP" : "EEPROM", eeprom_ver);
         for (ofs = 0 ; ofs < eeprom_len ; ofs += 16) {
                 pos += scnprintf(buf + pos, buf_size - pos, "0x%.4x ", ofs);
@@ -526,8 +526,6 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
         int pos = 0;
         const size_t bufsz = sizeof(buf);
 
-        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
-                test_bit(STATUS_HCMD_ACTIVE, &priv->shrd->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_RF_KILL_HW:\t %d\n",
                 test_bit(STATUS_RF_KILL_HW, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_CT_KILL:\t\t %d\n",
@@ -577,7 +575,7 @@ static ssize_t iwl_dbgfs_rx_handlers_read(struct file *file,
                 if (priv->rx_handlers_stats[cnt] > 0)
                         pos += scnprintf(buf + pos, bufsz - pos,
                                 "\tRx handler[%36s]:\t\t %u\n",
-                                get_cmd_string(cnt),
+                                iwl_dvm_get_cmd_string(cnt),
                                 priv->rx_handlers_stats[cnt]);
         }
 
@@ -1541,17 +1539,17 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
         if (tx->tx_power.ant_a || tx->tx_power.ant_b || tx->tx_power.ant_c) {
                 pos += scnprintf(buf + pos, bufsz - pos,
                         "tx power: (1/2 dB step)\n");
-                if ((hw_params(priv).valid_tx_ant & ANT_A) &&
+                if ((priv->hw_params.valid_tx_ant & ANT_A) &&
                     tx->tx_power.ant_a)
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         fmt_hex, "antenna A:",
                                         tx->tx_power.ant_a);
-                if ((hw_params(priv).valid_tx_ant & ANT_B) &&
+                if ((priv->hw_params.valid_tx_ant & ANT_B) &&
                     tx->tx_power.ant_b)
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         fmt_hex, "antenna B:",
                                         tx->tx_power.ant_b);
-                if ((hw_params(priv).valid_tx_ant & ANT_C) &&
+                if ((priv->hw_params.valid_tx_ant & ANT_C) &&
                     tx->tx_power.ant_c)
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         fmt_hex, "antenna C:",
@@ -2267,59 +2265,39 @@ static ssize_t iwl_dbgfs_plcp_delta_write(struct file *file,
         return count;
 }
 
-static ssize_t iwl_dbgfs_force_reset_read(struct file *file,
-                                        char __user *user_buf,
-                                        size_t count, loff_t *ppos)
+static ssize_t iwl_dbgfs_rf_reset_read(struct file *file,
+                                       char __user *user_buf,
+                                       size_t count, loff_t *ppos)
 {
         struct iwl_priv *priv = file->private_data;
-        int i, pos = 0;
+        int pos = 0;
         char buf[300];
         const size_t bufsz = sizeof(buf);
-        struct iwl_force_reset *force_reset;
+        struct iwl_rf_reset *rf_reset = &priv->rf_reset;
+
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "RF reset statistics\n");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\tnumber of reset request: %d\n",
+                        rf_reset->reset_request_count);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\tnumber of reset request success: %d\n",
+                        rf_reset->reset_success_count);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\tnumber of reset request reject: %d\n",
+                        rf_reset->reset_reject_count);
 
-        for (i = 0; i < IWL_MAX_FORCE_RESET; i++) {
-                force_reset = &priv->force_reset[i];
-                pos += scnprintf(buf + pos, bufsz - pos,
-                                "Force reset method %d\n", i);
-                pos += scnprintf(buf + pos, bufsz - pos,
-                                "\tnumber of reset request: %d\n",
-                                force_reset->reset_request_count);
-                pos += scnprintf(buf + pos, bufsz - pos,
-                                "\tnumber of reset request success: %d\n",
-                                force_reset->reset_success_count);
-                pos += scnprintf(buf + pos, bufsz - pos,
-                                "\tnumber of reset request reject: %d\n",
-                                force_reset->reset_reject_count);
-                pos += scnprintf(buf + pos, bufsz - pos,
-                                "\treset duration: %lu\n",
-                                force_reset->reset_duration);
-        }
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
-static ssize_t iwl_dbgfs_force_reset_write(struct file *file,
+static ssize_t iwl_dbgfs_rf_reset_write(struct file *file,
                                         const char __user *user_buf,
                                         size_t count, loff_t *ppos) {
 
         struct iwl_priv *priv = file->private_data;
-        char buf[8];
-        int buf_size;
-        int reset, ret;
+        int ret;
 
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) -  1);
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-        if (sscanf(buf, "%d", &reset) != 1)
-                return -EINVAL;
-        switch (reset) {
-        case IWL_RF_RESET:
-        case IWL_FW_RESET:
-                ret = iwl_force_reset(priv, reset, true);
-                break;
-        default:
-                return -EINVAL;
-        }
+        ret = iwl_force_rf_reset(priv, true);
         return ret ? ret : count;
 }
 
@@ -2347,29 +2325,6 @@ static ssize_t iwl_dbgfs_txfifo_flush_write(struct file *file,
         return count;
 }
 
-static ssize_t iwl_dbgfs_wd_timeout_write(struct file *file,
-                                        const char __user *user_buf,
-                                        size_t count, loff_t *ppos)
-{
-        struct iwl_priv *priv = file->private_data;
-        char buf[8];
-        int buf_size;
-        int timeout;
-
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) -  1);
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-        if (sscanf(buf, "%d", &timeout) != 1)
-                return -EINVAL;
-        if (timeout < 0 || timeout > IWL_MAX_WD_TIMEOUT)
-                timeout = IWL_DEF_WD_TIMEOUT;
-
-        hw_params(priv).wd_timeout = timeout;
-        iwl_setup_watchdog(priv);
-        return count;
-}
-
 static ssize_t iwl_dbgfs_bt_traffic_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos) {
@@ -2428,7 +2383,7 @@ static ssize_t iwl_dbgfs_protection_mode_read(struct file *file,
         if (cfg(priv)->ht_params)
                 pos += scnprintf(buf + pos, bufsz - pos,
                          "use %s for aggregation\n",
-                         (hw_params(priv).use_rts_for_aggregation) ?
+                         (priv->hw_params.use_rts_for_aggregation) ?
                                 "rts/cts" : "cts-to-self");
         else
                 pos += scnprintf(buf + pos, bufsz - pos, "N/A");
@@ -2455,9 +2410,9 @@ static ssize_t iwl_dbgfs_protection_mode_write(struct file *file,
         if (sscanf(buf, "%d", &rts) != 1)
                 return -EINVAL;
         if (rts)
-                hw_params(priv).use_rts_for_aggregation = true;
+                priv->hw_params.use_rts_for_aggregation = true;
         else
-                hw_params(priv).use_rts_for_aggregation = false;
+                priv->hw_params.use_rts_for_aggregation = false;
         return count;
 }
 
@@ -2516,6 +2471,34 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
         return count;
 }
 
+static ssize_t iwl_dbgfs_calib_disabled_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[120];
+        int pos = 0;
+        const size_t bufsz = sizeof(buf);
+
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "Sensitivity calibrations %s\n",
+                         (priv->calib_disabled &
+                                        IWL_SENSITIVITY_CALIB_DISABLED) ?
+                         "DISABLED" : "ENABLED");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "Chain noise calibrations %s\n",
+                         (priv->calib_disabled &
+                                        IWL_CHAIN_NOISE_CALIB_DISABLED) ?
+                         "DISABLED" : "ENABLED");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "Tx power calibrations %s\n",
+                         (priv->calib_disabled &
+                                        IWL_TX_POWER_CALIB_DISABLED) ?
+                         "DISABLED" : "ENABLED");
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
 DEBUGFS_READ_FILE_OPS(rx_statistics);
 DEBUGFS_READ_FILE_OPS(tx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
@@ -2530,17 +2513,17 @@ DEBUGFS_WRITE_FILE_OPS(clear_traffic_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(ucode_tracing);
 DEBUGFS_READ_WRITE_FILE_OPS(missed_beacon);
 DEBUGFS_READ_WRITE_FILE_OPS(plcp_delta);
-DEBUGFS_READ_WRITE_FILE_OPS(force_reset);
+DEBUGFS_READ_WRITE_FILE_OPS(rf_reset);
 DEBUGFS_READ_FILE_OPS(rxon_flags);
 DEBUGFS_READ_FILE_OPS(rxon_filter_flags);
 DEBUGFS_WRITE_FILE_OPS(txfifo_flush);
 DEBUGFS_READ_FILE_OPS(ucode_bt_stats);
-DEBUGFS_WRITE_FILE_OPS(wd_timeout);
 DEBUGFS_READ_FILE_OPS(bt_traffic);
 DEBUGFS_READ_WRITE_FILE_OPS(protection_mode);
 DEBUGFS_READ_FILE_OPS(reply_tx_error);
 DEBUGFS_WRITE_FILE_OPS(echo_test);
 DEBUGFS_READ_WRITE_FILE_OPS(log_event);
+DEBUGFS_READ_FILE_OPS(calib_disabled);
 
 /*
  * Create the debugfs files and directories
@@ -2589,7 +2572,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(clear_traffic_statistics, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(missed_beacon, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(plcp_delta, dir_debug, S_IWUSR | S_IRUSR);
-        DEBUGFS_ADD_FILE(force_reset, dir_debug, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(rf_reset, dir_debug, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(ucode_rx_stats, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(ucode_tx_stats, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(ucode_general_stats, dir_debug, S_IRUSR);
@@ -2602,17 +2585,14 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(reply_tx_error, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(rxon_flags, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(rxon_filter_flags, dir_debug, S_IWUSR);
-        DEBUGFS_ADD_FILE(wd_timeout, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(echo_test, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(log_event, dir_debug, S_IWUSR | S_IRUSR);
 
         if (iwl_advanced_bt_coexist(priv))
                 DEBUGFS_ADD_FILE(bt_traffic, dir_debug, S_IRUSR);
 
-        DEBUGFS_ADD_BOOL(disable_sensitivity, dir_rf,
-                         &priv->disable_sens_cal);
-        DEBUGFS_ADD_BOOL(disable_chain_noise, dir_rf,
-                         &priv->disable_chain_noise_cal);
+        /* Calibrations disabled/enabled status*/
+        DEBUGFS_ADD_FILE(calib_disabled, dir_rf, S_IRUSR);
 
         if (iwl_trans_dbgfs_register(trans(priv), dir_debug))
                 goto err;
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 99be58940e27..c235a1ea71b4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -51,8 +51,6 @@
 #include "iwl-op-mode.h"
 #include "iwl-notif-wait.h"
 
-struct iwl_tx_queue;
-
 /* CT-KILL constants */
 #define CT_KILL_THRESHOLD_LEGACY   110 /* in Celsius */
 #define CT_KILL_THRESHOLD          114 /* in Celsius */
@@ -582,9 +580,9 @@ struct iwl_event_log {
 #define IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE      (0)
 
 #define IWL_DELAY_NEXT_FORCE_RF_RESET  (HZ*3)
-#define IWL_DELAY_NEXT_FORCE_FW_RELOAD (HZ*5)
 
 /* TX queue watchdog timeouts in mSecs */
+#define IWL_WATCHHDOG_DISABLED  (0)
 #define IWL_DEF_WD_TIMEOUT      (2000)
 #define IWL_LONG_WD_TIMEOUT     (10000)
 #define IWL_MAX_WD_TIMEOUT      (120000)
@@ -597,18 +595,11 @@ struct iwl_event_log {
 #define IWL_MAX_CONTINUE_RELOAD_CNT     4
 
 
-enum iwl_reset {
-        IWL_RF_RESET = 0,
-        IWL_FW_RESET,
-        IWL_MAX_FORCE_RESET,
-};
-
-struct iwl_force_reset {
+struct iwl_rf_reset {
         int reset_request_count;
         int reset_success_count;
         int reset_reject_count;
-        unsigned long reset_duration;
-        unsigned long last_force_reset_jiffies;
+        unsigned long last_reset_jiffies;
 };
 
 /* extend beacon time format bit shifting  */
@@ -680,6 +671,52 @@ enum iwl_scan_type {
         IWL_SCAN_ROC,
 };
 
+/**
+ * struct iwl_hw_params
+ *
+ * Holds the module parameters
+ *
+ * @tx_chains_num: Number of TX chains
+ * @rx_chains_num: Number of RX chains
+ * @valid_tx_ant: usable antennas for TX
+ * @valid_rx_ant: usable antennas for RX
+ * @ht40_channel: is 40MHz width possible: BIT(IEEE80211_BAND_XXX)
+ * @sku: sku read from EEPROM
+ * @ct_kill_threshold: temperature threshold - in hw dependent unit
+ * @ct_kill_exit_threshold: when to reeable the device - in hw dependent unit
+ *      relevant for 1000, 6000 and up
+ * @struct iwl_sensitivity_ranges: range of sensitivity values
+ * @use_rts_for_aggregation: use rts/cts protection for HT traffic
+ */
+struct iwl_hw_params {
+        u8  tx_chains_num;
+        u8  rx_chains_num;
+        u8  valid_tx_ant;
+        u8  valid_rx_ant;
+        u8  ht40_channel;
+        bool use_rts_for_aggregation;
+        u16 sku;
+        u32 ct_kill_threshold;
+        u32 ct_kill_exit_threshold;
+
+        const struct iwl_sensitivity_ranges *sens;
+};
+
+struct iwl_lib_ops {
+        /* set hw dependent parameters */
+        void (*set_hw_params)(struct iwl_priv *priv);
+        int (*set_channel_switch)(struct iwl_priv *priv,
+                                  struct ieee80211_channel_switch *ch_switch);
+        /* device specific configuration */
+        void (*nic_config)(struct iwl_priv *priv);
+
+        /* eeprom operations (as defined in iwl-eeprom.h) */
+        struct iwl_eeprom_ops eeprom_ops;
+
+        /* temperature */
+        void (*temperature)(struct iwl_priv *priv);
+};
+
 #ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
 struct iwl_testmode_trace {
         u32 buff_size;
@@ -704,6 +741,14 @@ struct iwl_wipan_noa_data {
         u8 data[];
 };
 
+/* Calibration disabling bit mask */
+#define IWL_SENSITIVITY_CALIB_DISABLED  BIT(1)
+#define IWL_CHAIN_NOISE_CALIB_DISABLED  BIT(2)
+#define IWL_TX_POWER_CALIB_DISABLED     BIT(3)
+
+#define IWL_CALIB_ENABLE_ALL    0
+#define IWL_CALIB_DISABLE_ALL   0xFFFFFFFF
+
 #define IWL_OP_MODE_GET_DVM(_iwl_op_mode) \
         ((struct iwl_priv *) ((_iwl_op_mode)->op_mode_specific))
 
@@ -716,6 +761,7 @@ struct iwl_priv {
         /*data shared among all the driver's layers */
         struct iwl_shared *shrd;
         const struct iwl_fw *fw;
+        const struct iwl_lib_ops *lib;
         unsigned long status;
 
         spinlock_t sta_lock;
@@ -738,6 +784,8 @@ struct iwl_priv {
 
         struct workqueue_struct *workqueue;
 
+        struct iwl_hw_params hw_params;
+
         enum ieee80211_band band;
         u8 valid_contexts;
 
@@ -772,8 +820,8 @@ struct iwl_priv {
         /*counters */
         u32 rx_handlers_stats[REPLY_MAX];
 
-        /* force reset */
-        struct iwl_force_reset force_reset[IWL_MAX_FORCE_RESET];
+        /* rf reset */
+        struct iwl_rf_reset rf_reset;
 
         /* firmware reload counter and timestamp */
         unsigned long reload_jiffies;
@@ -819,8 +867,6 @@ struct iwl_priv {
 
         __le16 switch_channel;
 
-        u16 active_rate;
-
         u8 start_calib;
         struct iwl_sensitivity_data sensitivity_data;
         struct iwl_chain_noise_data chain_noise_data;
@@ -967,13 +1013,15 @@ struct iwl_priv {
         void *wowlan_sram;
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 
+        /* eeprom -- this is in the card's little endian byte order */
+        u8 *eeprom;
+        enum iwl_nvm_type nvm_device_type;
+
         struct work_struct txpower_work;
-        u32 disable_sens_cal;
-        u32 disable_chain_noise_cal;
+        u32 calib_disabled;
         struct work_struct run_time_calib_work;
         struct timer_list statistics_periodic;
         struct timer_list ucode_trace;
-        struct timer_list watchdog;
 
         struct iwl_event_log event_log;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 6f312c77af5e..17485e715424 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -284,6 +284,7 @@ static int iwl_store_ucode_sec(struct iwl_firmware_pieces *pieces,
 
         sec->offset = le32_to_cpu(sec_parse->offset);
         sec->data = sec_parse->data;
+        sec->size = size - sizeof(sec_parse->offset);
 
         ++img->sec_counter;
 
@@ -414,9 +415,6 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
         struct iwl_ucode_tlv *tlv;
         size_t len = ucode_raw->size;
         const u8 *data;
-        int wanted_alternative = iwlagn_mod_params.wanted_ucode_alternative;
-        int tmp;
-        u64 alternatives;
         u32 tlv_len;
         enum iwl_ucode_tlv_type tlv_type;
         const u8 *tlv_data;
@@ -434,23 +432,6 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                 return -EINVAL;
         }
 
-        /*
-         * Check which alternatives are present, and "downgrade"
-         * when the chosen alternative is not present, warning
-         * the user when that happens. Some files may not have
-         * any alternatives, so don't warn in that case.
-         */
-        alternatives = le64_to_cpu(ucode->alternatives);
-        tmp = wanted_alternative;
-        if (wanted_alternative > 63)
-                wanted_alternative = 63;
-        while (wanted_alternative && !(alternatives & BIT(wanted_alternative)))
-                wanted_alternative--;
-        if (wanted_alternative && wanted_alternative != tmp)
-                IWL_WARN(drv,
-                         "uCode alternative %d not available, choosing %d\n",
-                         tmp, wanted_alternative);
-
         drv->fw.ucode_ver = le32_to_cpu(ucode->ver);
         build = le32_to_cpu(ucode->build);
 
@@ -475,14 +456,11 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
         len -= sizeof(*ucode);
 
         while (len >= sizeof(*tlv)) {
-                u16 tlv_alt;
-
                 len -= sizeof(*tlv);
                 tlv = (void *)data;
 
                 tlv_len = le32_to_cpu(tlv->length);
-                tlv_type = le16_to_cpu(tlv->type);
-                tlv_alt = le16_to_cpu(tlv->alternative);
+                tlv_type = le32_to_cpu(tlv->type);
                 tlv_data = tlv->data;
 
                 if (len < tlv_len) {
@@ -493,14 +471,6 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                 len -= ALIGN(tlv_len, 4);
                 data += sizeof(*tlv) + ALIGN(tlv_len, 4);
 
-                /*
-                 * Alternative 0 is always valid.
-                 *
-                 * Skip alternative TLVs that are not selected.
-                 */
-                if (tlv_alt != 0 && tlv_alt != wanted_alternative)
-                        continue;
-
                 switch (tlv_type) {
                 case IWL_UCODE_TLV_INST:
                         set_sec_data(pieces, IWL_UCODE_REGULAR,
@@ -838,42 +808,6 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         IWL_INFO(drv, "loaded firmware version %s", drv->fw.fw_version);
 
         /*
-         * For any of the failures below (before allocating pci memory)
-         * we will try to load a version with a smaller API -- maybe the
-         * user just got a corrupted version of the latest API.
-         */
-
-        IWL_DEBUG_INFO(drv, "f/w package hdr ucode version raw = 0x%x\n",
-                       drv->fw.ucode_ver);
-        IWL_DEBUG_INFO(drv, "f/w package hdr runtime inst size = %Zd\n",
-                get_sec_size(&pieces, IWL_UCODE_REGULAR,
-                             IWL_UCODE_SECTION_INST));
-        IWL_DEBUG_INFO(drv, "f/w package hdr runtime data size = %Zd\n",
-                get_sec_size(&pieces, IWL_UCODE_REGULAR,
-                             IWL_UCODE_SECTION_DATA));
-        IWL_DEBUG_INFO(drv, "f/w package hdr init inst size = %Zd\n",
-                get_sec_size(&pieces, IWL_UCODE_INIT, IWL_UCODE_SECTION_INST));
-        IWL_DEBUG_INFO(drv, "f/w package hdr init data size = %Zd\n",
-                get_sec_size(&pieces, IWL_UCODE_INIT, IWL_UCODE_SECTION_DATA));
-
-        /* Verify that uCode images will fit in card's SRAM */
-        if (get_sec_size(&pieces, IWL_UCODE_REGULAR, IWL_UCODE_SECTION_INST) >
-                                                        cfg->max_inst_size) {
-                IWL_ERR(drv, "uCode instr len %Zd too large to fit in\n",
-                        get_sec_size(&pieces, IWL_UCODE_REGULAR,
-                                     IWL_UCODE_SECTION_INST));
-                goto try_again;
-        }
-
-        if (get_sec_size(&pieces, IWL_UCODE_REGULAR, IWL_UCODE_SECTION_DATA) >
-                                                        cfg->max_data_size) {
-                IWL_ERR(drv, "uCode data len %Zd too large to fit in\n",
-                        get_sec_size(&pieces, IWL_UCODE_REGULAR,
-                                     IWL_UCODE_SECTION_DATA));
-                goto try_again;
-        }
-
-        /*
          * In mvm uCode there is no difference between data and instructions
          * sections.
          */
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 23cea42b9495..a004431d1a60 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -187,33 +187,33 @@ static void iwl_eeprom_release_semaphore(struct iwl_trans *trans)
 
 }
 
-static int iwl_eeprom_verify_signature(struct iwl_trans *trans)
+static int iwl_eeprom_verify_signature(struct iwl_priv *priv)
 {
-        u32 gp = iwl_read32(trans, CSR_EEPROM_GP) &
+        u32 gp = iwl_read32(trans(priv), CSR_EEPROM_GP) &
                            CSR_EEPROM_GP_VALID_MSK;
         int ret = 0;
 
-        IWL_DEBUG_EEPROM(trans, "EEPROM signature=0x%08x\n", gp);
+        IWL_DEBUG_EEPROM(priv, "EEPROM signature=0x%08x\n", gp);
         switch (gp) {
         case CSR_EEPROM_GP_BAD_SIG_EEP_GOOD_SIG_OTP:
-                if (trans->nvm_device_type != NVM_DEVICE_TYPE_OTP) {
-                        IWL_ERR(trans, "EEPROM with bad signature: 0x%08x\n",
+                if (priv->nvm_device_type != NVM_DEVICE_TYPE_OTP) {
+                        IWL_ERR(priv, "EEPROM with bad signature: 0x%08x\n",
                                 gp);
                         ret = -ENOENT;
                 }
                 break;
         case CSR_EEPROM_GP_GOOD_SIG_EEP_LESS_THAN_4K:
         case CSR_EEPROM_GP_GOOD_SIG_EEP_MORE_THAN_4K:
-                if (trans->nvm_device_type != NVM_DEVICE_TYPE_EEPROM) {
-                        IWL_ERR(trans, "OTP with bad signature: 0x%08x\n", gp);
+                if (priv->nvm_device_type != NVM_DEVICE_TYPE_EEPROM) {
+                        IWL_ERR(priv, "OTP with bad signature: 0x%08x\n", gp);
                         ret = -ENOENT;
                 }
                 break;
         case CSR_EEPROM_GP_BAD_SIGNATURE_BOTH_EEP_AND_OTP:
         default:
-                IWL_ERR(trans, "bad EEPROM/OTP signature, type=%s, "
+                IWL_ERR(priv, "bad EEPROM/OTP signature, type=%s, "
                         "EEPROM_GP=0x%08x\n",
-                        (trans->nvm_device_type == NVM_DEVICE_TYPE_OTP)
+                        (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
                         ? "OTP" : "EEPROM", gp);
                 ret = -ENOENT;
                 break;
@@ -221,11 +221,11 @@ static int iwl_eeprom_verify_signature(struct iwl_trans *trans)
         return ret;
 }
 
-u16 iwl_eeprom_query16(const struct iwl_shared *shrd, size_t offset)
+u16 iwl_eeprom_query16(struct iwl_priv *priv, size_t offset)
 {
-        if (!shrd->eeprom)
+        if (!priv->eeprom)
                 return 0;
-        return (u16)shrd->eeprom[offset] | ((u16)shrd->eeprom[offset + 1] << 8);
+        return (u16)priv->eeprom[offset] | ((u16)priv->eeprom[offset + 1] << 8);
 }
 
 int iwl_eeprom_check_version(struct iwl_priv *priv)
@@ -233,8 +233,8 @@ int iwl_eeprom_check_version(struct iwl_priv *priv)
         u16 eeprom_ver;
         u16 calib_ver;
 
-        eeprom_ver = iwl_eeprom_query16(priv->shrd, EEPROM_VERSION);
-        calib_ver = iwl_eeprom_calib_version(priv->shrd);
+        eeprom_ver = iwl_eeprom_query16(priv, EEPROM_VERSION);
+        calib_ver = iwl_eeprom_calib_version(priv);
 
         if (eeprom_ver < cfg(priv)->eeprom_ver ||
             calib_ver < cfg(priv)->eeprom_calib_ver)
@@ -255,50 +255,107 @@ err:
 
 int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
 {
-        struct iwl_shared *shrd = priv->shrd;
         u16 radio_cfg;
 
-        hw_params(priv).sku = iwl_eeprom_query16(shrd, EEPROM_SKU_CAP);
-        if (hw_params(priv).sku & EEPROM_SKU_CAP_11N_ENABLE &&
+        priv->hw_params.sku = iwl_eeprom_query16(priv, EEPROM_SKU_CAP);
+        if (priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE &&
             !cfg(priv)->ht_params) {
                 IWL_ERR(priv, "Invalid 11n configuration\n");
                 return -EINVAL;
         }
 
-        if (!hw_params(priv).sku) {
+        if (!priv->hw_params.sku) {
                 IWL_ERR(priv, "Invalid device sku\n");
                 return -EINVAL;
         }
 
-        IWL_INFO(priv, "Device SKU: 0x%X\n", hw_params(priv).sku);
+        IWL_INFO(priv, "Device SKU: 0x%X\n", priv->hw_params.sku);
 
-        radio_cfg = iwl_eeprom_query16(shrd, EEPROM_RADIO_CONFIG);
+        radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
 
-        hw_params(priv).valid_tx_ant = EEPROM_RF_CFG_TX_ANT_MSK(radio_cfg);
-        hw_params(priv).valid_rx_ant = EEPROM_RF_CFG_RX_ANT_MSK(radio_cfg);
+        priv->hw_params.valid_tx_ant = EEPROM_RF_CFG_TX_ANT_MSK(radio_cfg);
+        priv->hw_params.valid_rx_ant = EEPROM_RF_CFG_RX_ANT_MSK(radio_cfg);
 
         /* check overrides (some devices have wrong EEPROM) */
         if (cfg(priv)->valid_tx_ant)
-                hw_params(priv).valid_tx_ant = cfg(priv)->valid_tx_ant;
+                priv->hw_params.valid_tx_ant = cfg(priv)->valid_tx_ant;
         if (cfg(priv)->valid_rx_ant)
-                hw_params(priv).valid_rx_ant = cfg(priv)->valid_rx_ant;
+                priv->hw_params.valid_rx_ant = cfg(priv)->valid_rx_ant;
 
-        if (!hw_params(priv).valid_tx_ant || !hw_params(priv).valid_rx_ant) {
+        if (!priv->hw_params.valid_tx_ant || !priv->hw_params.valid_rx_ant) {
                 IWL_ERR(priv, "Invalid chain (0x%X, 0x%X)\n",
-                        hw_params(priv).valid_tx_ant,
-                        hw_params(priv).valid_rx_ant);
+                        priv->hw_params.valid_tx_ant,
+                        priv->hw_params.valid_rx_ant);
                 return -EINVAL;
         }
 
         IWL_INFO(priv, "Valid Tx ant: 0x%X, Valid Rx ant: 0x%X\n",
-                 hw_params(priv).valid_tx_ant, hw_params(priv).valid_rx_ant);
+                 priv->hw_params.valid_tx_ant, priv->hw_params.valid_rx_ant);
 
         return 0;
 }
 
-void iwl_eeprom_get_mac(const struct iwl_shared *shrd, u8 *mac)
+u16 iwl_eeprom_calib_version(struct iwl_priv *priv)
 {
-        const u8 *addr = iwl_eeprom_query_addr(shrd,
+        struct iwl_eeprom_calib_hdr *hdr;
+
+        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv,
+                                                        EEPROM_CALIB_ALL);
+        return hdr->version;
+}
+
+static u32 eeprom_indirect_address(struct iwl_priv *priv, u32 address)
+{
+        u16 offset = 0;
+
+        if ((address & INDIRECT_ADDRESS) == 0)
+                return address;
+
+        switch (address & INDIRECT_TYPE_MSK) {
+        case INDIRECT_HOST:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_HOST);
+                break;
+        case INDIRECT_GENERAL:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_GENERAL);
+                break;
+        case INDIRECT_REGULATORY:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_REGULATORY);
+                break;
+        case INDIRECT_TXP_LIMIT:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_TXP_LIMIT);
+                break;
+        case INDIRECT_TXP_LIMIT_SIZE:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_TXP_LIMIT_SIZE);
+                break;
+        case INDIRECT_CALIBRATION:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_CALIBRATION);
+                break;
+        case INDIRECT_PROCESS_ADJST:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_PROCESS_ADJST);
+                break;
+        case INDIRECT_OTHERS:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_OTHERS);
+                break;
+        default:
+                IWL_ERR(priv, "illegal indirect type: 0x%X\n",
+                address & INDIRECT_TYPE_MSK);
+                break;
+        }
+
+        /* translate the offset from words to byte */
+        return (address & ADDRESS_MSK) + (offset << 1);
+}
+
+const u8 *iwl_eeprom_query_addr(struct iwl_priv *priv, size_t offset)
+{
+        u32 address = eeprom_indirect_address(priv, offset);
+        BUG_ON(address >= cfg(priv)->base_params->eeprom_size);
+        return &priv->eeprom[address];
+}
+
+void iwl_eeprom_get_mac(struct iwl_priv *priv, u8 *mac)
+{
+        const u8 *addr = iwl_eeprom_query_addr(priv,
                                         EEPROM_MAC_ADDRESS);
         memcpy(mac, addr, ETH_ALEN);
 }
@@ -591,7 +648,6 @@ iwl_eeprom_enh_txp_read_element(struct iwl_priv *priv,
 
 static void iwl_eeprom_enhanced_txpower(struct iwl_priv *priv)
 {
-        struct iwl_shared *shrd = priv->shrd;
         struct iwl_eeprom_enhanced_txpwr *txp_array, *txp;
         int idx, entries;
         __le16 *txp_len;
@@ -600,10 +656,10 @@ static void iwl_eeprom_enhanced_txpower(struct iwl_priv *priv)
         BUILD_BUG_ON(sizeof(struct iwl_eeprom_enhanced_txpwr) != 8);
 
         /* the length is in 16-bit words, but we want entries */
-        txp_len = (__le16 *) iwl_eeprom_query_addr(shrd, EEPROM_TXP_SZ_OFFS);
+        txp_len = (__le16 *) iwl_eeprom_query_addr(priv, EEPROM_TXP_SZ_OFFS);
         entries = le16_to_cpup(txp_len) * 2 / EEPROM_TXP_ENTRY_LEN;
 
-        txp_array = (void *) iwl_eeprom_query_addr(shrd, EEPROM_TXP_OFFS);
+        txp_array = (void *) iwl_eeprom_query_addr(priv, EEPROM_TXP_OFFS);
 
         for (idx = 0; idx < entries; idx++) {
                 txp = &txp_array[idx];
@@ -656,66 +712,66 @@ static void iwl_eeprom_enhanced_txpower(struct iwl_priv *priv)
 /**
  * iwl_eeprom_init - read EEPROM contents
  *
- * Load the EEPROM contents from adapter into shrd->eeprom
+ * Load the EEPROM contents from adapter into priv->eeprom
  *
  * NOTE:  This routine uses the non-debug IO access functions.
  */
-int iwl_eeprom_init(struct iwl_trans *trans, u32 hw_rev)
+int iwl_eeprom_init(struct iwl_priv *priv, u32 hw_rev)
 {
         __le16 *e;
-        u32 gp = iwl_read32(trans, CSR_EEPROM_GP);
+        u32 gp = iwl_read32(trans(priv), CSR_EEPROM_GP);
         int sz;
         int ret;
         u16 addr;
         u16 validblockaddr = 0;
         u16 cache_addr = 0;
 
-        trans->nvm_device_type = iwl_get_nvm_type(trans, hw_rev);
-        if (trans->nvm_device_type == -ENOENT)
+        priv->nvm_device_type = iwl_get_nvm_type(trans(priv), hw_rev);
+        if (priv->nvm_device_type == -ENOENT)
                 return -ENOENT;
         /* allocate eeprom */
-        sz = cfg(trans)->base_params->eeprom_size;
-        IWL_DEBUG_EEPROM(trans, "NVM size = %d\n", sz);
-        trans->shrd->eeprom = kzalloc(sz, GFP_KERNEL);
-        if (!trans->shrd->eeprom) {
+        sz = cfg(priv)->base_params->eeprom_size;
+        IWL_DEBUG_EEPROM(priv, "NVM size = %d\n", sz);
+        priv->eeprom = kzalloc(sz, GFP_KERNEL);
+        if (!priv->eeprom) {
                 ret = -ENOMEM;
                 goto alloc_err;
         }
-        e = (__le16 *)trans->shrd->eeprom;
+        e = (__le16 *)priv->eeprom;
 
-        ret = iwl_eeprom_verify_signature(trans);
+        ret = iwl_eeprom_verify_signature(priv);
         if (ret < 0) {
-                IWL_ERR(trans, "EEPROM not found, EEPROM_GP=0x%08x\n", gp);
+                IWL_ERR(priv, "EEPROM not found, EEPROM_GP=0x%08x\n", gp);
                 ret = -ENOENT;
                 goto err;
         }
 
         /* Make sure driver (instead of uCode) is allowed to read EEPROM */
-        ret = iwl_eeprom_acquire_semaphore(trans);
+        ret = iwl_eeprom_acquire_semaphore(trans(priv));
         if (ret < 0) {
-                IWL_ERR(trans, "Failed to acquire EEPROM semaphore.\n");
+                IWL_ERR(priv, "Failed to acquire EEPROM semaphore.\n");
                 ret = -ENOENT;
                 goto err;
         }
 
-        if (trans->nvm_device_type == NVM_DEVICE_TYPE_OTP) {
+        if (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP) {
 
-                ret = iwl_init_otp_access(trans);
+                ret = iwl_init_otp_access(trans(priv));
                 if (ret) {
-                        IWL_ERR(trans, "Failed to initialize OTP access.\n");
+                        IWL_ERR(priv, "Failed to initialize OTP access.\n");
                         ret = -ENOENT;
                         goto done;
                 }
-                iwl_write32(trans, CSR_EEPROM_GP,
-                            iwl_read32(trans, CSR_EEPROM_GP) &
+                iwl_write32(trans(priv), CSR_EEPROM_GP,
+                            iwl_read32(trans(priv), CSR_EEPROM_GP) &
                             ~CSR_EEPROM_GP_IF_OWNER_MSK);
 
-                iwl_set_bit(trans, CSR_OTP_GP_REG,
+                iwl_set_bit(trans(priv), CSR_OTP_GP_REG,
                              CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK |
                              CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK);
                 /* traversing the linked list if no shadow ram supported */
-                if (!cfg(trans)->base_params->shadow_ram_support) {
-                        if (iwl_find_otp_image(trans, &validblockaddr)) {
+                if (!cfg(priv)->base_params->shadow_ram_support) {
+                        if (iwl_find_otp_image(trans(priv), &validblockaddr)) {
                                 ret = -ENOENT;
                                 goto done;
                         }
@@ -724,7 +780,8 @@ int iwl_eeprom_init(struct iwl_trans *trans, u32 hw_rev)
                      addr += sizeof(u16)) {
                         __le16 eeprom_data;
 
-                        ret = iwl_read_otp_word(trans, addr, &eeprom_data);
+                        ret = iwl_read_otp_word(trans(priv), addr,
+                                                &eeprom_data);
                         if (ret)
                                 goto done;
                         e[cache_addr / 2] = eeprom_data;
@@ -735,94 +792,93 @@ int iwl_eeprom_init(struct iwl_trans *trans, u32 hw_rev)
                 for (addr = 0; addr < sz; addr += sizeof(u16)) {
                         u32 r;
 
-                        iwl_write32(trans, CSR_EEPROM_REG,
+                        iwl_write32(trans(priv), CSR_EEPROM_REG,
                                     CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
 
-                        ret = iwl_poll_bit(trans, CSR_EEPROM_REG,
+                        ret = iwl_poll_bit(trans(priv), CSR_EEPROM_REG,
                                                   CSR_EEPROM_REG_READ_VALID_MSK,
                                                   CSR_EEPROM_REG_READ_VALID_MSK,
                                                   IWL_EEPROM_ACCESS_TIMEOUT);
                         if (ret < 0) {
-                                IWL_ERR(trans,
+                                IWL_ERR(priv,
                                         "Time out reading EEPROM[%d]\n", addr);
                                 goto done;
                         }
-                        r = iwl_read32(trans, CSR_EEPROM_REG);
+                        r = iwl_read32(trans(priv), CSR_EEPROM_REG);
                         e[addr / 2] = cpu_to_le16(r >> 16);
                 }
         }
 
-        IWL_DEBUG_EEPROM(trans, "NVM Type: %s, version: 0x%x\n",
-                       (trans->nvm_device_type == NVM_DEVICE_TYPE_OTP)
+        IWL_DEBUG_EEPROM(priv, "NVM Type: %s, version: 0x%x\n",
+                       (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
                        ? "OTP" : "EEPROM",
-                       iwl_eeprom_query16(trans->shrd, EEPROM_VERSION));
+                       iwl_eeprom_query16(priv, EEPROM_VERSION));
 
         ret = 0;
 done:
-        iwl_eeprom_release_semaphore(trans);
+        iwl_eeprom_release_semaphore(trans(priv));
 
 err:
         if (ret)
-                iwl_eeprom_free(trans->shrd);
+                iwl_eeprom_free(priv);
 alloc_err:
         return ret;
 }
 
-void iwl_eeprom_free(struct iwl_shared *shrd)
+void iwl_eeprom_free(struct iwl_priv *priv)
 {
-        kfree(shrd->eeprom);
-        shrd->eeprom = NULL;
+        kfree(priv->eeprom);
+        priv->eeprom = NULL;
 }
 
-static void iwl_init_band_reference(const struct iwl_priv *priv,
+static void iwl_init_band_reference(struct iwl_priv *priv,
                         int eep_band, int *eeprom_ch_count,
                         const struct iwl_eeprom_channel **eeprom_ch_info,
                         const u8 **eeprom_ch_index)
 {
-        struct iwl_shared *shrd = priv->shrd;
-        u32 offset = cfg(priv)->lib->
+        u32 offset = priv->lib->
                         eeprom_ops.regulatory_bands[eep_band - 1];
         switch (eep_band) {
         case 1:         /* 2.4GHz band */
                 *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_1);
                 *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(shrd, offset);
+                                iwl_eeprom_query_addr(priv, offset);
                 *eeprom_ch_index = iwl_eeprom_band_1;
                 break;
         case 2:         /* 4.9GHz band */
                 *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_2);
                 *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(shrd, offset);
+                                iwl_eeprom_query_addr(priv, offset);
                 *eeprom_ch_index = iwl_eeprom_band_2;
                 break;
         case 3:         /* 5.2GHz band */
                 *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_3);
                 *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(shrd, offset);
+                                iwl_eeprom_query_addr(priv, offset);
                 *eeprom_ch_index = iwl_eeprom_band_3;
                 break;
         case 4:         /* 5.5GHz band */
                 *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_4);
                 *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(shrd, offset);
+                                iwl_eeprom_query_addr(priv, offset);
                 *eeprom_ch_index = iwl_eeprom_band_4;
                 break;
         case 5:         /* 5.7GHz band */
                 *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_5);
                 *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(shrd, offset);
+                                iwl_eeprom_query_addr(priv, offset);
                 *eeprom_ch_index = iwl_eeprom_band_5;
                 break;
         case 6:         /* 2.4GHz ht40 channels */
                 *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_6);
                 *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(shrd, offset);
+                                iwl_eeprom_query_addr(priv, offset);
                 *eeprom_ch_index = iwl_eeprom_band_6;
                 break;
         case 7:         /* 5 GHz ht40 channels */
                 *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_7);
                 *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(shrd, offset);
+                                iwl_eeprom_query_addr(priv, offset);
                 *eeprom_ch_index = iwl_eeprom_band_7;
                 break;
         default:
@@ -987,9 +1043,9 @@ int iwl_init_channel_map(struct iwl_priv *priv)
         }
 
         /* Check if we do have HT40 channels */
-        if (cfg(priv)->lib->eeprom_ops.regulatory_bands[5] ==
+        if (priv->lib->eeprom_ops.regulatory_bands[5] ==
             EEPROM_REGULATORY_BAND_NO_HT40 &&
-            cfg(priv)->lib->eeprom_ops.regulatory_bands[6] ==
+            priv->lib->eeprom_ops.regulatory_bands[6] ==
             EEPROM_REGULATORY_BAND_NO_HT40)
                 return 0;
 
@@ -1025,7 +1081,7 @@ int iwl_init_channel_map(struct iwl_priv *priv)
          * driver need to process addition information
          * to determine the max channel tx power limits
          */
-        if (cfg(priv)->lib->eeprom_ops.enhanced_txpower)
+        if (priv->lib->eeprom_ops.enhanced_txpower)
                 iwl_eeprom_enhanced_txpower(priv);
 
         return 0;
@@ -1072,7 +1128,7 @@ void iwl_rf_config(struct iwl_priv *priv)
 {
         u16 radio_cfg;
 
-        radio_cfg = iwl_eeprom_query16(priv->shrd, EEPROM_RADIO_CONFIG);
+        radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
 
         /* write radio config values to register */
         if (EEPROM_RF_CFG_TYPE_MSK(radio_cfg) <= EEPROM_RF_CONFIG_TYPE_MAX) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index e4a758340996..b3a3b1f0fdc4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -66,8 +66,6 @@
 #include <net/mac80211.h>
 
 struct iwl_priv;
-struct iwl_shared;
-struct iwl_trans;
 
 /*
  * EEPROM access time values:
@@ -306,12 +304,14 @@ struct iwl_eeprom_ops {
 };
 
 
-int iwl_eeprom_init(struct iwl_trans *trans, u32 hw_rev);
-void iwl_eeprom_free(struct iwl_shared *shrd);
-int  iwl_eeprom_check_version(struct iwl_priv *priv);
+int iwl_eeprom_init(struct iwl_priv *priv, u32 hw_rev);
+void iwl_eeprom_free(struct iwl_priv *priv);
+int iwl_eeprom_check_version(struct iwl_priv *priv);
 int iwl_eeprom_init_hw_params(struct iwl_priv *priv);
-const u8 *iwl_eeprom_query_addr(const struct iwl_shared *shrd, size_t offset);
-u16 iwl_eeprom_query16(const struct iwl_shared *shrd, size_t offset);
+u16 iwl_eeprom_calib_version(struct iwl_priv *priv);
+const u8 *iwl_eeprom_query_addr(struct iwl_priv *priv, size_t offset);
+u16 iwl_eeprom_query16(struct iwl_priv *priv, size_t offset);
+void iwl_eeprom_get_mac(struct iwl_priv *priv, u8 *mac);
 int iwl_init_channel_map(struct iwl_priv *priv);
 void iwl_free_channel_map(struct iwl_priv *priv);
 const struct iwl_channel_info *iwl_get_channel_info(
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index c924ccb93c8c..e71564053e7f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -93,15 +93,7 @@ struct iwl_ucode_header {
  * new TLV uCode file layout
  *
  * The new TLV file format contains TLVs, that each specify
- * some piece of data. To facilitate "groups", for example
- * different instruction image with different capabilities,
- * bundled with the same init image, an alternative mechanism
- * is provided:
- * When the alternative field is 0, that means that the item
- * is always valid. When it is non-zero, then it is only
- * valid in conjunction with items of the same alternative,
- * in which case the driver (user) selects one alternative
- * to use.
+ * some piece of data.
  */
 
 enum iwl_ucode_tlv_type {
@@ -132,8 +124,7 @@ enum iwl_ucode_tlv_type {
 };
 
 struct iwl_ucode_tlv {
-        __le16 type;            /* see above */
-        __le16 alternative;     /* see comment */
+        __le32 type;            /* see above */
         __le32 length;          /* not including type/length fields */
         u8 data[0];
 };
@@ -152,7 +143,7 @@ struct iwl_tlv_ucode_header {
         u8 human_readable[64];
         __le32 ver;             /* major/minor/API/serial */
         __le32 build;
-        __le64 alternatives;    /* bitmask of valid alternatives */
+        __le64 ignore;
         /*
          * The data contained herein has a TLV layout,
          * see above for the TLV header and types.
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index f1c675a2a6f3..3f82ff4f3afe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -160,7 +160,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
                      IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
                      IEEE80211_HW_SCAN_WHILE_IDLE;
 
-        if (hw_params(priv).sku & EEPROM_SKU_CAP_11N_ENABLE)
+        if (priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE)
                 hw->flags |= IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
                              IEEE80211_HW_SUPPORTS_STATIC_SMPS;
 
@@ -333,7 +333,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw)
         return 0;
 }
 
-static void iwlagn_mac_stop(struct ieee80211_hw *hw)
+void iwlagn_mac_stop(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -361,9 +361,9 @@ static void iwlagn_mac_stop(struct ieee80211_hw *hw)
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-static void iwlagn_mac_set_rekey_data(struct ieee80211_hw *hw,
-                                      struct ieee80211_vif *vif,
-                                      struct cfg80211_gtk_rekey_data *data)
+void iwlagn_mac_set_rekey_data(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct cfg80211_gtk_rekey_data *data)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -389,8 +389,7 @@ static void iwlagn_mac_set_rekey_data(struct ieee80211_hw *hw,
 
 #ifdef CONFIG_PM_SLEEP
 
-static int iwlagn_mac_suspend(struct ieee80211_hw *hw,
-                              struct cfg80211_wowlan *wowlan)
+int iwlagn_mac_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
@@ -499,7 +498,7 @@ static int iwlagn_mac_resume(struct ieee80211_hw *hw)
 
 #endif
 
-static void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -510,21 +509,21 @@ static void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 dev_kfree_skb_any(skb);
 }
 
-static void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
-                                       struct ieee80211_vif *vif,
-                                       struct ieee80211_key_conf *keyconf,
-                                       struct ieee80211_sta *sta,
-                                       u32 iv32, u16 *phase1key)
+void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_key_conf *keyconf,
+                                struct ieee80211_sta *sta,
+                                u32 iv32, u16 *phase1key)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
         iwl_update_tkip_key(priv, vif, keyconf, sta, iv32, phase1key);
 }
 
-static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                              struct ieee80211_vif *vif,
-                              struct ieee80211_sta *sta,
-                              struct ieee80211_key_conf *key)
+int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta,
+                       struct ieee80211_key_conf *key)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
@@ -624,11 +623,11 @@ static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         return ret;
 }
 
-static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
-                                   struct ieee80211_vif *vif,
-                                   enum ieee80211_ampdu_mlme_action action,
-                                   struct ieee80211_sta *sta, u16 tid, u16 *ssn,
-                                   u8 buf_size)
+int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif,
+                            enum ieee80211_ampdu_mlme_action action,
+                            struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                            u8 buf_size)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         int ret = -EINVAL;
@@ -637,7 +636,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
         IWL_DEBUG_HT(priv, "A-MPDU action on addr %pM tid %d\n",
                      sta->addr, tid);
 
-        if (!(hw_params(priv).sku & EEPROM_SKU_CAP_11N_ENABLE))
+        if (!(priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE))
                 return -EACCES;
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
@@ -671,7 +670,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
                                      priv->agg_tids_count);
                 }
                 if (!priv->agg_tids_count &&
-                    hw_params(priv).use_rts_for_aggregation) {
+                    priv->hw_params.use_rts_for_aggregation) {
                         /*
                          * switch off RTS/CTS if it was previously enabled
                          */
@@ -750,11 +749,11 @@ static int iwlagn_mac_sta_remove(struct ieee80211_hw *hw,
         return ret;
 }
 
-static int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
-                                struct ieee80211_vif *vif,
-                                struct ieee80211_sta *sta,
-                                enum ieee80211_sta_state old_state,
-                                enum ieee80211_sta_state new_state)
+int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
+                         struct ieee80211_vif *vif,
+                         struct ieee80211_sta *sta,
+                         enum ieee80211_sta_state old_state,
+                         enum ieee80211_sta_state new_state)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
@@ -833,8 +832,8 @@ static int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
         return ret;
 }
 
-static void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
-                                struct ieee80211_channel_switch *ch_switch)
+void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+                               struct ieee80211_channel_switch *ch_switch)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         const struct iwl_channel_info *ch_info;
@@ -867,7 +866,7 @@ static void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
         if (!iwl_is_associated_ctx(ctx))
                 goto out;
 
-        if (!cfg(priv)->lib->set_channel_switch)
+        if (!priv->lib->set_channel_switch)
                 goto out;
 
         ch = channel->hw_value;
@@ -903,7 +902,7 @@ static void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
          */
         set_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status);
         priv->switch_channel = cpu_to_le16(ch);
-        if (cfg(priv)->lib->set_channel_switch(priv, ch_switch)) {
+        if (priv->lib->set_channel_switch(priv, ch_switch)) {
                 clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status);
                 priv->switch_channel = 0;
                 ieee80211_chswitch_done(ctx->vif, false);
@@ -914,10 +913,25 @@ out:
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-static void iwlagn_configure_filter(struct ieee80211_hw *hw,
-                                    unsigned int changed_flags,
-                                    unsigned int *total_flags,
-                                    u64 multicast)
+void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
+{
+        /*
+         * MULTI-FIXME
+         * See iwlagn_mac_channel_switch.
+         */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+                ieee80211_chswitch_done(ctx->vif, is_success);
+}
+
+void iwlagn_configure_filter(struct ieee80211_hw *hw,
+                             unsigned int changed_flags,
+                             unsigned int *total_flags,
+                             u64 multicast)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         __le32 filter_or = 0, filter_nand = 0;
@@ -964,7 +978,7 @@ static void iwlagn_configure_filter(struct ieee80211_hw *hw,
                         FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
 }
 
-static void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop)
+void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1091,7 +1105,7 @@ static int iwlagn_mac_remain_on_channel(struct ieee80211_hw *hw,
         return err;
 }
 
-static int iwlagn_mac_cancel_remain_on_channel(struct ieee80211_hw *hw)
+int iwlagn_mac_cancel_remain_on_channel(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1108,8 +1122,8 @@ static int iwlagn_mac_cancel_remain_on_channel(struct ieee80211_hw *hw)
         return 0;
 }
 
-static void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
-                           enum ieee80211_rssi_event rssi_event)
+void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
+                              enum ieee80211_rssi_event rssi_event)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1133,8 +1147,8 @@ static void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-static int iwlagn_mac_set_tim(struct ieee80211_hw *hw,
-                           struct ieee80211_sta *sta, bool set)
+int iwlagn_mac_set_tim(struct ieee80211_hw *hw,
+                       struct ieee80211_sta *sta, bool set)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1143,9 +1157,9 @@ static int iwlagn_mac_set_tim(struct ieee80211_hw *hw,
         return 0;
 }
 
-static int iwlagn_mac_conf_tx(struct ieee80211_hw *hw,
-                    struct ieee80211_vif *vif, u16 queue,
-                    const struct ieee80211_tx_queue_params *params)
+int iwlagn_mac_conf_tx(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif, u16 queue,
+                       const struct ieee80211_tx_queue_params *params)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
@@ -1187,7 +1201,7 @@ static int iwlagn_mac_conf_tx(struct ieee80211_hw *hw,
         return 0;
 }
 
-static int iwlagn_mac_tx_last_beacon(struct ieee80211_hw *hw)
+int iwlagn_mac_tx_last_beacon(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1203,8 +1217,7 @@ static int iwl_set_mode(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         return iwlagn_commit_rxon(priv, ctx);
 }
 
-static int iwl_setup_interface(struct iwl_priv *priv,
-                               struct iwl_rxon_context *ctx)
+int iwl_setup_interface(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         struct ieee80211_vif *vif = ctx->vif;
         int err;
@@ -1307,9 +1320,9 @@ static int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
         return err;
 }
 
-static void iwl_teardown_interface(struct iwl_priv *priv,
-                                   struct ieee80211_vif *vif,
-                                   bool mode_change)
+void iwl_teardown_interface(struct iwl_priv *priv,
+                            struct ieee80211_vif *vif,
+                            bool mode_change)
 {
         struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
 
@@ -1450,9 +1463,9 @@ static int iwlagn_mac_change_interface(struct ieee80211_hw *hw,
         return err;
 }
 
-static int iwlagn_mac_hw_scan(struct ieee80211_hw *hw,
-                    struct ieee80211_vif *vif,
-                    struct cfg80211_scan_request *req)
+int iwlagn_mac_hw_scan(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif,
+                       struct cfg80211_scan_request *req)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         int ret;
@@ -1507,7 +1520,7 @@ static void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
         iwl_send_add_sta(priv, &cmd, CMD_ASYNC);
 }
 
-static void iwlagn_mac_sta_notify(struct ieee80211_hw *hw,
+void iwlagn_mac_sta_notify(struct ieee80211_hw *hw,
                            struct ieee80211_vif *vif,
                            enum sta_notify_cmd cmd,
                            struct ieee80211_sta *sta)
diff --git a/drivers/net/wireless/iwlwifi/iwl-op-mode.h b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
index b1fd251e88d5..ca947aebb727 100644
--- a/drivers/net/wireless/iwlwifi/iwl-op-mode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
@@ -125,6 +125,7 @@ struct iwl_fw;
  * @cmd_queue_full: Called when the command queue gets full. Must be atomic.
  * @nic_config: configure NIC, called before firmware is started.
  *      May sleep
+ * @wimax_active: invoked when WiMax becomes active.  Must be atomic.
  */
 struct iwl_op_mode_ops {
         struct iwl_op_mode *(*start)(struct iwl_trans *trans,
@@ -139,6 +140,7 @@ struct iwl_op_mode_ops {
         void (*nic_error)(struct iwl_op_mode *op_mode);
         void (*cmd_queue_full)(struct iwl_op_mode *op_mode);
         void (*nic_config)(struct iwl_op_mode *op_mode);
+        void (*wimax_active)(struct iwl_op_mode *op_mode);
 };
 
 /**
@@ -209,6 +211,11 @@ static inline void iwl_op_mode_nic_config(struct iwl_op_mode *op_mode)
         op_mode->ops->nic_config(op_mode);
 }
 
+static inline void iwl_op_mode_wimax_active(struct iwl_op_mode *op_mode)
+{
+        op_mode->ops->wimax_active(op_mode);
+}
+
 /*****************************************************
 * Op mode layers implementations
 ******************************************************/
diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/iwl-pci.c
index f3e56b04d775..754001581340 100644
--- a/drivers/net/wireless/iwlwifi/iwl-pci.c
+++ b/drivers/net/wireless/iwlwifi/iwl-pci.c
@@ -67,10 +67,8 @@
 #include <linux/pci.h>
 #include <linux/pci-aspm.h>
 
-#include "iwl-io.h"
 #include "iwl-shared.h"
 #include "iwl-trans.h"
-#include "iwl-csr.h"
 #include "iwl-cfg.h"
 #include "iwl-drv.h"
 #include "iwl-trans.h"
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.c b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
index d65305d08ebf..1a791af82d15 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.c
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
@@ -228,8 +228,24 @@ static u16 channel_id_to_papd(u16 ch_id)
 
 static u16 channel_id_to_txp(struct iwl_phy_db *phy_db, u16 ch_id)
 {
-        /* TODO David*/
-        return 0;
+        struct iwl_phy_db_chg_txp *txp_chg;
+        int i;
+        u8 ch_index = ch_id_to_ch_index(ch_id);
+        if (ch_index == 0xff)
+                return 0xff;
+
+        for (i = 0; i < IWL_NUM_TXP_CH_GROUPS; i++) {
+                txp_chg = (void *)phy_db->calib_ch_group_txp[i].data;
+                if (!txp_chg)
+                        return 0xff;
+                /*
+                 * Looking for the first channel group that its max channel is
+                 * higher then wanted channel.
+                 */
+                if (le16_to_cpu(txp_chg->max_channel_idx) >= ch_index)
+                        return i;
+        }
+        return 0xff;
 }
 
 int iwl_phy_db_get_section_data(struct iwl_phy_db *phy_db,
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.h b/drivers/net/wireless/iwlwifi/iwl-phy-db.h
index ba91a8b28398..5e86305de66a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.h
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.h
@@ -108,6 +108,12 @@ enum iwl_phy_db_section_type {
         IWL_PHY_DB_MAX
 };
 
+/* for parsing of tx power channel group data that comes from the firmware*/
+struct iwl_phy_db_chg_txp {
+        __le32 space;
+        __le16 max_channel_idx;
+} __packed;
+
 struct iwl_phy_db *iwl_phy_db_init(struct iwl_shared *shrd);
 
 void iwl_phy_db_free(struct iwl_phy_db *phy_db);
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 7bc7a82aba47..174a0f737214 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -268,61 +268,6 @@ static void iwl_power_sleep_cam_cmd(struct iwl_priv *priv,
         IWL_DEBUG_POWER(priv, "Sleep command for CAM\n");
 }
 
-static void iwl_power_fill_sleep_cmd(struct iwl_priv *priv,
-                                     struct iwl_powertable_cmd *cmd,
-                                     int dynps_ms, int wakeup_period)
-{
-        /*
-         * These are the original power level 3 sleep successions. The
-         * device may behave better with such succession and was also
-         * only tested with that. Just like the original sleep commands,
-         * also adjust the succession here to the wakeup_period below.
-         * The ranges are the same as for the sleep commands, 0-2, 3-9
-         * and >10, which is selected based on the DTIM interval for
-         * the sleep index but here we use the wakeup period since that
-         * is what we need to do for the latency requirements.
-         */
-        static const u8 slp_succ_r0[IWL_POWER_VEC_SIZE] = { 2, 2, 2, 2, 2 };
-        static const u8 slp_succ_r1[IWL_POWER_VEC_SIZE] = { 2, 4, 6, 7, 9 };
-        static const u8 slp_succ_r2[IWL_POWER_VEC_SIZE] = { 2, 7, 9, 9, 0xFF };
-        const u8 *slp_succ = slp_succ_r0;
-        int i;
-
-        if (wakeup_period > IWL_DTIM_RANGE_0_MAX)
-                slp_succ = slp_succ_r1;
-        if (wakeup_period > IWL_DTIM_RANGE_1_MAX)
-                slp_succ = slp_succ_r2;
-
-        memset(cmd, 0, sizeof(*cmd));
-
-        cmd->flags = IWL_POWER_DRIVER_ALLOW_SLEEP_MSK |
-                     IWL_POWER_FAST_PD; /* no use seeing frames for others */
-
-        if (priv->power_data.bus_pm)
-                cmd->flags |= IWL_POWER_PCI_PM_MSK;
-
-        if (cfg(priv)->base_params->shadow_reg_enable)
-                cmd->flags |= IWL_POWER_SHADOW_REG_ENA;
-        else
-                cmd->flags &= ~IWL_POWER_SHADOW_REG_ENA;
-
-        if (iwl_advanced_bt_coexist(priv)) {
-                if (!cfg(priv)->bt_params->bt_sco_disable)
-                        cmd->flags |= IWL_POWER_BT_SCO_ENA;
-                else
-                        cmd->flags &= ~IWL_POWER_BT_SCO_ENA;
-        }
-
-        cmd->rx_data_timeout = cpu_to_le32(1000 * dynps_ms);
-        cmd->tx_data_timeout = cpu_to_le32(1000 * dynps_ms);
-
-        for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
-                cmd->sleep_interval[i] =
-                        cpu_to_le32(min_t(int, slp_succ[i], wakeup_period));
-
-        IWL_DEBUG_POWER(priv, "Automatic sleep command\n");
-}
-
 static int iwl_set_power(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd)
 {
         IWL_DEBUG_POWER(priv, "Sending power/sleep command\n");
@@ -363,7 +308,7 @@ static void iwl_power_build_cmd(struct iwl_priv *priv,
                 iwl_static_sleep_cmd(priv, cmd,
                                      priv->power_data.debug_sleep_level_override,
                                      dtimper);
-        else if (iwlagn_mod_params.no_sleep_autoadjust) {
+        else {
                 if (iwlagn_mod_params.power_level > IWL_POWER_INDEX_1 &&
                     iwlagn_mod_params.power_level <= IWL_POWER_INDEX_5)
                         iwl_static_sleep_cmd(priv, cmd,
@@ -371,10 +316,7 @@ static void iwl_power_build_cmd(struct iwl_priv *priv,
                 else
                         iwl_static_sleep_cmd(priv, cmd,
                                 IWL_POWER_INDEX_1, dtimper);
-        } else
-                iwl_power_fill_sleep_cmd(priv, cmd,
-                                         priv->hw->conf.dynamic_ps_timeout,
-                                         priv->hw->conf.max_sleep_period);
+        }
 }
 
 int iwl_power_set_mode(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd,
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index dcf5b12071b4..490a60d8ad7d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -673,12 +673,12 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         u16 rx_chain = 0;
         enum ieee80211_band band;
         u8 n_probes = 0;
-        u8 rx_ant = hw_params(priv).valid_rx_ant;
+        u8 rx_ant = priv->hw_params.valid_rx_ant;
         u8 rate;
         bool is_active = false;
         int  chan_mod;
         u8 active_chains;
-        u8 scan_tx_antennas = hw_params(priv).valid_tx_ant;
+        u8 scan_tx_antennas = priv->hw_params.valid_tx_ant;
         int ret;
 
         lockdep_assert_held(&priv->mutex);
@@ -872,7 +872,7 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
         /* MIMO is not used here, but value is required */
         rx_chain |=
-                hw_params(priv).valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
+                priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
         rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
         rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
         rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
@@ -985,7 +985,7 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
 void iwl_init_scan_params(struct iwl_priv *priv)
 {
-        u8 ant_idx = fls(hw_params(priv).valid_tx_ant) - 1;
+        u8 ant_idx = fls(priv->hw_params.valid_tx_ant) - 1;
         if (!priv->scan_tx_ant[IEEE80211_BAND_5GHZ])
                 priv->scan_tx_ant[IEEE80211_BAND_5GHZ] = ant_idx;
         if (!priv->scan_tx_ant[IEEE80211_BAND_2GHZ])
diff --git a/drivers/net/wireless/iwlwifi/iwl-shared.h b/drivers/net/wireless/iwlwifi/iwl-shared.h
index 983b41e43d4b..35bd83ce3dae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-shared.h
+++ b/drivers/net/wireless/iwlwifi/iwl-shared.h
@@ -70,6 +70,7 @@
 
 #include "iwl-commands.h"
 #include "iwl-fw.h"
+#include "iwl-config.h"
 
 /**
  * DOC: shared area - role and goal
@@ -95,7 +96,6 @@
 
 struct iwl_priv;
 struct iwl_trans;
-struct iwl_sensitivity_ranges;
 struct iwl_trans_ops;
 
 #define DRV_NAME        "iwlwifi"
@@ -118,252 +118,56 @@ extern struct iwl_mod_params iwlagn_mod_params;
  * @disable_11n: disable 11n capabilities, default = 0,
  *      use IWL_DISABLE_HT_* constants
  * @amsdu_size_8K: enable 8K amsdu size, default = 1
- * @antenna: both antennas (use diversity), default = 0
  * @restart_fw: restart firmware, default = 1
  * @plcp_check: enable plcp health check, default = true
- * @ack_check: disable ack health check, default = false
  * @wd_disable: enable stuck queue check, default = 0
  * @bt_coex_active: enable bt coex, default = true
  * @led_mode: system default, default = 0
- * @no_sleep_autoadjust: disable autoadjust, default = true
  * @power_save: disable power save, default = false
  * @power_level: power level, default = 1
  * @debug_level: levels are IWL_DL_*
  * @ant_coupling: antenna coupling in dB, default = 0
  * @bt_ch_announce: BT channel inhibition, default = enable
- * @wanted_ucode_alternative: ucode alternative to use, default = 1
  * @auto_agg: enable agg. without check, default = true
  */
 struct iwl_mod_params {
         int sw_crypto;
         unsigned int disable_11n;
         int amsdu_size_8K;
-        int antenna;
         int restart_fw;
         bool plcp_check;
-        bool ack_check;
         int  wd_disable;
         bool bt_coex_active;
         int led_mode;
-        bool no_sleep_autoadjust;
         bool power_save;
         int power_level;
         u32 debug_level;
         int ant_coupling;
         bool bt_ch_announce;
-        int wanted_ucode_alternative;
         bool auto_agg;
 };
 
 /**
- * struct iwl_hw_params
- *
- * Holds the module parameters
- *
- * @tx_chains_num: Number of TX chains
- * @rx_chains_num: Number of RX chains
- * @valid_tx_ant: usable antennas for TX
- * @valid_rx_ant: usable antennas for RX
- * @ht40_channel: is 40MHz width possible: BIT(IEEE80211_BAND_XXX)
- * @sku: sku read from EEPROM
- * @rx_page_order: Rx buffer page order
- * @ct_kill_threshold: temperature threshold - in hw dependent unit
- * @ct_kill_exit_threshold: when to reeable the device - in hw dependent unit
- *      relevant for 1000, 6000 and up
- * @wd_timeout: TX queues watchdog timeout
- * @struct iwl_sensitivity_ranges: range of sensitivity values
- * @use_rts_for_aggregation: use rts/cts protection for HT traffic
- */
-struct iwl_hw_params {
-        u8  tx_chains_num;
-        u8  rx_chains_num;
-        u8  valid_tx_ant;
-        u8  valid_rx_ant;
-        u8  ht40_channel;
-        bool use_rts_for_aggregation;
-        u16 sku;
-        u32 rx_page_order;
-        u32 ct_kill_threshold;
-        u32 ct_kill_exit_threshold;
-        unsigned int wd_timeout;
-
-        const struct iwl_sensitivity_ranges *sens;
-};
-
-/*
- * LED mode
- *    IWL_LED_DEFAULT:  use device default
- *    IWL_LED_RF_STATE: turn LED on/off based on RF state
- *                      LED ON  = RF ON
- *                      LED OFF = RF OFF
- *    IWL_LED_BLINK:    adjust led blink rate based on blink table
- *    IWL_LED_DISABLE:  led disabled
- */
-enum iwl_led_mode {
-        IWL_LED_DEFAULT,
-        IWL_LED_RF_STATE,
-        IWL_LED_BLINK,
-        IWL_LED_DISABLE,
-};
-
-/*
- * @max_ll_items: max number of OTP blocks
- * @shadow_ram_support: shadow support for OTP memory
- * @led_compensation: compensate on the led on/off time per HW according
- *      to the deviation to achieve the desired led frequency.
- *      The detail algorithm is described in iwl-led.c
- * @chain_noise_num_beacons: number of beacons used to compute chain noise
- * @adv_thermal_throttle: support advance thermal throttle
- * @support_ct_kill_exit: support ct kill exit condition
- * @plcp_delta_threshold: plcp error rate threshold used to trigger
- *      radio tuning when there is a high receiving plcp error rate
- * @chain_noise_scale: default chain noise scale used for gain computation
- * @wd_timeout: TX queues watchdog timeout
- * @max_event_log_size: size of event log buffer size for ucode event logging
- * @shadow_reg_enable: HW shadhow register bit
- * @hd_v2: v2 of enhanced sensitivity value, used for 2000 series and up
- * @no_idle_support: do not support idle mode
- * wd_disable: disable watchdog timer
- */
-struct iwl_base_params {
-        int eeprom_size;
-        int num_of_queues;      /* def: HW dependent */
-        /* for iwl_apm_init() */
-        u32 pll_cfg_val;
-
-        const u16 max_ll_items;
-        const bool shadow_ram_support;
-        u16 led_compensation;
-        bool adv_thermal_throttle;
-        bool support_ct_kill_exit;
-        u8 plcp_delta_threshold;
-        s32 chain_noise_scale;
-        unsigned int wd_timeout;
-        u32 max_event_log_size;
-        const bool shadow_reg_enable;
-        const bool hd_v2;
-        const bool no_idle_support;
-        const bool wd_disable;
-};
-
-/*
- * @advanced_bt_coexist: support advanced bt coexist
- * @bt_init_traffic_load: specify initial bt traffic load
- * @bt_prio_boost: default bt priority boost value
- * @agg_time_limit: maximum number of uSec in aggregation
- * @bt_sco_disable: uCode should not response to BT in SCO/ESCO mode
- */
-struct iwl_bt_params {
-        bool advanced_bt_coexist;
-        u8 bt_init_traffic_load;
-        u8 bt_prio_boost;
-        u16 agg_time_limit;
-        bool bt_sco_disable;
-        bool bt_session_2;
-};
-/*
- * @use_rts_for_aggregation: use rts/cts protection for HT traffic
- */
-struct iwl_ht_params {
-        const bool ht_greenfield_support; /* if used set to true */
-        bool use_rts_for_aggregation;
-        enum ieee80211_smps_mode smps_mode;
-};
-
-/**
- * struct iwl_cfg
- * @name: Offical name of the device
- * @fw_name_pre: Firmware filename prefix. The api version and extension
- *      (.ucode) will be added to filename before loading from disk. The
- *      filename is constructed as fw_name_pre<api>.ucode.
- * @ucode_api_max: Highest version of uCode API supported by driver.
- * @ucode_api_ok: oldest version of the uCode API that is OK to load
- *      without a warning, for use in transitions
- * @ucode_api_min: Lowest version of uCode API supported by driver.
- * @max_inst_size: The maximal length of the fw inst section
- * @max_data_size: The maximal length of the fw data section
- * @valid_tx_ant: valid transmit antenna
- * @valid_rx_ant: valid receive antenna
- * @eeprom_ver: EEPROM version
- * @eeprom_calib_ver: EEPROM calibration version
- * @lib: pointer to the lib ops
- * @additional_nic_config: additional nic configuration
- * @base_params: pointer to basic parameters
- * @ht_params: point to ht patameters
- * @bt_params: pointer to bt parameters
- * @need_temp_offset_calib: need to perform temperature offset calibration
- * @no_xtal_calib: some devices do not need crystal calibration data,
- *      don't send it to those
- * @led_mode: 0=blinking, 1=On(RF On)/Off(RF Off)
- * @adv_pm: advance power management
- * @rx_with_siso_diversity: 1x1 device with rx antenna diversity
- * @internal_wimax_coex: internal wifi/wimax combo device
- * @temp_offset_v2: support v2 of temperature offset calibration
- *
- * We enable the driver to be backward compatible wrt. hardware features.
- * API differences in uCode shouldn't be handled here but through TLVs
- * and/or the uCode API version instead.
- */
-struct iwl_cfg {
-        /* params specific to an individual device within a device family */
-        const char *name;
-        const char *fw_name_pre;
-        const unsigned int ucode_api_max;
-        const unsigned int ucode_api_ok;
-        const unsigned int ucode_api_min;
-        const u32 max_data_size;
-        const u32 max_inst_size;
-        u8   valid_tx_ant;
-        u8   valid_rx_ant;
-        u16  eeprom_ver;
-        u16  eeprom_calib_ver;
-        const struct iwl_lib_ops *lib;
-        void (*additional_nic_config)(struct iwl_priv *priv);
-        /* params not likely to change within a device family */
-        const struct iwl_base_params *base_params;
-        /* params likely to change within a device family */
-        const struct iwl_ht_params *ht_params;
-        const struct iwl_bt_params *bt_params;
-        const bool need_temp_offset_calib; /* if used set to true */
-        const bool no_xtal_calib;
-        enum iwl_led_mode led_mode;
-        const bool adv_pm;
-        const bool rx_with_siso_diversity;
-        const bool internal_wimax_coex;
-        const bool temp_offset_v2;
-};
-
-/**
  * struct iwl_shared - shared fields for all the layers of the driver
  *
- * @status: STATUS_*
  * @wowlan: are we running wowlan uCode
  * @bus: pointer to the bus layer data
  * @cfg: see struct iwl_cfg
  * @priv: pointer to the upper layer data
  * @trans: pointer to the transport layer data
  * @nic: pointer to the nic data
- * @hw_params: see struct iwl_hw_params
  * @lock: protect general shared data
  * @eeprom: pointer to the eeprom/OTP image
  */
 struct iwl_shared {
-        unsigned long status;
-
         const struct iwl_cfg *cfg;
         struct iwl_trans *trans;
         void *drv;
-        struct iwl_hw_params hw_params;
-
-        /* eeprom -- this is in the card's little endian byte order */
-        u8 *eeprom;
-
 };
 
 /*Whatever _m is (iwl_trans, iwl_priv, these macros will work */
 #define cfg(_m)         ((_m)->shrd->cfg)
 #define trans(_m)       ((_m)->shrd->trans)
-#define hw_params(_m)   ((_m)->shrd->hw_params)
 
 static inline bool iwl_have_debug_level(u32 level)
 {
@@ -377,33 +181,4 @@ enum iwl_rxon_context_id {
         NUM_IWL_RXON_CTX
 };
 
-int iwlagn_hw_valid_rtc_data_addr(u32 addr);
-const char *get_cmd_string(u8 cmd);
-
-#define IWL_CMD(x) case x: return #x
-
-/*****************************************************
-* DRIVER STATUS FUNCTIONS
-******************************************************/
-#define STATUS_HCMD_ACTIVE      0       /* host command in progress */
-/* 1 is unused (used to be STATUS_HCMD_SYNC_ACTIVE) */
-#define STATUS_INT_ENABLED      2
-#define STATUS_RF_KILL_HW       3
-#define STATUS_CT_KILL          4
-#define STATUS_INIT             5
-#define STATUS_ALIVE            6
-#define STATUS_READY            7
-#define STATUS_TEMPERATURE      8
-#define STATUS_GEO_CONFIGURED   9
-#define STATUS_EXIT_PENDING     10
-#define STATUS_STATISTICS       12
-#define STATUS_SCANNING         13
-#define STATUS_SCAN_ABORTING    14
-#define STATUS_SCAN_HW          15
-#define STATUS_POWER_PMI        16
-#define STATUS_FW_ERROR         17
-#define STATUS_DEVICE_ENABLED   18
-#define STATUS_CHANNEL_SWITCH_PENDING 19
-#define STATUS_SCAN_COMPLETE    20
-
 #endif /* #__iwl_shared_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-testmode.c b/drivers/net/wireless/iwlwifi/iwl-testmode.c
index f31a0629c6c6..bb275098bb10 100644
--- a/drivers/net/wireless/iwlwifi/iwl-testmode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-testmode.c
@@ -536,7 +536,7 @@ static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
                 break;
 
         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
-                if (priv->shrd->eeprom) {
+                if (priv->eeprom) {
                         skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
                                 cfg(priv)->base_params->eeprom_size + 20);
                         if (!skb) {
@@ -547,7 +547,7 @@ static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
                                         IWL_TM_CMD_DEV2APP_EEPROM_RSP) ||
                             nla_put(skb, IWL_TM_ATTR_EEPROM,
                                     cfg(priv)->base_params->eeprom_size,
-                                    priv->shrd->eeprom))
+                                    priv->eeprom))
                                 goto nla_put_failure;
                         status = cfg80211_testmode_reply(skb);
                         if (status < 0)
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
index 32adee3b54e3..70bdd0e2df38 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
@@ -34,6 +34,7 @@
 #include <linux/skbuff.h>
 #include <linux/wait.h>
 #include <linux/pci.h>
+#include <linux/timer.h>
 
 #include "iwl-fh.h"
 #include "iwl-csr.h"
@@ -43,8 +44,6 @@
 #include "iwl-io.h"
 #include "iwl-op-mode.h"
 
-struct iwl_tx_queue;
-struct iwl_queue;
 struct iwl_host_cmd;
 
 /*This file includes the declaration that are internal to the
@@ -140,10 +139,10 @@ struct iwl_cmd_meta {
         /* only for SYNC commands, iff the reply skb is wanted */
         struct iwl_host_cmd *source;
 
-        u32 flags;
-
         DEFINE_DMA_UNMAP_ADDR(mapping);
         DEFINE_DMA_UNMAP_LEN(len);
+
+        u32 flags;
 };
 
 /*
@@ -206,7 +205,8 @@ struct iwl_tx_queue {
         struct iwl_cmd_meta *meta;
         struct sk_buff **skbs;
         spinlock_t lock;
-        unsigned long time_stamp;
+        struct timer_list stuck_timer;
+        struct iwl_trans_pcie *trans_pcie;
         u8 need_update;
         u8 active;
 };
@@ -227,6 +227,9 @@ struct iwl_tx_queue {
  * @ucode_write_waitq: wait queue for uCode load
  * @status - transport specific status flags
  * @cmd_queue - command queue number
+ * @rx_buf_size_8k: 8 kB RX buffer size
+ * @rx_page_order: page order for receive buffer size
+ * @wd_timeout: queue watchdog timeout (jiffies)
  */
 struct iwl_trans_pcie {
         struct iwl_rx_queue rxq;
@@ -266,11 +269,34 @@ struct iwl_trans_pcie {
         u8 no_reclaim_cmds[MAX_NO_RECLAIM_CMDS];
         u8 setup_q_to_fifo[IWL_MAX_HW_QUEUES];
         u8 n_q_to_fifo;
+
+        bool rx_buf_size_8k;
+        u32 rx_page_order;
+
+        const char **command_names;
+
+        /* queue watchdog */
+        unsigned long wd_timeout;
 };
 
+/*****************************************************
+* DRIVER STATUS FUNCTIONS
+******************************************************/
+#define STATUS_HCMD_ACTIVE      0
+#define STATUS_DEVICE_ENABLED   1
+#define STATUS_TPOWER_PMI       2
+#define STATUS_INT_ENABLED      3
+
 #define IWL_TRANS_GET_PCIE_TRANS(_iwl_trans) \
         ((struct iwl_trans_pcie *) ((_iwl_trans)->trans_specific))
 
+static inline struct iwl_trans *
+iwl_trans_pcie_get_trans(struct iwl_trans_pcie *trans_pcie)
+{
+        return container_of((void *)trans_pcie, struct iwl_trans,
+                            trans_specific);
+}
+
 /*****************************************************
 * RX
 ******************************************************/
@@ -392,4 +418,12 @@ static inline u8 get_cmd_index(struct iwl_queue *q, u32 index)
         return index & (q->n_window - 1);
 }
 
+static inline const char *
+trans_pcie_get_cmd_string(struct iwl_trans_pcie *trans_pcie, u8 cmd)
+{
+        if (!trans_pcie->command_names || !trans_pcie->command_names[cmd])
+                return "UNKNOWN";
+        return trans_pcie->command_names[cmd];
+}
+
 #endif /* __iwl_trans_int_pcie_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
index ab0f3fc22b87..de78fb8dca9f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
@@ -150,7 +150,7 @@ void iwl_rx_queue_update_write_ptr(struct iwl_trans *trans,
                         IWL_TRANS_GET_PCIE_TRANS(trans);
 
                 /* If power-saving is in use, make sure device is awake */
-                if (test_bit(STATUS_POWER_PMI, &trans_pcie->status)) {
+                if (test_bit(STATUS_TPOWER_PMI, &trans_pcie->status)) {
                         reg = iwl_read32(trans, CSR_UCODE_DRV_GP1);
 
                         if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
@@ -274,17 +274,17 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority)
                 if (rxq->free_count > RX_LOW_WATERMARK)
                         gfp_mask |= __GFP_NOWARN;
 
-                if (hw_params(trans).rx_page_order > 0)
+                if (trans_pcie->rx_page_order > 0)
                         gfp_mask |= __GFP_COMP;
 
                 /* Alloc a new receive buffer */
                 page = alloc_pages(gfp_mask,
-                                  hw_params(trans).rx_page_order);
+                                  trans_pcie->rx_page_order);
                 if (!page) {
                         if (net_ratelimit())
                                 IWL_DEBUG_INFO(trans, "alloc_pages failed, "
                                            "order: %d\n",
-                                           hw_params(trans).rx_page_order);
+                                           trans_pcie->rx_page_order);
 
                         if ((rxq->free_count <= RX_LOW_WATERMARK) &&
                             net_ratelimit())
@@ -303,7 +303,7 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority)
 
                 if (list_empty(&rxq->rx_used)) {
                         spin_unlock_irqrestore(&rxq->lock, flags);
-                        __free_pages(page, hw_params(trans).rx_page_order);
+                        __free_pages(page, trans_pcie->rx_page_order);
                         return;
                 }
                 element = rxq->rx_used.next;
@@ -316,7 +316,7 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority)
                 rxb->page = page;
                 /* Get physical address of the RB */
                 rxb->page_dma = dma_map_page(trans->dev, page, 0,
-                                PAGE_SIZE << hw_params(trans).rx_page_order,
+                                PAGE_SIZE << trans_pcie->rx_page_order,
                                 DMA_FROM_DEVICE);
                 /* dma address must be no more than 36 bits */
                 BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
@@ -367,7 +367,7 @@ static void iwl_rx_handle_rxbuf(struct iwl_trans *trans,
         struct iwl_tx_queue *txq = &trans_pcie->txq[trans_pcie->cmd_queue];
         unsigned long flags;
         bool page_stolen = false;
-        int max_len = PAGE_SIZE << hw_params(trans).rx_page_order;
+        int max_len = PAGE_SIZE << trans_pcie->rx_page_order;
         u32 offset = 0;
 
         if (WARN_ON(!rxb))
@@ -393,8 +393,9 @@ static void iwl_rx_handle_rxbuf(struct iwl_trans *trans,
                         break;
 
                 IWL_DEBUG_RX(trans, "cmd at offset %d: %s (0x%.2x)\n",
-                             rxcb._offset, get_cmd_string(pkt->hdr.cmd),
-                             pkt->hdr.cmd);
+                        rxcb._offset,
+                        trans_pcie_get_cmd_string(trans_pcie, pkt->hdr.cmd),
+                        pkt->hdr.cmd);
 
                 len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
                 len += sizeof(u32); /* account for status word */
@@ -452,7 +453,7 @@ static void iwl_rx_handle_rxbuf(struct iwl_trans *trans,
 
         /* page was stolen from us -- free our reference */
         if (page_stolen) {
-                __free_pages(rxb->page, hw_params(trans).rx_page_order);
+                __free_pages(rxb->page, trans_pcie->rx_page_order);
                 rxb->page = NULL;
         }
 
@@ -463,7 +464,7 @@ static void iwl_rx_handle_rxbuf(struct iwl_trans *trans,
         if (rxb->page != NULL) {
                 rxb->page_dma =
                         dma_map_page(trans->dev, rxb->page, 0,
-                                PAGE_SIZE << hw_params(trans).rx_page_order,
+                                PAGE_SIZE << trans_pcie->rx_page_order,
                                 DMA_FROM_DEVICE);
                 list_add_tail(&rxb->list, &rxq->rx_free);
                 rxq->free_count++;
@@ -547,14 +548,12 @@ static void iwl_irq_handle_error(struct iwl_trans *trans)
                         APMS_CLK_VAL_MRB_FUNC_MODE) ||
              (iwl_read_prph(trans, APMG_PS_CTRL_REG) &
                         APMG_PS_CTRL_VAL_RESET_REQ))) {
-                /*
-                 * Keep the restart process from trying to send host
-                 * commands by clearing the ready bit.
-                 */
-                clear_bit(STATUS_READY, &trans->shrd->status);
-                clear_bit(STATUS_HCMD_ACTIVE, &trans->shrd->status);
+                struct iwl_trans_pcie *trans_pcie;
+
+                trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+                clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
+                iwl_op_mode_wimax_active(trans->op_mode);
                 wake_up(&trans->wait_command_queue);
-                IWL_ERR(trans, "RF is used by WiMAX\n");
                 return;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-tx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-tx.c
index 4684e2310cd8..918874067bd3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-tx.c
@@ -107,7 +107,7 @@ void iwl_txq_update_write_ptr(struct iwl_trans *trans, struct iwl_tx_queue *txq)
                 struct iwl_trans_pcie *trans_pcie =
                         IWL_TRANS_GET_PCIE_TRANS(trans);
                 /* if we're trying to save power */
-                if (test_bit(STATUS_POWER_PMI, &trans_pcie->status)) {
+                if (test_bit(STATUS_TPOWER_PMI, &trans_pcie->status)) {
                         /* wake up nic if it's powered down ...
                          * uCode will wake up, and interrupt us again, so next
                          * time we'll skip this part. */
@@ -605,12 +605,11 @@ static int iwl_enqueue_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
                 cmd_dest += cmd->len[i];
         }
 
-        IWL_DEBUG_HC(trans, "Sending command %s (#%x), seq: 0x%04X, "
-                        "%d bytes at %d[%d]:%d\n",
-                        get_cmd_string(out_cmd->hdr.cmd),
-                        out_cmd->hdr.cmd,
-                        le16_to_cpu(out_cmd->hdr.sequence), cmd_size,
-                        q->write_ptr, idx, trans_pcie->cmd_queue);
+        IWL_DEBUG_HC(trans,
+                "Sending command %s (#%x), seq: 0x%04X, %d bytes at %d[%d]:%d\n",
+                trans_pcie_get_cmd_string(trans_pcie, out_cmd->hdr.cmd),
+                out_cmd->hdr.cmd, le16_to_cpu(out_cmd->hdr.sequence), cmd_size,
+                q->write_ptr, idx, trans_pcie->cmd_queue);
 
         phys_addr = dma_map_single(trans->dev, &out_cmd->hdr, copy_size,
                                 DMA_BIDIRECTIONAL);
@@ -668,6 +667,10 @@ static int iwl_enqueue_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
                                trace_bufs[2], trace_lens[2]);
 #endif
 
+        /* start timer if queue currently empty */
+        if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
+                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+
         /* Increment and update queue's write index */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
         iwl_txq_update_write_ptr(trans, txq);
@@ -677,6 +680,22 @@ static int iwl_enqueue_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
         return idx;
 }
 
+static inline void iwl_queue_progress(struct iwl_trans_pcie *trans_pcie,
+                                      struct iwl_tx_queue *txq)
+{
+        if (!trans_pcie->wd_timeout)
+                return;
+
+        /*
+         * if empty delete timer, otherwise move timer forward
+         * since we're making progress on this queue
+         */
+        if (txq->q.read_ptr == txq->q.write_ptr)
+                del_timer(&txq->stuck_timer);
+        else
+                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+}
+
 /**
  * iwl_hcmd_queue_reclaim - Reclaim TX command queue entries already Tx'd
  *
@@ -711,6 +730,8 @@ static void iwl_hcmd_queue_reclaim(struct iwl_trans *trans, int txq_id,
                 }
 
         }
+
+        iwl_queue_progress(trans_pcie, txq);
 }
 
 /**
@@ -754,8 +775,6 @@ void iwl_tx_cmd_complete(struct iwl_trans *trans, struct iwl_rx_cmd_buffer *rxb,
         cmd = txq->cmd[cmd_index];
         meta = &txq->meta[cmd_index];
 
-        txq->time_stamp = jiffies;
-
         iwlagn_unmap_tfd(trans, meta, &txq->tfds[index],
                          DMA_BIDIRECTIONAL);
 
@@ -765,21 +784,23 @@ void iwl_tx_cmd_complete(struct iwl_trans *trans, struct iwl_rx_cmd_buffer *rxb,
 
                 meta->source->resp_pkt = pkt;
                 meta->source->_rx_page_addr = (unsigned long)page_address(p);
-                meta->source->_rx_page_order = hw_params(trans).rx_page_order;
+                meta->source->_rx_page_order = trans_pcie->rx_page_order;
                 meta->source->handler_status = handler_status;
         }
 
         iwl_hcmd_queue_reclaim(trans, txq_id, index);
 
         if (!(meta->flags & CMD_ASYNC)) {
-                if (!test_bit(STATUS_HCMD_ACTIVE, &trans->shrd->status)) {
+                if (!test_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status)) {
                         IWL_WARN(trans,
                                  "HCMD_ACTIVE already clear for command %s\n",
-                                 get_cmd_string(cmd->hdr.cmd));
+                                 trans_pcie_get_cmd_string(trans_pcie,
+                                                           cmd->hdr.cmd));
                 }
-                clear_bit(STATUS_HCMD_ACTIVE, &trans->shrd->status);
+                clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
                 IWL_DEBUG_INFO(trans, "Clearing HCMD_ACTIVE for command %s\n",
-                               get_cmd_string(cmd->hdr.cmd));
+                               trans_pcie_get_cmd_string(trans_pcie,
+                                                         cmd->hdr.cmd));
                 wake_up(&trans->wait_command_queue);
         }
 
@@ -792,6 +813,7 @@ void iwl_tx_cmd_complete(struct iwl_trans *trans, struct iwl_rx_cmd_buffer *rxb,
 
 static int iwl_send_cmd_async(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
 
         /* An asynchronous command can not expect an SKB to be set. */
@@ -803,7 +825,7 @@ static int iwl_send_cmd_async(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
         if (ret < 0) {
                 IWL_ERR(trans,
                         "Error sending %s: enqueue_hcmd failed: %d\n",
-                          get_cmd_string(cmd->id), ret);
+                        trans_pcie_get_cmd_string(trans_pcie, cmd->id), ret);
                 return ret;
         }
         return 0;
@@ -816,49 +838,51 @@ static int iwl_send_cmd_sync(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
         int ret;
 
         IWL_DEBUG_INFO(trans, "Attempting to send sync command %s\n",
-                        get_cmd_string(cmd->id));
+                       trans_pcie_get_cmd_string(trans_pcie, cmd->id));
 
         if (WARN_ON(test_and_set_bit(STATUS_HCMD_ACTIVE,
-                                     &trans->shrd->status))) {
+                                     &trans_pcie->status))) {
                 IWL_ERR(trans, "Command %s: a command is already active!\n",
-                        get_cmd_string(cmd->id));
+                        trans_pcie_get_cmd_string(trans_pcie, cmd->id));
                 return -EIO;
         }
 
         IWL_DEBUG_INFO(trans, "Setting HCMD_ACTIVE for command %s\n",
-                        get_cmd_string(cmd->id));
+                       trans_pcie_get_cmd_string(trans_pcie, cmd->id));
 
         cmd_idx = iwl_enqueue_hcmd(trans, cmd);
         if (cmd_idx < 0) {
                 ret = cmd_idx;
-                clear_bit(STATUS_HCMD_ACTIVE, &trans->shrd->status);
+                clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
                 IWL_ERR(trans,
                         "Error sending %s: enqueue_hcmd failed: %d\n",
-                          get_cmd_string(cmd->id), ret);
+                        trans_pcie_get_cmd_string(trans_pcie, cmd->id), ret);
                 return ret;
         }
 
         ret = wait_event_timeout(trans->wait_command_queue,
-                        !test_bit(STATUS_HCMD_ACTIVE, &trans->shrd->status),
+                        !test_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status),
                         HOST_COMPLETE_TIMEOUT);
         if (!ret) {
-                if (test_bit(STATUS_HCMD_ACTIVE, &trans->shrd->status)) {
+                if (test_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status)) {
                         struct iwl_tx_queue *txq =
                                 &trans_pcie->txq[trans_pcie->cmd_queue];
                         struct iwl_queue *q = &txq->q;
 
                         IWL_ERR(trans,
                                 "Error sending %s: time out after %dms.\n",
-                                get_cmd_string(cmd->id),
+                                trans_pcie_get_cmd_string(trans_pcie, cmd->id),
                                 jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
 
                         IWL_ERR(trans,
                                 "Current CMD queue read_ptr %d write_ptr %d\n",
                                 q->read_ptr, q->write_ptr);
 
-                        clear_bit(STATUS_HCMD_ACTIVE, &trans->shrd->status);
-                        IWL_DEBUG_INFO(trans, "Clearing HCMD_ACTIVE for command"
-                                 "%s\n", get_cmd_string(cmd->id));
+                        clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
+                        IWL_DEBUG_INFO(trans,
+                                       "Clearing HCMD_ACTIVE for command %s\n",
+                                       trans_pcie_get_cmd_string(trans_pcie,
+                                                                 cmd->id));
                         ret = -ETIMEDOUT;
                         goto cancel;
                 }
@@ -866,7 +890,7 @@ static int iwl_send_cmd_sync(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
 
         if ((cmd->flags & CMD_WANT_SKB) && !cmd->resp_pkt) {
                 IWL_ERR(trans, "Error: Response NULL in '%s'\n",
-                          get_cmd_string(cmd->id));
+                        trans_pcie_get_cmd_string(trans_pcie, cmd->id));
                 ret = -EIO;
                 goto cancel;
         }
@@ -949,5 +973,8 @@ int iwl_tx_queue_reclaim(struct iwl_trans *trans, int txq_id, int index,
                 iwlagn_txq_free_tfd(trans, txq, txq->q.read_ptr, DMA_TO_DEVICE);
                 freed++;
         }
+
+        iwl_queue_progress(trans_pcie, txq);
+
         return freed;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
index 9f62283504e3..14a32c420fd4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -132,10 +132,10 @@ static void iwl_trans_rxq_free_rx_bufs(struct iwl_trans *trans)
                  * to an SKB, so we need to unmap and free potential storage */
                 if (rxq->pool[i].page != NULL) {
                         dma_unmap_page(trans->dev, rxq->pool[i].page_dma,
-                                PAGE_SIZE << hw_params(trans).rx_page_order,
+                                PAGE_SIZE << trans_pcie->rx_page_order,
                                 DMA_FROM_DEVICE);
                         __free_pages(rxq->pool[i].page,
-                                     hw_params(trans).rx_page_order);
+                                     trans_pcie->rx_page_order);
                         rxq->pool[i].page = NULL;
                 }
                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
@@ -145,11 +145,12 @@ static void iwl_trans_rxq_free_rx_bufs(struct iwl_trans *trans)
 static void iwl_trans_rx_hw_init(struct iwl_trans *trans,
                                  struct iwl_rx_queue *rxq)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u32 rb_size;
         const u32 rfdnlog = RX_QUEUE_SIZE_LOG; /* 256 RBDs */
         u32 rb_timeout = RX_RB_TIMEOUT; /* FIXME: RX_RB_TIMEOUT for all devices? */
 
-        if (iwlagn_mod_params.amsdu_size_8K)
+        if (trans_pcie->rx_buf_size_8k)
                 rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K;
         else
                 rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K;
@@ -298,6 +299,33 @@ static inline void iwlagn_free_dma_ptr(struct iwl_trans *trans,
         memset(ptr, 0, sizeof(*ptr));
 }
 
+static void iwl_trans_pcie_queue_stuck_timer(unsigned long data)
+{
+        struct iwl_tx_queue *txq = (void *)data;
+        struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;
+        struct iwl_trans *trans = iwl_trans_pcie_get_trans(trans_pcie);
+
+        spin_lock(&txq->lock);
+        /* check if triggered erroneously */
+        if (txq->q.read_ptr == txq->q.write_ptr) {
+                spin_unlock(&txq->lock);
+                return;
+        }
+        spin_unlock(&txq->lock);
+
+
+        IWL_ERR(trans, "Queue %d stuck for %u ms.\n", txq->q.id,
+                jiffies_to_msecs(trans_pcie->wd_timeout));
+        IWL_ERR(trans, "Current SW read_ptr %d write_ptr %d\n",
+                txq->q.read_ptr, txq->q.write_ptr);
+        IWL_ERR(trans, "Current HW read_ptr %d write_ptr %d\n",
+                iwl_read_prph(trans, SCD_QUEUE_RDPTR(txq->q.id))
+                                        & (TFD_QUEUE_SIZE_MAX - 1),
+                iwl_read_prph(trans, SCD_QUEUE_WRPTR(txq->q.id)));
+
+        iwl_op_mode_nic_error(trans->op_mode);
+}
+
 static int iwl_trans_txq_alloc(struct iwl_trans *trans,
                                 struct iwl_tx_queue *txq, int slots_num,
                                 u32 txq_id)
@@ -309,6 +337,10 @@ static int iwl_trans_txq_alloc(struct iwl_trans *trans,
         if (WARN_ON(txq->meta || txq->cmd || txq->skbs || txq->tfds))
                 return -EINVAL;
 
+        setup_timer(&txq->stuck_timer, iwl_trans_pcie_queue_stuck_timer,
+                    (unsigned long)txq);
+        txq->trans_pcie = trans_pcie;
+
         txq->q.n_window = slots_num;
 
         txq->meta = kcalloc(slots_num, sizeof(txq->meta[0]), GFP_KERNEL);
@@ -471,6 +503,8 @@ static void iwl_tx_queue_free(struct iwl_trans *trans, int txq_id)
         txq->cmd = NULL;
         txq->meta = NULL;
 
+        del_timer_sync(&txq->stuck_timer);
+
         /* 0-fill queue descriptor structure */
         memset(txq, 0, sizeof(*txq));
 }
@@ -1214,6 +1248,12 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
 
         /* stop and reset the on-board processor */
         iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
+
+        /* clear all status bits */
+        clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
+        clear_bit(STATUS_INT_ENABLED, &trans_pcie->status);
+        clear_bit(STATUS_DEVICE_ENABLED, &trans_pcie->status);
+        clear_bit(STATUS_TPOWER_PMI, &trans_pcie->status);
 }
 
 static void iwl_trans_pcie_wowlan_suspend(struct iwl_trans *trans)
@@ -1346,6 +1386,10 @@ static int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                              &dev_cmd->hdr, firstlen,
                              skb->data + hdr_len, secondlen);
 
+        /* start timer if queue currently empty */
+        if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
+                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+
         /* Tell device the write index *just past* this latest filled TFD */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
         iwl_txq_update_write_ptr(trans, txq);
@@ -1441,8 +1485,6 @@ static void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
         spin_lock(&txq->lock);
 
-        txq->time_stamp = jiffies;
-
         if (txq->q.read_ptr != tfd_num) {
                 IWL_DEBUG_TX_REPLY(trans, "[Q %d] %d -> %d (%d)\n",
                                    txq_id, txq->q.read_ptr, tfd_num, ssn);
@@ -1493,6 +1535,17 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
 
         memcpy(trans_pcie->setup_q_to_fifo, trans_cfg->queue_to_fifo,
                trans_pcie->n_q_to_fifo * sizeof(u8));
+
+        trans_pcie->rx_buf_size_8k = trans_cfg->rx_buf_size_8k;
+        if (trans_pcie->rx_buf_size_8k)
+                trans_pcie->rx_page_order = get_order(8 * 1024);
+        else
+                trans_pcie->rx_page_order = get_order(4 * 1024);
+
+        trans_pcie->wd_timeout =
+                msecs_to_jiffies(trans_cfg->queue_watchdog_timeout);
+
+        trans_pcie->command_names = trans_cfg->command_names;
 }
 
 static void iwl_trans_pcie_free(struct iwl_trans *trans)
@@ -1523,9 +1576,9 @@ static void iwl_trans_pcie_set_pmi(struct iwl_trans *trans, bool state)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         if (state)
-                set_bit(STATUS_POWER_PMI, &trans_pcie->status);
+                set_bit(STATUS_TPOWER_PMI, &trans_pcie->status);
         else
-                clear_bit(STATUS_POWER_PMI, &trans_pcie->status);
+                clear_bit(STATUS_TPOWER_PMI, &trans_pcie->status);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -1582,42 +1635,9 @@ static int iwl_trans_pcie_wait_tx_queue_empty(struct iwl_trans *trans)
         return ret;
 }
 
-/*
- * On every watchdog tick we check (latest) time stamp. If it does not
- * change during timeout period and queue is not empty we reset firmware.
- */
-static int iwl_trans_pcie_check_stuck_queue(struct iwl_trans *trans, int cnt)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_tx_queue *txq = &trans_pcie->txq[cnt];
-        struct iwl_queue *q = &txq->q;
-        unsigned long timeout;
-
-        if (q->read_ptr == q->write_ptr) {
-                txq->time_stamp = jiffies;
-                return 0;
-        }
-
-        timeout = txq->time_stamp +
-                  msecs_to_jiffies(hw_params(trans).wd_timeout);
-
-        if (time_after(jiffies, timeout)) {
-                IWL_ERR(trans, "Queue %d stuck for %u ms.\n", q->id,
-                        hw_params(trans).wd_timeout);
-                IWL_ERR(trans, "Current SW read_ptr %d write_ptr %d\n",
-                        q->read_ptr, q->write_ptr);
-                IWL_ERR(trans, "Current HW read_ptr %d write_ptr %d\n",
-                        iwl_read_prph(trans, SCD_QUEUE_RDPTR(cnt))
-                                & (TFD_QUEUE_SIZE_MAX - 1),
-                        iwl_read_prph(trans, SCD_QUEUE_WRPTR(cnt)));
-                return 1;
-        }
-
-        return 0;
-}
-
 static const char *get_fh_string(int cmd)
 {
+#define IWL_CMD(x) case x: return #x
         switch (cmd) {
         IWL_CMD(FH_RSCSR_CHNL0_STTS_WPTR_REG);
         IWL_CMD(FH_RSCSR_CHNL0_RBDCB_BASE_REG);
@@ -1631,6 +1651,7 @@ static const char *get_fh_string(int cmd)
         default:
                 return "UNKNOWN";
         }
+#undef IWL_CMD
 }
 
 int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
@@ -1679,6 +1700,7 @@ int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
 
 static const char *get_csr_string(int cmd)
 {
+#define IWL_CMD(x) case x: return #x
         switch (cmd) {
         IWL_CMD(CSR_HW_IF_CONFIG_REG);
         IWL_CMD(CSR_INT_COALESCING);
@@ -1706,6 +1728,7 @@ static const char *get_csr_string(int cmd)
         default:
                 return "UNKNOWN";
         }
+#undef IWL_CMD
 }
 
 void iwl_dump_csr(struct iwl_trans *trans)
@@ -1983,11 +2006,26 @@ static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
         return ret;
 }
 
+static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct iwl_trans *trans = file->private_data;
+
+        if (!trans->op_mode)
+                return -EAGAIN;
+
+        iwl_op_mode_nic_error(trans->op_mode);
+
+        return count;
+}
+
 DEBUGFS_READ_WRITE_FILE_OPS(interrupt);
 DEBUGFS_READ_FILE_OPS(fh_reg);
 DEBUGFS_READ_FILE_OPS(rx_queue);
 DEBUGFS_READ_FILE_OPS(tx_queue);
 DEBUGFS_WRITE_FILE_OPS(csr);
+DEBUGFS_WRITE_FILE_OPS(fw_restart);
 
 /*
  * Create the debugfs files and directories
@@ -2001,6 +2039,7 @@ static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
         DEBUGFS_ADD_FILE(interrupt, dir, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(csr, dir, S_IWUSR);
         DEBUGFS_ADD_FILE(fh_reg, dir, S_IRUSR);
+        DEBUGFS_ADD_FILE(fw_restart, dir, S_IWUSR);
         return 0;
 }
 #else
@@ -2032,7 +2071,6 @@ const struct iwl_trans_ops trans_ops_pcie = {
         .dbgfs_register = iwl_trans_pcie_dbgfs_register,
 
         .wait_tx_queue_empty = iwl_trans_pcie_wait_tx_queue_empty,
-        .check_stuck_queue = iwl_trans_pcie_check_stuck_queue,
 
 #ifdef CONFIG_PM_SLEEP
         .suspend = iwl_trans_pcie_suspend,
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 66c54c1b404e..f3496a0490f0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -305,6 +305,12 @@ static inline struct page *rxb_steal_page(struct iwl_rx_cmd_buffer *r)
  *      list of such notifications to filter. Max length is
  *      %MAX_NO_RECLAIM_CMDS.
  * @n_no_reclaim_cmds: # of commands in list
+ * @rx_buf_size_8k: 8 kB RX buffer size needed for A-MSDUs,
+ *      if unset 4k will be the RX buffer size
+ * @queue_watchdog_timeout: time (in ms) after which queues
+ *      are considered stuck and will trigger device restart
+ * @command_names: array of command names, must be 256 entries
+ *      (one for each command); for debugging only
  */
 struct iwl_trans_config {
         struct iwl_op_mode *op_mode;
@@ -314,6 +320,10 @@ struct iwl_trans_config {
         u8 cmd_queue;
         const u8 *no_reclaim_cmds;
         int n_no_reclaim_cmds;
+
+        bool rx_buf_size_8k;
+        unsigned int queue_watchdog_timeout;
+        const char **command_names;
 };
 
 /**
@@ -351,7 +361,6 @@ struct iwl_trans_config {
  *      irq, tasklet etc... From this point on, the device may not issue
  *      any interrupt (incl. RFKILL).
  *      May sleep
- * @check_stuck_queue: check if a specific queue is stuck
  * @wait_tx_queue_empty: wait until all tx queues are empty
  *      May sleep
  * @dbgfs_register: add the dbgfs files under this directory. Files will be
@@ -390,7 +399,6 @@ struct iwl_trans_ops {
         void (*free)(struct iwl_trans *trans);
 
         int (*dbgfs_register)(struct iwl_trans *trans, struct dentry* dir);
-        int (*check_stuck_queue)(struct iwl_trans *trans, int q);
         int (*wait_tx_queue_empty)(struct iwl_trans *trans);
 #ifdef CONFIG_PM_SLEEP
         int (*suspend)(struct iwl_trans *trans);
@@ -426,7 +434,6 @@ enum iwl_trans_state {
  * @hw_id: a u32 with the ID of the device / subdevice.
  *      Set during transport allocation.
  * @hw_id_str: a string with info about HW ID. Set during transport allocation.
- * @nvm_device_type: indicates OTP or eeprom
  * @pm_support: set to true in start_hw if link pm is supported
  * @wait_command_queue: the wait_queue for SYNC host commands
  */
@@ -442,7 +449,6 @@ struct iwl_trans {
         u32 hw_id;
         char hw_id_str[52];
 
-        int    nvm_device_type;
         bool pm_support;
 
         wait_queue_head_t wait_command_queue;
@@ -573,13 +579,6 @@ static inline int iwl_trans_wait_tx_queue_empty(struct iwl_trans *trans)
         return trans->ops->wait_tx_queue_empty(trans);
 }
 
-static inline int iwl_trans_check_stuck_queue(struct iwl_trans *trans, int q)
-{
-        WARN_ONCE(trans->state != IWL_TRANS_FW_ALIVE,
-                  "%s bad state = %d", __func__, trans->state);
-
-        return trans->ops->check_stuck_queue(trans, q);
-}
 static inline int iwl_trans_dbgfs_register(struct iwl_trans *trans,
                                             struct dentry *dir)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-ucode.c b/drivers/net/wireless/iwlwifi/iwl-ucode.c
index ba7c9f883cb6..539171945610 100644
--- a/drivers/net/wireless/iwlwifi/iwl-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-ucode.c
@@ -62,7 +62,7 @@ static int iwl_set_Xtal_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_xtal_freq_cmd cmd;
         __le16 *xtal_calib =
-                (__le16 *)iwl_eeprom_query_addr(priv->shrd, EEPROM_XTAL);
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_XTAL);
 
         iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD);
         cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
@@ -74,8 +74,7 @@ static int iwl_set_temperature_offset_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_temperature_offset_cmd cmd;
         __le16 *offset_calib =
-                (__le16 *)iwl_eeprom_query_addr(priv->shrd,
-                                                EEPROM_RAW_TEMPERATURE);
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_RAW_TEMPERATURE);
 
         memset(&cmd, 0, sizeof(cmd));
         iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD);
@@ -91,16 +90,15 @@ static int iwl_set_temperature_offset_calib(struct iwl_priv *priv)
 static int iwl_set_temperature_offset_calib_v2(struct iwl_priv *priv)
 {
         struct iwl_calib_temperature_offset_v2_cmd cmd;
-        __le16 *offset_calib_high = (__le16 *)iwl_eeprom_query_addr(priv->shrd,
+        __le16 *offset_calib_high = (__le16 *)iwl_eeprom_query_addr(priv,
                                      EEPROM_KELVIN_TEMPERATURE);
         __le16 *offset_calib_low =
-                (__le16 *)iwl_eeprom_query_addr(priv->shrd,
-                                                EEPROM_RAW_TEMPERATURE);
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_RAW_TEMPERATURE);
         struct iwl_eeprom_calib_hdr *hdr;
 
         memset(&cmd, 0, sizeof(cmd));
         iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD);
-        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv->shrd,
+        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv,
                                                         EEPROM_CALIB_ALL);
         memcpy(&cmd.radio_sensor_offset_high, offset_calib_high,
                 sizeof(*offset_calib_high));
@@ -180,7 +178,7 @@ int iwl_init_alive_start(struct iwl_priv *priv)
         return 0;
 }
 
-static int iwl_send_wimax_coex(struct iwl_priv *priv)
+int iwl_send_wimax_coex(struct iwl_priv *priv)
 {
         struct iwl_wimax_coex_cmd coex_cmd;
 
diff --git a/drivers/net/wireless/libertas/Makefile b/drivers/net/wireless/libertas/Makefile
index f7d01bfa2e4a..eac72f7bd341 100644
--- a/drivers/net/wireless/libertas/Makefile
+++ b/drivers/net/wireless/libertas/Makefile
@@ -6,6 +6,7 @@ libertas-y += ethtool.o
 libertas-y += main.o
 libertas-y += rx.o
 libertas-y += tx.o
+libertas-y += firmware.o
 libertas-$(CONFIG_LIBERTAS_MESH) += mesh.o
 
 usb8xxx-objs += if_usb.o
diff --git a/drivers/net/wireless/libertas/decl.h b/drivers/net/wireless/libertas/decl.h
index bc951ab4b681..84a3aa7ac570 100644
--- a/drivers/net/wireless/libertas/decl.h
+++ b/drivers/net/wireless/libertas/decl.h
@@ -19,6 +19,10 @@ struct lbs_fw_table {
 };
 
 struct lbs_private;
+typedef void (*lbs_fw_cb)(struct lbs_private *priv, int ret,
+                const struct firmware *helper, const struct firmware *mainfw);
+
+struct lbs_private;
 struct sk_buff;
 struct net_device;
 struct cmd_ds_command;
@@ -66,10 +70,13 @@ int lbs_exit_auto_deep_sleep(struct lbs_private *priv);
 u32 lbs_fw_index_to_data_rate(u8 index);
 u8 lbs_data_rate_to_fw_index(u32 rate);
 
-int lbs_get_firmware(struct device *dev, const char *user_helper,
-                        const char *user_mainfw, u32 card_model,
+int lbs_get_firmware(struct device *dev, u32 card_model,
                         const struct lbs_fw_table *fw_table,
                         const struct firmware **helper,
                         const struct firmware **mainfw);
+int lbs_get_firmware_async(struct lbs_private *priv, struct device *device,
+                           u32 card_model, const struct lbs_fw_table *fw_table,
+                           lbs_fw_cb callback);
+void lbs_wait_for_firmware_load(struct lbs_private *priv);
 
 #endif
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index f3fd447131c2..672005430aca 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -7,6 +7,7 @@
 #define _LBS_DEV_H_
 
 #include "defs.h"
+#include "decl.h"
 #include "host.h"
 
 #include <linux/kfifo.h>
@@ -180,6 +181,15 @@ struct lbs_private {
         wait_queue_head_t scan_q;
         /* Whether the scan was initiated internally and not by cfg80211 */
         bool internal_scan;
+
+        /* Firmware load */
+        u32 fw_model;
+        wait_queue_head_t fw_waitq;
+        struct device *fw_device;
+        const struct firmware *helper_fw;
+        const struct lbs_fw_table *fw_table;
+        const struct lbs_fw_table *fw_iter;
+        lbs_fw_cb fw_callback;
 };
 
 extern struct cmd_confirm_sleep confirm_sleep;
diff --git a/drivers/net/wireless/libertas/firmware.c b/drivers/net/wireless/libertas/firmware.c
new file mode 100644
index 000000000000..cd23f1a8c98a
--- /dev/null
+++ b/drivers/net/wireless/libertas/firmware.c
@@ -0,0 +1,222 @@
+/*
+ * Firmware loading and handling functions.
+ */
+
+#include <linux/firmware.h>
+#include <linux/firmware.h>
+#include <linux/module.h>
+
+#include "dev.h"
+#include "decl.h"
+
+static void load_next_firmware_from_table(struct lbs_private *private);
+
+static void lbs_fw_loaded(struct lbs_private *priv, int ret,
+        const struct firmware *helper, const struct firmware *mainfw)
+{
+        unsigned long flags;
+
+        lbs_deb_fw("firmware load complete, code %d\n", ret);
+
+        /* User must free helper/mainfw */
+        priv->fw_callback(priv, ret, helper, mainfw);
+
+        spin_lock_irqsave(&priv->driver_lock, flags);
+        priv->fw_callback = NULL;
+        wake_up(&priv->fw_waitq);
+        spin_unlock_irqrestore(&priv->driver_lock, flags);
+}
+
+static void do_load_firmware(struct lbs_private *priv, const char *name,
+        void (*cb)(const struct firmware *fw, void *context))
+{
+        int ret;
+
+        lbs_deb_fw("Requesting %s\n", name);
+        ret = request_firmware_nowait(THIS_MODULE, true, name,
+                        priv->fw_device, GFP_KERNEL, priv, cb);
+        if (ret) {
+                lbs_deb_fw("request_firmware_nowait error %d\n", ret);
+                lbs_fw_loaded(priv, ret, NULL, NULL);
+        }
+}
+
+static void main_firmware_cb(const struct firmware *firmware, void *context)
+{
+        struct lbs_private *priv = context;
+
+        if (!firmware) {
+                /* Failed to find firmware: try next table entry */
+                load_next_firmware_from_table(priv);
+                return;
+        }
+
+        /* Firmware found! */
+        lbs_fw_loaded(priv, 0, priv->helper_fw, firmware);
+}
+
+static void helper_firmware_cb(const struct firmware *firmware, void *context)
+{
+        struct lbs_private *priv = context;
+
+        if (!firmware) {
+                /* Failed to find firmware: try next table entry */
+                load_next_firmware_from_table(priv);
+                return;
+        }
+
+        /* Firmware found! */
+        if (priv->fw_iter->fwname) {
+                priv->helper_fw = firmware;
+                do_load_firmware(priv, priv->fw_iter->fwname, main_firmware_cb);
+        } else {
+                /* No main firmware needed for this helper --> success! */
+                lbs_fw_loaded(priv, 0, firmware, NULL);
+        }
+}
+
+static void load_next_firmware_from_table(struct lbs_private *priv)
+{
+        const struct lbs_fw_table *iter;
+
+        if (!priv->fw_iter)
+                iter = priv->fw_table;
+        else
+                iter = ++priv->fw_iter;
+
+        if (priv->helper_fw) {
+                release_firmware(priv->helper_fw);
+                priv->helper_fw = NULL;
+        }
+
+next:
+        if (!iter->helper) {
+                /* End of table hit. */
+                lbs_fw_loaded(priv, -ENOENT, NULL, NULL);
+                return;
+        }
+
+        if (iter->model != priv->fw_model) {
+                iter++;
+                goto next;
+        }
+
+        priv->fw_iter = iter;
+        do_load_firmware(priv, iter->helper, helper_firmware_cb);
+}
+
+void lbs_wait_for_firmware_load(struct lbs_private *priv)
+{
+        wait_event(priv->fw_waitq, priv->fw_callback == NULL);
+}
+
+/**
+ *  lbs_get_firmware_async - Retrieves firmware asynchronously. Can load
+ *  either a helper firmware and a main firmware (2-stage), or just the helper.
+ *
+ *  @priv:      Pointer to lbs_private instance
+ *  @dev:       A pointer to &device structure
+ *  @card_model: Bus-specific card model ID used to filter firmware table
+ *              elements
+ *  @fw_table:  Table of firmware file names and device model numbers
+ *              terminated by an entry with a NULL helper name
+ *      @callback: User callback to invoke when firmware load succeeds or fails.
+ */
+int lbs_get_firmware_async(struct lbs_private *priv, struct device *device,
+                            u32 card_model, const struct lbs_fw_table *fw_table,
+                            lbs_fw_cb callback)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->driver_lock, flags);
+        if (priv->fw_callback) {
+                lbs_deb_fw("firmware load already in progress\n");
+                spin_unlock_irqrestore(&priv->driver_lock, flags);
+                return -EBUSY;
+        }
+
+        priv->fw_device = device;
+        priv->fw_callback = callback;
+        priv->fw_table = fw_table;
+        priv->fw_iter = NULL;
+        priv->fw_model = card_model;
+        spin_unlock_irqrestore(&priv->driver_lock, flags);
+
+        lbs_deb_fw("Starting async firmware load\n");
+        load_next_firmware_from_table(priv);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(lbs_get_firmware_async);
+
+/**
+ *  lbs_get_firmware - Retrieves two-stage firmware
+ *
+ *  @dev:       A pointer to &device structure
+ *  @card_model: Bus-specific card model ID used to filter firmware table
+ *              elements
+ *  @fw_table:  Table of firmware file names and device model numbers
+ *              terminated by an entry with a NULL helper name
+ *  @helper:    On success, the helper firmware; caller must free
+ *  @mainfw:    On success, the main firmware; caller must free
+ *
+ * Deprecated: use lbs_get_firmware_async() instead.
+ *
+ *  returns:            0 on success, non-zero on failure
+ */
+int lbs_get_firmware(struct device *dev, u32 card_model,
+                        const struct lbs_fw_table *fw_table,
+                        const struct firmware **helper,
+                        const struct firmware **mainfw)
+{
+        const struct lbs_fw_table *iter;
+        int ret;
+
+        BUG_ON(helper == NULL);
+        BUG_ON(mainfw == NULL);
+
+        /* Search for firmware to use from the table. */
+        iter = fw_table;
+        while (iter && iter->helper) {
+                if (iter->model != card_model)
+                        goto next;
+
+                if (*helper == NULL) {
+                        ret = request_firmware(helper, iter->helper, dev);
+                        if (ret)
+                                goto next;
+
+                        /* If the device has one-stage firmware (ie cf8305) and
+                         * we've got it then we don't need to bother with the
+                         * main firmware.
+                         */
+                        if (iter->fwname == NULL)
+                                return 0;
+                }
+
+                if (*mainfw == NULL) {
+                        ret = request_firmware(mainfw, iter->fwname, dev);
+                        if (ret) {
+                                /* Clear the helper to ensure we don't have
+                                 * mismatched firmware pairs.
+                                 */
+                                release_firmware(*helper);
+                                *helper = NULL;
+                        }
+                }
+
+                if (*helper && *mainfw)
+                        return 0;
+
+  next:
+                iter++;
+        }
+
+        /* Failed */
+        release_firmware(*helper);
+        *helper = NULL;
+        release_firmware(*mainfw);
+        *mainfw = NULL;
+
+        return -ENOENT;
+}
+EXPORT_SYMBOL_GPL(lbs_get_firmware);
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index 234ee88dec95..cee50528522b 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -890,8 +890,8 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
                 goto out2;
         }
 
-        ret = lbs_get_firmware(&p_dev->dev, NULL, NULL, card->model,
-                                &fw_table[0], &helper, &mainfw);
+        ret = lbs_get_firmware(&p_dev->dev, card->model, &fw_table[0],
+                                &helper, &mainfw);
         if (ret) {
                 pr_err("failed to find firmware (%d)\n", ret);
                 goto out2;
@@ -951,10 +951,8 @@ out2:
 out1:
         pcmcia_disable_device(p_dev);
 out:
-        if (helper)
-                release_firmware(helper);
-        if (mainfw)
-                release_firmware(mainfw);
+        release_firmware(helper);
+        release_firmware(mainfw);
 
         lbs_deb_leave_args(LBS_DEB_CS, "ret %d", ret);
         return ret;
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 9804ebc892d4..76caebaa4397 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -65,12 +65,6 @@ static void if_sdio_interrupt(struct sdio_func *func);
  */
 static u8 user_rmmod;
 
-static char *lbs_helper_name = NULL;
-module_param_named(helper_name, lbs_helper_name, charp, 0644);
-
-static char *lbs_fw_name = NULL;
-module_param_named(fw_name, lbs_fw_name, charp, 0644);
-
 static const struct sdio_device_id if_sdio_ids[] = {
         { SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL,
                         SDIO_DEVICE_ID_MARVELL_LIBERTAS) },
@@ -123,11 +117,8 @@ struct if_sdio_card {
         int                     model;
         unsigned long           ioport;
         unsigned int            scratch_reg;
-
-        const char              *helper;
-        const char              *firmware;
-        bool                    helper_allocated;
-        bool                    firmware_allocated;
+        bool                    started;
+        wait_queue_head_t       pwron_waitq;
 
         u8                      buffer[65536] __attribute__((aligned(4)));
 
@@ -140,6 +131,9 @@ struct if_sdio_card {
         u8                      rx_unit;
 };
 
+static void if_sdio_finish_power_on(struct if_sdio_card *card);
+static int if_sdio_power_off(struct if_sdio_card *card);
+
 /********************************************************************/
 /* I/O                                                              */
 /********************************************************************/
@@ -680,12 +674,39 @@ out:
         return ret;
 }
 
+static void if_sdio_do_prog_firmware(struct lbs_private *priv, int ret,
+                                     const struct firmware *helper,
+                                     const struct firmware *mainfw)
+{
+        struct if_sdio_card *card = priv->card;
+
+        if (ret) {
+                pr_err("failed to find firmware (%d)\n", ret);
+                return;
+        }
+
+        ret = if_sdio_prog_helper(card, helper);
+        if (ret)
+                goto out;
+
+        lbs_deb_sdio("Helper firmware loaded\n");
+
+        ret = if_sdio_prog_real(card, mainfw);
+        if (ret)
+                goto out;
+
+        lbs_deb_sdio("Firmware loaded\n");
+        if_sdio_finish_power_on(card);
+
+out:
+        release_firmware(helper);
+        release_firmware(mainfw);
+}
+
 static int if_sdio_prog_firmware(struct if_sdio_card *card)
 {
         int ret;
         u16 scratch;
-        const struct firmware *helper = NULL;
-        const struct firmware *mainfw = NULL;
 
         lbs_deb_enter(LBS_DEB_SDIO);
 
@@ -719,43 +740,18 @@ static int if_sdio_prog_firmware(struct if_sdio_card *card)
          */
         if (scratch == IF_SDIO_FIRMWARE_OK) {
                 lbs_deb_sdio("firmware already loaded\n");
-                goto success;
+                if_sdio_finish_power_on(card);
+                return 0;
         } else if ((card->model == MODEL_8686) && (scratch & 0x7fff)) {
                 lbs_deb_sdio("firmware may be running\n");
-                goto success;
-        }
-
-        ret = lbs_get_firmware(&card->func->dev, lbs_helper_name, lbs_fw_name,
-                                card->model, &fw_table[0], &helper, &mainfw);
-        if (ret) {
-                pr_err("failed to find firmware (%d)\n", ret);
-                goto out;
+                if_sdio_finish_power_on(card);
+                return 0;
         }
 
-        ret = if_sdio_prog_helper(card, helper);
-        if (ret)
-                goto out;
-
-        lbs_deb_sdio("Helper firmware loaded\n");
-
-        ret = if_sdio_prog_real(card, mainfw);
-        if (ret)
-                goto out;
-
-        lbs_deb_sdio("Firmware loaded\n");
-
-success:
-        sdio_claim_host(card->func);
-        sdio_set_block_size(card->func, IF_SDIO_BLOCK_SIZE);
-        sdio_release_host(card->func);
-        ret = 0;
+        ret = lbs_get_firmware_async(card->priv, &card->func->dev, card->model,
+                                     fw_table, if_sdio_do_prog_firmware);
 
 out:
-        if (helper)
-                release_firmware(helper);
-        if (mainfw)
-                release_firmware(mainfw);
-
         lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
         return ret;
 }
@@ -764,55 +760,15 @@ out:
 /* Power management                                                 */
 /********************************************************************/
 
-static int if_sdio_power_on(struct if_sdio_card *card)
+/* Finish power on sequence (after firmware is loaded) */
+static void if_sdio_finish_power_on(struct if_sdio_card *card)
 {
         struct sdio_func *func = card->func;
         struct lbs_private *priv = card->priv;
-        struct mmc_host *host = func->card->host;
         int ret;
 
         sdio_claim_host(func);
-
-        ret = sdio_enable_func(func);
-        if (ret)
-                goto release;
-
-        /* For 1-bit transfers to the 8686 model, we need to enable the
-         * interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0
-         * bit to allow access to non-vendor registers. */
-        if ((card->model == MODEL_8686) &&
-            (host->caps & MMC_CAP_SDIO_IRQ) &&
-            (host->ios.bus_width == MMC_BUS_WIDTH_1)) {
-                u8 reg;
-
-                func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
-                reg = sdio_f0_readb(func, SDIO_CCCR_IF, &ret);
-                if (ret)
-                        goto disable;
-
-                reg |= SDIO_BUS_ECSI;
-                sdio_f0_writeb(func, reg, SDIO_CCCR_IF, &ret);
-                if (ret)
-                        goto disable;
-        }
-
-        card->ioport = sdio_readb(func, IF_SDIO_IOPORT, &ret);
-        if (ret)
-                goto disable;
-
-        card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 1, &ret) << 8;
-        if (ret)
-                goto disable;
-
-        card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 2, &ret) << 16;
-        if (ret)
-                goto disable;
-
-        sdio_release_host(func);
-        ret = if_sdio_prog_firmware(card);
-        sdio_claim_host(func);
-        if (ret)
-                goto disable;
+        sdio_set_block_size(card->func, IF_SDIO_BLOCK_SIZE);
 
         /*
          * Get rx_unit if the chip is SD8688 or newer.
@@ -837,7 +793,7 @@ static int if_sdio_power_on(struct if_sdio_card *card)
          */
         ret = sdio_claim_irq(func, if_sdio_interrupt);
         if (ret)
-                goto disable;
+                goto release;
 
         /*
          * Enable interrupts now that everything is set up
@@ -863,11 +819,79 @@ static int if_sdio_power_on(struct if_sdio_card *card)
         }
 
         priv->fw_ready = 1;
+        wake_up(&card->pwron_waitq);
 
-        return 0;
+        if (!card->started) {
+                ret = lbs_start_card(priv);
+                if_sdio_power_off(card);
+                if (ret == 0) {
+                        card->started = true;
+                        /* Tell PM core that we don't need the card to be
+                         * powered now */
+                        pm_runtime_put_noidle(&func->dev);
+                }
+        }
+
+        return;
 
 release_irq:
         sdio_release_irq(func);
+release:
+        sdio_release_host(func);
+}
+
+static int if_sdio_power_on(struct if_sdio_card *card)
+{
+        struct sdio_func *func = card->func;
+        struct mmc_host *host = func->card->host;
+        int ret;
+
+        sdio_claim_host(func);
+
+        ret = sdio_enable_func(func);
+        if (ret)
+                goto release;
+
+        /* For 1-bit transfers to the 8686 model, we need to enable the
+         * interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0
+         * bit to allow access to non-vendor registers. */
+        if ((card->model == MODEL_8686) &&
+            (host->caps & MMC_CAP_SDIO_IRQ) &&
+            (host->ios.bus_width == MMC_BUS_WIDTH_1)) {
+                u8 reg;
+
+                func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+                reg = sdio_f0_readb(func, SDIO_CCCR_IF, &ret);
+                if (ret)
+                        goto disable;
+
+                reg |= SDIO_BUS_ECSI;
+                sdio_f0_writeb(func, reg, SDIO_CCCR_IF, &ret);
+                if (ret)
+                        goto disable;
+        }
+
+        card->ioport = sdio_readb(func, IF_SDIO_IOPORT, &ret);
+        if (ret)
+                goto disable;
+
+        card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 1, &ret) << 8;
+        if (ret)
+                goto disable;
+
+        card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 2, &ret) << 16;
+        if (ret)
+                goto disable;
+
+        sdio_release_host(func);
+        ret = if_sdio_prog_firmware(card);
+        if (ret) {
+                sdio_disable_func(func);
+                return ret;
+        }
+
+        return 0;
+
 disable:
         sdio_disable_func(func);
 release:
@@ -1074,11 +1098,17 @@ static int if_sdio_power_save(struct lbs_private *priv)
 static int if_sdio_power_restore(struct lbs_private *priv)
 {
         struct if_sdio_card *card = priv->card;
+        int r;
 
         /* Make sure the card will not be powered off by runtime PM */
         pm_runtime_get_sync(&card->func->dev);
 
-        return if_sdio_power_on(card);
+        r = if_sdio_power_on(card);
+        if (r)
+                return r;
+
+        wait_event(card->pwron_waitq, priv->fw_ready);
+        return 0;
 }
 
 
@@ -1179,6 +1209,7 @@ static int if_sdio_probe(struct sdio_func *func,
         spin_lock_init(&card->lock);
         card->workqueue = create_workqueue("libertas_sdio");
         INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
+        init_waitqueue_head(&card->pwron_waitq);
 
         /* Check if we support this card */
         for (i = 0; i < ARRAY_SIZE(fw_table); i++) {
@@ -1220,14 +1251,6 @@ static int if_sdio_probe(struct sdio_func *func,
         if (ret)
                 goto err_activate_card;
 
-        ret = lbs_start_card(priv);
-        if_sdio_power_off(card);
-        if (ret)
-                goto err_activate_card;
-
-        /* Tell PM core that we don't need the card to be powered now */
-        pm_runtime_put_noidle(&func->dev);
-
 out:
         lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
 
@@ -1244,10 +1267,6 @@ free:
                 kfree(packet);
         }
 
-        if (card->helper_allocated)
-                kfree(card->helper);
-        if (card->firmware_allocated)
-                kfree(card->firmware);
         kfree(card);
 
         goto out;
@@ -1295,12 +1314,6 @@ static void if_sdio_remove(struct sdio_func *func)
                 kfree(packet);
         }
 
-        if (card->helper_allocated)
-                kfree(card->helper);
-        if (card->firmware_allocated)
-                kfree(card->firmware);
-        kfree(card);
-
         lbs_deb_leave(LBS_DEB_SDIO);
 }
 
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 50b1ee7721e9..9604a1c4a74d 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -1064,9 +1064,8 @@ static int if_spi_init_card(struct if_spi_card *card)
                         goto out;
                 }
 
-                err = lbs_get_firmware(&card->spi->dev, NULL, NULL,
-                                        card->card_id, &fw_table[0], &helper,
-                                        &mainfw);
+                err = lbs_get_firmware(&card->spi->dev, card->card_id,
+                                        &fw_table[0], &helper, &mainfw);
                 if (err) {
                         netdev_err(priv->dev, "failed to find firmware (%d)\n",
                                    err);
@@ -1095,10 +1094,8 @@ static int if_spi_init_card(struct if_spi_card *card)
                 goto out;
 
 out:
-        if (helper)
-                release_firmware(helper);
-        if (mainfw)
-                release_firmware(mainfw);
+        release_firmware(helper);
+        release_firmware(mainfw);
 
         lbs_deb_leave_args(LBS_DEB_SPI, "err %d\n", err);
 
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index 74da5f1ea243..75403e6e3990 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -29,9 +29,6 @@
 
 #define MESSAGE_HEADER_LEN      4
 
-static char *lbs_fw_name = NULL;
-module_param_named(fw_name, lbs_fw_name, charp, 0644);
-
 MODULE_FIRMWARE("libertas/usb8388_v9.bin");
 MODULE_FIRMWARE("libertas/usb8388_v5.bin");
 MODULE_FIRMWARE("libertas/usb8388.bin");
@@ -44,6 +41,16 @@ enum {
         MODEL_8682 = 0x2
 };
 
+/* table of firmware file names */
+static const struct lbs_fw_table fw_table[] = {
+        { MODEL_8388, "libertas/usb8388_olpc.bin", NULL },
+        { MODEL_8388, "libertas/usb8388_v9.bin", NULL },
+        { MODEL_8388, "libertas/usb8388_v5.bin", NULL },
+        { MODEL_8388, "libertas/usb8388.bin", NULL },
+        { MODEL_8388, "usb8388.bin", NULL },
+        { MODEL_8682, "libertas/usb8682.bin", NULL }
+};
+
 static struct usb_device_id if_usb_table[] = {
         /* Enter the device signature inside */
         { USB_DEVICE(0x1286, 0x2001), .driver_info = MODEL_8388 },
@@ -55,10 +62,9 @@ MODULE_DEVICE_TABLE(usb, if_usb_table);
 
 static void if_usb_receive(struct urb *urb);
 static void if_usb_receive_fwload(struct urb *urb);
-static int __if_usb_prog_firmware(struct if_usb_card *cardp,
-                                        const char *fwname, int cmd);
-static int if_usb_prog_firmware(struct if_usb_card *cardp,
-                                        const char *fwname, int cmd);
+static void if_usb_prog_firmware(struct lbs_private *priv, int ret,
+                                 const struct firmware *fw,
+                                 const struct firmware *unused);
 static int if_usb_host_to_card(struct lbs_private *priv, uint8_t type,
                                uint8_t *payload, uint16_t nb);
 static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload,
@@ -67,69 +73,6 @@ static void if_usb_free(struct if_usb_card *cardp);
 static int if_usb_submit_rx_urb(struct if_usb_card *cardp);
 static int if_usb_reset_device(struct if_usb_card *cardp);
 
-/* sysfs hooks */
-
-/*
- *  Set function to write firmware to device's persistent memory
- */
-static ssize_t if_usb_firmware_set(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct if_usb_card *cardp = priv->card;
-        int ret;
-
-        BUG_ON(buf == NULL);
-
-        ret = if_usb_prog_firmware(cardp, buf, BOOT_CMD_UPDATE_FW);
-        if (ret == 0)
-                return count;
-
-        return ret;
-}
-
-/*
- * lbs_flash_fw attribute to be exported per ethX interface through sysfs
- * (/sys/class/net/ethX/lbs_flash_fw).  Use this like so to write firmware to
- * the device's persistent memory:
- * echo usb8388-5.126.0.p5.bin > /sys/class/net/ethX/lbs_flash_fw
- */
-static DEVICE_ATTR(lbs_flash_fw, 0200, NULL, if_usb_firmware_set);
-
-/**
- * if_usb_boot2_set - write firmware to device's persistent memory
- *
- * @dev: target device
- * @attr: device attributes
- * @buf: firmware buffer to write
- * @count: number of bytes to write
- *
- * returns: number of bytes written or negative error code
- */
-static ssize_t if_usb_boot2_set(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct if_usb_card *cardp = priv->card;
-        int ret;
-
-        BUG_ON(buf == NULL);
-
-        ret = if_usb_prog_firmware(cardp, buf, BOOT_CMD_UPDATE_BOOT2);
-        if (ret == 0)
-                return count;
-
-        return ret;
-}
-
-/*
- * lbs_flash_boot2 attribute to be exported per ethX interface through sysfs
- * (/sys/class/net/ethX/lbs_flash_boot2).  Use this like so to write firmware
- * to the device's persistent memory:
- * echo usb8388-5.126.0.p5.bin > /sys/class/net/ethX/lbs_flash_boot2
- */
-static DEVICE_ATTR(lbs_flash_boot2, 0200, NULL, if_usb_boot2_set);
-
 /**
  * if_usb_write_bulk_callback - callback function to handle the status
  * of the URB
@@ -256,6 +199,7 @@ static int if_usb_probe(struct usb_interface *intf,
         struct usb_endpoint_descriptor *endpoint;
         struct lbs_private *priv;
         struct if_usb_card *cardp;
+        int r = -ENOMEM;
         int i;
 
         udev = interface_to_usbdev(intf);
@@ -313,20 +257,10 @@ static int if_usb_probe(struct usb_interface *intf,
                 goto dealloc;
         }
 
-        /* Upload firmware */
-        kparam_block_sysfs_write(fw_name);
-        if (__if_usb_prog_firmware(cardp, lbs_fw_name, BOOT_CMD_FW_BY_USB)) {
-                kparam_unblock_sysfs_write(fw_name);
-                lbs_deb_usbd(&udev->dev, "FW upload failed\n");
-                goto err_prog_firmware;
-        }
-        kparam_unblock_sysfs_write(fw_name);
-
         if (!(priv = lbs_add_card(cardp, &intf->dev)))
-                goto err_prog_firmware;
+                goto err_add_card;
 
         cardp->priv = priv;
-        cardp->priv->fw_ready = 1;
 
         priv->hw_host_to_card = if_usb_host_to_card;
         priv->enter_deep_sleep = NULL;
@@ -339,42 +273,25 @@ static int if_usb_probe(struct usb_interface *intf,
 
         cardp->boot2_version = udev->descriptor.bcdDevice;
 
-        if_usb_submit_rx_urb(cardp);
-
-        if (lbs_start_card(priv))
-                goto err_start_card;
-
-        if_usb_setup_firmware(priv);
-
         usb_get_dev(udev);
         usb_set_intfdata(intf, cardp);
 
-        if (device_create_file(&priv->dev->dev, &dev_attr_lbs_flash_fw))
-                netdev_err(priv->dev,
-                           "cannot register lbs_flash_fw attribute\n");
-
-        if (device_create_file(&priv->dev->dev, &dev_attr_lbs_flash_boot2))
-                netdev_err(priv->dev,
-                           "cannot register lbs_flash_boot2 attribute\n");
-
-        /*
-         * EHS_REMOVE_WAKEUP is not supported on all versions of the firmware.
-         */
-        priv->wol_criteria = EHS_REMOVE_WAKEUP;
-        if (lbs_host_sleep_cfg(priv, priv->wol_criteria, NULL))
-                priv->ehs_remove_supported = false;
+        r = lbs_get_firmware_async(priv, &udev->dev, cardp->model,
+                                   fw_table, if_usb_prog_firmware);
+        if (r)
+                goto err_get_fw;
 
         return 0;
 
-err_start_card:
+err_get_fw:
         lbs_remove_card(priv);
-err_prog_firmware:
+err_add_card:
         if_usb_reset_device(cardp);
 dealloc:
         if_usb_free(cardp);
 
 error:
-        return -ENOMEM;
+        return r;
 }
 
 /**
@@ -389,9 +306,6 @@ static void if_usb_disconnect(struct usb_interface *intf)
 
         lbs_deb_enter(LBS_DEB_MAIN);
 
-        device_remove_file(&priv->dev->dev, &dev_attr_lbs_flash_boot2);
-        device_remove_file(&priv->dev->dev, &dev_attr_lbs_flash_fw);
-
         cardp->surprise_removed = 1;
 
         if (priv) {
@@ -912,121 +826,22 @@ static int check_fwfile_format(const uint8_t *data, uint32_t totlen)
         return ret;
 }
 
-
-/**
-*  if_usb_prog_firmware - programs the firmware subject to cmd
-*
-*  @cardp:      the if_usb_card descriptor
-*  @fwname:     firmware or boot2 image file name
-*  @cmd:        either BOOT_CMD_FW_BY_USB, BOOT_CMD_UPDATE_FW,
-*               or BOOT_CMD_UPDATE_BOOT2.
-*  returns:     0 or error code
-*/
-static int if_usb_prog_firmware(struct if_usb_card *cardp,
-                                const char *fwname, int cmd)
-{
-        struct lbs_private *priv = cardp->priv;
-        unsigned long flags, caps;
-        int ret;
-
-        caps = priv->fwcapinfo;
-        if (((cmd == BOOT_CMD_UPDATE_FW) && !(caps & FW_CAPINFO_FIRMWARE_UPGRADE)) ||
-            ((cmd == BOOT_CMD_UPDATE_BOOT2) && !(caps & FW_CAPINFO_BOOT2_UPGRADE)))
-                return -EOPNOTSUPP;
-
-        /* Ensure main thread is idle. */
-        spin_lock_irqsave(&priv->driver_lock, flags);
-        while (priv->cur_cmd != NULL || priv->dnld_sent != DNLD_RES_RECEIVED) {
-                spin_unlock_irqrestore(&priv->driver_lock, flags);
-                if (wait_event_interruptible(priv->waitq,
-                                (priv->cur_cmd == NULL &&
-                                priv->dnld_sent == DNLD_RES_RECEIVED))) {
-                        return -ERESTARTSYS;
-                }
-                spin_lock_irqsave(&priv->driver_lock, flags);
-        }
-        priv->dnld_sent = DNLD_BOOTCMD_SENT;
-        spin_unlock_irqrestore(&priv->driver_lock, flags);
-
-        ret = __if_usb_prog_firmware(cardp, fwname, cmd);
-
-        spin_lock_irqsave(&priv->driver_lock, flags);
-        priv->dnld_sent = DNLD_RES_RECEIVED;
-        spin_unlock_irqrestore(&priv->driver_lock, flags);
-
-        wake_up(&priv->waitq);
-
-        return ret;
-}
-
-/* table of firmware file names */
-static const struct {
-        u32 model;
-        const char *fwname;
-} fw_table[] = {
-        { MODEL_8388, "libertas/usb8388_v9.bin" },
-        { MODEL_8388, "libertas/usb8388_v5.bin" },
-        { MODEL_8388, "libertas/usb8388.bin" },
-        { MODEL_8388, "usb8388.bin" },
-        { MODEL_8682, "libertas/usb8682.bin" }
-};
-
-#ifdef CONFIG_OLPC
-
-static int try_olpc_fw(struct if_usb_card *cardp)
-{
-        int retval = -ENOENT;
-
-        /* try the OLPC firmware first; fall back to fw_table list */
-        if (machine_is_olpc() && cardp->model == MODEL_8388)
-                retval = request_firmware(&cardp->fw,
-                                "libertas/usb8388_olpc.bin", &cardp->udev->dev);
-        return retval;
-}
-
-#else
-static int try_olpc_fw(struct if_usb_card *cardp) { return -ENOENT; }
-#endif /* !CONFIG_OLPC */
-
-static int get_fw(struct if_usb_card *cardp, const char *fwname)
-{
-        int i;
-
-        /* Try user-specified firmware first */
-        if (fwname)
-                return request_firmware(&cardp->fw, fwname, &cardp->udev->dev);
-
-        /* Handle OLPC firmware */
-        if (try_olpc_fw(cardp) == 0)
-                return 0;
-
-        /* Otherwise search for firmware to use */
-        for (i = 0; i < ARRAY_SIZE(fw_table); i++) {
-                if (fw_table[i].model != cardp->model)
-                        continue;
-                if (request_firmware(&cardp->fw, fw_table[i].fwname,
-                                        &cardp->udev->dev) == 0)
-                        return 0;
-        }
-
-        return -ENOENT;
-}
-
-static int __if_usb_prog_firmware(struct if_usb_card *cardp,
-                                        const char *fwname, int cmd)
+static void if_usb_prog_firmware(struct lbs_private *priv, int ret,
+                                 const struct firmware *fw,
+                                 const struct firmware *unused)
 {
+        struct if_usb_card *cardp = priv->card;
         int i = 0;
         static int reset_count = 10;
-        int ret = 0;
 
         lbs_deb_enter(LBS_DEB_USB);
 
-        ret = get_fw(cardp, fwname);
         if (ret) {
                 pr_err("failed to find firmware (%d)\n", ret);
                 goto done;
         }
 
+        cardp->fw = fw;
         if (check_fwfile_format(cardp->fw->data, cardp->fw->size)) {
                 ret = -EINVAL;
                 goto release_fw;
@@ -1053,7 +868,7 @@ restart:
         do {
                 int j = 0;
                 i++;
-                if_usb_issue_boot_command(cardp, cmd);
+                if_usb_issue_boot_command(cardp, BOOT_CMD_FW_BY_USB);
                 /* wait for command response */
                 do {
                         j++;
@@ -1109,13 +924,27 @@ restart:
                 goto release_fw;
         }
 
+        cardp->priv->fw_ready = 1;
+        if_usb_submit_rx_urb(cardp);
+
+        if (lbs_start_card(priv))
+                goto release_fw;
+
+        if_usb_setup_firmware(priv);
+
+        /*
+         * EHS_REMOVE_WAKEUP is not supported on all versions of the firmware.
+         */
+        priv->wol_criteria = EHS_REMOVE_WAKEUP;
+        if (lbs_host_sleep_cfg(priv, priv->wol_criteria, NULL))
+                priv->ehs_remove_supported = false;
+
  release_fw:
         release_firmware(cardp->fw);
         cardp->fw = NULL;
 
  done:
-        lbs_deb_leave_args(LBS_DEB_USB, "ret %d", ret);
-        return ret;
+        lbs_deb_leave(LBS_DEB_USB);
 }
 
 
@@ -1128,8 +957,10 @@ static int if_usb_suspend(struct usb_interface *intf, pm_message_t message)
 
         lbs_deb_enter(LBS_DEB_USB);
 
-        if (priv->psstate != PS_STATE_FULL_POWER)
-                return -1;
+        if (priv->psstate != PS_STATE_FULL_POWER) {
+                ret = -1;
+                goto out;
+        }
 
 #ifdef CONFIG_OLPC
         if (machine_is_olpc()) {
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 957681dede17..e96ee0aa8439 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -878,6 +878,7 @@ static int lbs_init_adapter(struct lbs_private *priv)
         priv->is_host_sleep_configured = 0;
         priv->is_host_sleep_activated = 0;
         init_waitqueue_head(&priv->host_sleep_q);
+        init_waitqueue_head(&priv->fw_waitq);
         mutex_init(&priv->lock);
 
         setup_timer(&priv->command_timer, lbs_cmd_timeout_handler,
@@ -1033,7 +1034,11 @@ void lbs_remove_card(struct lbs_private *priv)
         lbs_deb_enter(LBS_DEB_MAIN);
 
         lbs_remove_mesh(priv);
-        lbs_scan_deinit(priv);
+
+        if (priv->wiphy_registered)
+                lbs_scan_deinit(priv);
+
+        lbs_wait_for_firmware_load(priv);
 
         /* worker thread destruction blocks on the in-flight command which
          * should have been cleared already in lbs_stop_card().
@@ -1128,6 +1133,11 @@ void lbs_stop_card(struct lbs_private *priv)
                 goto out;
         dev = priv->dev;
 
+        /* If the netdev isn't registered, it means that lbs_start_card() was
+         * never called so we have nothing to do here. */
+        if (dev->reg_state != NETREG_REGISTERED)
+                goto out;
+
         netif_stop_queue(dev);
         netif_carrier_off(dev);
 
@@ -1177,111 +1187,6 @@ void lbs_notify_command_response(struct lbs_private *priv, u8 resp_idx)
 }
 EXPORT_SYMBOL_GPL(lbs_notify_command_response);
 
-/**
- *  lbs_get_firmware - Retrieves two-stage firmware
- *
- *  @dev:       A pointer to &device structure
- *  @user_helper: User-defined helper firmware file
- *  @user_mainfw: User-defined main firmware file
- *  @card_model: Bus-specific card model ID used to filter firmware table
- *              elements
- *  @fw_table:  Table of firmware file names and device model numbers
- *              terminated by an entry with a NULL helper name
- *  @helper:    On success, the helper firmware; caller must free
- *  @mainfw:    On success, the main firmware; caller must free
- *
- *  returns:            0 on success, non-zero on failure
- */
-int lbs_get_firmware(struct device *dev, const char *user_helper,
-                        const char *user_mainfw, u32 card_model,
-                        const struct lbs_fw_table *fw_table,
-                        const struct firmware **helper,
-                        const struct firmware **mainfw)
-{
-        const struct lbs_fw_table *iter;
-        int ret;
-
-        BUG_ON(helper == NULL);
-        BUG_ON(mainfw == NULL);
-
-        /* Try user-specified firmware first */
-        if (user_helper) {
-                ret = request_firmware(helper, user_helper, dev);
-                if (ret) {
-                        dev_err(dev, "couldn't find helper firmware %s\n",
-                                user_helper);
-                        goto fail;
-                }
-        }
-        if (user_mainfw) {
-                ret = request_firmware(mainfw, user_mainfw, dev);
-                if (ret) {
-                        dev_err(dev, "couldn't find main firmware %s\n",
-                                user_mainfw);
-                        goto fail;
-                }
-        }
-
-        if (*helper && *mainfw)
-                return 0;
-
-        /* Otherwise search for firmware to use.  If neither the helper or
-         * the main firmware were specified by the user, then we need to
-         * make sure that found helper & main are from the same entry in
-         * fw_table.
-         */
-        iter = fw_table;
-        while (iter && iter->helper) {
-                if (iter->model != card_model)
-                        goto next;
-
-                if (*helper == NULL) {
-                        ret = request_firmware(helper, iter->helper, dev);
-                        if (ret)
-                                goto next;
-
-                        /* If the device has one-stage firmware (ie cf8305) and
-                         * we've got it then we don't need to bother with the
-                         * main firmware.
-                         */
-                        if (iter->fwname == NULL)
-                                return 0;
-                }
-
-                if (*mainfw == NULL) {
-                        ret = request_firmware(mainfw, iter->fwname, dev);
-                        if (ret && !user_helper) {
-                                /* Clear the helper if it wasn't user-specified
-                                 * and the main firmware load failed, to ensure
-                                 * we don't have mismatched firmware pairs.
-                                 */
-                                release_firmware(*helper);
-                                *helper = NULL;
-                        }
-                }
-
-                if (*helper && *mainfw)
-                        return 0;
-
-  next:
-                iter++;
-        }
-
-  fail:
-        /* Failed */
-        if (*helper) {
-                release_firmware(*helper);
-                *helper = NULL;
-        }
-        if (*mainfw) {
-                release_firmware(*mainfw);
-                *mainfw = NULL;
-        }
-
-        return -ENOENT;
-}
-EXPORT_SYMBOL_GPL(lbs_get_firmware);
-
 static int __init lbs_init_module(void)
 {
         lbs_deb_enter(LBS_DEB_MAIN);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 2d913644d92b..03c0c6b1372c 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -699,6 +699,7 @@ static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
                     ieee80211_is_probe_resp(mgmt->frame_control))
                         mgmt->u.beacon.timestamp = cpu_to_le64(
                                 rx_status.mactime +
+                                (data->tsf_offset - data2->tsf_offset) +
                                 24 * 8 * 10 / txrate->bitrate);
 
                 memcpy(IEEE80211_SKB_RXCB(nskb), &rx_status, sizeof(rx_status));
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index c7e89188c350..c78ea873a63a 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1162,6 +1162,17 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
         priv->user_scan_cfg->num_ssids = request->n_ssids;
         priv->user_scan_cfg->ssid_list = request->ssids;
 
+        if (request->ie && request->ie_len) {
+                for (i = 0; i < MWIFIEX_MAX_VSIE_NUM; i++) {
+                        if (priv->vs_ie[i].mask != MWIFIEX_VSIE_MASK_CLEAR)
+                                continue;
+                        priv->vs_ie[i].mask = MWIFIEX_VSIE_MASK_SCAN;
+                        memcpy(&priv->vs_ie[i].ie, request->ie,
+                               request->ie_len);
+                        break;
+                }
+        }
+
         for (i = 0; i < request->n_channels; i++) {
                 chan = request->channels[i];
                 priv->user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
@@ -1179,6 +1190,15 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
         if (mwifiex_set_user_scan_ioctl(priv, priv->user_scan_cfg))
                 return -EFAULT;
 
+        if (request->ie && request->ie_len) {
+                for (i = 0; i < MWIFIEX_MAX_VSIE_NUM; i++) {
+                        if (priv->vs_ie[i].mask == MWIFIEX_VSIE_MASK_SCAN) {
+                                priv->vs_ie[i].mask = MWIFIEX_VSIE_MASK_CLEAR;
+                                memset(&priv->vs_ie[i].ie, 0,
+                                       MWIFIEX_MAX_VSIE_LEN);
+                        }
+                }
+        }
         return 0;
 }
 
@@ -1422,6 +1442,7 @@ int mwifiex_register_cfg80211(struct mwifiex_private *priv)
         void *wdev_priv;
         struct wireless_dev *wdev;
         struct ieee80211_sta_ht_cap *ht_info;
+        u8 *country_code;
 
         wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
         if (!wdev) {
@@ -1438,6 +1459,7 @@ int mwifiex_register_cfg80211(struct mwifiex_private *priv)
         }
         wdev->iftype = NL80211_IFTYPE_STATION;
         wdev->wiphy->max_scan_ssids = 10;
+        wdev->wiphy->max_scan_ie_len = MWIFIEX_MAX_VSIE_LEN;
         wdev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                                        BIT(NL80211_IFTYPE_ADHOC);
 
@@ -1460,8 +1482,8 @@ int mwifiex_register_cfg80211(struct mwifiex_private *priv)
         memcpy(wdev->wiphy->perm_addr, priv->curr_addr, ETH_ALEN);
         wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
 
-        /* Reserve space for bss band information */
-        wdev->wiphy->bss_priv_size = sizeof(u8);
+        /* Reserve space for mwifiex specific private data for BSS */
+        wdev->wiphy->bss_priv_size = sizeof(struct mwifiex_bss_priv);
 
         wdev->wiphy->reg_notifier = mwifiex_reg_notifier;
 
@@ -1484,6 +1506,11 @@ int mwifiex_register_cfg80211(struct mwifiex_private *priv)
                         "info: successfully registered wiphy device\n");
         }
 
+        country_code = mwifiex_11d_code_2_region(priv->adapter->region_code);
+        if (country_code && regulatory_hint(wdev->wiphy, country_code))
+                dev_err(priv->adapter->dev,
+                        "%s: regulatory_hint failed\n", __func__);
+
         priv->wdev = wdev;
 
         return ret;
diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c
index 2fe1c33765b8..560871b0e236 100644
--- a/drivers/net/wireless/mwifiex/cfp.c
+++ b/drivers/net/wireless/mwifiex/cfp.c
@@ -71,6 +71,37 @@ u16 region_code_index[MWIFIEX_MAX_REGION_CODE] = { 0x10, 0x20, 0x30,
 
 static u8 supported_rates_n[N_SUPPORTED_RATES] = { 0x02, 0x04, 0 };
 
+struct region_code_mapping {
+        u8 code;
+        u8 region[IEEE80211_COUNTRY_STRING_LEN];
+};
+
+static struct region_code_mapping region_code_mapping_t[] = {
+        { 0x10, "US " }, /* US FCC */
+        { 0x20, "CA " }, /* IC Canada */
+        { 0x30, "EU " }, /* ETSI */
+        { 0x31, "ES " }, /* Spain */
+        { 0x32, "FR " }, /* France */
+        { 0x40, "JP " }, /* Japan */
+        { 0x41, "JP " }, /* Japan */
+        { 0x50, "CN " }, /* China */
+};
+
+/* This function converts integer code to region string */
+u8 *mwifiex_11d_code_2_region(u8 code)
+{
+        u8 i;
+        u8 size = sizeof(region_code_mapping_t)/
+                                sizeof(struct region_code_mapping);
+
+        /* Look for code in mapping table */
+        for (i = 0; i < size; i++)
+                if (region_code_mapping_t[i].code == code)
+                        return region_code_mapping_t[i].region;
+
+        return NULL;
+}
+
 /*
  * This function maps an index in supported rates table into
  * the corresponding data rate.
diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
index 1a845074c52a..a870b5885c09 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -212,7 +212,7 @@ mwifiex_info_read(struct file *file, char __user *ubuf,
                 p += sprintf(p, "essid=\"%s\"\n", info.ssid.ssid);
                 p += sprintf(p, "bssid=\"%pM\"\n", info.bssid);
                 p += sprintf(p, "channel=\"%d\"\n", (int) info.bss_chan);
-                p += sprintf(p, "region_code = \"%02x\"\n", info.region_code);
+                p += sprintf(p, "country_code = \"%s\"\n", info.country_code);
 
                 netdev_for_each_mc_addr(ha, netdev)
                         p += sprintf(p, "multicast_address[%d]=\"%pM\"\n",
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index bb26114bdb96..6b15449a4cb7 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -104,6 +104,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_RATE_SCOPE         (PROPRIETARY_TLV_BASE_ID + 83)
 #define TLV_TYPE_POWER_GROUP        (PROPRIETARY_TLV_BASE_ID + 84)
 #define TLV_TYPE_WAPI_IE            (PROPRIETARY_TLV_BASE_ID + 94)
+#define TLV_TYPE_MGMT_IE            (PROPRIETARY_TLV_BASE_ID + 105)
 #define TLV_TYPE_AUTO_DS_PARAM      (PROPRIETARY_TLV_BASE_ID + 113)
 #define TLV_TYPE_PS_PARAM           (PROPRIETARY_TLV_BASE_ID + 114)
 
@@ -818,7 +819,7 @@ struct host_cmd_ds_txpwr_cfg {
 struct mwifiex_bcn_param {
         u8 bssid[ETH_ALEN];
         u8 rssi;
-        __le32 timestamp[2];
+        __le64 timestamp;
         __le16 beacon_period;
         __le16 cap_info_bitmap;
 } __packed;
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index 54bb4839b57c..0d55c5b542d7 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -131,6 +131,8 @@ static int mwifiex_init_priv(struct mwifiex_private *priv)
         priv->wmm_qosinfo = 0;
         priv->curr_bcn_buf = NULL;
         priv->curr_bcn_size = 0;
+        priv->wps_ie = NULL;
+        priv->wps_ie_len = 0;
 
         priv->scan_block = false;
 
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index 99c06649f94c..f0f95524e96b 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -96,7 +96,7 @@ struct mwifiex_bss_info {
         u32 bss_mode;
         struct cfg80211_ssid ssid;
         u32 bss_chan;
-        u32 region_code;
+        u8 country_code[3];
         u32 media_connected;
         u32 max_power_level;
         u32 min_power_level;
@@ -303,6 +303,7 @@ struct mwifiex_ds_misc_subsc_evt {
 
 #define MWIFIEX_MAX_VSIE_LEN       (256)
 #define MWIFIEX_MAX_VSIE_NUM       (8)
+#define MWIFIEX_VSIE_MASK_CLEAR    0x00
 #define MWIFIEX_VSIE_MASK_SCAN     0x01
 #define MWIFIEX_VSIE_MASK_ASSOC    0x02
 #define MWIFIEX_VSIE_MASK_ADHOC    0x04
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index bca8b6d52273..8a390982463e 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -118,15 +118,15 @@ mwifiex_cmd_append_tsf_tlv(struct mwifiex_private *priv, u8 **buffer,
         *buffer += sizeof(tsf_tlv.header);
 
         /* TSF at the time when beacon/probe_response was received */
-        tsf_val = cpu_to_le64(bss_desc->network_tsf);
+        tsf_val = cpu_to_le64(bss_desc->fw_tsf);
         memcpy(*buffer, &tsf_val, sizeof(tsf_val));
         *buffer += sizeof(tsf_val);
 
-        memcpy(&tsf_val, bss_desc->time_stamp, sizeof(tsf_val));
+        tsf_val = cpu_to_le64(bss_desc->timestamp);
 
         dev_dbg(priv->adapter->dev,
                 "info: %s: TSF offset calc: %016llx - %016llx\n",
-                __func__, tsf_val, bss_desc->network_tsf);
+                __func__, bss_desc->timestamp, bss_desc->fw_tsf);
 
         memcpy(*buffer, &tsf_val, sizeof(tsf_val));
         *buffer += sizeof(tsf_val);
@@ -225,6 +225,48 @@ mwifiex_setup_rates_from_bssdesc(struct mwifiex_private *priv,
 }
 
 /*
+ * This function appends a WPS IE. It is called from the network join command
+ * preparation routine.
+ *
+ * If the IE buffer has been setup by the application, this routine appends
+ * the buffer as a WPS TLV type to the request.
+ */
+static int
+mwifiex_cmd_append_wps_ie(struct mwifiex_private *priv, u8 **buffer)
+{
+        int retLen = 0;
+        struct mwifiex_ie_types_header ie_header;
+
+        if (!buffer || !*buffer)
+                return 0;
+
+        /*
+         * If there is a wps ie buffer setup, append it to the return
+         * parameter buffer pointer.
+         */
+        if (priv->wps_ie_len) {
+                dev_dbg(priv->adapter->dev, "cmd: append wps ie %d to %p\n",
+                        priv->wps_ie_len, *buffer);
+
+                /* Wrap the generic IE buffer with a pass through TLV type */
+                ie_header.type = cpu_to_le16(TLV_TYPE_MGMT_IE);
+                ie_header.len = cpu_to_le16(priv->wps_ie_len);
+                memcpy(*buffer, &ie_header, sizeof(ie_header));
+                *buffer += sizeof(ie_header);
+                retLen += sizeof(ie_header);
+
+                memcpy(*buffer, priv->wps_ie, priv->wps_ie_len);
+                *buffer += priv->wps_ie_len;
+                retLen += priv->wps_ie_len;
+
+        }
+
+        kfree(priv->wps_ie);
+        priv->wps_ie_len = 0;
+        return retLen;
+}
+
+/*
  * This function appends a WAPI IE.
  *
  * This function is called from the network join command preparation routine.
@@ -480,6 +522,8 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
         if (priv->sec_info.wapi_enabled && priv->wapi_ie_len)
                 mwifiex_cmd_append_wapi_ie(priv, &pos);
 
+        if (priv->wps.session_enable && priv->wps_ie_len)
+                mwifiex_cmd_append_wps_ie(priv, &pos);
 
         mwifiex_cmd_append_generic_ie(priv, &pos);
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 9d1b3ca6334b..245b7329e0c9 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -292,29 +292,28 @@ static void mwifiex_free_adapter(struct mwifiex_adapter *adapter)
 }
 
 /*
- * This function initializes the hardware and firmware.
+ * This function gets firmware and initializes it.
  *
  * The main initialization steps followed are -
  *      - Download the correct firmware to card
- *      - Allocate and initialize the adapter structure
- *      - Initialize the private structures
  *      - Issue the init commands to firmware
  */
-static int mwifiex_init_hw_fw(struct mwifiex_adapter *adapter)
+static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
 {
-        int ret, err;
+        int ret;
+        char fmt[64];
+        struct mwifiex_private *priv;
+        struct mwifiex_adapter *adapter = context;
         struct mwifiex_fw_image fw;
 
-        memset(&fw, 0, sizeof(struct mwifiex_fw_image));
-
-        err = request_firmware(&adapter->firmware, adapter->fw_name,
-                               adapter->dev);
-        if (err < 0) {
-                dev_err(adapter->dev, "request_firmware() returned"
-                                " error code %#x\n", err);
-                ret = -1;
+        if (!firmware) {
+                dev_err(adapter->dev,
+                        "Failed to get firmware %s\n", adapter->fw_name);
                 goto done;
         }
+
+        memset(&fw, 0, sizeof(struct mwifiex_fw_image));
+        adapter->firmware = firmware;
         fw.fw_buf = (u8 *) adapter->firmware->data;
         fw.fw_len = adapter->firmware->size;
 
@@ -335,17 +334,54 @@ static int mwifiex_init_hw_fw(struct mwifiex_adapter *adapter)
         /* Wait for mwifiex_init to complete */
         wait_event_interruptible(adapter->init_wait_q,
                                  adapter->init_wait_q_woken);
-        if (adapter->hw_status != MWIFIEX_HW_STATUS_READY) {
-                ret = -1;
+        if (adapter->hw_status != MWIFIEX_HW_STATUS_READY)
                 goto done;
+
+        priv = adapter->priv[0];
+        if (mwifiex_register_cfg80211(priv) != 0) {
+                dev_err(adapter->dev, "cannot register with cfg80211\n");
+                goto err_init_fw;
+        }
+
+        rtnl_lock();
+        /* Create station interface by default */
+        if (!mwifiex_add_virtual_intf(priv->wdev->wiphy, "mlan%d",
+                                      NL80211_IFTYPE_STATION, NULL, NULL)) {
+                dev_err(adapter->dev, "cannot create default STA interface\n");
+                goto err_add_intf;
         }
-        ret = 0;
+        rtnl_unlock();
+
+        mwifiex_drv_get_driver_version(adapter, fmt, sizeof(fmt) - 1);
+        dev_notice(adapter->dev, "driver_version = %s\n", fmt);
+        goto done;
 
+err_add_intf:
+        mwifiex_del_virtual_intf(priv->wdev->wiphy, priv->netdev);
+        rtnl_unlock();
+err_init_fw:
+        pr_debug("info: %s: unregister device\n", __func__);
+        adapter->if_ops.unregister_dev(adapter);
 done:
-        if (adapter->firmware)
-                release_firmware(adapter->firmware);
-        if (ret)
-                ret = -1;
+        release_firmware(adapter->firmware);
+        complete(&adapter->fw_load);
+        return;
+}
+
+/*
+ * This function initializes the hardware and gets firmware.
+ */
+static int mwifiex_init_hw_fw(struct mwifiex_adapter *adapter)
+{
+        int ret;
+
+        init_completion(&adapter->fw_load);
+        ret = request_firmware_nowait(THIS_MODULE, 1, adapter->fw_name,
+                                      adapter->dev, GFP_KERNEL, adapter,
+                                      mwifiex_fw_dpc);
+        if (ret < 0)
+                dev_err(adapter->dev,
+                        "request_firmware_nowait() returned error %d\n", ret);
         return ret;
 }
 
@@ -650,8 +686,6 @@ mwifiex_add_card(void *card, struct semaphore *sem,
                  struct mwifiex_if_ops *if_ops, u8 iface_type)
 {
         struct mwifiex_adapter *adapter;
-        char fmt[64];
-        struct mwifiex_private *priv;
 
         if (down_interruptible(sem))
                 goto exit_sem_err;
@@ -692,37 +726,9 @@ mwifiex_add_card(void *card, struct semaphore *sem,
                 goto err_init_fw;
         }
 
-        priv = adapter->priv[0];
-
-        if (mwifiex_register_cfg80211(priv) != 0) {
-                dev_err(adapter->dev, "cannot register netdevice"
-                               " with cfg80211\n");
-                        goto err_init_fw;
-        }
-
-        rtnl_lock();
-        /* Create station interface by default */
-        if (!mwifiex_add_virtual_intf(priv->wdev->wiphy, "mlan%d",
-                                      NL80211_IFTYPE_STATION, NULL, NULL)) {
-                rtnl_unlock();
-                dev_err(adapter->dev, "cannot create default station"
-                                " interface\n");
-                goto err_add_intf;
-        }
-
-        rtnl_unlock();
-
         up(sem);
-
-        mwifiex_drv_get_driver_version(adapter, fmt, sizeof(fmt) - 1);
-        dev_notice(adapter->dev, "driver_version = %s\n", fmt);
-
         return 0;
 
-err_add_intf:
-        rtnl_lock();
-        mwifiex_del_virtual_intf(priv->wdev->wiphy, priv->netdev);
-        rtnl_unlock();
 err_init_fw:
         pr_debug("info: %s: unregister device\n", __func__);
         adapter->if_ops.unregister_dev(adapter);
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index fcccf6b1373f..a4000f9608d5 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -260,8 +260,8 @@ struct mwifiex_bssdescriptor {
          * BAND_A(0X04): 'a' band
          */
         u16 bss_band;
-        u64 network_tsf;
-        u8 time_stamp[8];
+        u64 fw_tsf;
+        u64 timestamp;
         union ieee_types_phy_param_set phy_param_set;
         union ieee_types_ss_param_set ss_param_set;
         u16 cap_info_bitmap;
@@ -407,6 +407,8 @@ struct mwifiex_private {
         struct host_cmd_ds_802_11_key_material aes_key;
         u8 wapi_ie[256];
         u8 wapi_ie_len;
+        u8 *wps_ie;
+        u8 wps_ie_len;
         u8 wmm_required;
         u8 wmm_enabled;
         u8 wmm_qosinfo;
@@ -520,6 +522,11 @@ struct cmd_ctrl_node {
         u8 cmd_wait_q_woken;
 };
 
+struct mwifiex_bss_priv {
+        u8 band;
+        u64 fw_tsf;
+};
+
 struct mwifiex_if_ops {
         int (*init_if) (struct mwifiex_adapter *);
         void (*cleanup_if) (struct mwifiex_adapter *);
@@ -653,6 +660,7 @@ struct mwifiex_adapter {
         u8 scan_wait_q_woken;
         struct cmd_ctrl_node *cmd_queued;
         spinlock_t queue_lock;          /* lock for tx queues */
+        struct completion fw_load;
 };
 
 int mwifiex_init_lock_list(struct mwifiex_adapter *adapter);
@@ -950,13 +958,10 @@ int mwifiex_bss_set_channel(struct mwifiex_private *,
 int mwifiex_get_bss_info(struct mwifiex_private *,
                          struct mwifiex_bss_info *);
 int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
-                              u8 *bssid, s32 rssi, u8 *ie_buf,
-                              size_t ie_len, u16 beacon_period,
-                              u16 cap_info_bitmap, u8 band,
+                              struct cfg80211_bss *bss,
                               struct mwifiex_bssdescriptor *bss_desc);
 int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
-                                struct mwifiex_bssdescriptor *bss_entry,
-                                u8 *ie_buf, u32 ie_len);
+                                    struct mwifiex_bssdescriptor *bss_entry);
 int mwifiex_check_network_compatibility(struct mwifiex_private *priv,
                                         struct mwifiex_bssdescriptor *bss_desc);
 
@@ -965,6 +970,7 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                                         u32 *flags, struct vif_params *params);
 int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct net_device *dev);
 
+u8 *mwifiex_11d_code_2_region(u8 code);
 
 #ifdef CONFIG_DEBUG_FS
 void mwifiex_debugfs_init(void);
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 5867facd415d..13fbc4eb1595 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -119,6 +119,9 @@ static void mwifiex_pcie_remove(struct pci_dev *pdev)
         if (!adapter || !adapter->priv_num)
                 return;
 
+        /* In case driver is removed when asynchronous FW load is in progress */
+        wait_for_completion(&adapter->fw_load);
+
         if (user_rmmod) {
 #ifdef CONFIG_PM
                 if (adapter->is_suspended)
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index ef84a1a6742f..74f045715723 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1048,10 +1048,8 @@ mwifiex_ret_802_11_scan_get_tlv_ptrs(struct mwifiex_adapter *adapter,
  * This function parses provided beacon buffer and updates
  * respective fields in bss descriptor structure.
  */
-int
-mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
-                                struct mwifiex_bssdescriptor *bss_entry,
-                                u8 *ie_buf, u32 ie_len)
+int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
+                                    struct mwifiex_bssdescriptor *bss_entry)
 {
         int ret = 0;
         u8 element_id;
@@ -1073,10 +1071,8 @@ mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
 
         found_data_rate_ie = false;
         rate_size = 0;
-        current_ptr = ie_buf;
-        bytes_left = ie_len;
-        bss_entry->beacon_buf = ie_buf;
-        bss_entry->beacon_buf_size = ie_len;
+        current_ptr = bss_entry->beacon_buf;
+        bytes_left = bss_entry->beacon_buf_size;
 
         /* Process variable IE */
         while (bytes_left >= 2) {
@@ -1447,15 +1443,12 @@ int mwifiex_check_network_compatibility(struct mwifiex_private *priv,
         return ret;
 }
 
-static int
-mwifiex_update_curr_bss_params(struct mwifiex_private *priv, u8 *bssid,
-                               s32 rssi, const u8 *ie_buf, size_t ie_len,
-                               u16 beacon_period, u16 cap_info_bitmap, u8 band)
+static int mwifiex_update_curr_bss_params(struct mwifiex_private *priv,
+                                          struct cfg80211_bss *bss)
 {
         struct mwifiex_bssdescriptor *bss_desc;
         int ret;
         unsigned long flags;
-        u8 *beacon_ie;
 
         /* Allocate and fill new bss descriptor */
         bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor),
@@ -1465,16 +1458,7 @@ mwifiex_update_curr_bss_params(struct mwifiex_private *priv, u8 *bssid,
                 return -ENOMEM;
         }
 
-        beacon_ie = kmemdup(ie_buf, ie_len, GFP_KERNEL);
-        if (!beacon_ie) {
-                kfree(bss_desc);
-                dev_err(priv->adapter->dev, " failed to alloc beacon_ie\n");
-                return -ENOMEM;
-        }
-
-        ret = mwifiex_fill_new_bss_desc(priv, bssid, rssi, beacon_ie,
-                                        ie_len, beacon_period,
-                                        cap_info_bitmap, band, bss_desc);
+        ret = mwifiex_fill_new_bss_desc(priv, bss, bss_desc);
         if (ret)
                 goto done;
 
@@ -1514,7 +1498,6 @@ mwifiex_update_curr_bss_params(struct mwifiex_private *priv, u8 *bssid,
 
 done:
         kfree(bss_desc);
-        kfree(beacon_ie);
         return 0;
 }
 
@@ -1620,14 +1603,16 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 const u8 *ie_buf;
                 size_t ie_len;
                 u16 channel = 0;
-                u64 network_tsf = 0;
+                u64 fw_tsf = 0;
                 u16 beacon_size = 0;
                 u32 curr_bcn_bytes;
                 u32 freq;
                 u16 beacon_period;
                 u16 cap_info_bitmap;
                 u8 *current_ptr;
+                u64 timestamp;
                 struct mwifiex_bcn_param *bcn_param;
+                struct mwifiex_bss_priv *bss_priv;
 
                 if (bytes_left >= sizeof(beacon_size)) {
                         /* Extract & convert beacon size from command buffer */
@@ -1671,6 +1656,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 rssi = (-rssi) * 100;           /* Convert dBm to mBm */
                 dev_dbg(adapter->dev, "info: InterpretIE: RSSI=%d\n", rssi);
 
+                timestamp = le64_to_cpu(bcn_param->timestamp);
                 beacon_period = le16_to_cpu(bcn_param->beacon_period);
 
                 cap_info_bitmap = le16_to_cpu(bcn_param->cap_info_bitmap);
@@ -1710,14 +1696,13 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 
                 /*
                  * If the TSF TLV was appended to the scan results, save this
-                 * entry's TSF value in the networkTSF field.The networkTSF is
-                 * the firmware's TSF value at the time the beacon or probe
-                 * response was received.
+                 * entry's TSF value in the fw_tsf field. It is the firmware's
+                 * TSF value at the time the beacon or probe response was
+                 * received.
                  */
                 if (tsf_tlv)
-                        memcpy(&network_tsf,
-                               &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE],
-                               sizeof(network_tsf));
+                        memcpy(&fw_tsf, &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE],
+                               sizeof(fw_tsf));
 
                 if (channel) {
                         struct ieee80211_channel *chan;
@@ -1740,21 +1725,19 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 
                         if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
                                 bss = cfg80211_inform_bss(priv->wdev->wiphy,
-                                              chan, bssid, network_tsf,
+                                              chan, bssid, timestamp,
                                               cap_info_bitmap, beacon_period,
                                               ie_buf, ie_len, rssi, GFP_KERNEL);
-                                *(u8 *)bss->priv = band;
-                                cfg80211_put_bss(bss);
-
+                                bss_priv = (struct mwifiex_bss_priv *)bss->priv;
+                                bss_priv->band = band;
+                                bss_priv->fw_tsf = fw_tsf;
                                 if (priv->media_connected &&
                                     !memcmp(bssid,
                                             priv->curr_bss_params.bss_descriptor
                                             .mac_address, ETH_ALEN))
-                                        mwifiex_update_curr_bss_params
-                                                        (priv, bssid, rssi,
-                                                         ie_buf, ie_len,
-                                                         beacon_period,
-                                                         cap_info_bitmap, band);
+                                        mwifiex_update_curr_bss_params(priv,
+                                                                       bss);
+                                cfg80211_put_bss(bss);
                         }
                 } else {
                         dev_dbg(adapter->dev, "missing BSS channel IE\n");
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index f8012e2b7f7c..1aa45c4295bb 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -123,6 +123,9 @@ mwifiex_sdio_remove(struct sdio_func *func)
         if (!adapter || !adapter->priv_num)
                 return;
 
+        /* In case driver is removed when asynchronous FW load is in progress */
+        wait_for_completion(&adapter->fw_load);
+
         if (user_rmmod) {
                 if (adapter->is_suspended)
                         mwifiex_sdio_resume(adapter->dev);
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index e90c34d9c63d..1f7110577b9d 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -988,7 +988,7 @@ mwifiex_cmd_802_11_subsc_evt(struct mwifiex_private *priv,
                 rssi_tlv->abs_value = subsc_evt_cfg->bcn_h_rssi_cfg.abs_value;
                 rssi_tlv->evt_freq = subsc_evt_cfg->bcn_h_rssi_cfg.evt_freq;
 
-                dev_dbg(priv->adapter->dev, "Cfg Beacon Low Rssi event, "
+                dev_dbg(priv->adapter->dev, "Cfg Beacon High Rssi event, "
                         "RSSI:-%d dBm, Freq:%d\n",
                         subsc_evt_cfg->bcn_h_rssi_cfg.abs_value,
                         subsc_evt_cfg->bcn_h_rssi_cfg.evt_freq);
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 8ba58d935328..58970e0f7d13 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -155,20 +155,29 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
  * information.
  */
 int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
-                              u8 *bssid, s32 rssi, u8 *ie_buf,
-                              size_t ie_len, u16 beacon_period,
-                              u16 cap_info_bitmap, u8 band,
+                              struct cfg80211_bss *bss,
                               struct mwifiex_bssdescriptor *bss_desc)
 {
         int ret;
+        u8 *beacon_ie;
+        struct mwifiex_bss_priv *bss_priv = (void *)bss->priv;
 
-        memcpy(bss_desc->mac_address, bssid, ETH_ALEN);
-        bss_desc->rssi = rssi;
-        bss_desc->beacon_buf = ie_buf;
-        bss_desc->beacon_buf_size = ie_len;
-        bss_desc->beacon_period = beacon_period;
-        bss_desc->cap_info_bitmap = cap_info_bitmap;
-        bss_desc->bss_band = band;
+        beacon_ie = kmemdup(bss->information_elements, bss->len_beacon_ies,
+                            GFP_KERNEL);
+        if (!beacon_ie) {
+                dev_err(priv->adapter->dev, " failed to alloc beacon_ie\n");
+                return -ENOMEM;
+        }
+
+        memcpy(bss_desc->mac_address, bss->bssid, ETH_ALEN);
+        bss_desc->rssi = bss->signal;
+        bss_desc->beacon_buf = beacon_ie;
+        bss_desc->beacon_buf_size = bss->len_beacon_ies;
+        bss_desc->beacon_period = bss->beacon_interval;
+        bss_desc->cap_info_bitmap = bss->capability;
+        bss_desc->bss_band = bss_priv->band;
+        bss_desc->fw_tsf = bss_priv->fw_tsf;
+        bss_desc->timestamp = bss->tsf;
         if (bss_desc->cap_info_bitmap & WLAN_CAPABILITY_PRIVACY) {
                 dev_dbg(priv->adapter->dev, "info: InterpretIE: AP WEP enabled\n");
                 bss_desc->privacy = MWIFIEX_802_11_PRIV_FILTER_8021X_WEP;
@@ -180,9 +189,9 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
         else
                 bss_desc->bss_mode = NL80211_IFTYPE_STATION;
 
-        ret = mwifiex_update_bss_desc_with_ie(priv->adapter, bss_desc,
-                                              ie_buf, ie_len);
+        ret = mwifiex_update_bss_desc_with_ie(priv->adapter, bss_desc);
 
+        kfree(beacon_ie);
         return ret;
 }
 
@@ -197,7 +206,6 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
         int ret;
         struct mwifiex_adapter *adapter = priv->adapter;
         struct mwifiex_bssdescriptor *bss_desc = NULL;
-        u8 *beacon_ie = NULL;
 
         priv->scan_block = false;
 
@@ -210,19 +218,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                         return -ENOMEM;
                 }
 
-                beacon_ie = kmemdup(bss->information_elements,
-                                        bss->len_beacon_ies, GFP_KERNEL);
-                if (!beacon_ie) {
-                        kfree(bss_desc);
-                        dev_err(priv->adapter->dev, " failed to alloc beacon_ie\n");
-                        return -ENOMEM;
-                }
-
-                ret = mwifiex_fill_new_bss_desc(priv, bss->bssid, bss->signal,
-                                                beacon_ie, bss->len_beacon_ies,
-                                                bss->beacon_interval,
-                                                bss->capability,
-                                                *(u8 *)bss->priv, bss_desc);
+                ret = mwifiex_fill_new_bss_desc(priv, bss, bss_desc);
                 if (ret)
                         goto done;
         }
@@ -269,7 +265,6 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                     (!mwifiex_ssid_cmp(&priv->curr_bss_params.bss_descriptor.
                                        ssid, &bss_desc->ssid))) {
                         kfree(bss_desc);
-                        kfree(beacon_ie);
                         return 0;
                 }
 
@@ -304,7 +299,6 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
 
 done:
         kfree(bss_desc);
-        kfree(beacon_ie);
         return ret;
 }
 
@@ -468,7 +462,8 @@ int mwifiex_get_bss_info(struct mwifiex_private *priv,
 
         info->bss_chan = bss_desc->channel;
 
-        info->region_code = adapter->region_code;
+        memcpy(info->country_code, priv->country_code,
+               IEEE80211_COUNTRY_STRING_LEN);
 
         info->media_connected = priv->media_connected;
 
@@ -996,6 +991,39 @@ static int mwifiex_set_wapi_ie(struct mwifiex_private *priv,
 }
 
 /*
+ * IOCTL request handler to set/reset WPS IE.
+ *
+ * The supplied WPS IE is treated as a opaque buffer. Only the first field
+ * is checked to internally enable WPS. If buffer length is zero, the existing
+ * WPS IE is reset.
+ */
+static int mwifiex_set_wps_ie(struct mwifiex_private *priv,
+                               u8 *ie_data_ptr, u16 ie_len)
+{
+        if (ie_len) {
+                priv->wps_ie = kzalloc(MWIFIEX_MAX_VSIE_LEN, GFP_KERNEL);
+                if (!priv->wps_ie)
+                        return -ENOMEM;
+                if (ie_len > sizeof(priv->wps_ie)) {
+                        dev_dbg(priv->adapter->dev,
+                                "info: failed to copy WPS IE, too big\n");
+                        kfree(priv->wps_ie);
+                        return -1;
+                }
+                memcpy(priv->wps_ie, ie_data_ptr, ie_len);
+                priv->wps_ie_len = ie_len;
+                dev_dbg(priv->adapter->dev, "cmd: Set wps_ie_len=%d IE=%#x\n",
+                        priv->wps_ie_len, priv->wps_ie[0]);
+        } else {
+                kfree(priv->wps_ie);
+                priv->wps_ie_len = ie_len;
+                dev_dbg(priv->adapter->dev,
+                        "info: Reset wps_ie_len=%d\n", priv->wps_ie_len);
+        }
+        return 0;
+}
+
+/*
  * IOCTL request handler to set WAPI key.
  *
  * This function prepares the correct firmware command and
@@ -1408,6 +1436,7 @@ mwifiex_set_gen_ie_helper(struct mwifiex_private *priv, u8 *ie_data_ptr,
                         priv->wps.session_enable = true;
                         dev_dbg(priv->adapter->dev,
                                 "info: WPS Session Enabled.\n");
+                        ret = mwifiex_set_wps_ie(priv, ie_data_ptr, ie_len);
                 }
 
                 /* Append the passed data to the end of the
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index b48674b577e6..e30cc32f8279 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -5893,18 +5893,7 @@ static struct pci_driver mwl8k_driver = {
         .shutdown       = __devexit_p(mwl8k_shutdown),
 };
 
-static int __init mwl8k_init(void)
-{
-        return pci_register_driver(&mwl8k_driver);
-}
-
-static void __exit mwl8k_exit(void)
-{
-        pci_unregister_driver(&mwl8k_driver);
-}
-
-module_init(mwl8k_init);
-module_exit(mwl8k_exit);
+module_pci_driver(mwl8k_driver);
 
 MODULE_DESCRIPTION(MWL8K_DESC);
 MODULE_VERSION(MWL8K_VERSION);
diff --git a/drivers/net/wireless/orinoco/fw.c b/drivers/net/wireless/orinoco/fw.c
index 4df8cf64b56c..400a35217644 100644
--- a/drivers/net/wireless/orinoco/fw.c
+++ b/drivers/net/wireless/orinoco/fw.c
@@ -379,11 +379,8 @@ void orinoco_cache_fw(struct orinoco_private *priv, int ap)
 
 void orinoco_uncache_fw(struct orinoco_private *priv)
 {
-        if (priv->cached_pri_fw)
-                release_firmware(priv->cached_pri_fw);
-        if (priv->cached_fw)
-                release_firmware(priv->cached_fw);
-
+        release_firmware(priv->cached_pri_fw);
+        release_firmware(priv->cached_fw);
         priv->cached_pri_fw = NULL;
         priv->cached_fw = NULL;
 }
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 45df728183fd..89318adc8c7f 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -667,15 +667,4 @@ static struct pci_driver p54p_driver = {
         .driver.pm      = P54P_PM_OPS,
 };
 
-static int __init p54p_init(void)
-{
-        return pci_register_driver(&p54p_driver);
-}
-
-static void __exit p54p_exit(void)
-{
-        pci_unregister_driver(&p54p_driver);
-}
-
-module_init(p54p_init);
-module_exit(p54p_exit);
+module_pci_driver(p54p_driver);
diff --git a/drivers/net/wireless/prism54/oid_mgt.c b/drivers/net/wireless/prism54/oid_mgt.c
index 9b796cae4afe..a01606b36e03 100644
--- a/drivers/net/wireless/prism54/oid_mgt.c
+++ b/drivers/net/wireless/prism54/oid_mgt.c
@@ -693,8 +693,6 @@ mgt_update_addr(islpci_private *priv)
         return ret;
 }
 
-#define VEC_SIZE(a) ARRAY_SIZE(a)
-
 int
 mgt_commit(islpci_private *priv)
 {
@@ -704,10 +702,10 @@ mgt_commit(islpci_private *priv)
         if (islpci_get_state(priv) < PRV_STATE_INIT)
                 return 0;
 
-        rvalue = mgt_commit_list(priv, commit_part1, VEC_SIZE(commit_part1));
+        rvalue = mgt_commit_list(priv, commit_part1, ARRAY_SIZE(commit_part1));
 
         if (priv->iw_mode != IW_MODE_MONITOR)
-                rvalue |= mgt_commit_list(priv, commit_part2, VEC_SIZE(commit_part2));
+                rvalue |= mgt_commit_list(priv, commit_part2, ARRAY_SIZE(commit_part2));
 
         u = OID_INL_MODE;
         rvalue |= mgt_commit_list(priv, &u, 1);
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 3a6b40239bc1..5e6b50143165 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1828,15 +1828,4 @@ static struct pci_driver rt2400pci_driver = {
         .resume         = rt2x00pci_resume,
 };
 
-static int __init rt2400pci_init(void)
-{
-        return pci_register_driver(&rt2400pci_driver);
-}
-
-static void __exit rt2400pci_exit(void)
-{
-        pci_unregister_driver(&rt2400pci_driver);
-}
-
-module_init(rt2400pci_init);
-module_exit(rt2400pci_exit);
+module_pci_driver(rt2400pci_driver);
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index dcc0e1fcca77..136b849f11b5 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -2119,15 +2119,4 @@ static struct pci_driver rt2500pci_driver = {
         .resume         = rt2x00pci_resume,
 };
 
-static int __init rt2500pci_init(void)
-{
-        return pci_register_driver(&rt2500pci_driver);
-}
-
-static void __exit rt2500pci_exit(void)
-{
-        pci_unregister_driver(&rt2500pci_driver);
-}
-
-module_init(rt2500pci_init);
-module_exit(rt2500pci_exit);
+module_pci_driver(rt2500pci_driver);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 1de9c752c88b..c88fd3e61090 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1912,7 +1912,7 @@ static struct usb_device_id rt2500usb_device_table[] = {
         { USB_DEVICE(0x0b05, 0x1706) },
         { USB_DEVICE(0x0b05, 0x1707) },
         /* Belkin */
-        { USB_DEVICE(0x050d, 0x7050) },
+        { USB_DEVICE(0x050d, 0x7050) }, /* FCC ID: K7SF5D7050A ver. 2.x */
         { USB_DEVICE(0x050d, 0x7051) },
         /* Cisco Systems */
         { USB_DEVICE(0x13b1, 0x000d) },
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 6c0a12ea6a15..bd1980202f19 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -290,11 +290,25 @@ int rt2800_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev)
                 msleep(10);
         }
 
-        ERROR(rt2x00dev, "WPDMA TX/RX busy, aborting.\n");
+        ERROR(rt2x00dev, "WPDMA TX/RX busy [0x%08x].\n", reg);
         return -EACCES;
 }
 EXPORT_SYMBOL_GPL(rt2800_wait_wpdma_ready);
 
+void rt2800_disable_wpdma(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+}
+EXPORT_SYMBOL_GPL(rt2800_disable_wpdma);
+
 static bool rt2800_check_firmware_crc(const u8 *data, const size_t len)
 {
         u16 fw_crc;
@@ -412,6 +426,8 @@ int rt2800_load_firmware(struct rt2x00_dev *rt2x00dev,
                 rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000002);
         }
 
+        rt2800_disable_wpdma(rt2x00dev);
+
         /*
          * Write firmware to the device.
          */
@@ -436,10 +452,7 @@ int rt2800_load_firmware(struct rt2x00_dev *rt2x00dev,
          * Disable DMA, will be reenabled later when enabling
          * the radio.
          */
-        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
-        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+        rt2800_disable_wpdma(rt2x00dev);
 
         /*
          * Initialize firmware.
@@ -2717,13 +2730,7 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
         unsigned int i;
         int ret;
 
-        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
-        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+        rt2800_disable_wpdma(rt2x00dev);
 
         ret = rt2800_drv_init_registers(rt2x00dev);
         if (ret)
@@ -3997,10 +4004,7 @@ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
-        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+        rt2800_disable_wpdma(rt2x00dev);
 
         /* Wait for DMA, ignore error */
         rt2800_wait_wpdma_ready(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
index 419e36cb06be..18a0b67b4c68 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.h
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -208,5 +208,6 @@ int rt2800_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         u8 buf_size);
 int rt2800_get_survey(struct ieee80211_hw *hw, int idx,
                       struct survey_info *survey);
+void rt2800_disable_wpdma(struct rt2x00_dev *rt2x00dev);
 
 #endif /* RT2800LIB_H */
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 0397bbf0ce01..931331d95217 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -361,7 +361,6 @@ static void rt2800pci_clear_entry(struct queue_entry *entry)
 static int rt2800pci_init_queues(struct rt2x00_dev *rt2x00dev)
 {
         struct queue_entry_priv_pci *entry_priv;
-        u32 reg;
 
         /*
          * Initialize registers.
@@ -394,6 +393,16 @@ static int rt2800pci_init_queues(struct rt2x00_dev *rt2x00dev)
         rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX3, 0);
         rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX3, 0);
 
+        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR4, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT4, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX4, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX4, 0);
+
+        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR5, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT5, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX5, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX5, 0);
+
         entry_priv = rt2x00dev->rx->entries[0].priv_data;
         rt2x00pci_register_write(rt2x00dev, RX_BASE_PTR, entry_priv->desc_dma);
         rt2x00pci_register_write(rt2x00dev, RX_MAX_CNT,
@@ -402,14 +411,7 @@ static int rt2800pci_init_queues(struct rt2x00_dev *rt2x00dev)
                                  rt2x00dev->rx[0].limit - 1);
         rt2x00pci_register_write(rt2x00dev, RX_DRX_IDX, 0);
 
-        /*
-         * Enable global DMA configuration
-         */
-        rt2x00pci_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
-        rt2x00pci_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+        rt2800_disable_wpdma(rt2x00dev);
 
         rt2x00pci_register_write(rt2x00dev, DELAY_INT_CFG, 0);
 
@@ -504,8 +506,10 @@ static int rt2800pci_enable_radio(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
 
-        if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
-                     rt2800pci_init_queues(rt2x00dev)))
+        /* Wait for DMA, ignore error until we initialize queues. */
+        rt2800_wait_wpdma_ready(rt2x00dev);
+
+        if (unlikely(rt2800pci_init_queues(rt2x00dev)))
                 return -EIO;
 
         retval = rt2800_enable_radio(rt2x00dev);
@@ -1184,7 +1188,9 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
         { PCI_DEVICE(0x1814, 0x3593) },
 #endif
 #ifdef CONFIG_RT2800PCI_RT53XX
+        { PCI_DEVICE(0x1814, 0x5362) },
         { PCI_DEVICE(0x1814, 0x5390) },
+        { PCI_DEVICE(0x1814, 0x5392) },
         { PCI_DEVICE(0x1814, 0x539a) },
         { PCI_DEVICE(0x1814, 0x539f) },
 #endif
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 90cc5e772650..dd87d41ac936 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -391,9 +391,10 @@ void rt2x00lib_txdone(struct queue_entry *entry,
                 tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
                 tx_info->status.ampdu_len = 1;
                 tx_info->status.ampdu_ack_len = success ? 1 : 0;
-
-                if (!success)
-                        tx_info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
+                /*
+                 * TODO: Need to tear down BA session here
+                 * if not successful.
+                 */
         }
 
         if (rate_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index e0c6d117429d..ee22bd74579d 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -3092,15 +3092,4 @@ static struct pci_driver rt61pci_driver = {
         .resume         = rt2x00pci_resume,
 };
 
-static int __init rt61pci_init(void)
-{
-        return pci_register_driver(&rt61pci_driver);
-}
-
-static void __exit rt61pci_exit(void)
-{
-        pci_unregister_driver(&rt61pci_driver);
-}
-
-module_init(rt61pci_init);
-module_exit(rt61pci_exit);
+module_pci_driver(rt61pci_driver);
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index e477a964081d..155136691a38 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2412,6 +2412,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x0b05, 0x1723) },
         { USB_DEVICE(0x0b05, 0x1724) },
         /* Belkin */
+        { USB_DEVICE(0x050d, 0x7050) }, /* FCC ID: K7SF5D7050B ver. 3.x */
         { USB_DEVICE(0x050d, 0x705a) },
         { USB_DEVICE(0x050d, 0x905b) },
         { USB_DEVICE(0x050d, 0x905c) },
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index 2f14a5fb0cbb..2bebcb71a1e9 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -1173,15 +1173,4 @@ static struct pci_driver rtl8180_driver = {
 #endif /* CONFIG_PM */
 };
 
-static int __init rtl8180_init(void)
-{
-        return pci_register_driver(&rtl8180_driver);
-}
-
-static void __exit rtl8180_exit(void)
-{
-        pci_unregister_driver(&rtl8180_driver);
-}
-
-module_init(rtl8180_init);
-module_exit(rtl8180_exit);
+module_pci_driver(rtl8180_driver);
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index cf53ac9d6f23..d8114962b0c9 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -294,6 +294,7 @@ static void rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
                 hdr->retry = cpu_to_le32((info->control.rates[0].count - 1) << 8);
                 hdr->tx_duration =
                         ieee80211_generic_frame_duration(dev, priv->vif,
+                                                         info->band,
                                                          skb->len, txrate);
                 buf = hdr;
 
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 288b035a3579..81d0c9b34328 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -34,6 +34,7 @@
 #include "ps.h"
 #include "efuse.h"
 #include <linux/export.h>
+#include <linux/kmemleak.h>
 
 static const u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
         PCI_VENDOR_ID_INTEL,
@@ -1099,6 +1100,7 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw)
                         u32 bufferaddress;
                         if (!skb)
                                 return 0;
+                        kmemleak_not_leak(skb);
                         entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];
 
                         /*skb->dev = dev; */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index c20b3c30f62e..692c8ef5ee89 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -34,6 +34,7 @@
 #include "../rtl8192ce/def.h"
 #include "fw_common.h"
 #include <linux/export.h>
+#include <linux/kmemleak.h>
 
 static void _rtl92c_enable_fw_download(struct ieee80211_hw *hw, bool enable)
 {
@@ -776,6 +777,8 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished)
         skb = dev_alloc_skb(totalpacketlen);
         if (!skb)
                 return;
+        kmemleak_not_leak(skb);
+
         memcpy((u8 *) skb_put(skb, totalpacketlen),
                &reserved_page_packet, totalpacketlen);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index 2c3b73366cd2..3aa927f8b9b9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -389,21 +389,4 @@ static struct pci_driver rtl92ce_driver = {
         .driver.pm = &rtlwifi_pm_ops,
 };
 
-static int __init rtl92ce_module_init(void)
-{
-        int ret;
-
-        ret = pci_register_driver(&rtl92ce_driver);
-        if (ret)
-                RT_ASSERT(false, "No device found\n");
-
-        return ret;
-}
-
-static void __exit rtl92ce_module_exit(void)
-{
-        pci_unregister_driver(&rtl92ce_driver);
-}
-
-module_init(rtl92ce_module_init);
-module_exit(rtl92ce_module_exit);
+module_pci_driver(rtl92ce_driver);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 82c85286ab2e..7737fb0c6661 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -338,6 +338,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x2019, 0x1201, rtl92cu_hal_cfg)}, /*Planex-Vencer*/
 
         /****** 8192CU ********/
+        {RTL_USB_DEVICE(0x050d, 0x1004, rtl92cu_hal_cfg)}, /*Belcom-SurfN300*/
         {RTL_USB_DEVICE(0x050d, 0x2102, rtl92cu_hal_cfg)}, /*Belcom-Sercomm*/
         {RTL_USB_DEVICE(0x050d, 0x2103, rtl92cu_hal_cfg)}, /*Belcom-Edimax*/
         {RTL_USB_DEVICE(0x0586, 0x341f, rtl92cu_hal_cfg)}, /*Zyxel -Abocom*/
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/def.h b/drivers/net/wireless/rtlwifi/rtl8192de/def.h
index eafdf76ed64d..939c905f547f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/def.h
@@ -151,9 +151,6 @@ enum version_8192d {
 
 /* for 92D */
 #define CHIP_92D_SINGLEPHY              BIT(9)
-#define C_CUT_VERSION                   BIT(13)
-#define D_CUT_VERSION                   ((BIT(12)|BIT(13)))
-#define E_CUT_VERSION                   BIT(14)
 
 /* Chip specific */
 #define CHIP_BONDING_IDENTIFIER(_value) (((_value)>>22)&0x3)
@@ -173,7 +170,10 @@ enum version_8192d {
 #define RF_TYPE_1T2R                    BIT(4)
 #define RF_TYPE_2T2R                    BIT(5)
 #define CHIP_VENDOR_UMC                 BIT(7)
-#define B_CUT_VERSION                   BIT(12)
+#define CHIP_92D_B_CUT                  BIT(12)
+#define CHIP_92D_C_CUT                  BIT(13)
+#define CHIP_92D_D_CUT                  (BIT(13)|BIT(12))
+#define CHIP_92D_E_CUT                  BIT(14)
 
 /* MASK */
 #define IC_TYPE_MASK                    (BIT(0)|BIT(1)|BIT(2))
@@ -205,15 +205,13 @@ enum version_8192d {
                                          CHIP_92D) ? true : false)
 #define IS_92D_C_CUT(version)           ((IS_92D(version)) ?            \
                                  ((GET_CVID_CUT_VERSION(version) ==     \
-                                 0x2000) ? true : false) : false)
+                                 CHIP_92D_C_CUT) ? true : false) : false)
 #define IS_92D_D_CUT(version)                   ((IS_92D(version)) ?    \
                                  ((GET_CVID_CUT_VERSION(version) ==     \
-                                 0x3000) ? true : false) : false)
+                                 CHIP_92D_D_CUT) ? true : false) : false)
 #define IS_92D_E_CUT(version)           ((IS_92D(version)) ?            \
                                  ((GET_CVID_CUT_VERSION(version) ==     \
-                                 0x4000) ? true : false) : false)
-#define CHIP_92D_C_CUT                  BIT(10)
-#define CHIP_92D_D_CUT                  BIT(11)
+                                 CHIP_92D_E_CUT) ? true : false) : false)
 
 enum rf_optype {
         RF_OP_BY_SW_3WIRE = 0,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
index 7ac9b8cb2ced..b338d526c422 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
@@ -1743,6 +1743,10 @@ static void _rtl92de_efuse_update_chip_version(struct ieee80211_hw *hw)
                 chipver |= CHIP_92D_D_CUT;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "D-CUT!!!\n");
                 break;
+        case 0xCC33:
+                chipver |= CHIP_92D_E_CUT;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "E-CUT!!!\n");
+                break;
         default:
                 chipver |= CHIP_92D_D_CUT;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_EMERG, "Unknown CUT!\n");
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index f1b36005c6a2..730bcc919529 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -450,21 +450,4 @@ static struct pci_driver rtl92se_driver = {
         .driver.pm = &rtlwifi_pm_ops,
 };
 
-static int __init rtl92se_module_init(void)
-{
-        int ret = 0;
-
-        ret = pci_register_driver(&rtl92se_driver);
-        if (ret)
-                RT_ASSERT(false, "No device found\n");
-
-        return ret;
-}
-
-static void __exit rtl92se_module_exit(void)
-{
-        pci_unregister_driver(&rtl92se_driver);
-}
-
-module_init(rtl92se_module_init);
-module_exit(rtl92se_module_exit);
+module_pci_driver(rtl92se_driver);
diff --git a/drivers/net/wireless/ti/Kconfig b/drivers/net/wireless/ti/Kconfig
new file mode 100644
index 000000000000..1a72932e2213
--- /dev/null
+++ b/drivers/net/wireless/ti/Kconfig
@@ -0,0 +1,14 @@
+menuconfig WL_TI
+        bool "TI Wireless LAN support"
+        ---help---
+          This section contains support for all the wireless drivers
+          for Texas Instruments WLAN chips, such as wl1251 and the wl12xx
+          family.
+
+if WL_TI
+source "drivers/net/wireless/ti/wl1251/Kconfig"
+source "drivers/net/wireless/ti/wl12xx/Kconfig"
+
+# keep last for automatic dependencies
+source "drivers/net/wireless/ti/wlcore/Kconfig"
+endif # WL_TI
diff --git a/drivers/net/wireless/ti/Makefile b/drivers/net/wireless/ti/Makefile
new file mode 100644
index 000000000000..0a565622d4a4
--- /dev/null
+++ b/drivers/net/wireless/ti/Makefile
@@ -0,0 +1,4 @@
+obj-$(CONFIG_WLCORE)                    += wlcore/
+obj-$(CONFIG_WL12XX)                    += wl12xx/
+obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wlcore/
+obj-$(CONFIG_WL1251)                    += wl1251/
diff --git a/drivers/net/wireless/wl1251/Kconfig b/drivers/net/wireless/ti/wl1251/Kconfig
index 1fb65849414f..1fb65849414f 100644
--- a/drivers/net/wireless/wl1251/Kconfig
+++ b/drivers/net/wireless/ti/wl1251/Kconfig
diff --git a/drivers/net/wireless/wl1251/Makefile b/drivers/net/wireless/ti/wl1251/Makefile
index a5c6328b5f72..a5c6328b5f72 100644
--- a/drivers/net/wireless/wl1251/Makefile
+++ b/drivers/net/wireless/ti/wl1251/Makefile
diff --git a/drivers/net/wireless/wl1251/acx.c b/drivers/net/wireless/ti/wl1251/acx.c
index ad87a1ac6462..ad87a1ac6462 100644
--- a/drivers/net/wireless/wl1251/acx.c
+++ b/drivers/net/wireless/ti/wl1251/acx.c
diff --git a/drivers/net/wireless/wl1251/acx.h b/drivers/net/wireless/ti/wl1251/acx.h
index c2ba100f9b1a..c2ba100f9b1a 100644
--- a/drivers/net/wireless/wl1251/acx.h
+++ b/drivers/net/wireless/ti/wl1251/acx.h
diff --git a/drivers/net/wireless/wl1251/boot.c b/drivers/net/wireless/ti/wl1251/boot.c
index a2e5241382da..a2e5241382da 100644
--- a/drivers/net/wireless/wl1251/boot.c
+++ b/drivers/net/wireless/ti/wl1251/boot.c
diff --git a/drivers/net/wireless/wl1251/boot.h b/drivers/net/wireless/ti/wl1251/boot.h
index 7661bc5e4662..7661bc5e4662 100644
--- a/drivers/net/wireless/wl1251/boot.h
+++ b/drivers/net/wireless/ti/wl1251/boot.h
diff --git a/drivers/net/wireless/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c
index d14d69d733a0..d14d69d733a0 100644
--- a/drivers/net/wireless/wl1251/cmd.c
+++ b/drivers/net/wireless/ti/wl1251/cmd.c
diff --git a/drivers/net/wireless/wl1251/cmd.h b/drivers/net/wireless/ti/wl1251/cmd.h
index ee4f2b391822..ee4f2b391822 100644
--- a/drivers/net/wireless/wl1251/cmd.h
+++ b/drivers/net/wireless/ti/wl1251/cmd.h
diff --git a/drivers/net/wireless/wl1251/debugfs.c b/drivers/net/wireless/ti/wl1251/debugfs.c
index 448da1f8c22f..448da1f8c22f 100644
--- a/drivers/net/wireless/wl1251/debugfs.c
+++ b/drivers/net/wireless/ti/wl1251/debugfs.c
diff --git a/drivers/net/wireless/wl1251/debugfs.h b/drivers/net/wireless/ti/wl1251/debugfs.h
index b3417c02a218..b3417c02a218 100644
--- a/drivers/net/wireless/wl1251/debugfs.h
+++ b/drivers/net/wireless/ti/wl1251/debugfs.h
diff --git a/drivers/net/wireless/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index 9f15ccaf8f05..9f15ccaf8f05 100644
--- a/drivers/net/wireless/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
diff --git a/drivers/net/wireless/wl1251/event.h b/drivers/net/wireless/ti/wl1251/event.h
index 30eb5d150bf7..30eb5d150bf7 100644
--- a/drivers/net/wireless/wl1251/event.h
+++ b/drivers/net/wireless/ti/wl1251/event.h
diff --git a/drivers/net/wireless/wl1251/init.c b/drivers/net/wireless/ti/wl1251/init.c
index 89b43d35473c..89b43d35473c 100644
--- a/drivers/net/wireless/wl1251/init.c
+++ b/drivers/net/wireless/ti/wl1251/init.c
diff --git a/drivers/net/wireless/wl1251/init.h b/drivers/net/wireless/ti/wl1251/init.h
index 543f17582ead..543f17582ead 100644
--- a/drivers/net/wireless/wl1251/init.h
+++ b/drivers/net/wireless/ti/wl1251/init.h
diff --git a/drivers/net/wireless/wl1251/io.c b/drivers/net/wireless/ti/wl1251/io.c
index cdcadbf6ac2c..cdcadbf6ac2c 100644
--- a/drivers/net/wireless/wl1251/io.c
+++ b/drivers/net/wireless/ti/wl1251/io.c
diff --git a/drivers/net/wireless/wl1251/io.h b/drivers/net/wireless/ti/wl1251/io.h
index d382877c34cc..d382877c34cc 100644
--- a/drivers/net/wireless/wl1251/io.h
+++ b/drivers/net/wireless/ti/wl1251/io.h
diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 41302c7b1ad0..41302c7b1ad0 100644
--- a/drivers/net/wireless/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
diff --git a/drivers/net/wireless/wl1251/ps.c b/drivers/net/wireless/ti/wl1251/ps.c
index db719f7d2692..db719f7d2692 100644
--- a/drivers/net/wireless/wl1251/ps.c
+++ b/drivers/net/wireless/ti/wl1251/ps.c
diff --git a/drivers/net/wireless/wl1251/ps.h b/drivers/net/wireless/ti/wl1251/ps.h
index 75efad246d67..75efad246d67 100644
--- a/drivers/net/wireless/wl1251/ps.h
+++ b/drivers/net/wireless/ti/wl1251/ps.h
diff --git a/drivers/net/wireless/wl1251/reg.h b/drivers/net/wireless/ti/wl1251/reg.h
index a5809019c5c1..a5809019c5c1 100644
--- a/drivers/net/wireless/wl1251/reg.h
+++ b/drivers/net/wireless/ti/wl1251/reg.h
diff --git a/drivers/net/wireless/wl1251/rx.c b/drivers/net/wireless/ti/wl1251/rx.c
index 6af35265c900..6af35265c900 100644
--- a/drivers/net/wireless/wl1251/rx.c
+++ b/drivers/net/wireless/ti/wl1251/rx.c
diff --git a/drivers/net/wireless/wl1251/rx.h b/drivers/net/wireless/ti/wl1251/rx.h
index 4448f635a4d8..4448f635a4d8 100644
--- a/drivers/net/wireless/wl1251/rx.h
+++ b/drivers/net/wireless/ti/wl1251/rx.h
diff --git a/drivers/net/wireless/wl1251/sdio.c b/drivers/net/wireless/ti/wl1251/sdio.c
index f78694295c39..f78694295c39 100644
--- a/drivers/net/wireless/wl1251/sdio.c
+++ b/drivers/net/wireless/ti/wl1251/sdio.c
diff --git a/drivers/net/wireless/wl1251/spi.c b/drivers/net/wireless/ti/wl1251/spi.c
index 6248c354fc5c..6248c354fc5c 100644
--- a/drivers/net/wireless/wl1251/spi.c
+++ b/drivers/net/wireless/ti/wl1251/spi.c
diff --git a/drivers/net/wireless/wl1251/spi.h b/drivers/net/wireless/ti/wl1251/spi.h
index 16d506955cc0..16d506955cc0 100644
--- a/drivers/net/wireless/wl1251/spi.h
+++ b/drivers/net/wireless/ti/wl1251/spi.h
diff --git a/drivers/net/wireless/wl1251/tx.c b/drivers/net/wireless/ti/wl1251/tx.c
index 28121c590a2b..28121c590a2b 100644
--- a/drivers/net/wireless/wl1251/tx.c
+++ b/drivers/net/wireless/ti/wl1251/tx.c
diff --git a/drivers/net/wireless/wl1251/tx.h b/drivers/net/wireless/ti/wl1251/tx.h
index 81338d39b43e..81338d39b43e 100644
--- a/drivers/net/wireless/wl1251/tx.h
+++ b/drivers/net/wireless/ti/wl1251/tx.h
diff --git a/drivers/net/wireless/wl1251/wl1251.h b/drivers/net/wireless/ti/wl1251/wl1251.h
index 9d8f5816c6f9..9d8f5816c6f9 100644
--- a/drivers/net/wireless/wl1251/wl1251.h
+++ b/drivers/net/wireless/ti/wl1251/wl1251.h
diff --git a/drivers/net/wireless/wl1251/wl12xx_80211.h b/drivers/net/wireless/ti/wl1251/wl12xx_80211.h
index 04ed51495772..04ed51495772 100644
--- a/drivers/net/wireless/wl1251/wl12xx_80211.h
+++ b/drivers/net/wireless/ti/wl1251/wl12xx_80211.h
diff --git a/drivers/net/wireless/ti/wl12xx/Kconfig b/drivers/net/wireless/ti/wl12xx/Kconfig
new file mode 100644
index 000000000000..5b92329122c4
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/Kconfig
@@ -0,0 +1,8 @@
+config WL12XX
+       tristate "TI wl12xx support"
+       select WLCORE
+       ---help---
+          This module adds support for wireless adapters based on TI wl1271,
+          wl1273, wl1281 and wl1283 chipsets. This module does *not* include
+          support for wl1251.  For wl1251 support, use the separate homonymous
+           driver instead.
diff --git a/drivers/net/wireless/ti/wl12xx/Makefile b/drivers/net/wireless/ti/wl12xx/Makefile
new file mode 100644
index 000000000000..87f64b14db35
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/Makefile
@@ -0,0 +1,3 @@
+wl12xx-objs     = main.o cmd.o acx.o
+
+obj-$(CONFIG_WL12XX)            += wl12xx.o
diff --git a/drivers/net/wireless/ti/wl12xx/acx.c b/drivers/net/wireless/ti/wl12xx/acx.c
new file mode 100644
index 000000000000..bea06b2d7bf4
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/acx.c
@@ -0,0 +1,53 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "../wlcore/cmd.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/acx.h"
+
+#include "acx.h"
+
+int wl1271_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap)
+{
+        struct wl1271_acx_host_config_bitmap *bitmap_conf;
+        int ret;
+
+        bitmap_conf = kzalloc(sizeof(*bitmap_conf), GFP_KERNEL);
+        if (!bitmap_conf) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        bitmap_conf->host_cfg_bitmap = cpu_to_le32(host_cfg_bitmap);
+
+        ret = wl1271_cmd_configure(wl, ACX_HOST_IF_CFG_BITMAP,
+                                   bitmap_conf, sizeof(*bitmap_conf));
+        if (ret < 0) {
+                wl1271_warning("wl1271 bitmap config opt failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(bitmap_conf);
+
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl12xx/acx.h b/drivers/net/wireless/ti/wl12xx/acx.h
new file mode 100644
index 000000000000..d1f5aba0afce
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/acx.h
@@ -0,0 +1,36 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 1998-2009, 2011 Texas Instruments. All rights reserved.
+ * Copyright (C) 2008-2010 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_ACX_H__
+#define __WL12XX_ACX_H__
+
+#include "../wlcore/wlcore.h"
+
+struct wl1271_acx_host_config_bitmap {
+        struct acx_header header;
+
+        __le32 host_cfg_bitmap;
+} __packed;
+
+int wl1271_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap);
+
+#endif /* __WL12XX_ACX_H__ */
diff --git a/drivers/net/wireless/ti/wl12xx/cmd.c b/drivers/net/wireless/ti/wl12xx/cmd.c
new file mode 100644
index 000000000000..8ffaeb5f2147
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/cmd.c
@@ -0,0 +1,254 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2009-2010 Nokia Corporation
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "../wlcore/cmd.h"
+#include "../wlcore/debug.h"
+
+#include "wl12xx.h"
+#include "cmd.h"
+
+int wl1271_cmd_ext_radio_parms(struct wl1271 *wl)
+{
+        struct wl1271_ext_radio_parms_cmd *ext_radio_parms;
+        struct wl12xx_priv *priv = wl->priv;
+        struct wl12xx_conf_rf *rf = &priv->conf.rf;
+        int ret;
+
+        if (!wl->nvs)
+                return -ENODEV;
+
+        ext_radio_parms = kzalloc(sizeof(*ext_radio_parms), GFP_KERNEL);
+        if (!ext_radio_parms)
+                return -ENOMEM;
+
+        ext_radio_parms->test.id = TEST_CMD_INI_FILE_RF_EXTENDED_PARAM;
+
+        memcpy(ext_radio_parms->tx_per_channel_power_compensation_2,
+               rf->tx_per_channel_power_compensation_2,
+               CONF_TX_PWR_COMPENSATION_LEN_2);
+        memcpy(ext_radio_parms->tx_per_channel_power_compensation_5,
+               rf->tx_per_channel_power_compensation_5,
+               CONF_TX_PWR_COMPENSATION_LEN_5);
+
+        wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_EXT_RADIO_PARAM: ",
+                    ext_radio_parms, sizeof(*ext_radio_parms));
+
+        ret = wl1271_cmd_test(wl, ext_radio_parms, sizeof(*ext_radio_parms), 0);
+        if (ret < 0)
+                wl1271_warning("TEST_CMD_INI_FILE_RF_EXTENDED_PARAM failed");
+
+        kfree(ext_radio_parms);
+        return ret;
+}
+
+int wl1271_cmd_general_parms(struct wl1271 *wl)
+{
+        struct wl1271_general_parms_cmd *gen_parms;
+        struct wl1271_ini_general_params *gp =
+                &((struct wl1271_nvs_file *)wl->nvs)->general_params;
+        bool answer = false;
+        int ret;
+
+        if (!wl->nvs)
+                return -ENODEV;
+
+        if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+                wl1271_warning("FEM index from INI out of bounds");
+                return -EINVAL;
+        }
+
+        gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+        if (!gen_parms)
+                return -ENOMEM;
+
+        gen_parms->test.id = TEST_CMD_INI_FILE_GENERAL_PARAM;
+
+        memcpy(&gen_parms->general_params, gp, sizeof(*gp));
+
+        if (gp->tx_bip_fem_auto_detect)
+                answer = true;
+
+        /* Override the REF CLK from the NVS with the one from platform data */
+        gen_parms->general_params.ref_clock = wl->ref_clock;
+
+        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), answer);
+        if (ret < 0) {
+                wl1271_warning("CMD_INI_FILE_GENERAL_PARAM failed");
+                goto out;
+        }
+
+        gp->tx_bip_fem_manufacturer =
+                gen_parms->general_params.tx_bip_fem_manufacturer;
+
+        if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+                wl1271_warning("FEM index from FW out of bounds");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
+                     answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+
+out:
+        kfree(gen_parms);
+        return ret;
+}
+
+int wl128x_cmd_general_parms(struct wl1271 *wl)
+{
+        struct wl128x_general_parms_cmd *gen_parms;
+        struct wl128x_ini_general_params *gp =
+                &((struct wl128x_nvs_file *)wl->nvs)->general_params;
+        bool answer = false;
+        int ret;
+
+        if (!wl->nvs)
+                return -ENODEV;
+
+        if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+                wl1271_warning("FEM index from ini out of bounds");
+                return -EINVAL;
+        }
+
+        gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+        if (!gen_parms)
+                return -ENOMEM;
+
+        gen_parms->test.id = TEST_CMD_INI_FILE_GENERAL_PARAM;
+
+        memcpy(&gen_parms->general_params, gp, sizeof(*gp));
+
+        if (gp->tx_bip_fem_auto_detect)
+                answer = true;
+
+        /* Replace REF and TCXO CLKs with the ones from platform data */
+        gen_parms->general_params.ref_clock = wl->ref_clock;
+        gen_parms->general_params.tcxo_ref_clock = wl->tcxo_clock;
+
+        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), answer);
+        if (ret < 0) {
+                wl1271_warning("CMD_INI_FILE_GENERAL_PARAM failed");
+                goto out;
+        }
+
+        gp->tx_bip_fem_manufacturer =
+                gen_parms->general_params.tx_bip_fem_manufacturer;
+
+        if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+                wl1271_warning("FEM index from FW out of bounds");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
+                     answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+
+out:
+        kfree(gen_parms);
+        return ret;
+}
+
+int wl1271_cmd_radio_parms(struct wl1271 *wl)
+{
+        struct wl1271_nvs_file *nvs = (struct wl1271_nvs_file *)wl->nvs;
+        struct wl1271_radio_parms_cmd *radio_parms;
+        struct wl1271_ini_general_params *gp = &nvs->general_params;
+        int ret;
+
+        if (!wl->nvs)
+                return -ENODEV;
+
+        radio_parms = kzalloc(sizeof(*radio_parms), GFP_KERNEL);
+        if (!radio_parms)
+                return -ENOMEM;
+
+        radio_parms->test.id = TEST_CMD_INI_FILE_RADIO_PARAM;
+
+        /* 2.4GHz parameters */
+        memcpy(&radio_parms->static_params_2, &nvs->stat_radio_params_2,
+               sizeof(struct wl1271_ini_band_params_2));
+        memcpy(&radio_parms->dyn_params_2,
+               &nvs->dyn_radio_params_2[gp->tx_bip_fem_manufacturer].params,
+               sizeof(struct wl1271_ini_fem_params_2));
+
+        /* 5GHz parameters */
+        memcpy(&radio_parms->static_params_5,
+               &nvs->stat_radio_params_5,
+               sizeof(struct wl1271_ini_band_params_5));
+        memcpy(&radio_parms->dyn_params_5,
+               &nvs->dyn_radio_params_5[gp->tx_bip_fem_manufacturer].params,
+               sizeof(struct wl1271_ini_fem_params_5));
+
+        wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_RADIO_PARAM: ",
+                    radio_parms, sizeof(*radio_parms));
+
+        ret = wl1271_cmd_test(wl, radio_parms, sizeof(*radio_parms), 0);
+        if (ret < 0)
+                wl1271_warning("CMD_INI_FILE_RADIO_PARAM failed");
+
+        kfree(radio_parms);
+        return ret;
+}
+
+int wl128x_cmd_radio_parms(struct wl1271 *wl)
+{
+        struct wl128x_nvs_file *nvs = (struct wl128x_nvs_file *)wl->nvs;
+        struct wl128x_radio_parms_cmd *radio_parms;
+        struct wl128x_ini_general_params *gp = &nvs->general_params;
+        int ret;
+
+        if (!wl->nvs)
+                return -ENODEV;
+
+        radio_parms = kzalloc(sizeof(*radio_parms), GFP_KERNEL);
+        if (!radio_parms)
+                return -ENOMEM;
+
+        radio_parms->test.id = TEST_CMD_INI_FILE_RADIO_PARAM;
+
+        /* 2.4GHz parameters */
+        memcpy(&radio_parms->static_params_2, &nvs->stat_radio_params_2,
+               sizeof(struct wl128x_ini_band_params_2));
+        memcpy(&radio_parms->dyn_params_2,
+               &nvs->dyn_radio_params_2[gp->tx_bip_fem_manufacturer].params,
+               sizeof(struct wl128x_ini_fem_params_2));
+
+        /* 5GHz parameters */
+        memcpy(&radio_parms->static_params_5,
+               &nvs->stat_radio_params_5,
+               sizeof(struct wl128x_ini_band_params_5));
+        memcpy(&radio_parms->dyn_params_5,
+               &nvs->dyn_radio_params_5[gp->tx_bip_fem_manufacturer].params,
+               sizeof(struct wl128x_ini_fem_params_5));
+
+        radio_parms->fem_vendor_and_options = nvs->fem_vendor_and_options;
+
+        wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_RADIO_PARAM: ",
+                    radio_parms, sizeof(*radio_parms));
+
+        ret = wl1271_cmd_test(wl, radio_parms, sizeof(*radio_parms), 0);
+        if (ret < 0)
+                wl1271_warning("CMD_INI_FILE_RADIO_PARAM failed");
+
+        kfree(radio_parms);
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl12xx/cmd.h b/drivers/net/wireless/ti/wl12xx/cmd.h
new file mode 100644
index 000000000000..140a0e8829d5
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/cmd.h
@@ -0,0 +1,112 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 1998-2009, 2011 Texas Instruments. All rights reserved.
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_CMD_H__
+#define __WL12XX_CMD_H__
+
+#include "conf.h"
+
+#define TEST_CMD_INI_FILE_RADIO_PARAM       0x19
+#define TEST_CMD_INI_FILE_GENERAL_PARAM     0x1E
+
+struct wl1271_general_parms_cmd {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        struct wl1271_ini_general_params general_params;
+
+        u8 sr_debug_table[WL1271_INI_MAX_SMART_REFLEX_PARAM];
+        u8 sr_sen_n_p;
+        u8 sr_sen_n_p_gain;
+        u8 sr_sen_nrn;
+        u8 sr_sen_prn;
+        u8 padding[3];
+} __packed;
+
+struct wl128x_general_parms_cmd {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        struct wl128x_ini_general_params general_params;
+
+        u8 sr_debug_table[WL1271_INI_MAX_SMART_REFLEX_PARAM];
+        u8 sr_sen_n_p;
+        u8 sr_sen_n_p_gain;
+        u8 sr_sen_nrn;
+        u8 sr_sen_prn;
+        u8 padding[3];
+} __packed;
+
+struct wl1271_radio_parms_cmd {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        /* Static radio parameters */
+        struct wl1271_ini_band_params_2 static_params_2;
+        struct wl1271_ini_band_params_5 static_params_5;
+
+        /* Dynamic radio parameters */
+        struct wl1271_ini_fem_params_2 dyn_params_2;
+        u8 padding2;
+        struct wl1271_ini_fem_params_5 dyn_params_5;
+        u8 padding3[2];
+} __packed;
+
+struct wl128x_radio_parms_cmd {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        /* Static radio parameters */
+        struct wl128x_ini_band_params_2 static_params_2;
+        struct wl128x_ini_band_params_5 static_params_5;
+
+        u8 fem_vendor_and_options;
+
+        /* Dynamic radio parameters */
+        struct wl128x_ini_fem_params_2 dyn_params_2;
+        u8 padding2;
+        struct wl128x_ini_fem_params_5 dyn_params_5;
+} __packed;
+
+#define TEST_CMD_INI_FILE_RF_EXTENDED_PARAM 0x26
+
+struct wl1271_ext_radio_parms_cmd {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        u8 tx_per_channel_power_compensation_2[CONF_TX_PWR_COMPENSATION_LEN_2];
+        u8 tx_per_channel_power_compensation_5[CONF_TX_PWR_COMPENSATION_LEN_5];
+        u8 padding[3];
+} __packed;
+
+int wl1271_cmd_general_parms(struct wl1271 *wl);
+int wl128x_cmd_general_parms(struct wl1271 *wl);
+int wl1271_cmd_radio_parms(struct wl1271 *wl);
+int wl128x_cmd_radio_parms(struct wl1271 *wl);
+int wl1271_cmd_ext_radio_parms(struct wl1271 *wl);
+
+#endif /* __WL12XX_CMD_H__ */
diff --git a/drivers/net/wireless/ti/wl12xx/conf.h b/drivers/net/wireless/ti/wl12xx/conf.h
new file mode 100644
index 000000000000..75e29897a0f5
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/conf.h
@@ -0,0 +1,50 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_CONF_H__
+#define __WL12XX_CONF_H__
+
+/* these are number of channels on the band divided by two, rounded up */
+#define CONF_TX_PWR_COMPENSATION_LEN_2 7
+#define CONF_TX_PWR_COMPENSATION_LEN_5 18
+
+struct wl12xx_conf_rf {
+        /*
+         * Per channel power compensation for 2.4GHz
+         *
+         * Range: s8
+         */
+        u8 tx_per_channel_power_compensation_2[CONF_TX_PWR_COMPENSATION_LEN_2];
+
+        /*
+         * Per channel power compensation for 5GHz
+         *
+         * Range: s8
+         */
+        u8 tx_per_channel_power_compensation_5[CONF_TX_PWR_COMPENSATION_LEN_5];
+};
+
+struct wl12xx_priv_conf {
+        struct wl12xx_conf_rf rf;
+        struct conf_memory_settings mem_wl127x;
+};
+
+#endif /* __WL12XX_CONF_H__ */
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
new file mode 100644
index 000000000000..d7dd3def07b5
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -0,0 +1,1388 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2010 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <linux/err.h>
+
+#include <linux/wl12xx.h>
+
+#include "../wlcore/wlcore.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/io.h"
+#include "../wlcore/acx.h"
+#include "../wlcore/tx.h"
+#include "../wlcore/rx.h"
+#include "../wlcore/io.h"
+#include "../wlcore/boot.h"
+
+#include "wl12xx.h"
+#include "reg.h"
+#include "cmd.h"
+#include "acx.h"
+
+static struct wlcore_conf wl12xx_conf = {
+        .sg = {
+                .params = {
+                        [CONF_SG_ACL_BT_MASTER_MIN_BR] = 10,
+                        [CONF_SG_ACL_BT_MASTER_MAX_BR] = 180,
+                        [CONF_SG_ACL_BT_SLAVE_MIN_BR] = 10,
+                        [CONF_SG_ACL_BT_SLAVE_MAX_BR] = 180,
+                        [CONF_SG_ACL_BT_MASTER_MIN_EDR] = 10,
+                        [CONF_SG_ACL_BT_MASTER_MAX_EDR] = 80,
+                        [CONF_SG_ACL_BT_SLAVE_MIN_EDR] = 10,
+                        [CONF_SG_ACL_BT_SLAVE_MAX_EDR] = 80,
+                        [CONF_SG_ACL_WLAN_PS_MASTER_BR] = 8,
+                        [CONF_SG_ACL_WLAN_PS_SLAVE_BR] = 8,
+                        [CONF_SG_ACL_WLAN_PS_MASTER_EDR] = 20,
+                        [CONF_SG_ACL_WLAN_PS_SLAVE_EDR] = 20,
+                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MIN_BR] = 20,
+                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MAX_BR] = 35,
+                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MIN_BR] = 16,
+                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MAX_BR] = 35,
+                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MIN_EDR] = 32,
+                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MAX_EDR] = 50,
+                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MIN_EDR] = 28,
+                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MAX_EDR] = 50,
+                        [CONF_SG_ACL_ACTIVE_SCAN_WLAN_BR] = 10,
+                        [CONF_SG_ACL_ACTIVE_SCAN_WLAN_EDR] = 20,
+                        [CONF_SG_ACL_PASSIVE_SCAN_BT_BR] = 75,
+                        [CONF_SG_ACL_PASSIVE_SCAN_WLAN_BR] = 15,
+                        [CONF_SG_ACL_PASSIVE_SCAN_BT_EDR] = 27,
+                        [CONF_SG_ACL_PASSIVE_SCAN_WLAN_EDR] = 17,
+                        /* active scan params */
+                        [CONF_SG_AUTO_SCAN_PROBE_REQ] = 170,
+                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_HV3] = 50,
+                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_A2DP] = 100,
+                        /* passive scan params */
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP_BR] = 800,
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP_EDR] = 200,
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_HV3] = 200,
+                        /* passive scan in dual antenna params */
+                        [CONF_SG_CONSECUTIVE_HV3_IN_PASSIVE_SCAN] = 0,
+                        [CONF_SG_BCN_HV3_COLLISION_THRESH_IN_PASSIVE_SCAN] = 0,
+                        [CONF_SG_TX_RX_PROTECTION_BWIDTH_IN_PASSIVE_SCAN] = 0,
+                        /* general params */
+                        [CONF_SG_STA_FORCE_PS_IN_BT_SCO] = 1,
+                        [CONF_SG_ANTENNA_CONFIGURATION] = 0,
+                        [CONF_SG_BEACON_MISS_PERCENT] = 60,
+                        [CONF_SG_DHCP_TIME] = 5000,
+                        [CONF_SG_RXT] = 1200,
+                        [CONF_SG_TXT] = 1000,
+                        [CONF_SG_ADAPTIVE_RXT_TXT] = 1,
+                        [CONF_SG_GENERAL_USAGE_BIT_MAP] = 3,
+                        [CONF_SG_HV3_MAX_SERVED] = 6,
+                        [CONF_SG_PS_POLL_TIMEOUT] = 10,
+                        [CONF_SG_UPSD_TIMEOUT] = 10,
+                        [CONF_SG_CONSECUTIVE_CTS_THRESHOLD] = 2,
+                        [CONF_SG_STA_RX_WINDOW_AFTER_DTIM] = 5,
+                        [CONF_SG_STA_CONNECTION_PROTECTION_TIME] = 30,
+                        /* AP params */
+                        [CONF_AP_BEACON_MISS_TX] = 3,
+                        [CONF_AP_RX_WINDOW_AFTER_BEACON] = 10,
+                        [CONF_AP_BEACON_WINDOW_INTERVAL] = 2,
+                        [CONF_AP_CONNECTION_PROTECTION_TIME] = 0,
+                        [CONF_AP_BT_ACL_VAL_BT_SERVE_TIME] = 25,
+                        [CONF_AP_BT_ACL_VAL_WL_SERVE_TIME] = 25,
+                        /* CTS Diluting params */
+                        [CONF_SG_CTS_DILUTED_BAD_RX_PACKETS_TH] = 0,
+                        [CONF_SG_CTS_CHOP_IN_DUAL_ANT_SCO_MASTER] = 0,
+                },
+                .state = CONF_SG_PROTECTIVE,
+        },
+        .rx = {
+                .rx_msdu_life_time           = 512000,
+                .packet_detection_threshold  = 0,
+                .ps_poll_timeout             = 15,
+                .upsd_timeout                = 15,
+                .rts_threshold               = IEEE80211_MAX_RTS_THRESHOLD,
+                .rx_cca_threshold            = 0,
+                .irq_blk_threshold           = 0xFFFF,
+                .irq_pkt_threshold           = 0,
+                .irq_timeout                 = 600,
+                .queue_type                  = CONF_RX_QUEUE_TYPE_LOW_PRIORITY,
+        },
+        .tx = {
+                .tx_energy_detection         = 0,
+                .sta_rc_conf                 = {
+                        .enabled_rates       = 0,
+                        .short_retry_limit   = 10,
+                        .long_retry_limit    = 10,
+                        .aflags              = 0,
+                },
+                .ac_conf_count               = 4,
+                .ac_conf                     = {
+                        [CONF_TX_AC_BE] = {
+                                .ac          = CONF_TX_AC_BE,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = 3,
+                                .tx_op_limit = 0,
+                        },
+                        [CONF_TX_AC_BK] = {
+                                .ac          = CONF_TX_AC_BK,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = 7,
+                                .tx_op_limit = 0,
+                        },
+                        [CONF_TX_AC_VI] = {
+                                .ac          = CONF_TX_AC_VI,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = CONF_TX_AIFS_PIFS,
+                                .tx_op_limit = 3008,
+                        },
+                        [CONF_TX_AC_VO] = {
+                                .ac          = CONF_TX_AC_VO,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = CONF_TX_AIFS_PIFS,
+                                .tx_op_limit = 1504,
+                        },
+                },
+                .max_tx_retries = 100,
+                .ap_aging_period = 300,
+                .tid_conf_count = 4,
+                .tid_conf = {
+                        [CONF_TX_AC_BE] = {
+                                .queue_id    = CONF_TX_AC_BE,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [CONF_TX_AC_BK] = {
+                                .queue_id    = CONF_TX_AC_BK,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_BK,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [CONF_TX_AC_VI] = {
+                                .queue_id    = CONF_TX_AC_VI,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_VI,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [CONF_TX_AC_VO] = {
+                                .queue_id    = CONF_TX_AC_VO,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_VO,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                },
+                .frag_threshold              = IEEE80211_MAX_FRAG_THRESHOLD,
+                .tx_compl_timeout            = 700,
+                .tx_compl_threshold          = 4,
+                .basic_rate                  = CONF_HW_BIT_RATE_1MBPS,
+                .basic_rate_5                = CONF_HW_BIT_RATE_6MBPS,
+                .tmpl_short_retry_limit      = 10,
+                .tmpl_long_retry_limit       = 10,
+                .tx_watchdog_timeout         = 5000,
+        },
+        .conn = {
+                .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
+                .listen_interval             = 1,
+                .suspend_wake_up_event       = CONF_WAKE_UP_EVENT_N_DTIM,
+                .suspend_listen_interval     = 3,
+                .bcn_filt_mode               = CONF_BCN_FILT_MODE_ENABLED,
+                .bcn_filt_ie_count           = 2,
+                .bcn_filt_ie = {
+                        [0] = {
+                                .ie          = WLAN_EID_CHANNEL_SWITCH,
+                                .rule        = CONF_BCN_RULE_PASS_ON_APPEARANCE,
+                        },
+                        [1] = {
+                                .ie          = WLAN_EID_HT_OPERATION,
+                                .rule        = CONF_BCN_RULE_PASS_ON_CHANGE,
+                        },
+                },
+                .synch_fail_thold            = 10,
+                .bss_lose_timeout            = 100,
+                .beacon_rx_timeout           = 10000,
+                .broadcast_timeout           = 20000,
+                .rx_broadcast_in_ps          = 1,
+                .ps_poll_threshold           = 10,
+                .bet_enable                  = CONF_BET_MODE_ENABLE,
+                .bet_max_consecutive         = 50,
+                .psm_entry_retries           = 8,
+                .psm_exit_retries            = 16,
+                .psm_entry_nullfunc_retries  = 3,
+                .dynamic_ps_timeout          = 40,
+                .forced_ps                   = false,
+                .keep_alive_interval         = 55000,
+                .max_listen_interval         = 20,
+        },
+        .itrim = {
+                .enable = false,
+                .timeout = 50000,
+        },
+        .pm_config = {
+                .host_clk_settling_time = 5000,
+                .host_fast_wakeup_support = false
+        },
+        .roam_trigger = {
+                .trigger_pacing               = 1,
+                .avg_weight_rssi_beacon       = 20,
+                .avg_weight_rssi_data         = 10,
+                .avg_weight_snr_beacon        = 20,
+                .avg_weight_snr_data          = 10,
+        },
+        .scan = {
+                .min_dwell_time_active        = 7500,
+                .max_dwell_time_active        = 30000,
+                .min_dwell_time_passive       = 100000,
+                .max_dwell_time_passive       = 100000,
+                .num_probe_reqs               = 2,
+                .split_scan_timeout           = 50000,
+        },
+        .sched_scan = {
+                /*
+                 * Values are in TU/1000 but since sched scan FW command
+                 * params are in TUs rounding up may occur.
+                 */
+                .base_dwell_time                = 7500,
+                .max_dwell_time_delta           = 22500,
+                /* based on 250bits per probe @1Mbps */
+                .dwell_time_delta_per_probe     = 2000,
+                /* based on 250bits per probe @6Mbps (plus a bit more) */
+                .dwell_time_delta_per_probe_5   = 350,
+                .dwell_time_passive             = 100000,
+                .dwell_time_dfs                 = 150000,
+                .num_probe_reqs                 = 2,
+                .rssi_threshold                 = -90,
+                .snr_threshold                  = 0,
+        },
+        .ht = {
+                .rx_ba_win_size = 8,
+                .tx_ba_win_size = 64,
+                .inactivity_timeout = 10000,
+                .tx_ba_tid_bitmap = CONF_TX_BA_ENABLED_TID_BITMAP,
+        },
+        /*
+         * Memory config for wl127x chips is given in the
+         * wl12xx_default_priv_conf struct. The below configuration is
+         * for wl128x chips.
+         */
+        .mem = {
+                .num_stations                 = 1,
+                .ssid_profiles                = 1,
+                .rx_block_num                 = 40,
+                .tx_min_block_num             = 40,
+                .dynamic_memory               = 1,
+                .min_req_tx_blocks            = 45,
+                .min_req_rx_blocks            = 22,
+                .tx_min                       = 27,
+        },
+        .fm_coex = {
+                .enable                       = true,
+                .swallow_period               = 5,
+                .n_divider_fref_set_1         = 0xff,       /* default */
+                .n_divider_fref_set_2         = 12,
+                .m_divider_fref_set_1         = 148,
+                .m_divider_fref_set_2         = 0xffff,     /* default */
+                .coex_pll_stabilization_time  = 0xffffffff, /* default */
+                .ldo_stabilization_time       = 0xffff,     /* default */
+                .fm_disturbed_band_margin     = 0xff,       /* default */
+                .swallow_clk_diff             = 0xff,       /* default */
+        },
+        .rx_streaming = {
+                .duration                      = 150,
+                .queues                        = 0x1,
+                .interval                      = 20,
+                .always                        = 0,
+        },
+        .fwlog = {
+                .mode                         = WL12XX_FWLOG_ON_DEMAND,
+                .mem_blocks                   = 2,
+                .severity                     = 0,
+                .timestamp                    = WL12XX_FWLOG_TIMESTAMP_DISABLED,
+                .output                       = WL12XX_FWLOG_OUTPUT_HOST,
+                .threshold                    = 0,
+        },
+        .rate = {
+                .rate_retry_score = 32000,
+                .per_add = 8192,
+                .per_th1 = 2048,
+                .per_th2 = 4096,
+                .max_per = 8100,
+                .inverse_curiosity_factor = 5,
+                .tx_fail_low_th = 4,
+                .tx_fail_high_th = 10,
+                .per_alpha_shift = 4,
+                .per_add_shift = 13,
+                .per_beta1_shift = 10,
+                .per_beta2_shift = 8,
+                .rate_check_up = 2,
+                .rate_check_down = 12,
+                .rate_retry_policy = {
+                        0x00, 0x00, 0x00, 0x00, 0x00,
+                        0x00, 0x00, 0x00, 0x00, 0x00,
+                        0x00, 0x00, 0x00,
+                },
+        },
+        .hangover = {
+                .recover_time               = 0,
+                .hangover_period            = 20,
+                .dynamic_mode               = 1,
+                .early_termination_mode     = 1,
+                .max_period                 = 20,
+                .min_period                 = 1,
+                .increase_delta             = 1,
+                .decrease_delta             = 2,
+                .quiet_time                 = 4,
+                .increase_time              = 1,
+                .window_size                = 16,
+        },
+};
+
+static struct wl12xx_priv_conf wl12xx_default_priv_conf = {
+        .rf = {
+                .tx_per_channel_power_compensation_2 = {
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                },
+                .tx_per_channel_power_compensation_5 = {
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                },
+        },
+        .mem_wl127x = {
+                .num_stations                 = 1,
+                .ssid_profiles                = 1,
+                .rx_block_num                 = 70,
+                .tx_min_block_num             = 40,
+                .dynamic_memory               = 1,
+                .min_req_tx_blocks            = 100,
+                .min_req_rx_blocks            = 22,
+                .tx_min                       = 27,
+        },
+
+};
+
+#define WL12XX_TX_HW_BLOCK_SPARE_DEFAULT        1
+#define WL12XX_TX_HW_BLOCK_GEM_SPARE            2
+#define WL12XX_TX_HW_BLOCK_SIZE                 252
+
+static const u8 wl12xx_rate_to_idx_2ghz[] = {
+        /* MCS rates are used only with 11n */
+        7,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS7_SGI */
+        7,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS7 */
+        6,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS6 */
+        5,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS5 */
+        4,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS4 */
+        3,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS3 */
+        2,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS2 */
+        1,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS1 */
+        0,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS0 */
+
+        11,                            /* WL12XX_CONF_HW_RXTX_RATE_54   */
+        10,                            /* WL12XX_CONF_HW_RXTX_RATE_48   */
+        9,                             /* WL12XX_CONF_HW_RXTX_RATE_36   */
+        8,                             /* WL12XX_CONF_HW_RXTX_RATE_24   */
+
+        /* TI-specific rate */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL12XX_CONF_HW_RXTX_RATE_22   */
+
+        7,                             /* WL12XX_CONF_HW_RXTX_RATE_18   */
+        6,                             /* WL12XX_CONF_HW_RXTX_RATE_12   */
+        3,                             /* WL12XX_CONF_HW_RXTX_RATE_11   */
+        5,                             /* WL12XX_CONF_HW_RXTX_RATE_9    */
+        4,                             /* WL12XX_CONF_HW_RXTX_RATE_6    */
+        2,                             /* WL12XX_CONF_HW_RXTX_RATE_5_5  */
+        1,                             /* WL12XX_CONF_HW_RXTX_RATE_2    */
+        0                              /* WL12XX_CONF_HW_RXTX_RATE_1    */
+};
+
+static const u8 wl12xx_rate_to_idx_5ghz[] = {
+        /* MCS rates are used only with 11n */
+        7,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS7_SGI */
+        7,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS7 */
+        6,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS6 */
+        5,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS5 */
+        4,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS4 */
+        3,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS3 */
+        2,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS2 */
+        1,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS1 */
+        0,                             /* WL12XX_CONF_HW_RXTX_RATE_MCS0 */
+
+        7,                             /* WL12XX_CONF_HW_RXTX_RATE_54   */
+        6,                             /* WL12XX_CONF_HW_RXTX_RATE_48   */
+        5,                             /* WL12XX_CONF_HW_RXTX_RATE_36   */
+        4,                             /* WL12XX_CONF_HW_RXTX_RATE_24   */
+
+        /* TI-specific rate */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL12XX_CONF_HW_RXTX_RATE_22   */
+
+        3,                             /* WL12XX_CONF_HW_RXTX_RATE_18   */
+        2,                             /* WL12XX_CONF_HW_RXTX_RATE_12   */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL12XX_CONF_HW_RXTX_RATE_11   */
+        1,                             /* WL12XX_CONF_HW_RXTX_RATE_9    */
+        0,                             /* WL12XX_CONF_HW_RXTX_RATE_6    */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL12XX_CONF_HW_RXTX_RATE_5_5  */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL12XX_CONF_HW_RXTX_RATE_2    */
+        CONF_HW_RXTX_RATE_UNSUPPORTED  /* WL12XX_CONF_HW_RXTX_RATE_1    */
+};
+
+static const u8 *wl12xx_band_rate_to_idx[] = {
+        [IEEE80211_BAND_2GHZ] = wl12xx_rate_to_idx_2ghz,
+        [IEEE80211_BAND_5GHZ] = wl12xx_rate_to_idx_5ghz
+};
+
+enum wl12xx_hw_rates {
+        WL12XX_CONF_HW_RXTX_RATE_MCS7_SGI = 0,
+        WL12XX_CONF_HW_RXTX_RATE_MCS7,
+        WL12XX_CONF_HW_RXTX_RATE_MCS6,
+        WL12XX_CONF_HW_RXTX_RATE_MCS5,
+        WL12XX_CONF_HW_RXTX_RATE_MCS4,
+        WL12XX_CONF_HW_RXTX_RATE_MCS3,
+        WL12XX_CONF_HW_RXTX_RATE_MCS2,
+        WL12XX_CONF_HW_RXTX_RATE_MCS1,
+        WL12XX_CONF_HW_RXTX_RATE_MCS0,
+        WL12XX_CONF_HW_RXTX_RATE_54,
+        WL12XX_CONF_HW_RXTX_RATE_48,
+        WL12XX_CONF_HW_RXTX_RATE_36,
+        WL12XX_CONF_HW_RXTX_RATE_24,
+        WL12XX_CONF_HW_RXTX_RATE_22,
+        WL12XX_CONF_HW_RXTX_RATE_18,
+        WL12XX_CONF_HW_RXTX_RATE_12,
+        WL12XX_CONF_HW_RXTX_RATE_11,
+        WL12XX_CONF_HW_RXTX_RATE_9,
+        WL12XX_CONF_HW_RXTX_RATE_6,
+        WL12XX_CONF_HW_RXTX_RATE_5_5,
+        WL12XX_CONF_HW_RXTX_RATE_2,
+        WL12XX_CONF_HW_RXTX_RATE_1,
+        WL12XX_CONF_HW_RXTX_RATE_MAX,
+};
+
+static struct wlcore_partition_set wl12xx_ptable[PART_TABLE_LEN] = {
+        [PART_DOWN] = {
+                .mem = {
+                        .start = 0x00000000,
+                        .size  = 0x000177c0
+                },
+                .reg = {
+                        .start = REGISTERS_BASE,
+                        .size  = 0x00008800
+                },
+                .mem2 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
+                .mem3 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
+        },
+
+        [PART_BOOT] = { /* in wl12xx we can use a mix of work and down
+                         * partition here */
+                .mem = {
+                        .start = 0x00040000,
+                        .size  = 0x00014fc0
+                },
+                .reg = {
+                        .start = REGISTERS_BASE,
+                        .size  = 0x00008800
+                },
+                .mem2 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
+                .mem3 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
+        },
+
+        [PART_WORK] = {
+                .mem = {
+                        .start = 0x00040000,
+                        .size  = 0x00014fc0
+                },
+                .reg = {
+                        .start = REGISTERS_BASE,
+                        .size  = 0x0000a000
+                },
+                .mem2 = {
+                        .start = 0x003004f8,
+                        .size  = 0x00000004
+                },
+                .mem3 = {
+                        .start = 0x00040404,
+                        .size  = 0x00000000
+                },
+        },
+
+        [PART_DRPW] = {
+                .mem = {
+                        .start = 0x00040000,
+                        .size  = 0x00014fc0
+                },
+                .reg = {
+                        .start = DRPW_BASE,
+                        .size  = 0x00006000
+                },
+                .mem2 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
+                .mem3 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                }
+        }
+};
+
+static const int wl12xx_rtable[REG_TABLE_LEN] = {
+        [REG_ECPU_CONTROL]              = WL12XX_REG_ECPU_CONTROL,
+        [REG_INTERRUPT_NO_CLEAR]        = WL12XX_REG_INTERRUPT_NO_CLEAR,
+        [REG_INTERRUPT_ACK]             = WL12XX_REG_INTERRUPT_ACK,
+        [REG_COMMAND_MAILBOX_PTR]       = WL12XX_REG_COMMAND_MAILBOX_PTR,
+        [REG_EVENT_MAILBOX_PTR]         = WL12XX_REG_EVENT_MAILBOX_PTR,
+        [REG_INTERRUPT_TRIG]            = WL12XX_REG_INTERRUPT_TRIG,
+        [REG_INTERRUPT_MASK]            = WL12XX_REG_INTERRUPT_MASK,
+        [REG_PC_ON_RECOVERY]            = WL12XX_SCR_PAD4,
+        [REG_CHIP_ID_B]                 = WL12XX_CHIP_ID_B,
+        [REG_CMD_MBOX_ADDRESS]          = WL12XX_CMD_MBOX_ADDRESS,
+
+        /* data access memory addresses, used with partition translation */
+        [REG_SLV_MEM_DATA]              = WL1271_SLV_MEM_DATA,
+        [REG_SLV_REG_DATA]              = WL1271_SLV_REG_DATA,
+
+        /* raw data access memory addresses */
+        [REG_RAW_FW_STATUS_ADDR]        = FW_STATUS_ADDR,
+};
+
+/* TODO: maybe move to a new header file? */
+#define WL127X_FW_NAME_MULTI    "ti-connectivity/wl127x-fw-4-mr.bin"
+#define WL127X_FW_NAME_SINGLE   "ti-connectivity/wl127x-fw-4-sr.bin"
+#define WL127X_PLT_FW_NAME      "ti-connectivity/wl127x-fw-4-plt.bin"
+
+#define WL128X_FW_NAME_MULTI    "ti-connectivity/wl128x-fw-4-mr.bin"
+#define WL128X_FW_NAME_SINGLE   "ti-connectivity/wl128x-fw-4-sr.bin"
+#define WL128X_PLT_FW_NAME      "ti-connectivity/wl128x-fw-4-plt.bin"
+
+static void wl127x_prepare_read(struct wl1271 *wl, u32 rx_desc, u32 len)
+{
+        if (wl->chip.id != CHIP_ID_1283_PG20) {
+                struct wl1271_acx_mem_map *wl_mem_map = wl->target_mem_map;
+                struct wl1271_rx_mem_pool_addr rx_mem_addr;
+
+                /*
+                 * Choose the block we want to read
+                 * For aggregated packets, only the first memory block
+                 * should be retrieved. The FW takes care of the rest.
+                 */
+                u32 mem_block = rx_desc & RX_MEM_BLOCK_MASK;
+
+                rx_mem_addr.addr = (mem_block << 8) +
+                        le32_to_cpu(wl_mem_map->packet_memory_pool_start);
+
+                rx_mem_addr.addr_extra = rx_mem_addr.addr + 4;
+
+                wl1271_write(wl, WL1271_SLV_REG_DATA,
+                             &rx_mem_addr, sizeof(rx_mem_addr), false);
+        }
+}
+
+static int wl12xx_identify_chip(struct wl1271 *wl)
+{
+        int ret = 0;
+
+        switch (wl->chip.id) {
+        case CHIP_ID_1271_PG10:
+                wl1271_warning("chip id 0x%x (1271 PG10) support is obsolete",
+                               wl->chip.id);
+
+                /* clear the alignment quirk, since we don't support it */
+                wl->quirks &= ~WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN;
+
+                wl->quirks |= WLCORE_QUIRK_LEGACY_NVS;
+                wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
+                wl->mr_fw_name = WL127X_FW_NAME_MULTI;
+                memcpy(&wl->conf.mem, &wl12xx_default_priv_conf.mem_wl127x,
+                       sizeof(wl->conf.mem));
+
+                /* read data preparation is only needed by wl127x */
+                wl->ops->prepare_read = wl127x_prepare_read;
+
+                break;
+
+        case CHIP_ID_1271_PG20:
+                wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1271 PG20)",
+                             wl->chip.id);
+
+                /* clear the alignment quirk, since we don't support it */
+                wl->quirks &= ~WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN;
+
+                wl->quirks |= WLCORE_QUIRK_LEGACY_NVS;
+                wl->plt_fw_name = WL127X_PLT_FW_NAME;
+                wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
+                wl->mr_fw_name = WL127X_FW_NAME_MULTI;
+                memcpy(&wl->conf.mem, &wl12xx_default_priv_conf.mem_wl127x,
+                       sizeof(wl->conf.mem));
+
+                /* read data preparation is only needed by wl127x */
+                wl->ops->prepare_read = wl127x_prepare_read;
+
+                break;
+
+        case CHIP_ID_1283_PG20:
+                wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1283 PG20)",
+                             wl->chip.id);
+                wl->plt_fw_name = WL128X_PLT_FW_NAME;
+                wl->sr_fw_name = WL128X_FW_NAME_SINGLE;
+                wl->mr_fw_name = WL128X_FW_NAME_MULTI;
+                break;
+        case CHIP_ID_1283_PG10:
+        default:
+                wl1271_warning("unsupported chip id: 0x%x", wl->chip.id);
+                ret = -ENODEV;
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void wl12xx_top_reg_write(struct wl1271 *wl, int addr, u16 val)
+{
+        /* write address >> 1 + 0x30000 to OCP_POR_CTR */
+        addr = (addr >> 1) + 0x30000;
+        wl1271_write32(wl, WL12XX_OCP_POR_CTR, addr);
+
+        /* write value to OCP_POR_WDATA */
+        wl1271_write32(wl, WL12XX_OCP_DATA_WRITE, val);
+
+        /* write 1 to OCP_CMD */
+        wl1271_write32(wl, WL12XX_OCP_CMD, OCP_CMD_WRITE);
+}
+
+static u16 wl12xx_top_reg_read(struct wl1271 *wl, int addr)
+{
+        u32 val;
+        int timeout = OCP_CMD_LOOP;
+
+        /* write address >> 1 + 0x30000 to OCP_POR_CTR */
+        addr = (addr >> 1) + 0x30000;
+        wl1271_write32(wl, WL12XX_OCP_POR_CTR, addr);
+
+        /* write 2 to OCP_CMD */
+        wl1271_write32(wl, WL12XX_OCP_CMD, OCP_CMD_READ);
+
+        /* poll for data ready */
+        do {
+                val = wl1271_read32(wl, WL12XX_OCP_DATA_READ);
+        } while (!(val & OCP_READY_MASK) && --timeout);
+
+        if (!timeout) {
+                wl1271_warning("Top register access timed out.");
+                return 0xffff;
+        }
+
+        /* check data status and return if OK */
+        if ((val & OCP_STATUS_MASK) == OCP_STATUS_OK)
+                return val & 0xffff;
+        else {
+                wl1271_warning("Top register access returned error.");
+                return 0xffff;
+        }
+}
+
+static int wl128x_switch_tcxo_to_fref(struct wl1271 *wl)
+{
+        u16 spare_reg;
+
+        /* Mask bits [2] & [8:4] in the sys_clk_cfg register */
+        spare_reg = wl12xx_top_reg_read(wl, WL_SPARE_REG);
+        if (spare_reg == 0xFFFF)
+                return -EFAULT;
+        spare_reg |= (BIT(3) | BIT(5) | BIT(6));
+        wl12xx_top_reg_write(wl, WL_SPARE_REG, spare_reg);
+
+        /* Enable FREF_CLK_REQ & mux MCS and coex PLLs to FREF */
+        wl12xx_top_reg_write(wl, SYS_CLK_CFG_REG,
+                             WL_CLK_REQ_TYPE_PG2 | MCS_PLL_CLK_SEL_FREF);
+
+        /* Delay execution for 15msec, to let the HW settle */
+        mdelay(15);
+
+        return 0;
+}
+
+static bool wl128x_is_tcxo_valid(struct wl1271 *wl)
+{
+        u16 tcxo_detection;
+
+        tcxo_detection = wl12xx_top_reg_read(wl, TCXO_CLK_DETECT_REG);
+        if (tcxo_detection & TCXO_DET_FAILED)
+                return false;
+
+        return true;
+}
+
+static bool wl128x_is_fref_valid(struct wl1271 *wl)
+{
+        u16 fref_detection;
+
+        fref_detection = wl12xx_top_reg_read(wl, FREF_CLK_DETECT_REG);
+        if (fref_detection & FREF_CLK_DETECT_FAIL)
+                return false;
+
+        return true;
+}
+
+static int wl128x_manually_configure_mcs_pll(struct wl1271 *wl)
+{
+        wl12xx_top_reg_write(wl, MCS_PLL_M_REG, MCS_PLL_M_REG_VAL);
+        wl12xx_top_reg_write(wl, MCS_PLL_N_REG, MCS_PLL_N_REG_VAL);
+        wl12xx_top_reg_write(wl, MCS_PLL_CONFIG_REG, MCS_PLL_CONFIG_REG_VAL);
+
+        return 0;
+}
+
+static int wl128x_configure_mcs_pll(struct wl1271 *wl, int clk)
+{
+        u16 spare_reg;
+        u16 pll_config;
+        u8 input_freq;
+
+        /* Mask bits [3:1] in the sys_clk_cfg register */
+        spare_reg = wl12xx_top_reg_read(wl, WL_SPARE_REG);
+        if (spare_reg == 0xFFFF)
+                return -EFAULT;
+        spare_reg |= BIT(2);
+        wl12xx_top_reg_write(wl, WL_SPARE_REG, spare_reg);
+
+        /* Handle special cases of the TCXO clock */
+        if (wl->tcxo_clock == WL12XX_TCXOCLOCK_16_8 ||
+            wl->tcxo_clock == WL12XX_TCXOCLOCK_33_6)
+                return wl128x_manually_configure_mcs_pll(wl);
+
+        /* Set the input frequency according to the selected clock source */
+        input_freq = (clk & 1) + 1;
+
+        pll_config = wl12xx_top_reg_read(wl, MCS_PLL_CONFIG_REG);
+        if (pll_config == 0xFFFF)
+                return -EFAULT;
+        pll_config |= (input_freq << MCS_SEL_IN_FREQ_SHIFT);
+        pll_config |= MCS_PLL_ENABLE_HP;
+        wl12xx_top_reg_write(wl, MCS_PLL_CONFIG_REG, pll_config);
+
+        return 0;
+}
+
+/*
+ * WL128x has two clocks input - TCXO and FREF.
+ * TCXO is the main clock of the device, while FREF is used to sync
+ * between the GPS and the cellular modem.
+ * In cases where TCXO is 32.736MHz or 16.368MHz, the FREF will be used
+ * as the WLAN/BT main clock.
+ */
+static int wl128x_boot_clk(struct wl1271 *wl, int *selected_clock)
+{
+        u16 sys_clk_cfg;
+
+        /* For XTAL-only modes, FREF will be used after switching from TCXO */
+        if (wl->ref_clock == WL12XX_REFCLOCK_26_XTAL ||
+            wl->ref_clock == WL12XX_REFCLOCK_38_XTAL) {
+                if (!wl128x_switch_tcxo_to_fref(wl))
+                        return -EINVAL;
+                goto fref_clk;
+        }
+
+        /* Query the HW, to determine which clock source we should use */
+        sys_clk_cfg = wl12xx_top_reg_read(wl, SYS_CLK_CFG_REG);
+        if (sys_clk_cfg == 0xFFFF)
+                return -EINVAL;
+        if (sys_clk_cfg & PRCM_CM_EN_MUX_WLAN_FREF)
+                goto fref_clk;
+
+        /* If TCXO is either 32.736MHz or 16.368MHz, switch to FREF */
+        if (wl->tcxo_clock == WL12XX_TCXOCLOCK_16_368 ||
+            wl->tcxo_clock == WL12XX_TCXOCLOCK_32_736) {
+                if (!wl128x_switch_tcxo_to_fref(wl))
+                        return -EINVAL;
+                goto fref_clk;
+        }
+
+        /* TCXO clock is selected */
+        if (!wl128x_is_tcxo_valid(wl))
+                return -EINVAL;
+        *selected_clock = wl->tcxo_clock;
+        goto config_mcs_pll;
+
+fref_clk:
+        /* FREF clock is selected */
+        if (!wl128x_is_fref_valid(wl))
+                return -EINVAL;
+        *selected_clock = wl->ref_clock;
+
+config_mcs_pll:
+        return wl128x_configure_mcs_pll(wl, *selected_clock);
+}
+
+static int wl127x_boot_clk(struct wl1271 *wl)
+{
+        u32 pause;
+        u32 clk;
+
+        if (WL127X_PG_GET_MAJOR(wl->hw_pg_ver) < 3)
+                wl->quirks |= WLCORE_QUIRK_END_OF_TRANSACTION;
+
+        if (wl->ref_clock == CONF_REF_CLK_19_2_E ||
+            wl->ref_clock == CONF_REF_CLK_38_4_E ||
+            wl->ref_clock == CONF_REF_CLK_38_4_M_XTAL)
+                /* ref clk: 19.2/38.4/38.4-XTAL */
+                clk = 0x3;
+        else if (wl->ref_clock == CONF_REF_CLK_26_E ||
+                 wl->ref_clock == CONF_REF_CLK_52_E)
+                /* ref clk: 26/52 */
+                clk = 0x5;
+        else
+                return -EINVAL;
+
+        if (wl->ref_clock != CONF_REF_CLK_19_2_E) {
+                u16 val;
+                /* Set clock type (open drain) */
+                val = wl12xx_top_reg_read(wl, OCP_REG_CLK_TYPE);
+                val &= FREF_CLK_TYPE_BITS;
+                wl12xx_top_reg_write(wl, OCP_REG_CLK_TYPE, val);
+
+                /* Set clock pull mode (no pull) */
+                val = wl12xx_top_reg_read(wl, OCP_REG_CLK_PULL);
+                val |= NO_PULL;
+                wl12xx_top_reg_write(wl, OCP_REG_CLK_PULL, val);
+        } else {
+                u16 val;
+                /* Set clock polarity */
+                val = wl12xx_top_reg_read(wl, OCP_REG_CLK_POLARITY);
+                val &= FREF_CLK_POLARITY_BITS;
+                val |= CLK_REQ_OUTN_SEL;
+                wl12xx_top_reg_write(wl, OCP_REG_CLK_POLARITY, val);
+        }
+
+        wl1271_write32(wl, WL12XX_PLL_PARAMETERS, clk);
+
+        pause = wl1271_read32(wl, WL12XX_PLL_PARAMETERS);
+
+        wl1271_debug(DEBUG_BOOT, "pause1 0x%x", pause);
+
+        pause &= ~(WU_COUNTER_PAUSE_VAL);
+        pause |= WU_COUNTER_PAUSE_VAL;
+        wl1271_write32(wl, WL12XX_WU_COUNTER_PAUSE, pause);
+
+        return 0;
+}
+
+static int wl1271_boot_soft_reset(struct wl1271 *wl)
+{
+        unsigned long timeout;
+        u32 boot_data;
+
+        /* perform soft reset */
+        wl1271_write32(wl, WL12XX_SLV_SOFT_RESET, ACX_SLV_SOFT_RESET_BIT);
+
+        /* SOFT_RESET is self clearing */
+        timeout = jiffies + usecs_to_jiffies(SOFT_RESET_MAX_TIME);
+        while (1) {
+                boot_data = wl1271_read32(wl, WL12XX_SLV_SOFT_RESET);
+                wl1271_debug(DEBUG_BOOT, "soft reset bootdata 0x%x", boot_data);
+                if ((boot_data & ACX_SLV_SOFT_RESET_BIT) == 0)
+                        break;
+
+                if (time_after(jiffies, timeout)) {
+                        /* 1.2 check pWhalBus->uSelfClearTime if the
+                         * timeout was reached */
+                        wl1271_error("soft reset timeout");
+                        return -1;
+                }
+
+                udelay(SOFT_RESET_STALL_TIME);
+        }
+
+        /* disable Rx/Tx */
+        wl1271_write32(wl, WL12XX_ENABLE, 0x0);
+
+        /* disable auto calibration on start*/
+        wl1271_write32(wl, WL12XX_SPARE_A2, 0xffff);
+
+        return 0;
+}
+
+static int wl12xx_pre_boot(struct wl1271 *wl)
+{
+        int ret = 0;
+        u32 clk;
+        int selected_clock = -1;
+
+        if (wl->chip.id == CHIP_ID_1283_PG20) {
+                ret = wl128x_boot_clk(wl, &selected_clock);
+                if (ret < 0)
+                        goto out;
+        } else {
+                ret = wl127x_boot_clk(wl);
+                if (ret < 0)
+                        goto out;
+        }
+
+        /* Continue the ELP wake up sequence */
+        wl1271_write32(wl, WL12XX_WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
+        udelay(500);
+
+        wlcore_set_partition(wl, &wl->ptable[PART_DRPW]);
+
+        /* Read-modify-write DRPW_SCRATCH_START register (see next state)
+           to be used by DRPw FW. The RTRIM value will be added by the FW
+           before taking DRPw out of reset */
+
+        clk = wl1271_read32(wl, WL12XX_DRPW_SCRATCH_START);
+
+        wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
+
+        if (wl->chip.id == CHIP_ID_1283_PG20)
+                clk |= ((selected_clock & 0x3) << 1) << 4;
+        else
+                clk |= (wl->ref_clock << 1) << 4;
+
+        wl1271_write32(wl, WL12XX_DRPW_SCRATCH_START, clk);
+
+        wlcore_set_partition(wl, &wl->ptable[PART_WORK]);
+
+        /* Disable interrupts */
+        wlcore_write_reg(wl, REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
+
+        ret = wl1271_boot_soft_reset(wl);
+        if (ret < 0)
+                goto out;
+
+out:
+        return ret;
+}
+
+static void wl12xx_pre_upload(struct wl1271 *wl)
+{
+        u32 tmp;
+
+        /* write firmware's last address (ie. it's length) to
+         * ACX_EEPROMLESS_IND_REG */
+        wl1271_debug(DEBUG_BOOT, "ACX_EEPROMLESS_IND_REG");
+
+        wl1271_write32(wl, WL12XX_EEPROMLESS_IND, WL12XX_EEPROMLESS_IND);
+
+        tmp = wlcore_read_reg(wl, REG_CHIP_ID_B);
+
+        wl1271_debug(DEBUG_BOOT, "chip id 0x%x", tmp);
+
+        /* 6. read the EEPROM parameters */
+        tmp = wl1271_read32(wl, WL12XX_SCR_PAD2);
+
+        /* WL1271: The reference driver skips steps 7 to 10 (jumps directly
+         * to upload_fw) */
+
+        if (wl->chip.id == CHIP_ID_1283_PG20)
+                wl12xx_top_reg_write(wl, SDIO_IO_DS, HCI_IO_DS_6MA);
+}
+
+static void wl12xx_enable_interrupts(struct wl1271 *wl)
+{
+        u32 polarity;
+
+        polarity = wl12xx_top_reg_read(wl, OCP_REG_POLARITY);
+
+        /* We use HIGH polarity, so unset the LOW bit */
+        polarity &= ~POLARITY_LOW;
+        wl12xx_top_reg_write(wl, OCP_REG_POLARITY, polarity);
+
+        wlcore_write_reg(wl, REG_INTERRUPT_MASK, WL1271_ACX_ALL_EVENTS_VECTOR);
+
+        wlcore_enable_interrupts(wl);
+        wlcore_write_reg(wl, REG_INTERRUPT_MASK,
+                         WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
+
+        wl1271_write32(wl, WL12XX_HI_CFG, HI_CFG_DEF_VAL);
+}
+
+static int wl12xx_boot(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl12xx_pre_boot(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wlcore_boot_upload_nvs(wl);
+        if (ret < 0)
+                goto out;
+
+        wl12xx_pre_upload(wl);
+
+        ret = wlcore_boot_upload_firmware(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wlcore_boot_run_firmware(wl);
+        if (ret < 0)
+                goto out;
+
+        wl12xx_enable_interrupts(wl);
+
+out:
+        return ret;
+}
+
+static void wl12xx_trigger_cmd(struct wl1271 *wl, int cmd_box_addr,
+                               void *buf, size_t len)
+{
+        wl1271_write(wl, cmd_box_addr, buf, len, false);
+        wlcore_write_reg(wl, REG_INTERRUPT_TRIG, WL12XX_INTR_TRIG_CMD);
+}
+
+static void wl12xx_ack_event(struct wl1271 *wl)
+{
+        wlcore_write_reg(wl, REG_INTERRUPT_TRIG, WL12XX_INTR_TRIG_EVENT_ACK);
+}
+
+static u32 wl12xx_calc_tx_blocks(struct wl1271 *wl, u32 len, u32 spare_blks)
+{
+        u32 blk_size = WL12XX_TX_HW_BLOCK_SIZE;
+        u32 align_len = wlcore_calc_packet_alignment(wl, len);
+
+        return (align_len + blk_size - 1) / blk_size + spare_blks;
+}
+
+static void
+wl12xx_set_tx_desc_blocks(struct wl1271 *wl, struct wl1271_tx_hw_descr *desc,
+                          u32 blks, u32 spare_blks)
+{
+        if (wl->chip.id == CHIP_ID_1283_PG20) {
+                desc->wl128x_mem.total_mem_blocks = blks;
+        } else {
+                desc->wl127x_mem.extra_blocks = spare_blks;
+                desc->wl127x_mem.total_mem_blocks = blks;
+        }
+}
+
+static void
+wl12xx_set_tx_desc_data_len(struct wl1271 *wl, struct wl1271_tx_hw_descr *desc,
+                            struct sk_buff *skb)
+{
+        u32 aligned_len = wlcore_calc_packet_alignment(wl, skb->len);
+
+        if (wl->chip.id == CHIP_ID_1283_PG20) {
+                desc->wl128x_mem.extra_bytes = aligned_len - skb->len;
+                desc->length = cpu_to_le16(aligned_len >> 2);
+
+                wl1271_debug(DEBUG_TX,
+                             "tx_fill_hdr: hlid: %d len: %d life: %d mem: %d extra: %d",
+                             desc->hlid,
+                             le16_to_cpu(desc->length),
+                             le16_to_cpu(desc->life_time),
+                             desc->wl128x_mem.total_mem_blocks,
+                             desc->wl128x_mem.extra_bytes);
+        } else {
+                /* calculate number of padding bytes */
+                int pad = aligned_len - skb->len;
+                desc->tx_attr |=
+                        cpu_to_le16(pad << TX_HW_ATTR_OFST_LAST_WORD_PAD);
+
+                /* Store the aligned length in terms of words */
+                desc->length = cpu_to_le16(aligned_len >> 2);
+
+                wl1271_debug(DEBUG_TX,
+                             "tx_fill_hdr: pad: %d hlid: %d len: %d life: %d mem: %d",
+                             pad, desc->hlid,
+                             le16_to_cpu(desc->length),
+                             le16_to_cpu(desc->life_time),
+                             desc->wl127x_mem.total_mem_blocks);
+        }
+}
+
+static enum wl_rx_buf_align
+wl12xx_get_rx_buf_align(struct wl1271 *wl, u32 rx_desc)
+{
+        if (rx_desc & RX_BUF_UNALIGNED_PAYLOAD)
+                return WLCORE_RX_BUF_UNALIGNED;
+
+        return WLCORE_RX_BUF_ALIGNED;
+}
+
+static u32 wl12xx_get_rx_packet_len(struct wl1271 *wl, void *rx_data,
+                                    u32 data_len)
+{
+        struct wl1271_rx_descriptor *desc = rx_data;
+
+        /* invalid packet */
+        if (data_len < sizeof(*desc) ||
+            data_len < sizeof(*desc) + desc->pad_len)
+                return 0;
+
+        return data_len - sizeof(*desc) - desc->pad_len;
+}
+
+static void wl12xx_tx_delayed_compl(struct wl1271 *wl)
+{
+        if (wl->fw_status->tx_results_counter == (wl->tx_results_count & 0xff))
+                return;
+
+        wl1271_tx_complete(wl);
+}
+
+static int wl12xx_hw_init(struct wl1271 *wl)
+{
+        int ret;
+
+        if (wl->chip.id == CHIP_ID_1283_PG20) {
+                u32 host_cfg_bitmap = HOST_IF_CFG_RX_FIFO_ENABLE;
+
+                ret = wl128x_cmd_general_parms(wl);
+                if (ret < 0)
+                        goto out;
+                ret = wl128x_cmd_radio_parms(wl);
+                if (ret < 0)
+                        goto out;
+
+                if (wl->quirks & WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN)
+                        /* Enable SDIO padding */
+                        host_cfg_bitmap |= HOST_IF_CFG_TX_PAD_TO_SDIO_BLK;
+
+                /* Must be before wl1271_acx_init_mem_config() */
+                ret = wl1271_acx_host_if_cfg_bitmap(wl, host_cfg_bitmap);
+                if (ret < 0)
+                        goto out;
+        } else {
+                ret = wl1271_cmd_general_parms(wl);
+                if (ret < 0)
+                        goto out;
+                ret = wl1271_cmd_radio_parms(wl);
+                if (ret < 0)
+                        goto out;
+                ret = wl1271_cmd_ext_radio_parms(wl);
+                if (ret < 0)
+                        goto out;
+        }
+out:
+        return ret;
+}
+
+static u32 wl12xx_sta_get_ap_rate_mask(struct wl1271 *wl,
+                                       struct wl12xx_vif *wlvif)
+{
+        return wlvif->rate_set;
+}
+
+static int wl12xx_identify_fw(struct wl1271 *wl)
+{
+        unsigned int *fw_ver = wl->chip.fw_ver;
+
+        /* Only new station firmwares support routing fw logs to the host */
+        if ((fw_ver[FW_VER_IF_TYPE] == FW_VER_IF_TYPE_STA) &&
+            (fw_ver[FW_VER_MINOR] < FW_VER_MINOR_FWLOG_STA_MIN))
+                wl->quirks |= WLCORE_QUIRK_FWLOG_NOT_IMPLEMENTED;
+
+        /* This feature is not yet supported for AP mode */
+        if (fw_ver[FW_VER_IF_TYPE] == FW_VER_IF_TYPE_AP)
+                wl->quirks |= WLCORE_QUIRK_FWLOG_NOT_IMPLEMENTED;
+
+        return 0;
+}
+
+static void wl12xx_conf_init(struct wl1271 *wl)
+{
+        struct wl12xx_priv *priv = wl->priv;
+
+        /* apply driver default configuration */
+        memcpy(&wl->conf, &wl12xx_conf, sizeof(wl12xx_conf));
+
+        /* apply default private configuration */
+        memcpy(&priv->conf, &wl12xx_default_priv_conf, sizeof(priv->conf));
+}
+
+static bool wl12xx_mac_in_fuse(struct wl1271 *wl)
+{
+        bool supported = false;
+        u8 major, minor;
+
+        if (wl->chip.id == CHIP_ID_1283_PG20) {
+                major = WL128X_PG_GET_MAJOR(wl->hw_pg_ver);
+                minor = WL128X_PG_GET_MINOR(wl->hw_pg_ver);
+
+                /* in wl128x we have the MAC address if the PG is >= (2, 1) */
+                if (major > 2 || (major == 2 && minor >= 1))
+                        supported = true;
+        } else {
+                major = WL127X_PG_GET_MAJOR(wl->hw_pg_ver);
+                minor = WL127X_PG_GET_MINOR(wl->hw_pg_ver);
+
+                /* in wl127x we have the MAC address if the PG is >= (3, 1) */
+                if (major == 3 && minor >= 1)
+                        supported = true;
+        }
+
+        wl1271_debug(DEBUG_PROBE,
+                     "PG Ver major = %d minor = %d, MAC %s present",
+                     major, minor, supported ? "is" : "is not");
+
+        return supported;
+}
+
+static void wl12xx_get_fuse_mac(struct wl1271 *wl)
+{
+        u32 mac1, mac2;
+
+        wlcore_set_partition(wl, &wl->ptable[PART_DRPW]);
+
+        mac1 = wl1271_read32(wl, WL12XX_REG_FUSE_BD_ADDR_1);
+        mac2 = wl1271_read32(wl, WL12XX_REG_FUSE_BD_ADDR_2);
+
+        /* these are the two parts of the BD_ADDR */
+        wl->fuse_oui_addr = ((mac2 & 0xffff) << 8) +
+                ((mac1 & 0xff000000) >> 24);
+        wl->fuse_nic_addr = mac1 & 0xffffff;
+
+        wlcore_set_partition(wl, &wl->ptable[PART_DOWN]);
+}
+
+static s8 wl12xx_get_pg_ver(struct wl1271 *wl)
+{
+        u32 die_info;
+
+        if (wl->chip.id == CHIP_ID_1283_PG20)
+                die_info = wl12xx_top_reg_read(wl, WL128X_REG_FUSE_DATA_2_1);
+        else
+                die_info = wl12xx_top_reg_read(wl, WL127X_REG_FUSE_DATA_2_1);
+
+        return (s8) (die_info & PG_VER_MASK) >> PG_VER_OFFSET;
+}
+
+static void wl12xx_get_mac(struct wl1271 *wl)
+{
+        if (wl12xx_mac_in_fuse(wl))
+                wl12xx_get_fuse_mac(wl);
+}
+
+static struct wlcore_ops wl12xx_ops = {
+        .identify_chip          = wl12xx_identify_chip,
+        .identify_fw            = wl12xx_identify_fw,
+        .boot                   = wl12xx_boot,
+        .trigger_cmd            = wl12xx_trigger_cmd,
+        .ack_event              = wl12xx_ack_event,
+        .calc_tx_blocks         = wl12xx_calc_tx_blocks,
+        .set_tx_desc_blocks     = wl12xx_set_tx_desc_blocks,
+        .set_tx_desc_data_len   = wl12xx_set_tx_desc_data_len,
+        .get_rx_buf_align       = wl12xx_get_rx_buf_align,
+        .get_rx_packet_len      = wl12xx_get_rx_packet_len,
+        .tx_immediate_compl     = NULL,
+        .tx_delayed_compl       = wl12xx_tx_delayed_compl,
+        .hw_init                = wl12xx_hw_init,
+        .init_vif               = NULL,
+        .sta_get_ap_rate_mask   = wl12xx_sta_get_ap_rate_mask,
+        .get_pg_ver             = wl12xx_get_pg_ver,
+        .get_mac                = wl12xx_get_mac,
+};
+
+static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
+        .cap = IEEE80211_HT_CAP_GRN_FLD | IEEE80211_HT_CAP_SGI_20 |
+               (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT),
+        .ht_supported = true,
+        .ampdu_factor = IEEE80211_HT_MAX_AMPDU_8K,
+        .ampdu_density = IEEE80211_HT_MPDU_DENSITY_8,
+        .mcs = {
+                .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                .rx_highest = cpu_to_le16(72),
+                .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                },
+};
+
+static int __devinit wl12xx_probe(struct platform_device *pdev)
+{
+        struct wl1271 *wl;
+        struct ieee80211_hw *hw;
+        struct wl12xx_priv *priv;
+
+        hw = wlcore_alloc_hw(sizeof(*priv));
+        if (IS_ERR(hw)) {
+                wl1271_error("can't allocate hw");
+                return PTR_ERR(hw);
+        }
+
+        wl = hw->priv;
+        wl->ops = &wl12xx_ops;
+        wl->ptable = wl12xx_ptable;
+        wl->rtable = wl12xx_rtable;
+        wl->num_tx_desc = 16;
+        wl->normal_tx_spare = WL12XX_TX_HW_BLOCK_SPARE_DEFAULT;
+        wl->gem_tx_spare = WL12XX_TX_HW_BLOCK_GEM_SPARE;
+        wl->band_rate_to_idx = wl12xx_band_rate_to_idx;
+        wl->hw_tx_rate_tbl_size = WL12XX_CONF_HW_RXTX_RATE_MAX;
+        wl->hw_min_ht_rate = WL12XX_CONF_HW_RXTX_RATE_MCS0;
+        wl->fw_status_priv_len = 0;
+        memcpy(&wl->ht_cap, &wl12xx_ht_cap, sizeof(wl12xx_ht_cap));
+        wl12xx_conf_init(wl);
+
+        return wlcore_probe(wl, pdev);
+}
+
+static const struct platform_device_id wl12xx_id_table[] __devinitconst = {
+        { "wl12xx", 0 },
+        {  } /* Terminating Entry */
+};
+MODULE_DEVICE_TABLE(platform, wl12xx_id_table);
+
+static struct platform_driver wl12xx_driver = {
+        .probe          = wl12xx_probe,
+        .remove         = __devexit_p(wlcore_remove),
+        .id_table       = wl12xx_id_table,
+        .driver = {
+                .name   = "wl12xx_driver",
+                .owner  = THIS_MODULE,
+        }
+};
+
+static int __init wl12xx_init(void)
+{
+        return platform_driver_register(&wl12xx_driver);
+}
+module_init(wl12xx_init);
+
+static void __exit wl12xx_exit(void)
+{
+        platform_driver_unregister(&wl12xx_driver);
+}
+module_exit(wl12xx_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
+MODULE_FIRMWARE(WL127X_FW_NAME_SINGLE);
+MODULE_FIRMWARE(WL127X_FW_NAME_MULTI);
+MODULE_FIRMWARE(WL127X_PLT_FW_NAME);
+MODULE_FIRMWARE(WL128X_FW_NAME_SINGLE);
+MODULE_FIRMWARE(WL128X_FW_NAME_MULTI);
+MODULE_FIRMWARE(WL128X_PLT_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/reg.h b/drivers/net/wireless/ti/wl12xx/reg.h
index 340db324bc26..79ede02e2587 100644
--- a/drivers/net/wireless/wl12xx/reg.h
+++ b/drivers/net/wireless/ti/wl12xx/reg.h
@@ -33,16 +33,8 @@
 #define REGISTERS_DOWN_SIZE 0x00008800
 #define REGISTERS_WORK_SIZE 0x0000b000
 
-#define HW_ACCESS_ELP_CTRL_REG_ADDR         0x1FFFC
 #define FW_STATUS_ADDR                      (0x14FC0 + 0xA000)
 
-/* ELP register commands */
-#define ELPCTRL_WAKE_UP             0x1
-#define ELPCTRL_WAKE_UP_WLAN_READY  0x5
-#define ELPCTRL_SLEEP               0x0
-/* ELP WLAN_READY bit */
-#define ELPCTRL_WLAN_READY          0x2
-
 /*===============================================
    Host Software Reset - 32bit RW
  ------------------------------------------
@@ -57,14 +49,14 @@
     (not self-clearing), the Wlan hardware
     exits the software reset state.
 ===============================================*/
-#define ACX_REG_SLV_SOFT_RESET         (REGISTERS_BASE + 0x0000)
+#define WL12XX_SLV_SOFT_RESET           (REGISTERS_BASE + 0x0000)
 
 #define WL1271_SLV_REG_DATA            (REGISTERS_BASE + 0x0008)
 #define WL1271_SLV_REG_ADATA           (REGISTERS_BASE + 0x000c)
 #define WL1271_SLV_MEM_DATA            (REGISTERS_BASE + 0x0018)
 
-#define ACX_REG_INTERRUPT_TRIG         (REGISTERS_BASE + 0x0474)
-#define ACX_REG_INTERRUPT_TRIG_H       (REGISTERS_BASE + 0x0478)
+#define WL12XX_REG_INTERRUPT_TRIG         (REGISTERS_BASE + 0x0474)
+#define WL12XX_REG_INTERRUPT_TRIG_H       (REGISTERS_BASE + 0x0478)
 
 /*=============================================
   Host Interrupt Mask Register - 32bit (RW)
@@ -94,7 +86,7 @@
  21-                    -
  Default: 0x0001
 *==============================================*/
-#define ACX_REG_INTERRUPT_MASK         (REGISTERS_BASE + 0x04DC)
+#define WL12XX_REG_INTERRUPT_MASK         (REGISTERS_BASE + 0x04DC)
 
 /*=============================================
   Host Interrupt Mask Set 16bit, (Write only)
@@ -125,7 +117,7 @@
  Reading this register doesn't
  effect its content.
 =============================================*/
-#define ACX_REG_INTERRUPT_NO_CLEAR     (REGISTERS_BASE + 0x04E8)
+#define WL12XX_REG_INTERRUPT_NO_CLEAR     (REGISTERS_BASE + 0x04E8)
 
 /*=============================================
   Host Interrupt Status Clear on Read  Register
@@ -148,9 +140,9 @@
  HINT_STS_ND registers, thus making the
  assotiated interrupt inactive. (0-no effect)
 ==============================================*/
-#define ACX_REG_INTERRUPT_ACK          (REGISTERS_BASE + 0x04F0)
+#define WL12XX_REG_INTERRUPT_ACK          (REGISTERS_BASE + 0x04F0)
 
-#define RX_DRIVER_COUNTER_ADDRESS      (REGISTERS_BASE + 0x0538)
+#define WL12XX_REG_RX_DRIVER_COUNTER    (REGISTERS_BASE + 0x0538)
 
 /* Device Configuration registers*/
 #define SOR_CFG                        (REGISTERS_BASE + 0x0800)
@@ -175,9 +167,9 @@
  1 halt eCPU
  0 enable eCPU
  ===============================================*/
-#define ACX_REG_ECPU_CONTROL           (REGISTERS_BASE + 0x0804)
+#define WL12XX_REG_ECPU_CONTROL           (REGISTERS_BASE + 0x0804)
 
-#define HI_CFG                         (REGISTERS_BASE + 0x0808)
+#define WL12XX_HI_CFG                   (REGISTERS_BASE + 0x0808)
 
 /*===============================================
  EEPROM Burst Read Start  - 32bit RW
@@ -196,72 +188,67 @@
 *================================================*/
 #define ACX_REG_EE_START               (REGISTERS_BASE + 0x080C)
 
-#define OCP_POR_CTR                    (REGISTERS_BASE + 0x09B4)
-#define OCP_DATA_WRITE                 (REGISTERS_BASE + 0x09B8)
-#define OCP_DATA_READ                  (REGISTERS_BASE + 0x09BC)
-#define OCP_CMD                        (REGISTERS_BASE + 0x09C0)
-
-#define WL1271_HOST_WR_ACCESS          (REGISTERS_BASE + 0x09F8)
+#define WL12XX_OCP_POR_CTR              (REGISTERS_BASE + 0x09B4)
+#define WL12XX_OCP_DATA_WRITE           (REGISTERS_BASE + 0x09B8)
+#define WL12XX_OCP_DATA_READ            (REGISTERS_BASE + 0x09BC)
+#define WL12XX_OCP_CMD                  (REGISTERS_BASE + 0x09C0)
 
-#define CHIP_ID_B                      (REGISTERS_BASE + 0x5674)
+#define WL12XX_HOST_WR_ACCESS           (REGISTERS_BASE + 0x09F8)
 
-#define CHIP_ID_1271_PG10              (0x4030101)
-#define CHIP_ID_1271_PG20              (0x4030111)
-#define CHIP_ID_1283_PG10              (0x05030101)
-#define CHIP_ID_1283_PG20              (0x05030111)
+#define WL12XX_CHIP_ID_B                (REGISTERS_BASE + 0x5674)
 
-#define ENABLE                         (REGISTERS_BASE + 0x5450)
+#define WL12XX_ENABLE                   (REGISTERS_BASE + 0x5450)
 
 /* Power Management registers */
-#define ELP_CFG_MODE                   (REGISTERS_BASE + 0x5804)
-#define ELP_CMD                        (REGISTERS_BASE + 0x5808)
-#define PLL_CAL_TIME                   (REGISTERS_BASE + 0x5810)
-#define CLK_REQ_TIME                   (REGISTERS_BASE + 0x5814)
-#define CLK_BUF_TIME                   (REGISTERS_BASE + 0x5818)
+#define WL12XX_ELP_CFG_MODE             (REGISTERS_BASE + 0x5804)
+#define WL12XX_ELP_CMD                  (REGISTERS_BASE + 0x5808)
+#define WL12XX_PLL_CAL_TIME             (REGISTERS_BASE + 0x5810)
+#define WL12XX_CLK_REQ_TIME             (REGISTERS_BASE + 0x5814)
+#define WL12XX_CLK_BUF_TIME             (REGISTERS_BASE + 0x5818)
 
-#define CFG_PLL_SYNC_CNT               (REGISTERS_BASE + 0x5820)
+#define WL12XX_CFG_PLL_SYNC_CNT         (REGISTERS_BASE + 0x5820)
 
 /* Scratch Pad registers*/
-#define SCR_PAD0                       (REGISTERS_BASE + 0x5608)
-#define SCR_PAD1                       (REGISTERS_BASE + 0x560C)
-#define SCR_PAD2                       (REGISTERS_BASE + 0x5610)
-#define SCR_PAD3                       (REGISTERS_BASE + 0x5614)
-#define SCR_PAD4                       (REGISTERS_BASE + 0x5618)
-#define SCR_PAD4_SET                   (REGISTERS_BASE + 0x561C)
-#define SCR_PAD4_CLR                   (REGISTERS_BASE + 0x5620)
-#define SCR_PAD5                       (REGISTERS_BASE + 0x5624)
-#define SCR_PAD5_SET                   (REGISTERS_BASE + 0x5628)
-#define SCR_PAD5_CLR                   (REGISTERS_BASE + 0x562C)
-#define SCR_PAD6                       (REGISTERS_BASE + 0x5630)
-#define SCR_PAD7                       (REGISTERS_BASE + 0x5634)
-#define SCR_PAD8                       (REGISTERS_BASE + 0x5638)
-#define SCR_PAD9                       (REGISTERS_BASE + 0x563C)
+#define WL12XX_SCR_PAD0                 (REGISTERS_BASE + 0x5608)
+#define WL12XX_SCR_PAD1                 (REGISTERS_BASE + 0x560C)
+#define WL12XX_SCR_PAD2                 (REGISTERS_BASE + 0x5610)
+#define WL12XX_SCR_PAD3                 (REGISTERS_BASE + 0x5614)
+#define WL12XX_SCR_PAD4                 (REGISTERS_BASE + 0x5618)
+#define WL12XX_SCR_PAD4_SET             (REGISTERS_BASE + 0x561C)
+#define WL12XX_SCR_PAD4_CLR             (REGISTERS_BASE + 0x5620)
+#define WL12XX_SCR_PAD5                 (REGISTERS_BASE + 0x5624)
+#define WL12XX_SCR_PAD5_SET             (REGISTERS_BASE + 0x5628)
+#define WL12XX_SCR_PAD5_CLR             (REGISTERS_BASE + 0x562C)
+#define WL12XX_SCR_PAD6                 (REGISTERS_BASE + 0x5630)
+#define WL12XX_SCR_PAD7                 (REGISTERS_BASE + 0x5634)
+#define WL12XX_SCR_PAD8                 (REGISTERS_BASE + 0x5638)
+#define WL12XX_SCR_PAD9                 (REGISTERS_BASE + 0x563C)
 
 /* Spare registers*/
-#define SPARE_A1                       (REGISTERS_BASE + 0x0994)
-#define SPARE_A2                       (REGISTERS_BASE + 0x0998)
-#define SPARE_A3                       (REGISTERS_BASE + 0x099C)
-#define SPARE_A4                       (REGISTERS_BASE + 0x09A0)
-#define SPARE_A5                       (REGISTERS_BASE + 0x09A4)
-#define SPARE_A6                       (REGISTERS_BASE + 0x09A8)
-#define SPARE_A7                       (REGISTERS_BASE + 0x09AC)
-#define SPARE_A8                       (REGISTERS_BASE + 0x09B0)
-#define SPARE_B1                       (REGISTERS_BASE + 0x5420)
-#define SPARE_B2                       (REGISTERS_BASE + 0x5424)
-#define SPARE_B3                       (REGISTERS_BASE + 0x5428)
-#define SPARE_B4                       (REGISTERS_BASE + 0x542C)
-#define SPARE_B5                       (REGISTERS_BASE + 0x5430)
-#define SPARE_B6                       (REGISTERS_BASE + 0x5434)
-#define SPARE_B7                       (REGISTERS_BASE + 0x5438)
-#define SPARE_B8                       (REGISTERS_BASE + 0x543C)
-
-#define PLL_PARAMETERS                 (REGISTERS_BASE + 0x6040)
-#define WU_COUNTER_PAUSE               (REGISTERS_BASE + 0x6008)
-#define WELP_ARM_COMMAND               (REGISTERS_BASE + 0x6100)
-#define DRPW_SCRATCH_START             (DRPW_BASE + 0x002C)
-
-
-#define ACX_SLV_SOFT_RESET_BIT   BIT(1)
+#define WL12XX_SPARE_A1                 (REGISTERS_BASE + 0x0994)
+#define WL12XX_SPARE_A2                 (REGISTERS_BASE + 0x0998)
+#define WL12XX_SPARE_A3                 (REGISTERS_BASE + 0x099C)
+#define WL12XX_SPARE_A4                 (REGISTERS_BASE + 0x09A0)
+#define WL12XX_SPARE_A5                 (REGISTERS_BASE + 0x09A4)
+#define WL12XX_SPARE_A6                 (REGISTERS_BASE + 0x09A8)
+#define WL12XX_SPARE_A7                 (REGISTERS_BASE + 0x09AC)
+#define WL12XX_SPARE_A8                 (REGISTERS_BASE + 0x09B0)
+#define WL12XX_SPARE_B1                 (REGISTERS_BASE + 0x5420)
+#define WL12XX_SPARE_B2                 (REGISTERS_BASE + 0x5424)
+#define WL12XX_SPARE_B3                 (REGISTERS_BASE + 0x5428)
+#define WL12XX_SPARE_B4                 (REGISTERS_BASE + 0x542C)
+#define WL12XX_SPARE_B5                 (REGISTERS_BASE + 0x5430)
+#define WL12XX_SPARE_B6                 (REGISTERS_BASE + 0x5434)
+#define WL12XX_SPARE_B7                 (REGISTERS_BASE + 0x5438)
+#define WL12XX_SPARE_B8                 (REGISTERS_BASE + 0x543C)
+
+#define WL12XX_PLL_PARAMETERS           (REGISTERS_BASE + 0x6040)
+#define WL12XX_WU_COUNTER_PAUSE         (REGISTERS_BASE + 0x6008)
+#define WL12XX_WELP_ARM_COMMAND         (REGISTERS_BASE + 0x6100)
+#define WL12XX_DRPW_SCRATCH_START       (DRPW_BASE + 0x002C)
+
+#define WL12XX_CMD_MBOX_ADDRESS         0x407B4
+
 #define ACX_REG_EEPROM_START_BIT BIT(1)
 
 /* Command/Information Mailbox Pointers */
@@ -279,7 +266,7 @@
  the host receives the Init Complete interrupt from
  the Wlan hardware.
  ===============================================*/
-#define REG_COMMAND_MAILBOX_PTR                         (SCR_PAD0)
+#define WL12XX_REG_COMMAND_MAILBOX_PTR          (WL12XX_SCR_PAD0)
 
 /*===============================================
   Information Mailbox Pointer - 32bit RW
@@ -294,7 +281,7 @@
  until after the host receives the Init Complete interrupt from
  the Wlan hardware.
  ===============================================*/
-#define REG_EVENT_MAILBOX_PTR                           (SCR_PAD1)
+#define WL12XX_REG_EVENT_MAILBOX_PTR            (WL12XX_SCR_PAD1)
 
 /*===============================================
  EEPROM Read/Write Request 32bit RW
@@ -365,26 +352,6 @@
 #define ACX_CONT_WIND_MIN_MASK   0x0000007f
 #define ACX_CONT_WIND_MAX        0x03ff0000
 
-/*===============================================
-  HI_CFG Interface Configuration Register Values
-  ------------------------------------------
-  ===============================================*/
-#define HI_CFG_UART_ENABLE          0x00000004
-#define HI_CFG_RST232_ENABLE        0x00000008
-#define HI_CFG_CLOCK_REQ_SELECT     0x00000010
-#define HI_CFG_HOST_INT_ENABLE      0x00000020
-#define HI_CFG_VLYNQ_OUTPUT_ENABLE  0x00000040
-#define HI_CFG_HOST_INT_ACTIVE_LOW  0x00000080
-#define HI_CFG_UART_TX_OUT_GPIO_15  0x00000100
-#define HI_CFG_UART_TX_OUT_GPIO_14  0x00000200
-#define HI_CFG_UART_TX_OUT_GPIO_7   0x00000400
-
-#define HI_CFG_DEF_VAL              \
-        (HI_CFG_UART_ENABLE |        \
-        HI_CFG_RST232_ENABLE |      \
-        HI_CFG_CLOCK_REQ_SELECT |   \
-        HI_CFG_HOST_INT_ENABLE)
-
 #define REF_FREQ_19_2                       0
 #define REF_FREQ_26_0                       1
 #define REF_FREQ_38_4                       2
@@ -400,38 +367,19 @@
 #define LUT_PARAM_BB_PLL_LOOP_FILTER        5
 #define LUT_PARAM_NUM                       6
 
-#define ACX_EEPROMLESS_IND_REG              (SCR_PAD4)
+#define WL12XX_EEPROMLESS_IND           (WL12XX_SCR_PAD4)
 #define USE_EEPROM                          0
-#define SOFT_RESET_MAX_TIME                 1000000
-#define SOFT_RESET_STALL_TIME               1000
 #define NVS_DATA_BUNDARY_ALIGNMENT          4
 
-
-/* Firmware image load chunk size */
-#define CHUNK_SIZE      16384
-
 /* Firmware image header size */
 #define FW_HDR_SIZE 8
 
-#define ECPU_CONTROL_HALT                                       0x00000101
-
-
 /******************************************************************************
 
     CHANNELS, BAND & REG DOMAINS definitions
 
 ******************************************************************************/
 
-
-enum {
-        RADIO_BAND_2_4GHZ = 0,  /* 2.4 Ghz band */
-        RADIO_BAND_5GHZ = 1,    /* 5 Ghz band */
-        RADIO_BAND_JAPAN_4_9_GHZ = 2,
-        DEFAULT_BAND = RADIO_BAND_2_4GHZ,
-        INVALID_BAND = 0xFE,
-        MAX_RADIO_BANDS = 0xFF
-};
-
 #define SHORT_PREAMBLE_BIT   BIT(0) /* CCK or Barker depending on the rate */
 #define OFDM_RATE_BIT        BIT(6)
 #define PBCC_RATE_BIT        BIT(7)
@@ -465,14 +413,82 @@ b12-b0 - Supported Rate indicator bits as defined below.
 
 ******************************************************************************/
 
+#define OCP_CMD_LOOP            32
+#define OCP_CMD_WRITE           0x1
+#define OCP_CMD_READ            0x2
+#define OCP_READY_MASK          BIT(18)
+#define OCP_STATUS_MASK         (BIT(16) | BIT(17))
+#define OCP_STATUS_NO_RESP      0x00000
+#define OCP_STATUS_OK           0x10000
+#define OCP_STATUS_REQ_FAILED   0x20000
+#define OCP_STATUS_RESP_ERROR   0x30000
+
+#define OCP_REG_POLARITY     0x0064
+#define OCP_REG_CLK_TYPE     0x0448
+#define OCP_REG_CLK_POLARITY 0x0cb2
+#define OCP_REG_CLK_PULL     0x0cb4
+
+#define POLARITY_LOW         BIT(1)
+#define NO_PULL              (BIT(14) | BIT(15))
+
+#define FREF_CLK_TYPE_BITS     0xfffffe7f
+#define CLK_REQ_PRCM           0x100
+#define FREF_CLK_POLARITY_BITS 0xfffff8ff
+#define CLK_REQ_OUTN_SEL       0x700
+
+#define WU_COUNTER_PAUSE_VAL 0x3FF
+
+/* PLL configuration algorithm for wl128x */
+#define SYS_CLK_CFG_REG              0x2200
+/* Bit[0]   -  0-TCXO,  1-FREF */
+#define MCS_PLL_CLK_SEL_FREF         BIT(0)
+/* Bit[3:2] - 01-TCXO, 10-FREF */
+#define WL_CLK_REQ_TYPE_FREF         BIT(3)
+#define WL_CLK_REQ_TYPE_PG2          (BIT(3) | BIT(2))
+/* Bit[4]   -  0-TCXO,  1-FREF */
+#define PRCM_CM_EN_MUX_WLAN_FREF     BIT(4)
+
+#define TCXO_ILOAD_INT_REG           0x2264
+#define TCXO_CLK_DETECT_REG          0x2266
+
+#define TCXO_DET_FAILED              BIT(4)
+
+#define FREF_ILOAD_INT_REG           0x2084
+#define FREF_CLK_DETECT_REG          0x2086
+#define FREF_CLK_DETECT_FAIL         BIT(4)
+
+/* Use this reg for masking during driver access */
+#define WL_SPARE_REG                 0x2320
+#define WL_SPARE_VAL                 BIT(2)
+/* Bit[6:5:3] -  mask wl write SYS_CLK_CFG[8:5:2:4] */
+#define WL_SPARE_MASK_8526           (BIT(6) | BIT(5) | BIT(3))
+
+#define PLL_LOCK_COUNTERS_REG        0xD8C
+#define PLL_LOCK_COUNTERS_COEX       0x0F
+#define PLL_LOCK_COUNTERS_MCS        0xF0
+#define MCS_PLL_OVERRIDE_REG         0xD90
+#define MCS_PLL_CONFIG_REG           0xD92
+#define MCS_SEL_IN_FREQ_MASK         0x0070
+#define MCS_SEL_IN_FREQ_SHIFT        4
+#define MCS_PLL_CONFIG_REG_VAL       0x73
+#define MCS_PLL_ENABLE_HP            (BIT(0) | BIT(1))
+
+#define MCS_PLL_M_REG                0xD94
+#define MCS_PLL_N_REG                0xD96
+#define MCS_PLL_M_REG_VAL            0xC8
+#define MCS_PLL_N_REG_VAL            0x07
+
+#define SDIO_IO_DS                   0xd14
+
+/* SDIO/wSPI DS configuration values */
+enum {
+        HCI_IO_DS_8MA = 0,
+        HCI_IO_DS_4MA = 1, /* default */
+        HCI_IO_DS_6MA = 2,
+        HCI_IO_DS_2MA = 3,
+};
 
-/*************************************************************************
-
-    Interrupt Trigger Register (Host -> WiLink)
-
-**************************************************************************/
-
-/* Hardware to Embedded CPU Interrupts - first 32-bit register set */
+/* end PLL configuration algorithm for wl128x */
 
 /*
  * Host Command Interrupt. Setting this bit masks
@@ -480,7 +496,7 @@ b12-b0 - Supported Rate indicator bits as defined below.
  * the FW that it has sent a command
  * to the Wlan hardware Command Mailbox.
  */
-#define INTR_TRIG_CMD       BIT(0)
+#define WL12XX_INTR_TRIG_CMD            BIT(0)
 
 /*
  * Host Event Acknowlegde Interrupt. The host
@@ -488,42 +504,27 @@ b12-b0 - Supported Rate indicator bits as defined below.
  * the unsolicited information from the event
  * mailbox.
  */
-#define INTR_TRIG_EVENT_ACK BIT(1)
-
-/*
- * The host sets this bit to inform the Wlan
- * FW that a TX packet is in the XFER
- * Buffer #0.
- */
-#define INTR_TRIG_TX_PROC0 BIT(2)
-
-/*
- * The host sets this bit to inform the FW
- * that it read a packet from RX XFER
- * Buffer #0.
- */
-#define INTR_TRIG_RX_PROC0 BIT(3)
-
-#define INTR_TRIG_DEBUG_ACK BIT(4)
+#define WL12XX_INTR_TRIG_EVENT_ACK      BIT(1)
 
-#define INTR_TRIG_STATE_CHANGED BIT(5)
-
-
-/* Hardware to Embedded CPU Interrupts - second 32-bit register set */
-
-/*
- * The host sets this bit to inform the FW
- * that it read a packet from RX XFER
- * Buffer #1.
- */
-#define INTR_TRIG_RX_PROC1 BIT(17)
+/*===============================================
+  HI_CFG Interface Configuration Register Values
+  ------------------------------------------
+  ===============================================*/
+#define HI_CFG_UART_ENABLE          0x00000004
+#define HI_CFG_RST232_ENABLE        0x00000008
+#define HI_CFG_CLOCK_REQ_SELECT     0x00000010
+#define HI_CFG_HOST_INT_ENABLE      0x00000020
+#define HI_CFG_VLYNQ_OUTPUT_ENABLE  0x00000040
+#define HI_CFG_HOST_INT_ACTIVE_LOW  0x00000080
+#define HI_CFG_UART_TX_OUT_GPIO_15  0x00000100
+#define HI_CFG_UART_TX_OUT_GPIO_14  0x00000200
+#define HI_CFG_UART_TX_OUT_GPIO_7   0x00000400
 
-/*
- * The host sets this bit to inform the Wlan
- * hardware that a TX packet is in the XFER
- * Buffer #1.
- */
-#define INTR_TRIG_TX_PROC1 BIT(18)
+#define HI_CFG_DEF_VAL              \
+        (HI_CFG_UART_ENABLE |        \
+        HI_CFG_RST232_ENABLE |      \
+        HI_CFG_CLOCK_REQ_SELECT |   \
+        HI_CFG_HOST_INT_ENABLE)
 
 #define WL127X_REG_FUSE_DATA_2_1        0x050a
 #define WL128X_REG_FUSE_DATA_2_1        0x2152
diff --git a/drivers/net/wireless/ti/wl12xx/wl12xx.h b/drivers/net/wireless/ti/wl12xx/wl12xx.h
new file mode 100644
index 000000000000..74cd332e23ef
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/wl12xx.h
@@ -0,0 +1,31 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_PRIV_H__
+#define __WL12XX_PRIV_H__
+
+#include "conf.h"
+
+struct wl12xx_priv {
+        struct wl12xx_priv_conf conf;
+};
+
+#endif /* __WL12XX_PRIV_H__ */
diff --git a/drivers/net/wireless/ti/wlcore/Kconfig b/drivers/net/wireless/ti/wlcore/Kconfig
new file mode 100644
index 000000000000..9d04c38938bc
--- /dev/null
+++ b/drivers/net/wireless/ti/wlcore/Kconfig
@@ -0,0 +1,41 @@
+config WLCORE
+        tristate "TI wlcore support"
+        depends on WL_TI && GENERIC_HARDIRQS
+        depends on INET
+        select FW_LOADER
+        ---help---
+          This module contains the main code for TI WLAN chips.  It abstracts
+          hardware-specific differences among different chipset families.
+          Each chipset family needs to implement its own lower-level module
+          that will depend on this module for the common code.
+
+          If you choose to build a module, it will be called wlcore. Say N if
+          unsure.
+
+config WLCORE_SPI
+        tristate "TI wlcore SPI support"
+        depends on WLCORE && SPI_MASTER
+        select CRC7
+        ---help---
+          This module adds support for the SPI interface of adapters using
+          TI WLAN chipsets.  Select this if your platform is using
+          the SPI bus.
+
+          If you choose to build a module, it'll be called wlcore_spi.
+          Say N if unsure.
+
+config WLCORE_SDIO
+        tristate "TI wlcore SDIO support"
+        depends on WLCORE && MMC
+        ---help---
+          This module adds support for the SDIO interface of adapters using
+          TI WLAN chipsets.  Select this if your platform is using
+          the SDIO bus.
+
+          If you choose to build a module, it'll be called wlcore_sdio.
+          Say N if unsure.
+
+config WL12XX_PLATFORM_DATA
+        bool
+        depends on WLCORE_SDIO != n || WL1251_SDIO != n
+        default y
diff --git a/drivers/net/wireless/ti/wlcore/Makefile b/drivers/net/wireless/ti/wlcore/Makefile
new file mode 100644
index 000000000000..d9fba9e32130
--- /dev/null
+++ b/drivers/net/wireless/ti/wlcore/Makefile
@@ -0,0 +1,15 @@
+wlcore-objs             = main.o cmd.o io.o event.o tx.o rx.o ps.o acx.o \
+                          boot.o init.o debugfs.o scan.o
+
+wlcore_spi-objs         = spi.o
+wlcore_sdio-objs        = sdio.o
+
+wlcore-$(CONFIG_NL80211_TESTMODE)       += testmode.o
+obj-$(CONFIG_WLCORE)                    += wlcore.o
+obj-$(CONFIG_WLCORE_SPI)                += wlcore_spi.o
+obj-$(CONFIG_WLCORE_SDIO)               += wlcore_sdio.o
+
+# small builtin driver bit
+obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wl12xx_platform_data.o
+
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/wl12xx/acx.c b/drivers/net/wireless/ti/wlcore/acx.c
index bc96db0683a5..5912541a925e 100644
--- a/drivers/net/wireless/wl12xx/acx.c
+++ b/drivers/net/wireless/ti/wlcore/acx.c
@@ -28,11 +28,11 @@
 #include <linux/spi/spi.h>
 #include <linux/slab.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
 #include "wl12xx_80211.h"
-#include "reg.h"
 #include "ps.h"
+#include "hw_ops.h"
 
 int wl1271_acx_wake_up_conditions(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                                   u8 wake_up_event, u8 listen_interval)
@@ -757,7 +757,10 @@ int wl1271_acx_sta_rate_policies(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 
         /* configure one AP supported rate class */
         acx->rate_policy_idx = cpu_to_le32(wlvif->sta.ap_rate_idx);
-        acx->rate_policy.enabled_rates = cpu_to_le32(wlvif->rate_set);
+
+        /* the AP policy is HW specific */
+        acx->rate_policy.enabled_rates =
+                cpu_to_le32(wlcore_hw_sta_get_ap_rate_mask(wl, wlvif));
         acx->rate_policy.short_retry_limit = c->short_retry_limit;
         acx->rate_policy.long_retry_limit = c->long_retry_limit;
         acx->rate_policy.aflags = c->aflags;
@@ -969,17 +972,14 @@ int wl12xx_acx_mem_cfg(struct wl1271 *wl)
                 goto out;
         }
 
-        if (wl->chip.id == CHIP_ID_1283_PG20)
-                mem = &wl->conf.mem_wl128x;
-        else
-                mem = &wl->conf.mem_wl127x;
+        mem = &wl->conf.mem;
 
         /* memory config */
         mem_conf->num_stations = mem->num_stations;
         mem_conf->rx_mem_block_num = mem->rx_block_num;
         mem_conf->tx_min_mem_block_num = mem->tx_min_block_num;
         mem_conf->num_ssid_profiles = mem->ssid_profiles;
-        mem_conf->total_tx_descriptors = cpu_to_le32(ACX_TX_DESCRIPTORS);
+        mem_conf->total_tx_descriptors = cpu_to_le32(wl->num_tx_desc);
         mem_conf->dyn_mem_enable = mem->dynamic_memory;
         mem_conf->tx_free_req = mem->min_req_tx_blocks;
         mem_conf->rx_free_req = mem->min_req_rx_blocks;
@@ -998,32 +998,6 @@ out:
         return ret;
 }
 
-int wl1271_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap)
-{
-        struct wl1271_acx_host_config_bitmap *bitmap_conf;
-        int ret;
-
-        bitmap_conf = kzalloc(sizeof(*bitmap_conf), GFP_KERNEL);
-        if (!bitmap_conf) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        bitmap_conf->host_cfg_bitmap = cpu_to_le32(host_cfg_bitmap);
-
-        ret = wl1271_cmd_configure(wl, ACX_HOST_IF_CFG_BITMAP,
-                                   bitmap_conf, sizeof(*bitmap_conf));
-        if (ret < 0) {
-                wl1271_warning("wl1271 bitmap config opt failed: %d", ret);
-                goto out;
-        }
-
-out:
-        kfree(bitmap_conf);
-
-        return ret;
-}
-
 int wl1271_acx_init_mem_config(struct wl1271 *wl)
 {
         int ret;
diff --git a/drivers/net/wireless/wl12xx/acx.h b/drivers/net/wireless/ti/wlcore/acx.h
index a28fc044034c..b2f88831b7a9 100644
--- a/drivers/net/wireless/wl12xx/acx.h
+++ b/drivers/net/wireless/ti/wlcore/acx.h
@@ -25,7 +25,7 @@
 #ifndef __ACX_H__
 #define __ACX_H__
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "cmd.h"
 
 /*************************************************************************
@@ -824,16 +824,11 @@ struct wl1271_acx_keep_alive_config {
         __le32 period;
 } __packed;
 
+/* TODO: maybe this needs to be moved somewhere else? */
 #define HOST_IF_CFG_RX_FIFO_ENABLE     BIT(0)
 #define HOST_IF_CFG_TX_EXTRA_BLKS_SWAP BIT(1)
 #define HOST_IF_CFG_TX_PAD_TO_SDIO_BLK BIT(3)
 
-struct wl1271_acx_host_config_bitmap {
-        struct acx_header header;
-
-        __le32 host_cfg_bitmap;
-} __packed;
-
 enum {
         WL1271_ACX_TRIG_TYPE_LEVEL = 0,
         WL1271_ACX_TRIG_TYPE_EDGE,
@@ -1274,7 +1269,6 @@ int wl1271_acx_frag_threshold(struct wl1271 *wl, u32 frag_threshold);
 int wl1271_acx_tx_config_options(struct wl1271 *wl);
 int wl12xx_acx_mem_cfg(struct wl1271 *wl);
 int wl1271_acx_init_mem_config(struct wl1271 *wl);
-int wl1271_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap);
 int wl1271_acx_init_rx_interrupt(struct wl1271 *wl);
 int wl1271_acx_smart_reflex(struct wl1271 *wl);
 int wl1271_acx_bet_enable(struct wl1271 *wl, struct wl12xx_vif *wlvif,
diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c
new file mode 100644
index 000000000000..3a2207db5405
--- /dev/null
+++ b/drivers/net/wireless/ti/wlcore/boot.c
@@ -0,0 +1,443 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2010 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/slab.h>
+#include <linux/wl12xx.h>
+#include <linux/export.h>
+
+#include "debug.h"
+#include "acx.h"
+#include "boot.h"
+#include "io.h"
+#include "event.h"
+#include "rx.h"
+#include "hw_ops.h"
+
+static void wl1271_boot_set_ecpu_ctrl(struct wl1271 *wl, u32 flag)
+{
+        u32 cpu_ctrl;
+
+        /* 10.5.0 run the firmware (I) */
+        cpu_ctrl = wlcore_read_reg(wl, REG_ECPU_CONTROL);
+
+        /* 10.5.1 run the firmware (II) */
+        cpu_ctrl |= flag;
+        wlcore_write_reg(wl, REG_ECPU_CONTROL, cpu_ctrl);
+}
+
+static int wlcore_parse_fw_ver(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = sscanf(wl->chip.fw_ver_str + 4, "%u.%u.%u.%u.%u",
+                     &wl->chip.fw_ver[0], &wl->chip.fw_ver[1],
+                     &wl->chip.fw_ver[2], &wl->chip.fw_ver[3],
+                     &wl->chip.fw_ver[4]);
+
+        if (ret != 5) {
+                wl1271_warning("fw version incorrect value");
+                memset(wl->chip.fw_ver, 0, sizeof(wl->chip.fw_ver));
+                return -EINVAL;
+        }
+
+        ret = wlcore_identify_fw(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wlcore_boot_fw_version(struct wl1271 *wl)
+{
+        struct wl1271_static_data *static_data;
+        int ret;
+
+        static_data = kmalloc(sizeof(*static_data), GFP_DMA);
+        if (!static_data) {
+                wl1271_error("Couldn't allocate memory for static data!");
+                return -ENOMEM;
+        }
+
+        wl1271_read(wl, wl->cmd_box_addr, static_data, sizeof(*static_data),
+                    false);
+
+        strncpy(wl->chip.fw_ver_str, static_data->fw_version,
+                sizeof(wl->chip.fw_ver_str));
+
+        kfree(static_data);
+
+        /* make sure the string is NULL-terminated */
+        wl->chip.fw_ver_str[sizeof(wl->chip.fw_ver_str) - 1] = '\0';
+
+        ret = wlcore_parse_fw_ver(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
+                                             size_t fw_data_len, u32 dest)
+{
+        struct wlcore_partition_set partition;
+        int addr, chunk_num, partition_limit;
+        u8 *p, *chunk;
+
+        /* whal_FwCtrl_LoadFwImageSm() */
+
+        wl1271_debug(DEBUG_BOOT, "starting firmware upload");
+
+        wl1271_debug(DEBUG_BOOT, "fw_data_len %zd chunk_size %d",
+                     fw_data_len, CHUNK_SIZE);
+
+        if ((fw_data_len % 4) != 0) {
+                wl1271_error("firmware length not multiple of four");
+                return -EIO;
+        }
+
+        chunk = kmalloc(CHUNK_SIZE, GFP_KERNEL);
+        if (!chunk) {
+                wl1271_error("allocation for firmware upload chunk failed");
+                return -ENOMEM;
+        }
+
+        memcpy(&partition, &wl->ptable[PART_DOWN], sizeof(partition));
+        partition.mem.start = dest;
+        wlcore_set_partition(wl, &partition);
+
+        /* 10.1 set partition limit and chunk num */
+        chunk_num = 0;
+        partition_limit = wl->ptable[PART_DOWN].mem.size;
+
+        while (chunk_num < fw_data_len / CHUNK_SIZE) {
+                /* 10.2 update partition, if needed */
+                addr = dest + (chunk_num + 2) * CHUNK_SIZE;
+                if (addr > partition_limit) {
+                        addr = dest + chunk_num * CHUNK_SIZE;
+                        partition_limit = chunk_num * CHUNK_SIZE +
+                                wl->ptable[PART_DOWN].mem.size;
+                        partition.mem.start = addr;
+                        wlcore_set_partition(wl, &partition);
+                }
+
+                /* 10.3 upload the chunk */
+                addr = dest + chunk_num * CHUNK_SIZE;
+                p = buf + chunk_num * CHUNK_SIZE;
+                memcpy(chunk, p, CHUNK_SIZE);
+                wl1271_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
+                             p, addr);
+                wl1271_write(wl, addr, chunk, CHUNK_SIZE, false);
+
+                chunk_num++;
+        }
+
+        /* 10.4 upload the last chunk */
+        addr = dest + chunk_num * CHUNK_SIZE;
+        p = buf + chunk_num * CHUNK_SIZE;
+        memcpy(chunk, p, fw_data_len % CHUNK_SIZE);
+        wl1271_debug(DEBUG_BOOT, "uploading fw last chunk (%zd B) 0x%p to 0x%x",
+                     fw_data_len % CHUNK_SIZE, p, addr);
+        wl1271_write(wl, addr, chunk, fw_data_len % CHUNK_SIZE, false);
+
+        kfree(chunk);
+        return 0;
+}
+
+int wlcore_boot_upload_firmware(struct wl1271 *wl)
+{
+        u32 chunks, addr, len;
+        int ret = 0;
+        u8 *fw;
+
+        fw = wl->fw;
+        chunks = be32_to_cpup((__be32 *) fw);
+        fw += sizeof(u32);
+
+        wl1271_debug(DEBUG_BOOT, "firmware chunks to be uploaded: %u", chunks);
+
+        while (chunks--) {
+                addr = be32_to_cpup((__be32 *) fw);
+                fw += sizeof(u32);
+                len = be32_to_cpup((__be32 *) fw);
+                fw += sizeof(u32);
+
+                if (len > 300000) {
+                        wl1271_info("firmware chunk too long: %u", len);
+                        return -EINVAL;
+                }
+                wl1271_debug(DEBUG_BOOT, "chunk %d addr 0x%x len %u",
+                             chunks, addr, len);
+                ret = wl1271_boot_upload_firmware_chunk(wl, fw, len, addr);
+                if (ret != 0)
+                        break;
+                fw += len;
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(wlcore_boot_upload_firmware);
+
+int wlcore_boot_upload_nvs(struct wl1271 *wl)
+{
+        size_t nvs_len, burst_len;
+        int i;
+        u32 dest_addr, val;
+        u8 *nvs_ptr, *nvs_aligned;
+
+        if (wl->nvs == NULL)
+                return -ENODEV;
+
+        if (wl->quirks & WLCORE_QUIRK_LEGACY_NVS) {
+                struct wl1271_nvs_file *nvs =
+                        (struct wl1271_nvs_file *)wl->nvs;
+                /*
+                 * FIXME: the LEGACY NVS image support (NVS's missing the 5GHz
+                 * band configurations) can be removed when those NVS files stop
+                 * floating around.
+                 */
+                if (wl->nvs_len == sizeof(struct wl1271_nvs_file) ||
+                    wl->nvs_len == WL1271_INI_LEGACY_NVS_FILE_SIZE) {
+                        if (nvs->general_params.dual_mode_select)
+                                wl->enable_11a = true;
+                }
+
+                if (wl->nvs_len != sizeof(struct wl1271_nvs_file) &&
+                    (wl->nvs_len != WL1271_INI_LEGACY_NVS_FILE_SIZE ||
+                     wl->enable_11a)) {
+                        wl1271_error("nvs size is not as expected: %zu != %zu",
+                                wl->nvs_len, sizeof(struct wl1271_nvs_file));
+                        kfree(wl->nvs);
+                        wl->nvs = NULL;
+                        wl->nvs_len = 0;
+                        return -EILSEQ;
+                }
+
+                /* only the first part of the NVS needs to be uploaded */
+                nvs_len = sizeof(nvs->nvs);
+                nvs_ptr = (u8 *) nvs->nvs;
+        } else {
+                struct wl128x_nvs_file *nvs = (struct wl128x_nvs_file *)wl->nvs;
+
+                if (wl->nvs_len == sizeof(struct wl128x_nvs_file)) {
+                        if (nvs->general_params.dual_mode_select)
+                                wl->enable_11a = true;
+                } else {
+                        wl1271_error("nvs size is not as expected: %zu != %zu",
+                                     wl->nvs_len,
+                                     sizeof(struct wl128x_nvs_file));
+                        kfree(wl->nvs);
+                        wl->nvs = NULL;
+                        wl->nvs_len = 0;
+                        return -EILSEQ;
+                }
+
+                /* only the first part of the NVS needs to be uploaded */
+                nvs_len = sizeof(nvs->nvs);
+                nvs_ptr = (u8 *)nvs->nvs;
+        }
+
+        /* update current MAC address to NVS */
+        nvs_ptr[11] = wl->addresses[0].addr[0];
+        nvs_ptr[10] = wl->addresses[0].addr[1];
+        nvs_ptr[6] = wl->addresses[0].addr[2];
+        nvs_ptr[5] = wl->addresses[0].addr[3];
+        nvs_ptr[4] = wl->addresses[0].addr[4];
+        nvs_ptr[3] = wl->addresses[0].addr[5];
+
+        /*
+         * Layout before the actual NVS tables:
+         * 1 byte : burst length.
+         * 2 bytes: destination address.
+         * n bytes: data to burst copy.
+         *
+         * This is ended by a 0 length, then the NVS tables.
+         */
+
+        /* FIXME: Do we need to check here whether the LSB is 1? */
+        while (nvs_ptr[0]) {
+                burst_len = nvs_ptr[0];
+                dest_addr = (nvs_ptr[1] & 0xfe) | ((u32)(nvs_ptr[2] << 8));
+
+                /*
+                 * Due to our new wl1271_translate_reg_addr function,
+                 * we need to add the register partition start address
+                 * to the destination
+                 */
+                dest_addr += wl->curr_part.reg.start;
+
+                /* We move our pointer to the data */
+                nvs_ptr += 3;
+
+                for (i = 0; i < burst_len; i++) {
+                        if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
+                                goto out_badnvs;
+
+                        val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
+                               | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
+
+                        wl1271_debug(DEBUG_BOOT,
+                                     "nvs burst write 0x%x: 0x%x",
+                                     dest_addr, val);
+                        wl1271_write32(wl, dest_addr, val);
+
+                        nvs_ptr += 4;
+                        dest_addr += 4;
+                }
+
+                if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+                        goto out_badnvs;
+        }
+
+        /*
+         * We've reached the first zero length, the first NVS table
+         * is located at an aligned offset which is at least 7 bytes further.
+         * NOTE: The wl->nvs->nvs element must be first, in order to
+         * simplify the casting, we assume it is at the beginning of
+         * the wl->nvs structure.
+         */
+        nvs_ptr = (u8 *)wl->nvs +
+                        ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
+
+        if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+                goto out_badnvs;
+
+        nvs_len -= nvs_ptr - (u8 *)wl->nvs;
+
+        /* Now we must set the partition correctly */
+        wlcore_set_partition(wl, &wl->ptable[PART_WORK]);
+
+        /* Copy the NVS tables to a new block to ensure alignment */
+        nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL);
+        if (!nvs_aligned)
+                return -ENOMEM;
+
+        /* And finally we upload the NVS tables */
+        wlcore_write_data(wl, REG_CMD_MBOX_ADDRESS,
+                          nvs_aligned, nvs_len, false);
+
+        kfree(nvs_aligned);
+        return 0;
+
+out_badnvs:
+        wl1271_error("nvs data is malformed");
+        return -EILSEQ;
+}
+EXPORT_SYMBOL_GPL(wlcore_boot_upload_nvs);
+
+int wlcore_boot_run_firmware(struct wl1271 *wl)
+{
+        int loop, ret;
+        u32 chip_id, intr;
+
+        /* Make sure we have the boot partition */
+        wlcore_set_partition(wl, &wl->ptable[PART_BOOT]);
+
+        wl1271_boot_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
+
+        chip_id = wlcore_read_reg(wl, REG_CHIP_ID_B);
+
+        wl1271_debug(DEBUG_BOOT, "chip id after firmware boot: 0x%x", chip_id);
+
+        if (chip_id != wl->chip.id) {
+                wl1271_error("chip id doesn't match after firmware boot");
+                return -EIO;
+        }
+
+        /* wait for init to complete */
+        loop = 0;
+        while (loop++ < INIT_LOOP) {
+                udelay(INIT_LOOP_DELAY);
+                intr = wlcore_read_reg(wl, REG_INTERRUPT_NO_CLEAR);
+
+                if (intr == 0xffffffff) {
+                        wl1271_error("error reading hardware complete "
+                                     "init indication");
+                        return -EIO;
+                }
+                /* check that ACX_INTR_INIT_COMPLETE is enabled */
+                else if (intr & WL1271_ACX_INTR_INIT_COMPLETE) {
+                        wlcore_write_reg(wl, REG_INTERRUPT_ACK,
+                                         WL1271_ACX_INTR_INIT_COMPLETE);
+                        break;
+                }
+        }
+
+        if (loop > INIT_LOOP) {
+                wl1271_error("timeout waiting for the hardware to "
+                             "complete initialization");
+                return -EIO;
+        }
+
+        /* get hardware config command mail box */
+        wl->cmd_box_addr = wlcore_read_reg(wl, REG_COMMAND_MAILBOX_PTR);
+
+        wl1271_debug(DEBUG_MAILBOX, "cmd_box_addr 0x%x", wl->cmd_box_addr);
+
+        /* get hardware config event mail box */
+        wl->mbox_ptr[0] = wlcore_read_reg(wl, REG_EVENT_MAILBOX_PTR);
+        wl->mbox_ptr[1] = wl->mbox_ptr[0] + sizeof(struct event_mailbox);
+
+        wl1271_debug(DEBUG_MAILBOX, "MBOX ptrs: 0x%x 0x%x",
+                     wl->mbox_ptr[0], wl->mbox_ptr[1]);
+
+        ret = wlcore_boot_fw_version(wl);
+        if (ret < 0) {
+                wl1271_error("couldn't boot firmware");
+                return ret;
+        }
+
+        /*
+         * in case of full asynchronous mode the firmware event must be
+         * ready to receive event from the command mailbox
+         */
+
+        /* unmask required mbox events  */
+        wl->event_mask = BSS_LOSE_EVENT_ID |
+                SCAN_COMPLETE_EVENT_ID |
+                ROLE_STOP_COMPLETE_EVENT_ID |
+                RSSI_SNR_TRIGGER_0_EVENT_ID |
+                PSPOLL_DELIVERY_FAILURE_EVENT_ID |
+                SOFT_GEMINI_SENSE_EVENT_ID |
+                PERIODIC_SCAN_REPORT_EVENT_ID |
+                PERIODIC_SCAN_COMPLETE_EVENT_ID |
+                DUMMY_PACKET_EVENT_ID |
+                PEER_REMOVE_COMPLETE_EVENT_ID |
+                BA_SESSION_RX_CONSTRAINT_EVENT_ID |
+                REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID |
+                INACTIVE_STA_EVENT_ID |
+                MAX_TX_RETRY_EVENT_ID |
+                CHANNEL_SWITCH_COMPLETE_EVENT_ID;
+
+        ret = wl1271_event_unmask(wl);
+        if (ret < 0) {
+                wl1271_error("EVENT mask setting failed");
+                return ret;
+        }
+
+        /* set the working partition to its "running" mode offset */
+        wlcore_set_partition(wl, &wl->ptable[PART_WORK]);
+
+        /* firmware startup completed */
+        return 0;
+}
+EXPORT_SYMBOL_GPL(wlcore_boot_run_firmware);
diff --git a/drivers/net/wireless/ti/wlcore/boot.h b/drivers/net/wireless/ti/wlcore/boot.h
new file mode 100644
index 000000000000..094981dd2227
--- /dev/null
+++ b/drivers/net/wireless/ti/wlcore/boot.h
@@ -0,0 +1,54 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __BOOT_H__
+#define __BOOT_H__
+
+#include "wlcore.h"
+
+int wlcore_boot_upload_firmware(struct wl1271 *wl);
+int wlcore_boot_upload_nvs(struct wl1271 *wl);
+int wlcore_boot_run_firmware(struct wl1271 *wl);
+
+#define WL1271_NO_SUBBANDS 8
+#define WL1271_NO_POWER_LEVELS 4
+#define WL1271_FW_VERSION_MAX_LEN 20
+
+struct wl1271_static_data {
+        u8 mac_address[ETH_ALEN];
+        u8 padding[2];
+        u8 fw_version[WL1271_FW_VERSION_MAX_LEN];
+        u32 hw_version;
+        u8 tx_power_table[WL1271_NO_SUBBANDS][WL1271_NO_POWER_LEVELS];
+};
+
+/* number of times we try to read the INIT interrupt */
+#define INIT_LOOP 20000
+
+/* delay between retries */
+#define INIT_LOOP_DELAY 50
+
+#define WU_COUNTER_PAUSE_VAL 0x3FF
+#define WELP_ARM_COMMAND_VAL 0x4
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 3414fc11e9ba..5c4716c6f040 100644
--- a/drivers/net/wireless/wl12xx/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -28,9 +28,8 @@
 #include <linux/ieee80211.h>
 #include <linux/slab.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
-#include "reg.h"
 #include "io.h"
 #include "acx.h"
 #include "wl12xx_80211.h"
@@ -67,11 +66,15 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
 
         wl1271_write(wl, wl->cmd_box_addr, buf, len, false);
 
-        wl1271_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_CMD);
+        /*
+         * TODO: we just need this because one bit is in a different
+         * place.  Is there any better way?
+         */
+        wl->ops->trigger_cmd(wl, wl->cmd_box_addr, buf, len);
 
         timeout = jiffies + msecs_to_jiffies(WL1271_COMMAND_TIMEOUT);
 
-        intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+        intr = wlcore_read_reg(wl, REG_INTERRUPT_NO_CLEAR);
         while (!(intr & WL1271_ACX_INTR_CMD_COMPLETE)) {
                 if (time_after(jiffies, timeout)) {
                         wl1271_error("command complete timeout");
@@ -85,7 +88,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                 else
                         msleep(1);
 
-                intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+                intr = wlcore_read_reg(wl, REG_INTERRUPT_NO_CLEAR);
         }
 
         /* read back the status code of the command */
@@ -100,8 +103,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                 goto fail;
         }
 
-        wl1271_write32(wl, ACX_REG_INTERRUPT_ACK,
-                       WL1271_ACX_INTR_CMD_COMPLETE);
+        wlcore_write_reg(wl, REG_INTERRUPT_ACK, WL1271_ACX_INTR_CMD_COMPLETE);
         return 0;
 
 fail:
@@ -110,240 +112,18 @@ fail:
         return ret;
 }
 
-int wl1271_cmd_general_parms(struct wl1271 *wl)
-{
-        struct wl1271_general_parms_cmd *gen_parms;
-        struct wl1271_ini_general_params *gp =
-                &((struct wl1271_nvs_file *)wl->nvs)->general_params;
-        bool answer = false;
-        int ret;
-
-        if (!wl->nvs)
-                return -ENODEV;
-
-        if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
-                wl1271_warning("FEM index from INI out of bounds");
-                return -EINVAL;
-        }
-
-        gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
-        if (!gen_parms)
-                return -ENOMEM;
-
-        gen_parms->test.id = TEST_CMD_INI_FILE_GENERAL_PARAM;
-
-        memcpy(&gen_parms->general_params, gp, sizeof(*gp));
-
-        if (gp->tx_bip_fem_auto_detect)
-                answer = true;
-
-        /* Override the REF CLK from the NVS with the one from platform data */
-        gen_parms->general_params.ref_clock = wl->ref_clock;
-
-        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), answer);
-        if (ret < 0) {
-                wl1271_warning("CMD_INI_FILE_GENERAL_PARAM failed");
-                goto out;
-        }
-
-        gp->tx_bip_fem_manufacturer =
-                gen_parms->general_params.tx_bip_fem_manufacturer;
-
-        if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
-                wl1271_warning("FEM index from FW out of bounds");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
-                     answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
-
-out:
-        kfree(gen_parms);
-        return ret;
-}
-
-int wl128x_cmd_general_parms(struct wl1271 *wl)
-{
-        struct wl128x_general_parms_cmd *gen_parms;
-        struct wl128x_ini_general_params *gp =
-                &((struct wl128x_nvs_file *)wl->nvs)->general_params;
-        bool answer = false;
-        int ret;
-
-        if (!wl->nvs)
-                return -ENODEV;
-
-        if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
-                wl1271_warning("FEM index from ini out of bounds");
-                return -EINVAL;
-        }
-
-        gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
-        if (!gen_parms)
-                return -ENOMEM;
-
-        gen_parms->test.id = TEST_CMD_INI_FILE_GENERAL_PARAM;
-
-        memcpy(&gen_parms->general_params, gp, sizeof(*gp));
-
-        if (gp->tx_bip_fem_auto_detect)
-                answer = true;
-
-        /* Replace REF and TCXO CLKs with the ones from platform data */
-        gen_parms->general_params.ref_clock = wl->ref_clock;
-        gen_parms->general_params.tcxo_ref_clock = wl->tcxo_clock;
-
-        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), answer);
-        if (ret < 0) {
-                wl1271_warning("CMD_INI_FILE_GENERAL_PARAM failed");
-                goto out;
-        }
-
-        gp->tx_bip_fem_manufacturer =
-                gen_parms->general_params.tx_bip_fem_manufacturer;
-
-        if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
-                wl1271_warning("FEM index from FW out of bounds");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
-                     answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
-
-out:
-        kfree(gen_parms);
-        return ret;
-}
-
-int wl1271_cmd_radio_parms(struct wl1271 *wl)
-{
-        struct wl1271_nvs_file *nvs = (struct wl1271_nvs_file *)wl->nvs;
-        struct wl1271_radio_parms_cmd *radio_parms;
-        struct wl1271_ini_general_params *gp = &nvs->general_params;
-        int ret;
-
-        if (!wl->nvs)
-                return -ENODEV;
-
-        radio_parms = kzalloc(sizeof(*radio_parms), GFP_KERNEL);
-        if (!radio_parms)
-                return -ENOMEM;
-
-        radio_parms->test.id = TEST_CMD_INI_FILE_RADIO_PARAM;
-
-        /* 2.4GHz parameters */
-        memcpy(&radio_parms->static_params_2, &nvs->stat_radio_params_2,
-               sizeof(struct wl1271_ini_band_params_2));
-        memcpy(&radio_parms->dyn_params_2,
-               &nvs->dyn_radio_params_2[gp->tx_bip_fem_manufacturer].params,
-               sizeof(struct wl1271_ini_fem_params_2));
-
-        /* 5GHz parameters */
-        memcpy(&radio_parms->static_params_5,
-               &nvs->stat_radio_params_5,
-               sizeof(struct wl1271_ini_band_params_5));
-        memcpy(&radio_parms->dyn_params_5,
-               &nvs->dyn_radio_params_5[gp->tx_bip_fem_manufacturer].params,
-               sizeof(struct wl1271_ini_fem_params_5));
-
-        wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_RADIO_PARAM: ",
-                    radio_parms, sizeof(*radio_parms));
-
-        ret = wl1271_cmd_test(wl, radio_parms, sizeof(*radio_parms), 0);
-        if (ret < 0)
-                wl1271_warning("CMD_INI_FILE_RADIO_PARAM failed");
-
-        kfree(radio_parms);
-        return ret;
-}
-
-int wl128x_cmd_radio_parms(struct wl1271 *wl)
-{
-        struct wl128x_nvs_file *nvs = (struct wl128x_nvs_file *)wl->nvs;
-        struct wl128x_radio_parms_cmd *radio_parms;
-        struct wl128x_ini_general_params *gp = &nvs->general_params;
-        int ret;
-
-        if (!wl->nvs)
-                return -ENODEV;
-
-        radio_parms = kzalloc(sizeof(*radio_parms), GFP_KERNEL);
-        if (!radio_parms)
-                return -ENOMEM;
-
-        radio_parms->test.id = TEST_CMD_INI_FILE_RADIO_PARAM;
-
-        /* 2.4GHz parameters */
-        memcpy(&radio_parms->static_params_2, &nvs->stat_radio_params_2,
-               sizeof(struct wl128x_ini_band_params_2));
-        memcpy(&radio_parms->dyn_params_2,
-               &nvs->dyn_radio_params_2[gp->tx_bip_fem_manufacturer].params,
-               sizeof(struct wl128x_ini_fem_params_2));
-
-        /* 5GHz parameters */
-        memcpy(&radio_parms->static_params_5,
-               &nvs->stat_radio_params_5,
-               sizeof(struct wl128x_ini_band_params_5));
-        memcpy(&radio_parms->dyn_params_5,
-               &nvs->dyn_radio_params_5[gp->tx_bip_fem_manufacturer].params,
-               sizeof(struct wl128x_ini_fem_params_5));
-
-        radio_parms->fem_vendor_and_options = nvs->fem_vendor_and_options;
-
-        wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_RADIO_PARAM: ",
-                    radio_parms, sizeof(*radio_parms));
-
-        ret = wl1271_cmd_test(wl, radio_parms, sizeof(*radio_parms), 0);
-        if (ret < 0)
-                wl1271_warning("CMD_INI_FILE_RADIO_PARAM failed");
-
-        kfree(radio_parms);
-        return ret;
-}
-
-int wl1271_cmd_ext_radio_parms(struct wl1271 *wl)
-{
-        struct wl1271_ext_radio_parms_cmd *ext_radio_parms;
-        struct conf_rf_settings *rf = &wl->conf.rf;
-        int ret;
-
-        if (!wl->nvs)
-                return -ENODEV;
-
-        ext_radio_parms = kzalloc(sizeof(*ext_radio_parms), GFP_KERNEL);
-        if (!ext_radio_parms)
-                return -ENOMEM;
-
-        ext_radio_parms->test.id = TEST_CMD_INI_FILE_RF_EXTENDED_PARAM;
-
-        memcpy(ext_radio_parms->tx_per_channel_power_compensation_2,
-               rf->tx_per_channel_power_compensation_2,
-               CONF_TX_PWR_COMPENSATION_LEN_2);
-        memcpy(ext_radio_parms->tx_per_channel_power_compensation_5,
-               rf->tx_per_channel_power_compensation_5,
-               CONF_TX_PWR_COMPENSATION_LEN_5);
-
-        wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_EXT_RADIO_PARAM: ",
-                    ext_radio_parms, sizeof(*ext_radio_parms));
-
-        ret = wl1271_cmd_test(wl, ext_radio_parms, sizeof(*ext_radio_parms), 0);
-        if (ret < 0)
-                wl1271_warning("TEST_CMD_INI_FILE_RF_EXTENDED_PARAM failed");
-
-        kfree(ext_radio_parms);
-        return ret;
-}
-
 /*
  * Poll the mailbox event field until any of the bits in the mask is set or a
  * timeout occurs (WL1271_EVENT_TIMEOUT in msecs)
  */
 static int wl1271_cmd_wait_for_event_or_timeout(struct wl1271 *wl, u32 mask)
 {
-        u32 events_vector, event;
+        u32 *events_vector;
+        u32 event;
         unsigned long timeout;
+        int ret = 0;
+
+        events_vector = kmalloc(sizeof(*events_vector), GFP_DMA);
 
         timeout = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
 
@@ -351,21 +131,24 @@ static int wl1271_cmd_wait_for_event_or_timeout(struct wl1271 *wl, u32 mask)
                 if (time_after(jiffies, timeout)) {
                         wl1271_debug(DEBUG_CMD, "timeout waiting for event %d",
                                      (int)mask);
-                        return -ETIMEDOUT;
+                        ret = -ETIMEDOUT;
+                        goto out;
                 }
 
                 msleep(1);
 
                 /* read from both event fields */
-                wl1271_read(wl, wl->mbox_ptr[0], &events_vector,
-                            sizeof(events_vector), false);
-                event = events_vector & mask;
-                wl1271_read(wl, wl->mbox_ptr[1], &events_vector,
-                            sizeof(events_vector), false);
-                event |= events_vector & mask;
+                wl1271_read(wl, wl->mbox_ptr[0], events_vector,
+                            sizeof(*events_vector), false);
+                event = *events_vector & mask;
+                wl1271_read(wl, wl->mbox_ptr[1], events_vector,
+                            sizeof(*events_vector), false);
+                event |= *events_vector & mask;
         } while (!event);
 
-        return 0;
+out:
+        kfree(events_vector);
+        return ret;
 }
 
 static int wl1271_cmd_wait_for_event(struct wl1271 *wl, u32 mask)
@@ -522,7 +305,7 @@ static int wl12xx_cmd_role_start_dev(struct wl1271 *wl,
 
         cmd->role_id = wlvif->dev_role_id;
         if (wlvif->band == IEEE80211_BAND_5GHZ)
-                cmd->band = WL12XX_BAND_5GHZ;
+                cmd->band = WLCORE_BAND_5GHZ;
         cmd->channel = wlvif->channel;
 
         if (wlvif->dev_hlid == WL12XX_INVALID_LINK_ID) {
@@ -613,7 +396,7 @@ int wl12xx_cmd_role_start_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 
         cmd->role_id = wlvif->role_id;
         if (wlvif->band == IEEE80211_BAND_5GHZ)
-                cmd->band = WL12XX_BAND_5GHZ;
+                cmd->band = WLCORE_BAND_5GHZ;
         cmd->channel = wlvif->channel;
         cmd->sta.basic_rate_set = cpu_to_le32(wlvif->basic_rate_set);
         cmd->sta.beacon_interval = cpu_to_le16(wlvif->beacon_int);
@@ -750,14 +533,14 @@ int wl12xx_cmd_role_start_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 
         switch (wlvif->band) {
         case IEEE80211_BAND_2GHZ:
-                cmd->band = RADIO_BAND_2_4GHZ;
+                cmd->band = WLCORE_BAND_2_4GHZ;
                 break;
         case IEEE80211_BAND_5GHZ:
-                cmd->band = RADIO_BAND_5GHZ;
+                cmd->band = WLCORE_BAND_5GHZ;
                 break;
         default:
                 wl1271_warning("ap start - unknown band: %d", (int)wlvif->band);
-                cmd->band = RADIO_BAND_2_4GHZ;
+                cmd->band = WLCORE_BAND_2_4GHZ;
                 break;
         }
 
@@ -830,7 +613,7 @@ int wl12xx_cmd_role_start_ibss(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 
         cmd->role_id = wlvif->role_id;
         if (wlvif->band == IEEE80211_BAND_5GHZ)
-                cmd->band = WL12XX_BAND_5GHZ;
+                cmd->band = WLCORE_BAND_5GHZ;
         cmd->channel = wlvif->channel;
         cmd->ibss.basic_rate_set = cpu_to_le32(wlvif->basic_rate_set);
         cmd->ibss.beacon_interval = cpu_to_le16(wlvif->beacon_int);
@@ -904,6 +687,7 @@ int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(wl1271_cmd_test);
 
 /**
  * read acx from firmware
@@ -960,6 +744,7 @@ int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(wl1271_cmd_configure);
 
 int wl1271_cmd_data_path(struct wl1271 *wl, bool enable)
 {
@@ -1730,10 +1515,10 @@ static int wl12xx_cmd_roc(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         cmd->channel = wlvif->channel;
         switch (wlvif->band) {
         case IEEE80211_BAND_2GHZ:
-                cmd->band = RADIO_BAND_2_4GHZ;
+                cmd->band = WLCORE_BAND_2_4GHZ;
                 break;
         case IEEE80211_BAND_5GHZ:
-                cmd->band = RADIO_BAND_5GHZ;
+                cmd->band = WLCORE_BAND_5GHZ;
                 break;
         default:
                 wl1271_error("roc - unknown band: %d", (int)wlvif->band);
diff --git a/drivers/net/wireless/wl12xx/cmd.h b/drivers/net/wireless/ti/wlcore/cmd.h
index de217d92516b..a46ae07cb77e 100644
--- a/drivers/net/wireless/wl12xx/cmd.h
+++ b/drivers/net/wireless/ti/wlcore/cmd.h
@@ -25,17 +25,12 @@
 #ifndef __CMD_H__
 #define __CMD_H__
 
-#include "wl12xx.h"
+#include "wlcore.h"
 
 struct acx_header;
 
 int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                     size_t res_len);
-int wl1271_cmd_general_parms(struct wl1271 *wl);
-int wl128x_cmd_general_parms(struct wl1271 *wl);
-int wl1271_cmd_radio_parms(struct wl1271 *wl);
-int wl128x_cmd_radio_parms(struct wl1271 *wl);
-int wl1271_cmd_ext_radio_parms(struct wl1271 *wl);
 int wl12xx_cmd_role_enable(struct wl1271 *wl, u8 *addr, u8 role_type,
                            u8 *role_id);
 int wl12xx_cmd_role_disable(struct wl1271 *wl, u8 *role_id);
@@ -262,13 +257,13 @@ struct wl12xx_cmd_role_disable {
         u8 padding[3];
 } __packed;
 
-enum wl12xx_band {
-        WL12XX_BAND_2_4GHZ              = 0,
-        WL12XX_BAND_5GHZ                = 1,
-        WL12XX_BAND_JAPAN_4_9_GHZ       = 2,
-        WL12XX_BAND_DEFAULT             = WL12XX_BAND_2_4GHZ,
-        WL12XX_BAND_INVALID             = 0x7E,
-        WL12XX_BAND_MAX_RADIO           = 0x7F,
+enum wlcore_band {
+        WLCORE_BAND_2_4GHZ              = 0,
+        WLCORE_BAND_5GHZ                = 1,
+        WLCORE_BAND_JAPAN_4_9_GHZ       = 2,
+        WLCORE_BAND_DEFAULT             = WLCORE_BAND_2_4GHZ,
+        WLCORE_BAND_INVALID             = 0x7E,
+        WLCORE_BAND_MAX_RADIO           = 0x7F,
 };
 
 struct wl12xx_cmd_role_start {
@@ -494,83 +489,6 @@ enum wl1271_channel_tune_bands {
 
 #define WL1271_PD_REFERENCE_POINT_BAND_B_G  0
 
-#define TEST_CMD_INI_FILE_RADIO_PARAM       0x19
-#define TEST_CMD_INI_FILE_GENERAL_PARAM     0x1E
-#define TEST_CMD_INI_FILE_RF_EXTENDED_PARAM 0x26
-
-struct wl1271_general_parms_cmd {
-        struct wl1271_cmd_header header;
-
-        struct wl1271_cmd_test_header test;
-
-        struct wl1271_ini_general_params general_params;
-
-        u8 sr_debug_table[WL1271_INI_MAX_SMART_REFLEX_PARAM];
-        u8 sr_sen_n_p;
-        u8 sr_sen_n_p_gain;
-        u8 sr_sen_nrn;
-        u8 sr_sen_prn;
-        u8 padding[3];
-} __packed;
-
-struct wl128x_general_parms_cmd {
-        struct wl1271_cmd_header header;
-
-        struct wl1271_cmd_test_header test;
-
-        struct wl128x_ini_general_params general_params;
-
-        u8 sr_debug_table[WL1271_INI_MAX_SMART_REFLEX_PARAM];
-        u8 sr_sen_n_p;
-        u8 sr_sen_n_p_gain;
-        u8 sr_sen_nrn;
-        u8 sr_sen_prn;
-        u8 padding[3];
-} __packed;
-
-struct wl1271_radio_parms_cmd {
-        struct wl1271_cmd_header header;
-
-        struct wl1271_cmd_test_header test;
-
-        /* Static radio parameters */
-        struct wl1271_ini_band_params_2 static_params_2;
-        struct wl1271_ini_band_params_5 static_params_5;
-
-        /* Dynamic radio parameters */
-        struct wl1271_ini_fem_params_2 dyn_params_2;
-        u8 padding2;
-        struct wl1271_ini_fem_params_5 dyn_params_5;
-        u8 padding3[2];
-} __packed;
-
-struct wl128x_radio_parms_cmd {
-        struct wl1271_cmd_header header;
-
-        struct wl1271_cmd_test_header test;
-
-        /* Static radio parameters */
-        struct wl128x_ini_band_params_2 static_params_2;
-        struct wl128x_ini_band_params_5 static_params_5;
-
-        u8 fem_vendor_and_options;
-
-        /* Dynamic radio parameters */
-        struct wl128x_ini_fem_params_2 dyn_params_2;
-        u8 padding2;
-        struct wl128x_ini_fem_params_5 dyn_params_5;
-} __packed;
-
-struct wl1271_ext_radio_parms_cmd {
-        struct wl1271_cmd_header header;
-
-        struct wl1271_cmd_test_header test;
-
-        u8 tx_per_channel_power_compensation_2[CONF_TX_PWR_COMPENSATION_LEN_2];
-        u8 tx_per_channel_power_compensation_5[CONF_TX_PWR_COMPENSATION_LEN_5];
-        u8 padding[3];
-} __packed;
-
 /*
  * There are three types of disconnections:
  *
diff --git a/drivers/net/wireless/wl12xx/conf.h b/drivers/net/wireless/ti/wlcore/conf.h
index 3e581e19424c..fef0db4213bc 100644
--- a/drivers/net/wireless/wl12xx/conf.h
+++ b/drivers/net/wireless/ti/wlcore/conf.h
@@ -65,36 +65,7 @@ enum {
         CONF_HW_RATE_INDEX_MAX     = CONF_HW_RATE_INDEX_54MBPS,
 };
 
-enum {
-        CONF_HW_RXTX_RATE_MCS7_SGI = 0,
-        CONF_HW_RXTX_RATE_MCS7,
-        CONF_HW_RXTX_RATE_MCS6,
-        CONF_HW_RXTX_RATE_MCS5,
-        CONF_HW_RXTX_RATE_MCS4,
-        CONF_HW_RXTX_RATE_MCS3,
-        CONF_HW_RXTX_RATE_MCS2,
-        CONF_HW_RXTX_RATE_MCS1,
-        CONF_HW_RXTX_RATE_MCS0,
-        CONF_HW_RXTX_RATE_54,
-        CONF_HW_RXTX_RATE_48,
-        CONF_HW_RXTX_RATE_36,
-        CONF_HW_RXTX_RATE_24,
-        CONF_HW_RXTX_RATE_22,
-        CONF_HW_RXTX_RATE_18,
-        CONF_HW_RXTX_RATE_12,
-        CONF_HW_RXTX_RATE_11,
-        CONF_HW_RXTX_RATE_9,
-        CONF_HW_RXTX_RATE_6,
-        CONF_HW_RXTX_RATE_5_5,
-        CONF_HW_RXTX_RATE_2,
-        CONF_HW_RXTX_RATE_1,
-        CONF_HW_RXTX_RATE_MAX,
-        CONF_HW_RXTX_RATE_UNSUPPORTED = 0xff
-};
-
-/* Rates between and including these are MCS rates */
-#define CONF_HW_RXTX_RATE_MCS_MIN CONF_HW_RXTX_RATE_MCS7_SGI
-#define CONF_HW_RXTX_RATE_MCS_MAX CONF_HW_RXTX_RATE_MCS0
+#define CONF_HW_RXTX_RATE_UNSUPPORTED 0xff
 
 enum {
         CONF_SG_DISABLE = 0,
@@ -1096,16 +1067,31 @@ struct conf_scan_settings {
 };
 
 struct conf_sched_scan_settings {
-        /* minimum time to wait on the channel for active scans (in TUs) */
-        u16 min_dwell_time_active;
+        /*
+         * The base time to wait on the channel for active scans (in TU/1000).
+         * The minimum dwell time is calculated according to this:
+         * min_dwell_time = base + num_of_probes_to_be_sent * delta_per_probe
+         * The maximum dwell time is calculated according to this:
+         * max_dwell_time = min_dwell_time + max_dwell_time_delta
+         */
+        u32 base_dwell_time;
 
-        /* maximum time to wait on the channel for active scans (in TUs) */
-        u16 max_dwell_time_active;
+        /* The delta between the min dwell time and max dwell time for
+         * active scans (in TU/1000s). The max dwell time is used by the FW once
+         * traffic is detected on the channel.
+         */
+        u32 max_dwell_time_delta;
+
+        /* Delta added to min dwell time per each probe in 2.4 GHz (TU/1000) */
+        u32 dwell_time_delta_per_probe;
 
-        /* time to wait on the channel for passive scans (in TUs) */
+        /* Delta added to min dwell time per each probe in 5 GHz (TU/1000) */
+        u32 dwell_time_delta_per_probe_5;
+
+        /* time to wait on the channel for passive scans (in TU/1000) */
         u32 dwell_time_passive;
 
-        /* time to wait on the channel for DFS scans (in TUs) */
+        /* time to wait on the channel for DFS scans (in TU/1000) */
         u32 dwell_time_dfs;
 
         /* number of probe requests to send on each channel in active scans */
@@ -1118,26 +1104,6 @@ struct conf_sched_scan_settings {
         s8 snr_threshold;
 };
 
-/* these are number of channels on the band divided by two, rounded up */
-#define CONF_TX_PWR_COMPENSATION_LEN_2 7
-#define CONF_TX_PWR_COMPENSATION_LEN_5 18
-
-struct conf_rf_settings {
-        /*
-         * Per channel power compensation for 2.4GHz
-         *
-         * Range: s8
-         */
-        u8 tx_per_channel_power_compensation_2[CONF_TX_PWR_COMPENSATION_LEN_2];
-
-        /*
-         * Per channel power compensation for 5GHz
-         *
-         * Range: s8
-         */
-        u8 tx_per_channel_power_compensation_5[CONF_TX_PWR_COMPENSATION_LEN_5];
-};
-
 struct conf_ht_setting {
         u8 rx_ba_win_size;
         u8 tx_ba_win_size;
@@ -1286,7 +1252,7 @@ struct conf_hangover_settings {
         u8 window_size;
 };
 
-struct conf_drv_settings {
+struct wlcore_conf {
         struct conf_sg_settings sg;
         struct conf_rx_settings rx;
         struct conf_tx_settings tx;
@@ -1296,16 +1262,13 @@ struct conf_drv_settings {
         struct conf_roam_trigger_settings roam_trigger;
         struct conf_scan_settings scan;
         struct conf_sched_scan_settings sched_scan;
-        struct conf_rf_settings rf;
         struct conf_ht_setting ht;
-        struct conf_memory_settings mem_wl127x;
-        struct conf_memory_settings mem_wl128x;
+        struct conf_memory_settings mem;
         struct conf_fm_coex fm_coex;
         struct conf_rx_streaming_settings rx_streaming;
         struct conf_fwlog fwlog;
         struct conf_rate_policy_settings rate;
         struct conf_hangover_settings hangover;
-        u8 hci_io_ds;
 };
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/debug.h b/drivers/net/wireless/ti/wlcore/debug.h
index ec0fdc25b280..6b800b3cbea5 100644
--- a/drivers/net/wireless/wl12xx/debug.h
+++ b/drivers/net/wireless/ti/wlcore/debug.h
@@ -52,6 +52,7 @@ enum {
         DEBUG_ADHOC     = BIT(16),
         DEBUG_AP        = BIT(17),
         DEBUG_PROBE     = BIT(18),
+        DEBUG_IO        = BIT(19),
         DEBUG_MASTER    = (DEBUG_ADHOC | DEBUG_AP),
         DEBUG_ALL       = ~0,
 };
diff --git a/drivers/net/wireless/wl12xx/debugfs.c b/drivers/net/wireless/ti/wlcore/debugfs.c
index 564d49575c94..d5aea1ff5ad1 100644
--- a/drivers/net/wireless/wl12xx/debugfs.c
+++ b/drivers/net/wireless/ti/wlcore/debugfs.c
@@ -26,7 +26,7 @@
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
 #include "acx.h"
 #include "ps.h"
@@ -647,6 +647,7 @@ static ssize_t vifs_state_read(struct file *file, char __user *user_buf,
                 VIF_STATE_PRINT_INT(last_rssi_event);
                 VIF_STATE_PRINT_INT(ba_support);
                 VIF_STATE_PRINT_INT(ba_allowed);
+                VIF_STATE_PRINT_INT(is_gem);
                 VIF_STATE_PRINT_LLHEX(tx_security_seq);
                 VIF_STATE_PRINT_INT(tx_security_last_seq_lsb);
         }
diff --git a/drivers/net/wireless/wl12xx/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h
index 254c5b292cf6..a8d3aef011ff 100644
--- a/drivers/net/wireless/wl12xx/debugfs.h
+++ b/drivers/net/wireless/ti/wlcore/debugfs.h
@@ -24,7 +24,7 @@
 #ifndef __DEBUGFS_H__
 #define __DEBUGFS_H__
 
-#include "wl12xx.h"
+#include "wlcore.h"
 
 int wl1271_debugfs_init(struct wl1271 *wl);
 void wl1271_debugfs_exit(struct wl1271 *wl);
diff --git a/drivers/net/wireless/wl12xx/event.c b/drivers/net/wireless/ti/wlcore/event.c
index c953717f38eb..292632ddf890 100644
--- a/drivers/net/wireless/wl12xx/event.c
+++ b/drivers/net/wireless/ti/wlcore/event.c
@@ -21,9 +21,8 @@
  *
  */
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
-#include "reg.h"
 #include "io.h"
 #include "event.h"
 #include "ps.h"
@@ -98,8 +97,9 @@ static void wl1271_event_mbox_dump(struct event_mailbox *mbox)
         wl1271_debug(DEBUG_EVENT, "\tmask: 0x%x", mbox->events_mask);
 }
 
-static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
+static int wl1271_event_process(struct wl1271 *wl)
 {
+        struct event_mailbox *mbox = wl->mbox;
         struct ieee80211_vif *vif;
         struct wl12xx_vif *wlvif;
         u32 vector;
@@ -196,7 +196,7 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
                         bool success;
 
                         if (!test_and_clear_bit(WLVIF_FLAG_CS_PROGRESS,
-                                                &wl->flags))
+                                                &wlvif->flags))
                                 continue;
 
                         success = mbox->channel_switch_status ? false : true;
@@ -278,18 +278,8 @@ int wl1271_event_unmask(struct wl1271 *wl)
         return 0;
 }
 
-void wl1271_event_mbox_config(struct wl1271 *wl)
-{
-        wl->mbox_ptr[0] = wl1271_read32(wl, REG_EVENT_MAILBOX_PTR);
-        wl->mbox_ptr[1] = wl->mbox_ptr[0] + sizeof(struct event_mailbox);
-
-        wl1271_debug(DEBUG_EVENT, "MBOX ptrs: 0x%x 0x%x",
-                     wl->mbox_ptr[0], wl->mbox_ptr[1]);
-}
-
 int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
 {
-        struct event_mailbox mbox;
         int ret;
 
         wl1271_debug(DEBUG_EVENT, "EVENT on mbox %d", mbox_num);
@@ -298,16 +288,19 @@ int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
                 return -EINVAL;
 
         /* first we read the mbox descriptor */
-        wl1271_read(wl, wl->mbox_ptr[mbox_num], &mbox,
-                    sizeof(struct event_mailbox), false);
+        wl1271_read(wl, wl->mbox_ptr[mbox_num], wl->mbox,
+                    sizeof(*wl->mbox), false);
 
         /* process the descriptor */
-        ret = wl1271_event_process(wl, &mbox);
+        ret = wl1271_event_process(wl);
         if (ret < 0)
                 return ret;
 
-        /* then we let the firmware know it can go on...*/
-        wl1271_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_EVENT_ACK);
+        /*
+         * TODO: we just need this because one bit is in a different
+         * place.  Is there any better way?
+         */
+        wl->ops->ack_event(wl);
 
         return 0;
 }
diff --git a/drivers/net/wireless/wl12xx/event.h b/drivers/net/wireless/ti/wlcore/event.h
index 057d193d3525..8adf18d6c58f 100644
--- a/drivers/net/wireless/wl12xx/event.h
+++ b/drivers/net/wireless/ti/wlcore/event.h
@@ -132,8 +132,9 @@ struct event_mailbox {
         u8 reserved_8[9];
 } __packed;
 
+struct wl1271;
+
 int wl1271_event_unmask(struct wl1271 *wl);
-void wl1271_event_mbox_config(struct wl1271 *wl);
 int wl1271_event_handle(struct wl1271 *wl, u8 mbox);
 
 #endif
diff --git a/drivers/net/wireless/ti/wlcore/hw_ops.h b/drivers/net/wireless/ti/wlcore/hw_ops.h
new file mode 100644
index 000000000000..9384b4d56c24
--- /dev/null
+++ b/drivers/net/wireless/ti/wlcore/hw_ops.h
@@ -0,0 +1,122 @@
+/*
+ * This file is part of wlcore
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WLCORE_HW_OPS_H__
+#define __WLCORE_HW_OPS_H__
+
+#include "wlcore.h"
+#include "rx.h"
+
+static inline u32
+wlcore_hw_calc_tx_blocks(struct wl1271 *wl, u32 len, u32 spare_blks)
+{
+        if (!wl->ops->calc_tx_blocks)
+                BUG_ON(1);
+
+        return wl->ops->calc_tx_blocks(wl, len, spare_blks);
+}
+
+static inline void
+wlcore_hw_set_tx_desc_blocks(struct wl1271 *wl, struct wl1271_tx_hw_descr *desc,
+                             u32 blks, u32 spare_blks)
+{
+        if (!wl->ops->set_tx_desc_blocks)
+                BUG_ON(1);
+
+        return wl->ops->set_tx_desc_blocks(wl, desc, blks, spare_blks);
+}
+
+static inline void
+wlcore_hw_set_tx_desc_data_len(struct wl1271 *wl,
+                               struct wl1271_tx_hw_descr *desc,
+                               struct sk_buff *skb)
+{
+        if (!wl->ops->set_tx_desc_data_len)
+                BUG_ON(1);
+
+        wl->ops->set_tx_desc_data_len(wl, desc, skb);
+}
+
+static inline enum wl_rx_buf_align
+wlcore_hw_get_rx_buf_align(struct wl1271 *wl, u32 rx_desc)
+{
+
+        if (!wl->ops->get_rx_buf_align)
+                BUG_ON(1);
+
+        return wl->ops->get_rx_buf_align(wl, rx_desc);
+}
+
+static inline void
+wlcore_hw_prepare_read(struct wl1271 *wl, u32 rx_desc, u32 len)
+{
+        if (wl->ops->prepare_read)
+                wl->ops->prepare_read(wl, rx_desc, len);
+}
+
+static inline u32
+wlcore_hw_get_rx_packet_len(struct wl1271 *wl, void *rx_data, u32 data_len)
+{
+        if (!wl->ops->get_rx_packet_len)
+                BUG_ON(1);
+
+        return wl->ops->get_rx_packet_len(wl, rx_data, data_len);
+}
+
+static inline void wlcore_hw_tx_delayed_compl(struct wl1271 *wl)
+{
+        if (wl->ops->tx_delayed_compl)
+                wl->ops->tx_delayed_compl(wl);
+}
+
+static inline void wlcore_hw_tx_immediate_compl(struct wl1271 *wl)
+{
+        if (wl->ops->tx_immediate_compl)
+                wl->ops->tx_immediate_compl(wl);
+}
+
+static inline int
+wlcore_hw_init_vif(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        if (wl->ops->init_vif)
+                return wl->ops->init_vif(wl, wlvif);
+
+        return 0;
+}
+
+static inline u32
+wlcore_hw_sta_get_ap_rate_mask(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        if (!wl->ops->sta_get_ap_rate_mask)
+                BUG_ON(1);
+
+        return wl->ops->sta_get_ap_rate_mask(wl, wlvif);
+}
+
+static inline int wlcore_identify_fw(struct wl1271 *wl)
+{
+        if (wl->ops->identify_fw)
+                return wl->ops->identify_fw(wl);
+
+        return 0;
+}
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/ini.h b/drivers/net/wireless/ti/wlcore/ini.h
index 4cf9ecc56212..4cf9ecc56212 100644
--- a/drivers/net/wireless/wl12xx/ini.h
+++ b/drivers/net/wireless/ti/wlcore/ini.h
diff --git a/drivers/net/wireless/wl12xx/init.c b/drivers/net/wireless/ti/wlcore/init.c
index 203fbebf09eb..9f89255eb6e6 100644
--- a/drivers/net/wireless/wl12xx/init.c
+++ b/drivers/net/wireless/ti/wlcore/init.c
@@ -30,9 +30,9 @@
 #include "wl12xx_80211.h"
 #include "acx.h"
 #include "cmd.h"
-#include "reg.h"
 #include "tx.h"
 #include "io.h"
+#include "hw_ops.h"
 
 int wl1271_init_templates_config(struct wl1271 *wl)
 {
@@ -319,7 +319,7 @@ static int wl12xx_init_fwlog(struct wl1271 *wl)
 {
         int ret;
 
-        if (wl->quirks & WL12XX_QUIRK_FWLOG_NOT_IMPLEMENTED)
+        if (wl->quirks & WLCORE_QUIRK_FWLOG_NOT_IMPLEMENTED)
                 return 0;
 
         ret = wl12xx_cmd_config_fwlog(wl);
@@ -494,26 +494,6 @@ static int wl1271_set_ba_policies(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         return wl12xx_acx_set_ba_initiator_policy(wl, wlvif);
 }
 
-int wl1271_chip_specific_init(struct wl1271 *wl)
-{
-        int ret = 0;
-
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
-                u32 host_cfg_bitmap = HOST_IF_CFG_RX_FIFO_ENABLE;
-
-                if (!(wl->quirks & WL12XX_QUIRK_NO_BLOCKSIZE_ALIGNMENT))
-                        /* Enable SDIO padding */
-                        host_cfg_bitmap |= HOST_IF_CFG_TX_PAD_TO_SDIO_BLK;
-
-                /* Must be before wl1271_acx_init_mem_config() */
-                ret = wl1271_acx_host_if_cfg_bitmap(wl, host_cfg_bitmap);
-                if (ret < 0)
-                        goto out;
-        }
-out:
-        return ret;
-}
-
 /* vif-specifc initialization */
 static int wl12xx_init_sta_role(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
@@ -582,10 +562,17 @@ int wl1271_init_vif_specific(struct wl1271 *wl, struct ieee80211_vif *vif)
                         if (ret < 0)
                                 return ret;
                 } else if (!wl->sta_count) {
-                        /* Configure for ELP power saving */
-                        ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_ELP);
-                        if (ret < 0)
-                                return ret;
+                        if (wl->quirks & WLCORE_QUIRK_NO_ELP) {
+                                /* Configure for power always on */
+                                ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
+                                if (ret < 0)
+                                        return ret;
+                        } else {
+                                /* Configure for ELP power saving */
+                                ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_ELP);
+                                if (ret < 0)
+                                        return ret;
+                        }
                 }
         }
 
@@ -652,6 +639,10 @@ int wl1271_init_vif_specific(struct wl1271 *wl, struct ieee80211_vif *vif)
         if (ret < 0)
                 return ret;
 
+        ret = wlcore_hw_init_vif(wl, wlvif);
+        if (ret < 0)
+                return ret;
+
         return 0;
 }
 
@@ -659,27 +650,8 @@ int wl1271_hw_init(struct wl1271 *wl)
 {
         int ret;
 
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
-                ret = wl128x_cmd_general_parms(wl);
-                if (ret < 0)
-                        return ret;
-                ret = wl128x_cmd_radio_parms(wl);
-                if (ret < 0)
-                        return ret;
-        } else {
-                ret = wl1271_cmd_general_parms(wl);
-                if (ret < 0)
-                        return ret;
-                ret = wl1271_cmd_radio_parms(wl);
-                if (ret < 0)
-                        return ret;
-                ret = wl1271_cmd_ext_radio_parms(wl);
-                if (ret < 0)
-                        return ret;
-        }
-
-        /* Chip-specific init */
-        ret = wl1271_chip_specific_init(wl);
+        /* Chip-specific hw init */
+        ret = wl->ops->hw_init(wl);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/net/wireless/wl12xx/init.h b/drivers/net/wireless/ti/wlcore/init.h
index 2da0f404ef6e..a45fbfddec19 100644
--- a/drivers/net/wireless/wl12xx/init.h
+++ b/drivers/net/wireless/ti/wlcore/init.h
@@ -24,7 +24,7 @@
 #ifndef __INIT_H__
 #define __INIT_H__
 
-#include "wl12xx.h"
+#include "wlcore.h"
 
 int wl1271_hw_init_power_auth(struct wl1271 *wl);
 int wl1271_init_templates_config(struct wl1271 *wl);
diff --git a/drivers/net/wireless/wl12xx/io.c b/drivers/net/wireless/ti/wlcore/io.c
index c574a3b31e31..7cd0081aede5 100644
--- a/drivers/net/wireless/wl12xx/io.c
+++ b/drivers/net/wireless/ti/wlcore/io.c
@@ -26,84 +26,12 @@
 #include <linux/spi/spi.h>
 #include <linux/interrupt.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
 #include "wl12xx_80211.h"
 #include "io.h"
 #include "tx.h"
 
-#define OCP_CMD_LOOP  32
-
-#define OCP_CMD_WRITE 0x1
-#define OCP_CMD_READ  0x2
-
-#define OCP_READY_MASK  BIT(18)
-#define OCP_STATUS_MASK (BIT(16) | BIT(17))
-
-#define OCP_STATUS_NO_RESP    0x00000
-#define OCP_STATUS_OK         0x10000
-#define OCP_STATUS_REQ_FAILED 0x20000
-#define OCP_STATUS_RESP_ERROR 0x30000
-
-struct wl1271_partition_set wl12xx_part_table[PART_TABLE_LEN] = {
-        [PART_DOWN] = {
-                .mem = {
-                        .start = 0x00000000,
-                        .size  = 0x000177c0
-                },
-                .reg = {
-                        .start = REGISTERS_BASE,
-                        .size  = 0x00008800
-                },
-                .mem2 = {
-                        .start = 0x00000000,
-                        .size  = 0x00000000
-                },
-                .mem3 = {
-                        .start = 0x00000000,
-                        .size  = 0x00000000
-                },
-        },
-
-        [PART_WORK] = {
-                .mem = {
-                        .start = 0x00040000,
-                        .size  = 0x00014fc0
-                },
-                .reg = {
-                        .start = REGISTERS_BASE,
-                        .size  = 0x0000a000
-                },
-                .mem2 = {
-                        .start = 0x003004f8,
-                        .size  = 0x00000004
-                },
-                .mem3 = {
-                        .start = 0x00040404,
-                        .size  = 0x00000000
-                },
-        },
-
-        [PART_DRPW] = {
-                .mem = {
-                        .start = 0x00040000,
-                        .size  = 0x00014fc0
-                },
-                .reg = {
-                        .start = DRPW_BASE,
-                        .size  = 0x00006000
-                },
-                .mem2 = {
-                        .start = 0x00000000,
-                        .size  = 0x00000000
-                },
-                .mem3 = {
-                        .start = 0x00000000,
-                        .size  = 0x00000000
-                }
-        }
-};
-
 bool wl1271_set_block_size(struct wl1271 *wl)
 {
         if (wl->if_ops->set_block_size) {
@@ -114,17 +42,53 @@ bool wl1271_set_block_size(struct wl1271 *wl)
         return false;
 }
 
-void wl1271_disable_interrupts(struct wl1271 *wl)
+void wlcore_disable_interrupts(struct wl1271 *wl)
 {
         disable_irq(wl->irq);
 }
+EXPORT_SYMBOL_GPL(wlcore_disable_interrupts);
 
-void wl1271_enable_interrupts(struct wl1271 *wl)
+void wlcore_enable_interrupts(struct wl1271 *wl)
 {
         enable_irq(wl->irq);
 }
+EXPORT_SYMBOL_GPL(wlcore_enable_interrupts);
 
-/* Set the SPI partitions to access the chip addresses
+int wlcore_translate_addr(struct wl1271 *wl, int addr)
+{
+        struct wlcore_partition_set *part = &wl->curr_part;
+
+        /*
+         * To translate, first check to which window of addresses the
+         * particular address belongs. Then subtract the starting address
+         * of that window from the address. Then, add offset of the
+         * translated region.
+         *
+         * The translated regions occur next to each other in physical device
+         * memory, so just add the sizes of the preceding address regions to
+         * get the offset to the new region.
+         */
+        if ((addr >= part->mem.start) &&
+            (addr < part->mem.start + part->mem.size))
+                return addr - part->mem.start;
+        else if ((addr >= part->reg.start) &&
+                 (addr < part->reg.start + part->reg.size))
+                return addr - part->reg.start + part->mem.size;
+        else if ((addr >= part->mem2.start) &&
+                 (addr < part->mem2.start + part->mem2.size))
+                return addr - part->mem2.start + part->mem.size +
+                        part->reg.size;
+        else if ((addr >= part->mem3.start) &&
+                 (addr < part->mem3.start + part->mem3.size))
+                return addr - part->mem3.start + part->mem.size +
+                        part->reg.size + part->mem2.size;
+
+        WARN(1, "HW address 0x%x out of range", addr);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(wlcore_translate_addr);
+
+/* Set the partitions to access the chip addresses
  *
  * To simplify driver code, a fixed (virtual) memory map is defined for
  * register and memory addresses. Because in the chipset, in different stages
@@ -158,33 +122,43 @@ void wl1271_enable_interrupts(struct wl1271 *wl)
  *                                    |    |
  *
  */
-int wl1271_set_partition(struct wl1271 *wl,
-                         struct wl1271_partition_set *p)
+void wlcore_set_partition(struct wl1271 *wl,
+                          const struct wlcore_partition_set *p)
 {
         /* copy partition info */
-        memcpy(&wl->part, p, sizeof(*p));
+        memcpy(&wl->curr_part, p, sizeof(*p));
 
-        wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+        wl1271_debug(DEBUG_IO, "mem_start %08X mem_size %08X",
                      p->mem.start, p->mem.size);
-        wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+        wl1271_debug(DEBUG_IO, "reg_start %08X reg_size %08X",
                      p->reg.start, p->reg.size);
-        wl1271_debug(DEBUG_SPI, "mem2_start %08X mem2_size %08X",
+        wl1271_debug(DEBUG_IO, "mem2_start %08X mem2_size %08X",
                      p->mem2.start, p->mem2.size);
-        wl1271_debug(DEBUG_SPI, "mem3_start %08X mem3_size %08X",
+        wl1271_debug(DEBUG_IO, "mem3_start %08X mem3_size %08X",
                      p->mem3.start, p->mem3.size);
 
-        /* write partition info to the chipset */
         wl1271_raw_write32(wl, HW_PART0_START_ADDR, p->mem.start);
         wl1271_raw_write32(wl, HW_PART0_SIZE_ADDR, p->mem.size);
         wl1271_raw_write32(wl, HW_PART1_START_ADDR, p->reg.start);
         wl1271_raw_write32(wl, HW_PART1_SIZE_ADDR, p->reg.size);
         wl1271_raw_write32(wl, HW_PART2_START_ADDR, p->mem2.start);
         wl1271_raw_write32(wl, HW_PART2_SIZE_ADDR, p->mem2.size);
+        /*
+         * We don't need the size of the last partition, as it is
+         * automatically calculated based on the total memory size and
+         * the sizes of the previous partitions.
+         */
         wl1271_raw_write32(wl, HW_PART3_START_ADDR, p->mem3.start);
+}
+EXPORT_SYMBOL_GPL(wlcore_set_partition);
 
-        return 0;
+void wlcore_select_partition(struct wl1271 *wl, u8 part)
+{
+        wl1271_debug(DEBUG_IO, "setting partition %d", part);
+
+        wlcore_set_partition(wl, &wl->ptable[part]);
 }
-EXPORT_SYMBOL_GPL(wl1271_set_partition);
+EXPORT_SYMBOL_GPL(wlcore_select_partition);
 
 void wl1271_io_reset(struct wl1271 *wl)
 {
@@ -197,48 +171,3 @@ void wl1271_io_init(struct wl1271 *wl)
         if (wl->if_ops->init)
                 wl->if_ops->init(wl->dev);
 }
-
-void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val)
-{
-        /* write address >> 1 + 0x30000 to OCP_POR_CTR */
-        addr = (addr >> 1) + 0x30000;
-        wl1271_write32(wl, OCP_POR_CTR, addr);
-
-        /* write value to OCP_POR_WDATA */
-        wl1271_write32(wl, OCP_DATA_WRITE, val);
-
-        /* write 1 to OCP_CMD */
-        wl1271_write32(wl, OCP_CMD, OCP_CMD_WRITE);
-}
-
-u16 wl1271_top_reg_read(struct wl1271 *wl, int addr)
-{
-        u32 val;
-        int timeout = OCP_CMD_LOOP;
-
-        /* write address >> 1 + 0x30000 to OCP_POR_CTR */
-        addr = (addr >> 1) + 0x30000;
-        wl1271_write32(wl, OCP_POR_CTR, addr);
-
-        /* write 2 to OCP_CMD */
-        wl1271_write32(wl, OCP_CMD, OCP_CMD_READ);
-
-        /* poll for data ready */
-        do {
-                val = wl1271_read32(wl, OCP_DATA_READ);
-        } while (!(val & OCP_READY_MASK) && --timeout);
-
-        if (!timeout) {
-                wl1271_warning("Top register access timed out.");
-                return 0xffff;
-        }
-
-        /* check data status and return if OK */
-        if ((val & OCP_STATUS_MASK) == OCP_STATUS_OK)
-                return val & 0xffff;
-        else {
-                wl1271_warning("Top register access returned error.");
-                return 0xffff;
-        }
-}
-
diff --git a/drivers/net/wireless/wl12xx/io.h b/drivers/net/wireless/ti/wlcore/io.h
index 4fb3dab8c3b2..8942954b56a0 100644
--- a/drivers/net/wireless/wl12xx/io.h
+++ b/drivers/net/wireless/ti/wlcore/io.h
@@ -26,7 +26,6 @@
 #define __IO_H__
 
 #include <linux/irqreturn.h>
-#include "reg.h"
 
 #define HW_ACCESS_MEMORY_MAX_RANGE      0x1FFC0
 
@@ -43,15 +42,14 @@
 
 #define HW_ACCESS_PRAM_MAX_RANGE        0x3c000
 
-extern struct wl1271_partition_set wl12xx_part_table[PART_TABLE_LEN];
-
 struct wl1271;
 
-void wl1271_disable_interrupts(struct wl1271 *wl);
-void wl1271_enable_interrupts(struct wl1271 *wl);
+void wlcore_disable_interrupts(struct wl1271 *wl);
+void wlcore_enable_interrupts(struct wl1271 *wl);
 
 void wl1271_io_reset(struct wl1271 *wl);
 void wl1271_io_init(struct wl1271 *wl);
+int wlcore_translate_addr(struct wl1271 *wl, int addr);
 
 /* Raw target IO, address is not translated */
 static inline void wl1271_raw_write(struct wl1271 *wl, int addr, void *buf,
@@ -66,6 +64,18 @@ static inline void wl1271_raw_read(struct wl1271 *wl, int addr, void *buf,
         wl->if_ops->read(wl->dev, addr, buf, len, fixed);
 }
 
+static inline void wlcore_raw_read_data(struct wl1271 *wl, int reg, void *buf,
+                                        size_t len, bool fixed)
+{
+        wl1271_raw_read(wl, wl->rtable[reg], buf, len, fixed);
+}
+
+static inline void wlcore_raw_write_data(struct wl1271 *wl, int reg, void *buf,
+                                         size_t len, bool fixed)
+{
+        wl1271_raw_write(wl, wl->rtable[reg], buf, len, fixed);
+}
+
 static inline u32 wl1271_raw_read32(struct wl1271 *wl, int addr)
 {
         wl1271_raw_read(wl, addr, &wl->buffer_32,
@@ -81,36 +91,12 @@ static inline void wl1271_raw_write32(struct wl1271 *wl, int addr, u32 val)
                              sizeof(wl->buffer_32), false);
 }
 
-/* Translated target IO */
-static inline int wl1271_translate_addr(struct wl1271 *wl, int addr)
-{
-        /*
-         * To translate, first check to which window of addresses the
-         * particular address belongs. Then subtract the starting address
-         * of that window from the address. Then, add offset of the
-         * translated region.
-         *
-         * The translated regions occur next to each other in physical device
-         * memory, so just add the sizes of the preceding address regions to
-         * get the offset to the new region.
-         *
-         * Currently, only the two first regions are addressed, and the
-         * assumption is that all addresses will fall into either of those
-         * two.
-         */
-        if ((addr >= wl->part.reg.start) &&
-            (addr < wl->part.reg.start + wl->part.reg.size))
-                return addr - wl->part.reg.start + wl->part.mem.size;
-        else
-                return addr - wl->part.mem.start;
-}
-
 static inline void wl1271_read(struct wl1271 *wl, int addr, void *buf,
                                size_t len, bool fixed)
 {
         int physical;
 
-        physical = wl1271_translate_addr(wl, addr);
+        physical = wlcore_translate_addr(wl, addr);
 
         wl1271_raw_read(wl, physical, buf, len, fixed);
 }
@@ -120,11 +106,23 @@ static inline void wl1271_write(struct wl1271 *wl, int addr, void *buf,
 {
         int physical;
 
-        physical = wl1271_translate_addr(wl, addr);
+        physical = wlcore_translate_addr(wl, addr);
 
         wl1271_raw_write(wl, physical, buf, len, fixed);
 }
 
+static inline void wlcore_write_data(struct wl1271 *wl, int reg, void *buf,
+                                     size_t len, bool fixed)
+{
+        wl1271_write(wl, wl->rtable[reg], buf, len, fixed);
+}
+
+static inline void wlcore_read_data(struct wl1271 *wl, int reg, void *buf,
+                                    size_t len, bool fixed)
+{
+        wl1271_read(wl, wl->rtable[reg], buf, len, fixed);
+}
+
 static inline void wl1271_read_hwaddr(struct wl1271 *wl, int hwaddr,
                                       void *buf, size_t len, bool fixed)
 {
@@ -134,19 +132,30 @@ static inline void wl1271_read_hwaddr(struct wl1271 *wl, int hwaddr,
         /* Addresses are stored internally as addresses to 32 bytes blocks */
         addr = hwaddr << 5;
 
-        physical = wl1271_translate_addr(wl, addr);
+        physical = wlcore_translate_addr(wl, addr);
 
         wl1271_raw_read(wl, physical, buf, len, fixed);
 }
 
 static inline u32 wl1271_read32(struct wl1271 *wl, int addr)
 {
-        return wl1271_raw_read32(wl, wl1271_translate_addr(wl, addr));
+        return wl1271_raw_read32(wl, wlcore_translate_addr(wl, addr));
 }
 
 static inline void wl1271_write32(struct wl1271 *wl, int addr, u32 val)
 {
-        wl1271_raw_write32(wl, wl1271_translate_addr(wl, addr), val);
+        wl1271_raw_write32(wl, wlcore_translate_addr(wl, addr), val);
+}
+
+static inline u32 wlcore_read_reg(struct wl1271 *wl, int reg)
+{
+        return wl1271_raw_read32(wl,
+                                 wlcore_translate_addr(wl, wl->rtable[reg]));
+}
+
+static inline void wlcore_write_reg(struct wl1271 *wl, int reg, u32 val)
+{
+        wl1271_raw_write32(wl, wlcore_translate_addr(wl, wl->rtable[reg]), val);
 }
 
 static inline void wl1271_power_off(struct wl1271 *wl)
@@ -164,13 +173,8 @@ static inline int wl1271_power_on(struct wl1271 *wl)
         return ret;
 }
 
-
-/* Top Register IO */
-void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val);
-u16 wl1271_top_reg_read(struct wl1271 *wl, int addr);
-
-int wl1271_set_partition(struct wl1271 *wl,
-                         struct wl1271_partition_set *p);
+void wlcore_set_partition(struct wl1271 *wl,
+                          const struct wlcore_partition_set *p);
 
 bool wl1271_set_block_size(struct wl1271 *wl);
 
@@ -178,4 +182,6 @@ bool wl1271_set_block_size(struct wl1271 *wl);
 
 int wl1271_tx_dummy_packet(struct wl1271 *wl);
 
+void wlcore_select_partition(struct wl1271 *wl, u8 part);
+
 #endif
diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 362ff1a7067e..2b0f987660c6 100644
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -35,10 +35,9 @@
 #include <linux/sched.h>
 #include <linux/interrupt.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
 #include "wl12xx_80211.h"
-#include "reg.h"
 #include "io.h"
 #include "event.h"
 #include "tx.h"
@@ -50,342 +49,15 @@
 #include "boot.h"
 #include "testmode.h"
 #include "scan.h"
+#include "hw_ops.h"
 
 #define WL1271_BOOT_RETRIES 3
 
-static struct conf_drv_settings default_conf = {
-        .sg = {
-                .params = {
-                        [CONF_SG_ACL_BT_MASTER_MIN_BR] = 10,
-                        [CONF_SG_ACL_BT_MASTER_MAX_BR] = 180,
-                        [CONF_SG_ACL_BT_SLAVE_MIN_BR] = 10,
-                        [CONF_SG_ACL_BT_SLAVE_MAX_BR] = 180,
-                        [CONF_SG_ACL_BT_MASTER_MIN_EDR] = 10,
-                        [CONF_SG_ACL_BT_MASTER_MAX_EDR] = 80,
-                        [CONF_SG_ACL_BT_SLAVE_MIN_EDR] = 10,
-                        [CONF_SG_ACL_BT_SLAVE_MAX_EDR] = 80,
-                        [CONF_SG_ACL_WLAN_PS_MASTER_BR] = 8,
-                        [CONF_SG_ACL_WLAN_PS_SLAVE_BR] = 8,
-                        [CONF_SG_ACL_WLAN_PS_MASTER_EDR] = 20,
-                        [CONF_SG_ACL_WLAN_PS_SLAVE_EDR] = 20,
-                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MIN_BR] = 20,
-                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MAX_BR] = 35,
-                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MIN_BR] = 16,
-                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MAX_BR] = 35,
-                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MIN_EDR] = 32,
-                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MAX_EDR] = 50,
-                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MIN_EDR] = 28,
-                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MAX_EDR] = 50,
-                        [CONF_SG_ACL_ACTIVE_SCAN_WLAN_BR] = 10,
-                        [CONF_SG_ACL_ACTIVE_SCAN_WLAN_EDR] = 20,
-                        [CONF_SG_ACL_PASSIVE_SCAN_BT_BR] = 75,
-                        [CONF_SG_ACL_PASSIVE_SCAN_WLAN_BR] = 15,
-                        [CONF_SG_ACL_PASSIVE_SCAN_BT_EDR] = 27,
-                        [CONF_SG_ACL_PASSIVE_SCAN_WLAN_EDR] = 17,
-                        /* active scan params */
-                        [CONF_SG_AUTO_SCAN_PROBE_REQ] = 170,
-                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_HV3] = 50,
-                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_A2DP] = 100,
-                        /* passive scan params */
-                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP_BR] = 800,
-                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP_EDR] = 200,
-                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_HV3] = 200,
-                        /* passive scan in dual antenna params */
-                        [CONF_SG_CONSECUTIVE_HV3_IN_PASSIVE_SCAN] = 0,
-                        [CONF_SG_BCN_HV3_COLLISION_THRESH_IN_PASSIVE_SCAN] = 0,
-                        [CONF_SG_TX_RX_PROTECTION_BWIDTH_IN_PASSIVE_SCAN] = 0,
-                        /* general params */
-                        [CONF_SG_STA_FORCE_PS_IN_BT_SCO] = 1,
-                        [CONF_SG_ANTENNA_CONFIGURATION] = 0,
-                        [CONF_SG_BEACON_MISS_PERCENT] = 60,
-                        [CONF_SG_DHCP_TIME] = 5000,
-                        [CONF_SG_RXT] = 1200,
-                        [CONF_SG_TXT] = 1000,
-                        [CONF_SG_ADAPTIVE_RXT_TXT] = 1,
-                        [CONF_SG_GENERAL_USAGE_BIT_MAP] = 3,
-                        [CONF_SG_HV3_MAX_SERVED] = 6,
-                        [CONF_SG_PS_POLL_TIMEOUT] = 10,
-                        [CONF_SG_UPSD_TIMEOUT] = 10,
-                        [CONF_SG_CONSECUTIVE_CTS_THRESHOLD] = 2,
-                        [CONF_SG_STA_RX_WINDOW_AFTER_DTIM] = 5,
-                        [CONF_SG_STA_CONNECTION_PROTECTION_TIME] = 30,
-                        /* AP params */
-                        [CONF_AP_BEACON_MISS_TX] = 3,
-                        [CONF_AP_RX_WINDOW_AFTER_BEACON] = 10,
-                        [CONF_AP_BEACON_WINDOW_INTERVAL] = 2,
-                        [CONF_AP_CONNECTION_PROTECTION_TIME] = 0,
-                        [CONF_AP_BT_ACL_VAL_BT_SERVE_TIME] = 25,
-                        [CONF_AP_BT_ACL_VAL_WL_SERVE_TIME] = 25,
-                        /* CTS Diluting params */
-                        [CONF_SG_CTS_DILUTED_BAD_RX_PACKETS_TH] = 0,
-                        [CONF_SG_CTS_CHOP_IN_DUAL_ANT_SCO_MASTER] = 0,
-                },
-                .state = CONF_SG_PROTECTIVE,
-        },
-        .rx = {
-                .rx_msdu_life_time           = 512000,
-                .packet_detection_threshold  = 0,
-                .ps_poll_timeout             = 15,
-                .upsd_timeout                = 15,
-                .rts_threshold               = IEEE80211_MAX_RTS_THRESHOLD,
-                .rx_cca_threshold            = 0,
-                .irq_blk_threshold           = 0xFFFF,
-                .irq_pkt_threshold           = 0,
-                .irq_timeout                 = 600,
-                .queue_type                  = CONF_RX_QUEUE_TYPE_LOW_PRIORITY,
-        },
-        .tx = {
-                .tx_energy_detection         = 0,
-                .sta_rc_conf                 = {
-                        .enabled_rates       = 0,
-                        .short_retry_limit   = 10,
-                        .long_retry_limit    = 10,
-                        .aflags              = 0,
-                },
-                .ac_conf_count               = 4,
-                .ac_conf                     = {
-                        [CONF_TX_AC_BE] = {
-                                .ac          = CONF_TX_AC_BE,
-                                .cw_min      = 15,
-                                .cw_max      = 63,
-                                .aifsn       = 3,
-                                .tx_op_limit = 0,
-                        },
-                        [CONF_TX_AC_BK] = {
-                                .ac          = CONF_TX_AC_BK,
-                                .cw_min      = 15,
-                                .cw_max      = 63,
-                                .aifsn       = 7,
-                                .tx_op_limit = 0,
-                        },
-                        [CONF_TX_AC_VI] = {
-                                .ac          = CONF_TX_AC_VI,
-                                .cw_min      = 15,
-                                .cw_max      = 63,
-                                .aifsn       = CONF_TX_AIFS_PIFS,
-                                .tx_op_limit = 3008,
-                        },
-                        [CONF_TX_AC_VO] = {
-                                .ac          = CONF_TX_AC_VO,
-                                .cw_min      = 15,
-                                .cw_max      = 63,
-                                .aifsn       = CONF_TX_AIFS_PIFS,
-                                .tx_op_limit = 1504,
-                        },
-                },
-                .max_tx_retries = 100,
-                .ap_aging_period = 300,
-                .tid_conf_count = 4,
-                .tid_conf = {
-                        [CONF_TX_AC_BE] = {
-                                .queue_id    = CONF_TX_AC_BE,
-                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
-                                .tsid        = CONF_TX_AC_BE,
-                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
-                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
-                                .apsd_conf   = {0, 0},
-                        },
-                        [CONF_TX_AC_BK] = {
-                                .queue_id    = CONF_TX_AC_BK,
-                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
-                                .tsid        = CONF_TX_AC_BK,
-                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
-                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
-                                .apsd_conf   = {0, 0},
-                        },
-                        [CONF_TX_AC_VI] = {
-                                .queue_id    = CONF_TX_AC_VI,
-                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
-                                .tsid        = CONF_TX_AC_VI,
-                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
-                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
-                                .apsd_conf   = {0, 0},
-                        },
-                        [CONF_TX_AC_VO] = {
-                                .queue_id    = CONF_TX_AC_VO,
-                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
-                                .tsid        = CONF_TX_AC_VO,
-                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
-                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
-                                .apsd_conf   = {0, 0},
-                        },
-                },
-                .frag_threshold              = IEEE80211_MAX_FRAG_THRESHOLD,
-                .tx_compl_timeout            = 700,
-                .tx_compl_threshold          = 4,
-                .basic_rate                  = CONF_HW_BIT_RATE_1MBPS,
-                .basic_rate_5                = CONF_HW_BIT_RATE_6MBPS,
-                .tmpl_short_retry_limit      = 10,
-                .tmpl_long_retry_limit       = 10,
-                .tx_watchdog_timeout         = 5000,
-        },
-        .conn = {
-                .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
-                .listen_interval             = 1,
-                .suspend_wake_up_event       = CONF_WAKE_UP_EVENT_N_DTIM,
-                .suspend_listen_interval     = 3,
-                .bcn_filt_mode               = CONF_BCN_FILT_MODE_ENABLED,
-                .bcn_filt_ie_count           = 2,
-                .bcn_filt_ie = {
-                        [0] = {
-                                .ie          = WLAN_EID_CHANNEL_SWITCH,
-                                .rule        = CONF_BCN_RULE_PASS_ON_APPEARANCE,
-                        },
-                        [1] = {
-                                .ie          = WLAN_EID_HT_OPERATION,
-                                .rule        = CONF_BCN_RULE_PASS_ON_CHANGE,
-                        },
-                },
-                .synch_fail_thold            = 10,
-                .bss_lose_timeout            = 100,
-                .beacon_rx_timeout           = 10000,
-                .broadcast_timeout           = 20000,
-                .rx_broadcast_in_ps          = 1,
-                .ps_poll_threshold           = 10,
-                .bet_enable                  = CONF_BET_MODE_ENABLE,
-                .bet_max_consecutive         = 50,
-                .psm_entry_retries           = 8,
-                .psm_exit_retries            = 16,
-                .psm_entry_nullfunc_retries  = 3,
-                .dynamic_ps_timeout          = 200,
-                .forced_ps                   = false,
-                .keep_alive_interval         = 55000,
-                .max_listen_interval         = 20,
-        },
-        .itrim = {
-                .enable = false,
-                .timeout = 50000,
-        },
-        .pm_config = {
-                .host_clk_settling_time = 5000,
-                .host_fast_wakeup_support = false
-        },
-        .roam_trigger = {
-                .trigger_pacing               = 1,
-                .avg_weight_rssi_beacon       = 20,
-                .avg_weight_rssi_data         = 10,
-                .avg_weight_snr_beacon        = 20,
-                .avg_weight_snr_data          = 10,
-        },
-        .scan = {
-                .min_dwell_time_active        = 7500,
-                .max_dwell_time_active        = 30000,
-                .min_dwell_time_passive       = 100000,
-                .max_dwell_time_passive       = 100000,
-                .num_probe_reqs               = 2,
-                .split_scan_timeout           = 50000,
-        },
-        .sched_scan = {
-                /* sched_scan requires dwell times in TU instead of TU/1000 */
-                .min_dwell_time_active = 30,
-                .max_dwell_time_active = 60,
-                .dwell_time_passive    = 100,
-                .dwell_time_dfs        = 150,
-                .num_probe_reqs        = 2,
-                .rssi_threshold        = -90,
-                .snr_threshold         = 0,
-        },
-        .rf = {
-                .tx_per_channel_power_compensation_2 = {
-                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                },
-                .tx_per_channel_power_compensation_5 = {
-                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                },
-        },
-        .ht = {
-                .rx_ba_win_size = 8,
-                .tx_ba_win_size = 64,
-                .inactivity_timeout = 10000,
-                .tx_ba_tid_bitmap = CONF_TX_BA_ENABLED_TID_BITMAP,
-        },
-        .mem_wl127x = {
-                .num_stations                 = 1,
-                .ssid_profiles                = 1,
-                .rx_block_num                 = 70,
-                .tx_min_block_num             = 40,
-                .dynamic_memory               = 1,
-                .min_req_tx_blocks            = 100,
-                .min_req_rx_blocks            = 22,
-                .tx_min                       = 27,
-        },
-        .mem_wl128x = {
-                .num_stations                 = 1,
-                .ssid_profiles                = 1,
-                .rx_block_num                 = 40,
-                .tx_min_block_num             = 40,
-                .dynamic_memory               = 1,
-                .min_req_tx_blocks            = 45,
-                .min_req_rx_blocks            = 22,
-                .tx_min                       = 27,
-        },
-        .fm_coex = {
-                .enable                       = true,
-                .swallow_period               = 5,
-                .n_divider_fref_set_1         = 0xff,       /* default */
-                .n_divider_fref_set_2         = 12,
-                .m_divider_fref_set_1         = 148,
-                .m_divider_fref_set_2         = 0xffff,     /* default */
-                .coex_pll_stabilization_time  = 0xffffffff, /* default */
-                .ldo_stabilization_time       = 0xffff,     /* default */
-                .fm_disturbed_band_margin     = 0xff,       /* default */
-                .swallow_clk_diff             = 0xff,       /* default */
-        },
-        .rx_streaming = {
-                .duration                      = 150,
-                .queues                        = 0x1,
-                .interval                      = 20,
-                .always                        = 0,
-        },
-        .fwlog = {
-                .mode                         = WL12XX_FWLOG_ON_DEMAND,
-                .mem_blocks                   = 2,
-                .severity                     = 0,
-                .timestamp                    = WL12XX_FWLOG_TIMESTAMP_DISABLED,
-                .output                       = WL12XX_FWLOG_OUTPUT_HOST,
-                .threshold                    = 0,
-        },
-        .hci_io_ds = HCI_IO_DS_6MA,
-        .rate = {
-                .rate_retry_score = 32000,
-                .per_add = 8192,
-                .per_th1 = 2048,
-                .per_th2 = 4096,
-                .max_per = 8100,
-                .inverse_curiosity_factor = 5,
-                .tx_fail_low_th = 4,
-                .tx_fail_high_th = 10,
-                .per_alpha_shift = 4,
-                .per_add_shift = 13,
-                .per_beta1_shift = 10,
-                .per_beta2_shift = 8,
-                .rate_check_up = 2,
-                .rate_check_down = 12,
-                .rate_retry_policy = {
-                        0x00, 0x00, 0x00, 0x00, 0x00,
-                        0x00, 0x00, 0x00, 0x00, 0x00,
-                        0x00, 0x00, 0x00,
-                },
-        },
-        .hangover = {
-                .recover_time               = 0,
-                .hangover_period            = 20,
-                .dynamic_mode               = 1,
-                .early_termination_mode     = 1,
-                .max_period                 = 20,
-                .min_period                 = 1,
-                .increase_delta             = 1,
-                .decrease_delta             = 2,
-                .quiet_time                 = 4,
-                .increase_time              = 1,
-                .window_size                = 16,
-        },
-};
+#define WL1271_BOOT_RETRIES 3
 
 static char *fwlog_param;
 static bool bug_on_recovery;
+static bool no_recovery;
 
 static void __wl1271_op_remove_interface(struct wl1271 *wl,
                                          struct ieee80211_vif *vif,
@@ -628,22 +300,8 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
-static void wl1271_conf_init(struct wl1271 *wl)
+static void wlcore_adjust_conf(struct wl1271 *wl)
 {
-
-        /*
-         * This function applies the default configuration to the driver. This
-         * function is invoked upon driver load (spi probe.)
-         *
-         * The configuration is stored in a run-time structure in order to
-         * facilitate for run-time adjustment of any of the parameters. Making
-         * changes to the configuration structure will apply the new values on
-         * the next interface up (wl1271_op_start.)
-         */
-
-        /* apply driver default configuration */
-        memcpy(&wl->conf, &default_conf, sizeof(default_conf));
-
         /* Adjust settings according to optional module parameters */
         if (fwlog_param) {
                 if (!strcmp(fwlog_param, "continuous")) {
@@ -666,28 +324,7 @@ static int wl1271_plt_init(struct wl1271 *wl)
 {
         int ret;
 
-        if (wl->chip.id == CHIP_ID_1283_PG20)
-                ret = wl128x_cmd_general_parms(wl);
-        else
-                ret = wl1271_cmd_general_parms(wl);
-        if (ret < 0)
-                return ret;
-
-        if (wl->chip.id == CHIP_ID_1283_PG20)
-                ret = wl128x_cmd_radio_parms(wl);
-        else
-                ret = wl1271_cmd_radio_parms(wl);
-        if (ret < 0)
-                return ret;
-
-        if (wl->chip.id != CHIP_ID_1283_PG20) {
-                ret = wl1271_cmd_ext_radio_parms(wl);
-                if (ret < 0)
-                        return ret;
-        }
-
-        /* Chip-specific initializations */
-        ret = wl1271_chip_specific_init(wl);
+        ret = wl->ops->hw_init(wl);
         if (ret < 0)
                 return ret;
 
@@ -750,7 +387,7 @@ static void wl12xx_irq_ps_regulate_link(struct wl1271 *wl,
 
 static void wl12xx_irq_update_links_status(struct wl1271 *wl,
                                            struct wl12xx_vif *wlvif,
-                                           struct wl12xx_fw_status *status)
+                                           struct wl_fw_status *status)
 {
         struct wl1271_link *lnk;
         u32 cur_fw_ps_map;
@@ -770,9 +407,10 @@ static void wl12xx_irq_update_links_status(struct wl1271 *wl,
 
         for_each_set_bit(hlid, wlvif->ap.sta_hlid_map, WL12XX_MAX_LINKS) {
                 lnk = &wl->links[hlid];
-                cnt = status->tx_lnk_free_pkts[hlid] - lnk->prev_freed_pkts;
+                cnt = status->counters.tx_lnk_free_pkts[hlid] -
+                        lnk->prev_freed_pkts;
 
-                lnk->prev_freed_pkts = status->tx_lnk_free_pkts[hlid];
+                lnk->prev_freed_pkts = status->counters.tx_lnk_free_pkts[hlid];
                 lnk->allocated_pkts -= cnt;
 
                 wl12xx_irq_ps_regulate_link(wl, wlvif, hlid,
@@ -781,15 +419,19 @@ static void wl12xx_irq_update_links_status(struct wl1271 *wl,
 }
 
 static void wl12xx_fw_status(struct wl1271 *wl,
-                             struct wl12xx_fw_status *status)
+                             struct wl_fw_status *status)
 {
         struct wl12xx_vif *wlvif;
         struct timespec ts;
         u32 old_tx_blk_count = wl->tx_blocks_available;
         int avail, freed_blocks;
         int i;
+        size_t status_len;
+
+        status_len = sizeof(*status) + wl->fw_status_priv_len;
 
-        wl1271_raw_read(wl, FW_STATUS_ADDR, status, sizeof(*status), false);
+        wlcore_raw_read_data(wl, REG_RAW_FW_STATUS_ADDR, status,
+                             status_len, false);
 
         wl1271_debug(DEBUG_IRQ, "intr: 0x%x (fw_rx_counter = %d, "
                      "drv_rx_counter = %d, tx_results_counter = %d)",
@@ -801,10 +443,10 @@ static void wl12xx_fw_status(struct wl1271 *wl,
         for (i = 0; i < NUM_TX_QUEUES; i++) {
                 /* prevent wrap-around in freed-packets counter */
                 wl->tx_allocated_pkts[i] -=
-                                (status->tx_released_pkts[i] -
+                                (status->counters.tx_released_pkts[i] -
                                 wl->tx_pkts_freed[i]) & 0xff;
 
-                wl->tx_pkts_freed[i] = status->tx_released_pkts[i];
+                wl->tx_pkts_freed[i] = status->counters.tx_released_pkts[i];
         }
 
         /* prevent wrap-around in total blocks counter */
@@ -927,6 +569,9 @@ static irqreturn_t wl1271_irq(int irq, void *cookie)
                 smp_mb__after_clear_bit();
 
                 wl12xx_fw_status(wl, wl->fw_status);
+
+                wlcore_hw_tx_immediate_compl(wl);
+
                 intr = le32_to_cpu(wl->fw_status->intr);
                 intr &= WL1271_INTR_MASK;
                 if (!intr) {
@@ -963,9 +608,7 @@ static irqreturn_t wl1271_irq(int irq, void *cookie)
                         }
 
                         /* check for tx results */
-                        if (wl->fw_status->tx_results_counter !=
-                            (wl->tx_results_count & 0xff))
-                                wl1271_tx_complete(wl);
+                        wlcore_hw_tx_delayed_compl(wl);
 
                         /* Make sure the deferred queues don't get too long */
                         defer_count = skb_queue_len(&wl->deferred_tx_queue) +
@@ -1046,10 +689,7 @@ static int wl12xx_fetch_firmware(struct wl1271 *wl, bool plt)
 
         if (plt) {
                 fw_type = WL12XX_FW_TYPE_PLT;
-                if (wl->chip.id == CHIP_ID_1283_PG20)
-                        fw_name = WL128X_PLT_FW_NAME;
-                else
-                        fw_name = WL127X_PLT_FW_NAME;
+                fw_name = wl->plt_fw_name;
         } else {
                 /*
                  * we can't call wl12xx_get_vif_count() here because
@@ -1057,16 +697,10 @@ static int wl12xx_fetch_firmware(struct wl1271 *wl, bool plt)
                  */
                 if (wl->last_vif_count > 1) {
                         fw_type = WL12XX_FW_TYPE_MULTI;
-                        if (wl->chip.id == CHIP_ID_1283_PG20)
-                                fw_name = WL128X_FW_NAME_MULTI;
-                        else
-                                fw_name = WL127X_FW_NAME_MULTI;
+                        fw_name = wl->mr_fw_name;
                 } else {
                         fw_type = WL12XX_FW_TYPE_NORMAL;
-                        if (wl->chip.id == CHIP_ID_1283_PG20)
-                                fw_name = WL128X_FW_NAME_SINGLE;
-                        else
-                                fw_name = WL127X_FW_NAME_SINGLE;
+                        fw_name = wl->sr_fw_name;
                 }
         }
 
@@ -1173,7 +807,7 @@ static void wl12xx_read_fwlog_panic(struct wl1271 *wl)
         u32 first_addr;
         u8 *block;
 
-        if ((wl->quirks & WL12XX_QUIRK_FWLOG_NOT_IMPLEMENTED) ||
+        if ((wl->quirks & WLCORE_QUIRK_FWLOG_NOT_IMPLEMENTED) ||
             (wl->conf.fwlog.mode != WL12XX_FWLOG_ON_DEMAND) ||
             (wl->conf.fwlog.mem_blocks == 0))
                 return;
@@ -1239,11 +873,20 @@ static void wl1271_recovery_work(struct work_struct *work)
         wl12xx_read_fwlog_panic(wl);
 
         wl1271_info("Hardware recovery in progress. FW ver: %s pc: 0x%x",
-                    wl->chip.fw_ver_str, wl1271_read32(wl, SCR_PAD4));
+                    wl->chip.fw_ver_str,
+                    wlcore_read_reg(wl, REG_PC_ON_RECOVERY));
 
         BUG_ON(bug_on_recovery &&
                !test_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags));
 
+        if (no_recovery) {
+                wl1271_info("No recovery (chosen on module load). Fw will remain stuck.");
+                clear_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags);
+                goto out_unlock;
+        }
+
+        BUG_ON(bug_on_recovery);
+
         /*
          * Advance security sequence number to overcome potential progress
          * in the firmware during recovery. This doens't hurt if the network is
@@ -1290,10 +933,7 @@ out_unlock:
 
 static void wl1271_fw_wakeup(struct wl1271 *wl)
 {
-        u32 elp_reg;
-
-        elp_reg = ELPCTRL_WAKE_UP;
-        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
+        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG, ELPCTRL_WAKE_UP);
 }
 
 static int wl1271_setup(struct wl1271 *wl)
@@ -1323,7 +963,7 @@ static int wl12xx_set_power_on(struct wl1271 *wl)
         wl1271_io_reset(wl);
         wl1271_io_init(wl);
 
-        wl1271_set_partition(wl, &wl12xx_part_table[PART_DOWN]);
+        wlcore_set_partition(wl, &wl->ptable[PART_BOOT]);
 
         /* ELP module wake up */
         wl1271_fw_wakeup(wl);
@@ -1348,44 +988,18 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool plt)
          * negligible, we use the same block size for all different
          * chip types.
          */
-        if (!wl1271_set_block_size(wl))
-                wl->quirks |= WL12XX_QUIRK_NO_BLOCKSIZE_ALIGNMENT;
-
-        switch (wl->chip.id) {
-        case CHIP_ID_1271_PG10:
-                wl1271_warning("chip id 0x%x (1271 PG10) support is obsolete",
-                               wl->chip.id);
+        if (wl1271_set_block_size(wl))
+                wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN;
 
-                ret = wl1271_setup(wl);
-                if (ret < 0)
-                        goto out;
-                wl->quirks |= WL12XX_QUIRK_NO_BLOCKSIZE_ALIGNMENT;
-                break;
-
-        case CHIP_ID_1271_PG20:
-                wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1271 PG20)",
-                             wl->chip.id);
-
-                ret = wl1271_setup(wl);
-                if (ret < 0)
-                        goto out;
-                wl->quirks |= WL12XX_QUIRK_NO_BLOCKSIZE_ALIGNMENT;
-                break;
+        ret = wl->ops->identify_chip(wl);
+        if (ret < 0)
+                goto out;
 
-        case CHIP_ID_1283_PG20:
-                wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1283 PG20)",
-                             wl->chip.id);
+        /* TODO: make sure the lower driver has set things up correctly */
 
-                ret = wl1271_setup(wl);
-                if (ret < 0)
-                        goto out;
-                break;
-        case CHIP_ID_1283_PG10:
-        default:
-                wl1271_warning("unsupported chip id: 0x%x", wl->chip.id);
-                ret = -ENODEV;
+        ret = wl1271_setup(wl);
+        if (ret < 0)
                 goto out;
-        }
 
         ret = wl12xx_fetch_firmware(wl, plt);
         if (ret < 0)
@@ -1425,7 +1039,7 @@ int wl1271_plt_start(struct wl1271 *wl)
                 if (ret < 0)
                         goto power_off;
 
-                ret = wl1271_boot(wl);
+                ret = wl->ops->boot(wl);
                 if (ret < 0)
                         goto power_off;
 
@@ -1454,7 +1068,7 @@ irq_disable:
                    work function will not do anything.) Also, any other
                    possible concurrent operations will fail due to the
                    current state, hence the wl1271 struct should be safe. */
-                wl1271_disable_interrupts(wl);
+                wlcore_disable_interrupts(wl);
                 wl1271_flush_deferred_work(wl);
                 cancel_work_sync(&wl->netstack_work);
                 mutex_lock(&wl->mutex);
@@ -1481,7 +1095,7 @@ int wl1271_plt_stop(struct wl1271 *wl)
          * Otherwise, the interrupt handler might be called and exit without
          * reading the interrupt status.
          */
-        wl1271_disable_interrupts(wl);
+        wlcore_disable_interrupts(wl);
         mutex_lock(&wl->mutex);
         if (!wl->plt) {
                 mutex_unlock(&wl->mutex);
@@ -1491,7 +1105,7 @@ int wl1271_plt_stop(struct wl1271 *wl)
                  * may have been disabled when op_stop was called. It will,
                  * however, balance the above call to disable_interrupts().
                  */
-                wl1271_enable_interrupts(wl);
+                wlcore_enable_interrupts(wl);
 
                 wl1271_error("cannot power down because not in PLT "
                              "state: %d", wl->state);
@@ -1652,14 +1266,12 @@ static int wl1271_configure_suspend_sta(struct wl1271 *wl,
 {
         int ret = 0;
 
-        mutex_lock(&wl->mutex);
-
         if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                goto out_unlock;
+                goto out;
 
         ret = wl1271_ps_elp_wakeup(wl);
         if (ret < 0)
-                goto out_unlock;
+                goto out;
 
         ret = wl1271_acx_wake_up_conditions(wl, wlvif,
                                     wl->conf.conn.suspend_wake_up_event,
@@ -1668,11 +1280,9 @@ static int wl1271_configure_suspend_sta(struct wl1271 *wl,
         if (ret < 0)
                 wl1271_error("suspend: set wake up conditions failed: %d", ret);
 
-
         wl1271_ps_elp_sleep(wl);
 
-out_unlock:
-        mutex_unlock(&wl->mutex);
+out:
         return ret;
 
 }
@@ -1682,20 +1292,17 @@ static int wl1271_configure_suspend_ap(struct wl1271 *wl,
 {
         int ret = 0;
 
-        mutex_lock(&wl->mutex);
-
         if (!test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags))
-                goto out_unlock;
+                goto out;
 
         ret = wl1271_ps_elp_wakeup(wl);
         if (ret < 0)
-                goto out_unlock;
+                goto out;
 
         ret = wl1271_acx_beacon_filter_opt(wl, wlvif, true);
 
         wl1271_ps_elp_sleep(wl);
-out_unlock:
-        mutex_unlock(&wl->mutex);
+out:
         return ret;
 
 }
@@ -1720,10 +1327,9 @@ static void wl1271_configure_resume(struct wl1271 *wl,
         if ((!is_ap) && (!is_sta))
                 return;
 
-        mutex_lock(&wl->mutex);
         ret = wl1271_ps_elp_wakeup(wl);
         if (ret < 0)
-                goto out;
+                return;
 
         if (is_sta) {
                 ret = wl1271_acx_wake_up_conditions(wl, wlvif,
@@ -1739,8 +1345,6 @@ static void wl1271_configure_resume(struct wl1271 *wl,
         }
 
         wl1271_ps_elp_sleep(wl);
-out:
-        mutex_unlock(&wl->mutex);
 }
 
 static int wl1271_op_suspend(struct ieee80211_hw *hw,
@@ -1755,6 +1359,7 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
 
         wl1271_tx_flush(wl);
 
+        mutex_lock(&wl->mutex);
         wl->wow_enabled = true;
         wl12xx_for_each_wlvif(wl, wlvif) {
                 ret = wl1271_configure_suspend(wl, wlvif);
@@ -1763,6 +1368,7 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
                         return ret;
                 }
         }
+        mutex_unlock(&wl->mutex);
         /* flush any remaining work */
         wl1271_debug(DEBUG_MAC80211, "flushing remaining works");
 
@@ -1770,7 +1376,7 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
          * disable and re-enable interrupts in order to flush
          * the threaded_irq
          */
-        wl1271_disable_interrupts(wl);
+        wlcore_disable_interrupts(wl);
 
         /*
          * set suspended flag to avoid triggering a new threaded_irq
@@ -1778,7 +1384,7 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
          */
         set_bit(WL1271_FLAG_SUSPENDED, &wl->flags);
 
-        wl1271_enable_interrupts(wl);
+        wlcore_enable_interrupts(wl);
         flush_work(&wl->tx_work);
         flush_delayed_work(&wl->elp_work);
 
@@ -1810,12 +1416,15 @@ static int wl1271_op_resume(struct ieee80211_hw *hw)
                 wl1271_debug(DEBUG_MAC80211,
                              "run postponed irq_work directly");
                 wl1271_irq(0, wl);
-                wl1271_enable_interrupts(wl);
+                wlcore_enable_interrupts(wl);
         }
+
+        mutex_lock(&wl->mutex);
         wl12xx_for_each_wlvif(wl, wlvif) {
                 wl1271_configure_resume(wl, wlvif);
         }
         wl->wow_enabled = false;
+        mutex_unlock(&wl->mutex);
 
         return 0;
 }
@@ -1851,7 +1460,7 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
          * Otherwise, the interrupt handler might be called and exit without
          * reading the interrupt status.
          */
-        wl1271_disable_interrupts(wl);
+        wlcore_disable_interrupts(wl);
         mutex_lock(&wl->mutex);
         if (wl->state == WL1271_STATE_OFF) {
                 mutex_unlock(&wl->mutex);
@@ -1861,7 +1470,7 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
                  * may have been disabled when op_stop was called. It will,
                  * however, balance the above call to disable_interrupts().
                  */
-                wl1271_enable_interrupts(wl);
+                wlcore_enable_interrupts(wl);
                 return;
         }
 
@@ -1894,7 +1503,6 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         wl->tx_results_count = 0;
         wl->tx_packets_count = 0;
         wl->time_offset = 0;
-        wl->tx_spare_blocks = TX_HW_BLOCK_SPARE_DEFAULT;
         wl->ap_fw_ps_map = 0;
         wl->ap_ps_map = 0;
         wl->sched_scanning = false;
@@ -2067,7 +1675,7 @@ static bool wl12xx_init_fw(struct wl1271 *wl)
                 if (ret < 0)
                         goto power_off;
 
-                ret = wl1271_boot(wl);
+                ret = wl->ops->boot(wl);
                 if (ret < 0)
                         goto power_off;
 
@@ -2087,7 +1695,7 @@ irq_disable:
                    work function will not do anything.) Also, any other
                    possible concurrent operations will fail due to the
                    current state, hence the wl1271 struct should be safe. */
-                wl1271_disable_interrupts(wl);
+                wlcore_disable_interrupts(wl);
                 wl1271_flush_deferred_work(wl);
                 cancel_work_sync(&wl->netstack_work);
                 mutex_lock(&wl->mutex);
@@ -2360,10 +1968,12 @@ deinit:
                 for (i = 0; i < CONF_TX_MAX_AC_COUNT; i++)
                         wl12xx_free_rate_policy(wl,
                                                 &wlvif->ap.ucast_rate_idx[i]);
+                wl1271_free_ap_keys(wl, wlvif);
         }
 
+        dev_kfree_skb(wlvif->probereq);
+        wlvif->probereq = NULL;
         wl12xx_tx_reset_wlvif(wl, wlvif);
-        wl1271_free_ap_keys(wl, wlvif);
         if (wl->last_wlvif == wlvif)
                 wl->last_wlvif = NULL;
         list_del(&wlvif->list);
@@ -2946,6 +2556,17 @@ static int wl1271_set_key(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         int ret;
         bool is_ap = (wlvif->bss_type == BSS_TYPE_AP_BSS);
 
+        /*
+         * A role set to GEM cipher requires different Tx settings (namely
+         * spare blocks). Note when we are in this mode so the HW can adjust.
+         */
+        if (key_type == KEY_GEM) {
+                if (action == KEY_ADD_OR_REPLACE)
+                        wlvif->is_gem = true;
+                else if (action == KEY_REMOVE)
+                        wlvif->is_gem = false;
+        }
+
         if (is_ap) {
                 struct wl1271_station *wl_sta;
                 u8 hlid;
@@ -2984,17 +2605,6 @@ static int wl1271_set_key(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                         0xff, 0xff, 0xff, 0xff, 0xff, 0xff
                 };
 
-                /*
-                 * A STA set to GEM cipher requires 2 tx spare blocks.
-                 * Return to default value when GEM cipher key is removed
-                 */
-                if (key_type == KEY_GEM) {
-                        if (action == KEY_ADD_OR_REPLACE)
-                                wl->tx_spare_blocks = 2;
-                        else if (action == KEY_REMOVE)
-                                wl->tx_spare_blocks = TX_HW_BLOCK_SPARE_DEFAULT;
-                }
-
                 addr = sta ? sta->addr : bcast_addr;
 
                 if (is_zero_ether_addr(addr)) {
@@ -3791,8 +3401,7 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                 wlvif->rssi_thold = bss_conf->cqm_rssi_thold;
         }
 
-        if (changed & BSS_CHANGED_BSSID &&
-            (is_ibss || bss_conf->assoc))
+        if (changed & BSS_CHANGED_BSSID)
                 if (!is_zero_ether_addr(bss_conf->bssid)) {
                         ret = wl12xx_cmd_build_null_data(wl, wlvif);
                         if (ret < 0)
@@ -3801,9 +3410,6 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                         ret = wl1271_build_qos_null_data(wl, vif);
                         if (ret < 0)
                                 goto out;
-
-                        /* Need to update the BSSID (for filtering etc) */
-                        do_join = true;
                 }
 
         if (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_HT)) {
@@ -3830,6 +3436,7 @@ sta_not_found:
                         int ieoffset;
                         wlvif->aid = bss_conf->aid;
                         wlvif->beacon_int = bss_conf->beacon_int;
+                        do_join = true;
                         set_assoc = true;
 
                         /*
@@ -4662,60 +4269,12 @@ static struct ieee80211_channel wl1271_channels[] = {
         { .hw_value = 14, .center_freq = 2484, .max_power = 25 },
 };
 
-/* mapping to indexes for wl1271_rates */
-static const u8 wl1271_rate_to_idx_2ghz[] = {
-        /* MCS rates are used only with 11n */
-        7,                            /* CONF_HW_RXTX_RATE_MCS7_SGI */
-        7,                            /* CONF_HW_RXTX_RATE_MCS7 */
-        6,                            /* CONF_HW_RXTX_RATE_MCS6 */
-        5,                            /* CONF_HW_RXTX_RATE_MCS5 */
-        4,                            /* CONF_HW_RXTX_RATE_MCS4 */
-        3,                            /* CONF_HW_RXTX_RATE_MCS3 */
-        2,                            /* CONF_HW_RXTX_RATE_MCS2 */
-        1,                            /* CONF_HW_RXTX_RATE_MCS1 */
-        0,                            /* CONF_HW_RXTX_RATE_MCS0 */
-
-        11,                            /* CONF_HW_RXTX_RATE_54   */
-        10,                            /* CONF_HW_RXTX_RATE_48   */
-        9,                             /* CONF_HW_RXTX_RATE_36   */
-        8,                             /* CONF_HW_RXTX_RATE_24   */
-
-        /* TI-specific rate */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_22   */
-
-        7,                             /* CONF_HW_RXTX_RATE_18   */
-        6,                             /* CONF_HW_RXTX_RATE_12   */
-        3,                             /* CONF_HW_RXTX_RATE_11   */
-        5,                             /* CONF_HW_RXTX_RATE_9    */
-        4,                             /* CONF_HW_RXTX_RATE_6    */
-        2,                             /* CONF_HW_RXTX_RATE_5_5  */
-        1,                             /* CONF_HW_RXTX_RATE_2    */
-        0                              /* CONF_HW_RXTX_RATE_1    */
-};
-
-/* 11n STA capabilities */
-#define HW_RX_HIGHEST_RATE      72
-
-#define WL12XX_HT_CAP { \
-        .cap = IEEE80211_HT_CAP_GRN_FLD | IEEE80211_HT_CAP_SGI_20 | \
-               (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT), \
-        .ht_supported = true, \
-        .ampdu_factor = IEEE80211_HT_MAX_AMPDU_8K, \
-        .ampdu_density = IEEE80211_HT_MPDU_DENSITY_8, \
-        .mcs = { \
-                .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, \
-                .rx_highest = cpu_to_le16(HW_RX_HIGHEST_RATE), \
-                .tx_params = IEEE80211_HT_MCS_TX_DEFINED, \
-                }, \
-}
-
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_supported_band wl1271_band_2ghz = {
         .channels = wl1271_channels,
         .n_channels = ARRAY_SIZE(wl1271_channels),
         .bitrates = wl1271_rates,
         .n_bitrates = ARRAY_SIZE(wl1271_rates),
-        .ht_cap = WL12XX_HT_CAP,
 };
 
 /* 5 GHz data rates for WL1273 */
@@ -4784,48 +4343,11 @@ static struct ieee80211_channel wl1271_channels_5ghz[] = {
         { .hw_value = 165, .center_freq = 5825, .max_power = 25 },
 };
 
-/* mapping to indexes for wl1271_rates_5ghz */
-static const u8 wl1271_rate_to_idx_5ghz[] = {
-        /* MCS rates are used only with 11n */
-        7,                            /* CONF_HW_RXTX_RATE_MCS7_SGI */
-        7,                            /* CONF_HW_RXTX_RATE_MCS7 */
-        6,                            /* CONF_HW_RXTX_RATE_MCS6 */
-        5,                            /* CONF_HW_RXTX_RATE_MCS5 */
-        4,                            /* CONF_HW_RXTX_RATE_MCS4 */
-        3,                            /* CONF_HW_RXTX_RATE_MCS3 */
-        2,                            /* CONF_HW_RXTX_RATE_MCS2 */
-        1,                            /* CONF_HW_RXTX_RATE_MCS1 */
-        0,                            /* CONF_HW_RXTX_RATE_MCS0 */
-
-        7,                             /* CONF_HW_RXTX_RATE_54   */
-        6,                             /* CONF_HW_RXTX_RATE_48   */
-        5,                             /* CONF_HW_RXTX_RATE_36   */
-        4,                             /* CONF_HW_RXTX_RATE_24   */
-
-        /* TI-specific rate */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_22   */
-
-        3,                             /* CONF_HW_RXTX_RATE_18   */
-        2,                             /* CONF_HW_RXTX_RATE_12   */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_11   */
-        1,                             /* CONF_HW_RXTX_RATE_9    */
-        0,                             /* CONF_HW_RXTX_RATE_6    */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_5_5  */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_2    */
-        CONF_HW_RXTX_RATE_UNSUPPORTED  /* CONF_HW_RXTX_RATE_1    */
-};
-
 static struct ieee80211_supported_band wl1271_band_5ghz = {
         .channels = wl1271_channels_5ghz,
         .n_channels = ARRAY_SIZE(wl1271_channels_5ghz),
         .bitrates = wl1271_rates_5ghz,
         .n_bitrates = ARRAY_SIZE(wl1271_rates_5ghz),
-        .ht_cap = WL12XX_HT_CAP,
-};
-
-static const u8 *wl1271_band_rate_to_idx[] = {
-        [IEEE80211_BAND_2GHZ] = wl1271_rate_to_idx_2ghz,
-        [IEEE80211_BAND_5GHZ] = wl1271_rate_to_idx_5ghz
 };
 
 static const struct ieee80211_ops wl1271_ops = {
@@ -4862,18 +4384,18 @@ static const struct ieee80211_ops wl1271_ops = {
 };
 
 
-u8 wl1271_rate_to_idx(int rate, enum ieee80211_band band)
+u8 wlcore_rate_to_idx(struct wl1271 *wl, u8 rate, enum ieee80211_band band)
 {
         u8 idx;
 
-        BUG_ON(band >= sizeof(wl1271_band_rate_to_idx)/sizeof(u8 *));
+        BUG_ON(band >= 2);
 
-        if (unlikely(rate >= CONF_HW_RXTX_RATE_MAX)) {
+        if (unlikely(rate >= wl->hw_tx_rate_tbl_size)) {
                 wl1271_error("Illegal RX rate from HW: %d", rate);
                 return 0;
         }
 
-        idx = wl1271_band_rate_to_idx[band][rate];
+        idx = wl->band_rate_to_idx[band][rate];
         if (unlikely(idx == CONF_HW_RXTX_RATE_UNSUPPORTED)) {
                 wl1271_error("Unsupported RX rate from HW: %d", rate);
                 return 0;
@@ -5027,34 +4549,6 @@ static struct bin_attribute fwlog_attr = {
         .read = wl1271_sysfs_read_fwlog,
 };
 
-static bool wl12xx_mac_in_fuse(struct wl1271 *wl)
-{
-        bool supported = false;
-        u8 major, minor;
-
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
-                major = WL128X_PG_GET_MAJOR(wl->hw_pg_ver);
-                minor = WL128X_PG_GET_MINOR(wl->hw_pg_ver);
-
-                /* in wl128x we have the MAC address if the PG is >= (2, 1) */
-                if (major > 2 || (major == 2 && minor >= 1))
-                        supported = true;
-        } else {
-                major = WL127X_PG_GET_MAJOR(wl->hw_pg_ver);
-                minor = WL127X_PG_GET_MINOR(wl->hw_pg_ver);
-
-                /* in wl127x we have the MAC address if the PG is >= (3, 1) */
-                if (major == 3 && minor >= 1)
-                        supported = true;
-        }
-
-        wl1271_debug(DEBUG_PROBE,
-                     "PG Ver major = %d minor = %d, MAC %s present",
-                     major, minor, supported ? "is" : "is not");
-
-        return supported;
-}
-
 static void wl12xx_derive_mac_addresses(struct wl1271 *wl,
                                         u32 oui, u32 nic, int n)
 {
@@ -5080,47 +4574,23 @@ static void wl12xx_derive_mac_addresses(struct wl1271 *wl,
         wl->hw->wiphy->addresses = wl->addresses;
 }
 
-static void wl12xx_get_fuse_mac(struct wl1271 *wl)
-{
-        u32 mac1, mac2;
-
-        wl1271_set_partition(wl, &wl12xx_part_table[PART_DRPW]);
-
-        mac1 = wl1271_read32(wl, WL12XX_REG_FUSE_BD_ADDR_1);
-        mac2 = wl1271_read32(wl, WL12XX_REG_FUSE_BD_ADDR_2);
-
-        /* these are the two parts of the BD_ADDR */
-        wl->fuse_oui_addr = ((mac2 & 0xffff) << 8) +
-                ((mac1 & 0xff000000) >> 24);
-        wl->fuse_nic_addr = mac1 & 0xffffff;
-
-        wl1271_set_partition(wl, &wl12xx_part_table[PART_DOWN]);
-}
-
 static int wl12xx_get_hw_info(struct wl1271 *wl)
 {
         int ret;
-        u32 die_info;
 
         ret = wl12xx_set_power_on(wl);
         if (ret < 0)
                 goto out;
 
-        wl->chip.id = wl1271_read32(wl, CHIP_ID_B);
+        wl->chip.id = wlcore_read_reg(wl, REG_CHIP_ID_B);
 
-        if (wl->chip.id == CHIP_ID_1283_PG20)
-                die_info = wl1271_top_reg_read(wl, WL128X_REG_FUSE_DATA_2_1);
-        else
-                die_info = wl1271_top_reg_read(wl, WL127X_REG_FUSE_DATA_2_1);
+        wl->fuse_oui_addr = 0;
+        wl->fuse_nic_addr = 0;
 
-        wl->hw_pg_ver = (s8) (die_info & PG_VER_MASK) >> PG_VER_OFFSET;
+        wl->hw_pg_ver = wl->ops->get_pg_ver(wl);
 
-        if (!wl12xx_mac_in_fuse(wl)) {
-                wl->fuse_oui_addr = 0;
-                wl->fuse_nic_addr = 0;
-        } else {
-                wl12xx_get_fuse_mac(wl);
-        }
+        if (wl->ops->get_mac)
+                wl->ops->get_mac(wl);
 
         wl1271_power_off(wl);
 out:
@@ -5255,8 +4725,12 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
          */
         memcpy(&wl->bands[IEEE80211_BAND_2GHZ], &wl1271_band_2ghz,
                sizeof(wl1271_band_2ghz));
+        memcpy(&wl->bands[IEEE80211_BAND_2GHZ].ht_cap, &wl->ht_cap,
+               sizeof(wl->ht_cap));
         memcpy(&wl->bands[IEEE80211_BAND_5GHZ], &wl1271_band_5ghz,
                sizeof(wl1271_band_5ghz));
+        memcpy(&wl->bands[IEEE80211_BAND_5GHZ].ht_cap, &wl->ht_cap,
+               sizeof(wl->ht_cap));
 
         wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                 &wl->bands[IEEE80211_BAND_2GHZ];
@@ -5280,14 +4754,14 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->sta_data_size = sizeof(struct wl1271_station);
         wl->hw->vif_data_size = sizeof(struct wl12xx_vif);
 
-        wl->hw->max_rx_aggregation_subframes = 8;
+        wl->hw->max_rx_aggregation_subframes = wl->conf.ht.rx_ba_win_size;
 
         return 0;
 }
 
 #define WL1271_DEFAULT_CHANNEL 0
 
-static struct ieee80211_hw *wl1271_alloc_hw(void)
+struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size)
 {
         struct ieee80211_hw *hw;
         struct wl1271 *wl;
@@ -5306,6 +4780,13 @@ static struct ieee80211_hw *wl1271_alloc_hw(void)
         wl = hw->priv;
         memset(wl, 0, sizeof(*wl));
 
+        wl->priv = kzalloc(priv_size, GFP_KERNEL);
+        if (!wl->priv) {
+                wl1271_error("could not alloc wl priv");
+                ret = -ENOMEM;
+                goto err_priv_alloc;
+        }
+
         INIT_LIST_HEAD(&wl->wlvif_list);
 
         wl->hw = hw;
@@ -5342,7 +4823,6 @@ static struct ieee80211_hw *wl1271_alloc_hw(void)
         wl->quirks = 0;
         wl->platform_quirks = 0;
         wl->sched_scanning = false;
-        wl->tx_spare_blocks = TX_HW_BLOCK_SPARE_DEFAULT;
         wl->system_hlid = WL12XX_SYSTEM_HLID;
         wl->active_sta_count = 0;
         wl->fwlog_size = 0;
@@ -5352,7 +4832,7 @@ static struct ieee80211_hw *wl1271_alloc_hw(void)
         __set_bit(WL12XX_SYSTEM_HLID, wl->links_map);
 
         memset(wl->tx_frames_map, 0, sizeof(wl->tx_frames_map));
-        for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
+        for (i = 0; i < wl->num_tx_desc; i++)
                 wl->tx_frames[i] = NULL;
 
         spin_lock_init(&wl->wl_lock);
@@ -5361,9 +4841,6 @@ static struct ieee80211_hw *wl1271_alloc_hw(void)
         wl->fw_type = WL12XX_FW_TYPE_NONE;
         mutex_init(&wl->mutex);
 
-        /* Apply default driver configuration. */
-        wl1271_conf_init(wl);
-
         order = get_order(WL1271_AGGR_BUFFER_SIZE);
         wl->aggr_buf = (u8 *)__get_free_pages(GFP_KERNEL, order);
         if (!wl->aggr_buf) {
@@ -5384,8 +4861,17 @@ static struct ieee80211_hw *wl1271_alloc_hw(void)
                 goto err_dummy_packet;
         }
 
+        wl->mbox = kmalloc(sizeof(*wl->mbox), GFP_DMA);
+        if (!wl->mbox) {
+                ret = -ENOMEM;
+                goto err_fwlog;
+        }
+
         return hw;
 
+err_fwlog:
+        free_page((unsigned long)wl->fwlog);
+
 err_dummy_packet:
         dev_kfree_skb(wl->dummy_packet);
 
@@ -5397,14 +4883,18 @@ err_wq:
 
 err_hw:
         wl1271_debugfs_exit(wl);
+        kfree(wl->priv);
+
+err_priv_alloc:
         ieee80211_free_hw(hw);
 
 err_hw_alloc:
 
         return ERR_PTR(ret);
 }
+EXPORT_SYMBOL_GPL(wlcore_alloc_hw);
 
-static int wl1271_free_hw(struct wl1271 *wl)
+int wlcore_free_hw(struct wl1271 *wl)
 {
         /* Unblock any fwlog readers */
         mutex_lock(&wl->mutex);
@@ -5434,10 +4924,12 @@ static int wl1271_free_hw(struct wl1271 *wl)
         kfree(wl->tx_res_if);
         destroy_workqueue(wl->freezable_wq);
 
+        kfree(wl->priv);
         ieee80211_free_hw(wl->hw);
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(wlcore_free_hw);
 
 static irqreturn_t wl12xx_hardirq(int irq, void *cookie)
 {
@@ -5468,22 +4960,22 @@ static irqreturn_t wl12xx_hardirq(int irq, void *cookie)
         return IRQ_WAKE_THREAD;
 }
 
-static int __devinit wl12xx_probe(struct platform_device *pdev)
+int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev)
 {
         struct wl12xx_platform_data *pdata = pdev->dev.platform_data;
-        struct ieee80211_hw *hw;
-        struct wl1271 *wl;
         unsigned long irqflags;
-        int ret = -ENODEV;
+        int ret;
 
-        hw = wl1271_alloc_hw();
-        if (IS_ERR(hw)) {
-                wl1271_error("can't allocate hw");
-                ret = PTR_ERR(hw);
-                goto out;
+        if (!wl->ops || !wl->ptable) {
+                ret = -EINVAL;
+                goto out_free_hw;
         }
 
-        wl = hw->priv;
+        BUG_ON(wl->num_tx_desc > WLCORE_MAX_TX_DESCRIPTORS);
+
+        /* adjust some runtime configuration parameters */
+        wlcore_adjust_conf(wl);
+
         wl->irq = platform_get_irq(pdev, 0);
         wl->ref_clock = pdata->board_ref_clock;
         wl->tcxo_clock = pdata->board_tcxo_clock;
@@ -5512,7 +5004,7 @@ static int __devinit wl12xx_probe(struct platform_device *pdev)
                 wl->irq_wake_enabled = true;
                 device_init_wakeup(wl->dev, 1);
                 if (pdata->pwr_in_suspend)
-                        hw->wiphy->wowlan.flags = WIPHY_WOWLAN_ANY;
+                        wl->hw->wiphy->wowlan.flags = WIPHY_WOWLAN_ANY;
 
         }
         disable_irq(wl->irq);
@@ -5546,7 +5038,7 @@ static int __devinit wl12xx_probe(struct platform_device *pdev)
                 goto out_hw_pg_ver;
         }
 
-        return 0;
+        goto out;
 
 out_hw_pg_ver:
         device_remove_file(wl->dev, &dev_attr_hw_pg_ver);
@@ -5558,13 +5050,14 @@ out_irq:
         free_irq(wl->irq, wl);
 
 out_free_hw:
-        wl1271_free_hw(wl);
+        wlcore_free_hw(wl);
 
 out:
         return ret;
 }
+EXPORT_SYMBOL_GPL(wlcore_probe);
 
-static int __devexit wl12xx_remove(struct platform_device *pdev)
+int __devexit wlcore_remove(struct platform_device *pdev)
 {
         struct wl1271 *wl = platform_get_drvdata(pdev);
 
@@ -5574,38 +5067,11 @@ static int __devexit wl12xx_remove(struct platform_device *pdev)
         }
         wl1271_unregister_hw(wl);
         free_irq(wl->irq, wl);
-        wl1271_free_hw(wl);
+        wlcore_free_hw(wl);
 
         return 0;
 }
-
-static const struct platform_device_id wl12xx_id_table[] __devinitconst = {
-        { "wl12xx", 0 },
-        {  } /* Terminating Entry */
-};
-MODULE_DEVICE_TABLE(platform, wl12xx_id_table);
-
-static struct platform_driver wl12xx_driver = {
-        .probe          = wl12xx_probe,
-        .remove         = __devexit_p(wl12xx_remove),
-        .id_table       = wl12xx_id_table,
-        .driver = {
-                .name   = "wl12xx_driver",
-                .owner  = THIS_MODULE,
-        }
-};
-
-static int __init wl12xx_init(void)
-{
-        return platform_driver_register(&wl12xx_driver);
-}
-module_init(wl12xx_init);
-
-static void __exit wl12xx_exit(void)
-{
-        platform_driver_unregister(&wl12xx_driver);
-}
-module_exit(wl12xx_exit);
+EXPORT_SYMBOL_GPL(wlcore_remove);
 
 u32 wl12xx_debug_level = DEBUG_NONE;
 EXPORT_SYMBOL_GPL(wl12xx_debug_level);
@@ -5619,6 +5085,9 @@ MODULE_PARM_DESC(fwlog,
 module_param(bug_on_recovery, bool, S_IRUSR | S_IWUSR);
 MODULE_PARM_DESC(bug_on_recovery, "BUG() on fw recovery");
 
+module_param(no_recovery, bool, S_IRUSR | S_IWUSR);
+MODULE_PARM_DESC(no_recovery, "Prevent HW recovery. FW will remain stuck.");
+
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
diff --git a/drivers/net/wireless/wl12xx/ps.c b/drivers/net/wireless/ti/wlcore/ps.c
index 78f598b4f97b..756eee2257b4 100644
--- a/drivers/net/wireless/wl12xx/ps.c
+++ b/drivers/net/wireless/ti/wlcore/ps.c
@@ -21,7 +21,6 @@
  *
  */
 
-#include "reg.h"
 #include "ps.h"
 #include "io.h"
 #include "tx.h"
@@ -62,7 +61,7 @@ void wl1271_elp_work(struct work_struct *work)
         }
 
         wl1271_debug(DEBUG_PSM, "chip to elp");
-        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
+        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG, ELPCTRL_SLEEP);
         set_bit(WL1271_FLAG_IN_ELP, &wl->flags);
 
 out:
@@ -74,6 +73,9 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
 {
         struct wl12xx_vif *wlvif;
 
+        if (wl->quirks & WLCORE_QUIRK_NO_ELP)
+                return;
+
         /* we shouldn't get consecutive sleep requests */
         if (WARN_ON(test_and_set_bit(WL1271_FLAG_ELP_REQUESTED, &wl->flags)))
                 return;
@@ -125,7 +127,7 @@ int wl1271_ps_elp_wakeup(struct wl1271 *wl)
                 wl->elp_compl = &compl;
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 
-        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
+        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG, ELPCTRL_WAKE_UP);
 
         if (!pending) {
                 ret = wait_for_completion_timeout(
diff --git a/drivers/net/wireless/wl12xx/ps.h b/drivers/net/wireless/ti/wlcore/ps.h
index 5f19d4fbbf27..de4f9da8ed26 100644
--- a/drivers/net/wireless/wl12xx/ps.h
+++ b/drivers/net/wireless/ti/wlcore/ps.h
@@ -24,7 +24,7 @@
 #ifndef __PS_H__
 #define __PS_H__
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "acx.h"
 
 int wl1271_ps_set_mode(struct wl1271 *wl, struct wl12xx_vif *wlvif,
diff --git a/drivers/net/wireless/wl12xx/rx.c b/drivers/net/wireless/ti/wlcore/rx.c
index cfa6071704c5..89bd9385e90b 100644
--- a/drivers/net/wireless/wl12xx/rx.c
+++ b/drivers/net/wireless/ti/wlcore/rx.c
@@ -24,34 +24,36 @@
 #include <linux/gfp.h>
 #include <linux/sched.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
 #include "acx.h"
-#include "reg.h"
 #include "rx.h"
 #include "tx.h"
 #include "io.h"
+#include "hw_ops.h"
 
-static u8 wl12xx_rx_get_mem_block(struct wl12xx_fw_status *status,
-                                  u32 drv_rx_counter)
-{
-        return le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
-                RX_MEM_BLOCK_MASK;
-}
+/*
+ * TODO: this is here just for now, it must be removed when the data
+ * operations are in place.
+ */
+#include "../wl12xx/reg.h"
 
-static u32 wl12xx_rx_get_buf_size(struct wl12xx_fw_status *status,
-                                 u32 drv_rx_counter)
+static u32 wlcore_rx_get_buf_size(struct wl1271 *wl,
+                                  u32 rx_pkt_desc)
 {
-        return (le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
-                RX_BUF_SIZE_MASK) >> RX_BUF_SIZE_SHIFT_DIV;
+        if (wl->quirks & WLCORE_QUIRK_RX_BLOCKSIZE_ALIGN)
+                return (rx_pkt_desc & ALIGNED_RX_BUF_SIZE_MASK) >>
+                       ALIGNED_RX_BUF_SIZE_SHIFT;
+
+        return (rx_pkt_desc & RX_BUF_SIZE_MASK) >> RX_BUF_SIZE_SHIFT_DIV;
 }
 
-static bool wl12xx_rx_get_unaligned(struct wl12xx_fw_status *status,
-                                    u32 drv_rx_counter)
+static u32 wlcore_rx_get_align_buf_size(struct wl1271 *wl, u32 pkt_len)
 {
-        /* Convert the value to bool */
-        return !!(le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
-                RX_BUF_UNALIGNED_PAYLOAD);
+        if (wl->quirks & WLCORE_QUIRK_RX_BLOCKSIZE_ALIGN)
+                return ALIGN(pkt_len, WL12XX_BUS_BLOCK_SIZE);
+
+        return pkt_len;
 }
 
 static void wl1271_rx_status(struct wl1271 *wl,
@@ -66,10 +68,10 @@ static void wl1271_rx_status(struct wl1271 *wl,
         else
                 status->band = IEEE80211_BAND_5GHZ;
 
-        status->rate_idx = wl1271_rate_to_idx(desc->rate, status->band);
+        status->rate_idx = wlcore_rate_to_idx(wl, desc->rate, status->band);
 
         /* 11n support */
-        if (desc->rate <= CONF_HW_RXTX_RATE_MCS0)
+        if (desc->rate <= wl->hw_min_ht_rate)
                 status->flag |= RX_FLAG_HT;
 
         status->signal = desc->rssi;
@@ -98,7 +100,7 @@ static void wl1271_rx_status(struct wl1271 *wl,
 }
 
 static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
-                                 bool unaligned, u8 *hlid)
+                                 enum wl_rx_buf_align rx_align, u8 *hlid)
 {
         struct wl1271_rx_descriptor *desc;
         struct sk_buff *skb;
@@ -106,8 +108,9 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
         u8 *buf;
         u8 beacon = 0;
         u8 is_data = 0;
-        u8 reserved = unaligned ? NET_IP_ALIGN : 0;
+        u8 reserved = 0;
         u16 seq_num;
+        u32 pkt_data_len;
 
         /*
          * In PLT mode we seem to get frames and mac80211 warns about them,
@@ -116,6 +119,16 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
         if (unlikely(wl->plt))
                 return -EINVAL;
 
+        pkt_data_len = wlcore_hw_get_rx_packet_len(wl, data, length);
+        if (!pkt_data_len) {
+                wl1271_error("Invalid packet arrived from HW. length %d",
+                             length);
+                return -EINVAL;
+        }
+
+        if (rx_align == WLCORE_RX_BUF_UNALIGNED)
+                reserved = NET_IP_ALIGN;
+
         /* the data read starts with the descriptor */
         desc = (struct wl1271_rx_descriptor *) data;
 
@@ -142,8 +155,8 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
                 return -EINVAL;
         }
 
-        /* skb length not included rx descriptor */
-        skb = __dev_alloc_skb(length + reserved - sizeof(*desc), GFP_KERNEL);
+        /* skb length not including rx descriptor */
+        skb = __dev_alloc_skb(pkt_data_len + reserved, GFP_KERNEL);
         if (!skb) {
                 wl1271_error("Couldn't allocate RX frame");
                 return -ENOMEM;
@@ -152,7 +165,7 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
         /* reserve the unaligned payload(if any) */
         skb_reserve(skb, reserved);
 
-        buf = skb_put(skb, length - sizeof(*desc));
+        buf = skb_put(skb, pkt_data_len);
 
         /*
          * Copy packets from aggregation buffer to the skbs without rx
@@ -160,7 +173,10 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
          * packets copy the packets in offset of 2 bytes guarantee IP header
          * payload aligned to 4 bytes.
          */
-        memcpy(buf, data + sizeof(*desc), length - sizeof(*desc));
+        memcpy(buf, data + sizeof(*desc), pkt_data_len);
+        if (rx_align == WLCORE_RX_BUF_PADDED)
+                skb_pull(skb, NET_IP_ALIGN);
+
         *hlid = desc->hlid;
 
         hdr = (struct ieee80211_hdr *)skb->data;
@@ -177,36 +193,35 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
                      beacon ? "beacon" : "",
                      seq_num, *hlid);
 
-        skb_trim(skb, skb->len - desc->pad_len);
-
         skb_queue_tail(&wl->deferred_rx_queue, skb);
         queue_work(wl->freezable_wq, &wl->netstack_work);
 
         return is_data;
 }
 
-void wl12xx_rx(struct wl1271 *wl, struct wl12xx_fw_status *status)
+void wl12xx_rx(struct wl1271 *wl, struct wl_fw_status *status)
 {
-        struct wl1271_acx_mem_map *wl_mem_map = wl->target_mem_map;
         unsigned long active_hlids[BITS_TO_LONGS(WL12XX_MAX_LINKS)] = {0};
         u32 buf_size;
         u32 fw_rx_counter  = status->fw_rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
         u32 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
         u32 rx_counter;
-        u32 mem_block;
-        u32 pkt_length;
-        u32 pkt_offset;
+        u32 pkt_len, align_pkt_len;
+        u32 pkt_offset, des;
         u8 hlid;
-        bool unaligned = false;
+        enum wl_rx_buf_align rx_align;
 
         while (drv_rx_counter != fw_rx_counter) {
                 buf_size = 0;
                 rx_counter = drv_rx_counter;
                 while (rx_counter != fw_rx_counter) {
-                        pkt_length = wl12xx_rx_get_buf_size(status, rx_counter);
-                        if (buf_size + pkt_length > WL1271_AGGR_BUFFER_SIZE)
+                        des = le32_to_cpu(status->rx_pkt_descs[rx_counter]);
+                        pkt_len = wlcore_rx_get_buf_size(wl, des);
+                        align_pkt_len = wlcore_rx_get_align_buf_size(wl,
+                                                                     pkt_len);
+                        if (buf_size + align_pkt_len > WL1271_AGGR_BUFFER_SIZE)
                                 break;
-                        buf_size += pkt_length;
+                        buf_size += align_pkt_len;
                         rx_counter++;
                         rx_counter &= NUM_RX_PKT_DESC_MOD_MASK;
                 }
@@ -216,38 +231,18 @@ void wl12xx_rx(struct wl1271 *wl, struct wl12xx_fw_status *status)
                         break;
                 }
 
-                if (wl->chip.id != CHIP_ID_1283_PG20) {
-                        /*
-                         * Choose the block we want to read
-                         * For aggregated packets, only the first memory block
-                         * should be retrieved. The FW takes care of the rest.
-                         */
-                        mem_block = wl12xx_rx_get_mem_block(status,
-                                                            drv_rx_counter);
-
-                        wl->rx_mem_pool_addr.addr = (mem_block << 8) +
-                           le32_to_cpu(wl_mem_map->packet_memory_pool_start);
-
-                        wl->rx_mem_pool_addr.addr_extra =
-                                wl->rx_mem_pool_addr.addr + 4;
-
-                        wl1271_write(wl, WL1271_SLV_REG_DATA,
-                                     &wl->rx_mem_pool_addr,
-                                     sizeof(wl->rx_mem_pool_addr), false);
-                }
-
                 /* Read all available packets at once */
-                wl1271_read(wl, WL1271_SLV_MEM_DATA, wl->aggr_buf,
-                                buf_size, true);
+                des = le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]);
+                wlcore_hw_prepare_read(wl, des, buf_size);
+                wlcore_read_data(wl, REG_SLV_MEM_DATA, wl->aggr_buf,
+                                 buf_size, true);
 
                 /* Split data into separate packets */
                 pkt_offset = 0;
                 while (pkt_offset < buf_size) {
-                        pkt_length = wl12xx_rx_get_buf_size(status,
-                                        drv_rx_counter);
-
-                        unaligned = wl12xx_rx_get_unaligned(status,
-                                        drv_rx_counter);
+                        des = le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]);
+                        pkt_len = wlcore_rx_get_buf_size(wl, des);
+                        rx_align = wlcore_hw_get_rx_buf_align(wl, des);
 
                         /*
                          * the handle data call can only fail in memory-outage
@@ -256,7 +251,7 @@ void wl12xx_rx(struct wl1271 *wl, struct wl12xx_fw_status *status)
                          */
                         if (wl1271_rx_handle_data(wl,
                                                   wl->aggr_buf + pkt_offset,
-                                                  pkt_length, unaligned,
+                                                  pkt_len, rx_align,
                                                   &hlid) == 1) {
                                 if (hlid < WL12XX_MAX_LINKS)
                                         __set_bit(hlid, active_hlids);
@@ -269,7 +264,7 @@ void wl12xx_rx(struct wl1271 *wl, struct wl12xx_fw_status *status)
                         wl->rx_counter++;
                         drv_rx_counter++;
                         drv_rx_counter &= NUM_RX_PKT_DESC_MOD_MASK;
-                        pkt_offset += pkt_length;
+                        pkt_offset += wlcore_rx_get_align_buf_size(wl, pkt_len);
                 }
         }
 
@@ -277,8 +272,9 @@ void wl12xx_rx(struct wl1271 *wl, struct wl12xx_fw_status *status)
          * Write the driver's packet counter to the FW. This is only required
          * for older hardware revisions
          */
-        if (wl->quirks & WL12XX_QUIRK_END_OF_TRANSACTION)
-                wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
+        if (wl->quirks & WLCORE_QUIRK_END_OF_TRANSACTION)
+                wl1271_write32(wl, WL12XX_REG_RX_DRIVER_COUNTER,
+                               wl->rx_counter);
 
         wl12xx_rearm_rx_streaming(wl, active_hlids);
 }
diff --git a/drivers/net/wireless/wl12xx/rx.h b/drivers/net/wireless/ti/wlcore/rx.h
index 86ba6b1d0cdc..6e129e2a8546 100644
--- a/drivers/net/wireless/wl12xx/rx.h
+++ b/drivers/net/wireless/ti/wlcore/rx.h
@@ -96,9 +96,19 @@
 #define RX_MEM_BLOCK_MASK            0xFF
 #define RX_BUF_SIZE_MASK             0xFFF00
 #define RX_BUF_SIZE_SHIFT_DIV        6
+#define ALIGNED_RX_BUF_SIZE_MASK     0xFFFF00
+#define ALIGNED_RX_BUF_SIZE_SHIFT    8
+
 /* If set, the start of IP payload is not 4 bytes aligned */
 #define RX_BUF_UNALIGNED_PAYLOAD     BIT(20)
 
+/* Describes the alignment state of a Rx buffer */
+enum wl_rx_buf_align {
+        WLCORE_RX_BUF_ALIGNED,
+        WLCORE_RX_BUF_UNALIGNED,
+        WLCORE_RX_BUF_PADDED,
+};
+
 enum {
         WL12XX_RX_CLASS_UNKNOWN,
         WL12XX_RX_CLASS_MANAGEMENT,
@@ -126,7 +136,7 @@ struct wl1271_rx_descriptor {
         u8  reserved;
 } __packed;
 
-void wl12xx_rx(struct wl1271 *wl, struct wl12xx_fw_status *status);
+void wl12xx_rx(struct wl1271 *wl, struct wl_fw_status *status);
 u8 wl1271_rate_to_idx(int rate, enum ieee80211_band band);
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/scan.c b/drivers/net/wireless/ti/wlcore/scan.c
index fcba055ef196..ade21a011c45 100644
--- a/drivers/net/wireless/wl12xx/scan.c
+++ b/drivers/net/wireless/ti/wlcore/scan.c
@@ -23,7 +23,7 @@
 
 #include <linux/ieee80211.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
 #include "cmd.h"
 #include "scan.h"
@@ -417,6 +417,23 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
         int i, j;
         u32 flags;
         bool force_passive = !req->n_ssids;
+        u32 min_dwell_time_active, max_dwell_time_active, delta_per_probe;
+        u32 dwell_time_passive, dwell_time_dfs;
+
+        if (band == IEEE80211_BAND_5GHZ)
+                delta_per_probe = c->dwell_time_delta_per_probe_5;
+        else
+                delta_per_probe = c->dwell_time_delta_per_probe;
+
+        min_dwell_time_active = c->base_dwell_time +
+                 req->n_ssids * c->num_probe_reqs * delta_per_probe;
+
+        max_dwell_time_active = min_dwell_time_active + c->max_dwell_time_delta;
+
+        min_dwell_time_active = DIV_ROUND_UP(min_dwell_time_active, 1000);
+        max_dwell_time_active = DIV_ROUND_UP(max_dwell_time_active, 1000);
+        dwell_time_passive = DIV_ROUND_UP(c->dwell_time_passive, 1000);
+        dwell_time_dfs = DIV_ROUND_UP(c->dwell_time_dfs, 1000);
 
         for (i = 0, j = start;
              i < req->n_channels && j < max_channels;
@@ -440,21 +457,24 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
                                      req->channels[i]->flags);
                         wl1271_debug(DEBUG_SCAN, "max_power %d",
                                      req->channels[i]->max_power);
+                        wl1271_debug(DEBUG_SCAN, "min_dwell_time %d max dwell time %d",
+                                     min_dwell_time_active,
+                                     max_dwell_time_active);
 
                         if (flags & IEEE80211_CHAN_RADAR) {
                                 channels[j].flags |= SCAN_CHANNEL_FLAGS_DFS;
 
                                 channels[j].passive_duration =
-                                        cpu_to_le16(c->dwell_time_dfs);
+                                        cpu_to_le16(dwell_time_dfs);
                         } else {
                                 channels[j].passive_duration =
-                                        cpu_to_le16(c->dwell_time_passive);
+                                        cpu_to_le16(dwell_time_passive);
                         }
 
                         channels[j].min_duration =
-                                cpu_to_le16(c->min_dwell_time_active);
+                                cpu_to_le16(min_dwell_time_active);
                         channels[j].max_duration =
-                                cpu_to_le16(c->max_dwell_time_active);
+                                cpu_to_le16(max_dwell_time_active);
 
                         channels[j].tx_power_att = req->channels[i]->max_power;
                         channels[j].channel = req->channels[i]->hw_value;
diff --git a/drivers/net/wireless/wl12xx/scan.h b/drivers/net/wireless/ti/wlcore/scan.h
index 96ff457a3a0b..81ee36ac2078 100644
--- a/drivers/net/wireless/wl12xx/scan.h
+++ b/drivers/net/wireless/ti/wlcore/scan.h
@@ -24,7 +24,7 @@
 #ifndef __SCAN_H__
 #define __SCAN_H__
 
-#include "wl12xx.h"
+#include "wlcore.h"
 
 int wl1271_scan(struct wl1271 *wl, struct ieee80211_vif *vif,
                 const u8 *ssid, size_t ssid_len,
@@ -55,7 +55,7 @@ void wl1271_scan_sched_scan_results(struct wl1271 *wl);
 #define WL1271_SCAN_BAND_2_4_GHZ 0
 #define WL1271_SCAN_BAND_5_GHZ 1
 
-#define WL1271_SCAN_TIMEOUT    10000 /* msec */
+#define WL1271_SCAN_TIMEOUT    30000 /* msec */
 
 enum {
         WL1271_SCAN_STATE_IDLE,
diff --git a/drivers/net/wireless/wl12xx/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 4b3c32774bae..0a72347cfc4c 100644
--- a/drivers/net/wireless/wl12xx/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -33,7 +33,7 @@
 #include <linux/wl12xx.h>
 #include <linux/pm_runtime.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "wl12xx_80211.h"
 #include "io.h"
 
@@ -76,7 +76,7 @@ static void wl12xx_sdio_raw_read(struct device *child, int addr, void *buf,
 
         sdio_claim_host(func);
 
-        if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
+        if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG)) {
                 ((u8 *)buf)[0] = sdio_f0_readb(func, addr, &ret);
                 dev_dbg(child->parent, "sdio read 52 addr 0x%x, byte 0x%02x\n",
                         addr, ((u8 *)buf)[0]);
@@ -105,7 +105,7 @@ static void wl12xx_sdio_raw_write(struct device *child, int addr, void *buf,
 
         sdio_claim_host(func);
 
-        if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
+        if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG)) {
                 sdio_f0_writeb(func, ((u8 *)buf)[0], addr, &ret);
                 dev_dbg(child->parent, "sdio write 52 addr 0x%x, byte 0x%02x\n",
                         addr, ((u8 *)buf)[0]);
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index 2fc18a8dcce8..553cd3cbb98c 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -30,12 +30,10 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "wl12xx_80211.h"
 #include "io.h"
 
-#include "reg.h"
-
 #define WSPI_CMD_READ                 0x40000000
 #define WSPI_CMD_WRITE                0x00000000
 #define WSPI_CMD_FIXED                0x20000000
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/ti/wlcore/testmode.c
index b41428f5b3b2..0e59ea2cdd39 100644
--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/ti/wlcore/testmode.c
@@ -25,10 +25,9 @@
 #include <linux/slab.h>
 #include <net/genetlink.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
 #include "acx.h"
-#include "reg.h"
 #include "ps.h"
 #include "io.h"
 
diff --git a/drivers/net/wireless/wl12xx/testmode.h b/drivers/net/wireless/ti/wlcore/testmode.h
index 8071654259ea..8071654259ea 100644
--- a/drivers/net/wireless/wl12xx/testmode.h
+++ b/drivers/net/wireless/ti/wlcore/testmode.h
diff --git a/drivers/net/wireless/wl12xx/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index 43ae49143d68..6893bc207994 100644
--- a/drivers/net/wireless/wl12xx/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -25,13 +25,19 @@
 #include <linux/module.h>
 #include <linux/etherdevice.h>
 
-#include "wl12xx.h"
+#include "wlcore.h"
 #include "debug.h"
 #include "io.h"
-#include "reg.h"
 #include "ps.h"
 #include "tx.h"
 #include "event.h"
+#include "hw_ops.h"
+
+/*
+ * TODO: this is here just for now, it must be removed when the data
+ * operations are in place.
+ */
+#include "../wl12xx/reg.h"
 
 static int wl1271_set_default_wep_key(struct wl1271 *wl,
                                       struct wl12xx_vif *wlvif, u8 id)
@@ -56,8 +62,8 @@ static int wl1271_alloc_tx_id(struct wl1271 *wl, struct sk_buff *skb)
 {
         int id;
 
-        id = find_first_zero_bit(wl->tx_frames_map, ACX_TX_DESCRIPTORS);
-        if (id >= ACX_TX_DESCRIPTORS)
+        id = find_first_zero_bit(wl->tx_frames_map, wl->num_tx_desc);
+        if (id >= wl->num_tx_desc)
                 return -EBUSY;
 
         __set_bit(id, wl->tx_frames_map);
@@ -69,7 +75,7 @@ static int wl1271_alloc_tx_id(struct wl1271 *wl, struct sk_buff *skb)
 static void wl1271_free_tx_id(struct wl1271 *wl, int id)
 {
         if (__test_and_clear_bit(id, wl->tx_frames_map)) {
-                if (unlikely(wl->tx_frames_cnt == ACX_TX_DESCRIPTORS))
+                if (unlikely(wl->tx_frames_cnt == wl->num_tx_desc))
                         clear_bit(WL1271_FLAG_FW_TX_BUSY, &wl->flags);
 
                 wl->tx_frames[id] = NULL;
@@ -167,14 +173,15 @@ u8 wl12xx_tx_get_hlid(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 return wlvif->dev_hlid;
 }
 
-static unsigned int wl12xx_calc_packet_alignment(struct wl1271 *wl,
-                                                unsigned int packet_length)
+unsigned int wlcore_calc_packet_alignment(struct wl1271 *wl,
+                                          unsigned int packet_length)
 {
-        if (wl->quirks & WL12XX_QUIRK_NO_BLOCKSIZE_ALIGNMENT)
-                return ALIGN(packet_length, WL1271_TX_ALIGN_TO);
-        else
+        if (wl->quirks & WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN)
                 return ALIGN(packet_length, WL12XX_BUS_BLOCK_SIZE);
+        else
+                return ALIGN(packet_length, WL1271_TX_ALIGN_TO);
 }
+EXPORT_SYMBOL(wlcore_calc_packet_alignment);
 
 static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                               struct sk_buff *skb, u32 extra, u32 buf_offset,
@@ -182,10 +189,9 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 {
         struct wl1271_tx_hw_descr *desc;
         u32 total_len = skb->len + sizeof(struct wl1271_tx_hw_descr) + extra;
-        u32 len;
         u32 total_blocks;
         int id, ret = -EBUSY, ac;
-        u32 spare_blocks = wl->tx_spare_blocks;
+        u32 spare_blocks = wl->normal_tx_spare;
         bool is_dummy = false;
 
         if (buf_offset + total_len > WL1271_AGGR_BUFFER_SIZE)
@@ -196,30 +202,19 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         if (id < 0)
                 return id;
 
-        /* approximate the number of blocks required for this packet
-           in the firmware */
-        len = wl12xx_calc_packet_alignment(wl, total_len);
-
-        /* in case of a dummy packet, use default amount of spare mem blocks */
-        if (unlikely(wl12xx_is_dummy_packet(wl, skb))) {
+        if (unlikely(wl12xx_is_dummy_packet(wl, skb)))
                 is_dummy = true;
-                spare_blocks = TX_HW_BLOCK_SPARE_DEFAULT;
-        }
+        else if (wlvif->is_gem)
+                spare_blocks = wl->gem_tx_spare;
 
-        total_blocks = (len + TX_HW_BLOCK_SIZE - 1) / TX_HW_BLOCK_SIZE +
-                spare_blocks;
+        total_blocks = wlcore_hw_calc_tx_blocks(wl, total_len, spare_blocks);
 
         if (total_blocks <= wl->tx_blocks_available) {
                 desc = (struct wl1271_tx_hw_descr *)skb_push(
                         skb, total_len - skb->len);
 
-                /* HW descriptor fields change between wl127x and wl128x */
-                if (wl->chip.id == CHIP_ID_1283_PG20) {
-                        desc->wl128x_mem.total_mem_blocks = total_blocks;
-                } else {
-                        desc->wl127x_mem.extra_blocks = spare_blocks;
-                        desc->wl127x_mem.total_mem_blocks = total_blocks;
-                }
+                wlcore_hw_set_tx_desc_blocks(wl, desc, total_blocks,
+                                             spare_blocks);
 
                 desc->id = id;
 
@@ -256,7 +251,7 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 {
         struct timespec ts;
         struct wl1271_tx_hw_descr *desc;
-        int aligned_len, ac, rate_idx;
+        int ac, rate_idx;
         s64 hosttime;
         u16 tx_attr = 0;
         __le16 frame_control;
@@ -329,44 +324,16 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         }
 
         tx_attr |= rate_idx << TX_HW_ATTR_OFST_RATE_POLICY;
-        desc->reserved = 0;
-
-        aligned_len = wl12xx_calc_packet_alignment(wl, skb->len);
-
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
-                desc->wl128x_mem.extra_bytes = aligned_len - skb->len;
-                desc->length = cpu_to_le16(aligned_len >> 2);
-
-                wl1271_debug(DEBUG_TX, "tx_fill_hdr: hlid: %d "
-                             "tx_attr: 0x%x len: %d life: %d mem: %d",
-                             desc->hlid, tx_attr,
-                             le16_to_cpu(desc->length),
-                             le16_to_cpu(desc->life_time),
-                             desc->wl128x_mem.total_mem_blocks);
-        } else {
-                int pad;
-
-                /* Store the aligned length in terms of words */
-                desc->length = cpu_to_le16(aligned_len >> 2);
-
-                /* calculate number of padding bytes */
-                pad = aligned_len - skb->len;
-                tx_attr |= pad << TX_HW_ATTR_OFST_LAST_WORD_PAD;
-
-                wl1271_debug(DEBUG_TX, "tx_fill_hdr: pad: %d hlid: %d "
-                             "tx_attr: 0x%x len: %d life: %d mem: %d", pad,
-                             desc->hlid, tx_attr,
-                             le16_to_cpu(desc->length),
-                             le16_to_cpu(desc->life_time),
-                             desc->wl127x_mem.total_mem_blocks);
-        }
 
         /* for WEP shared auth - no fw encryption is needed */
         if (ieee80211_is_auth(frame_control) &&
             ieee80211_has_protected(frame_control))
                 tx_attr |= TX_HW_ATTR_HOST_ENCRYPT;
 
+        desc->reserved = 0;
         desc->tx_attr = cpu_to_le16(tx_attr);
+
+        wlcore_hw_set_tx_desc_data_len(wl, desc, skb);
 }
 
 /* caller must hold wl->mutex */
@@ -432,7 +399,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
          * In special cases, we want to align to a specific block size
          * (eg. for wl128x with SDIO we align to 256).
          */
-        total_len = wl12xx_calc_packet_alignment(wl, skb->len);
+        total_len = wlcore_calc_packet_alignment(wl, skb->len);
 
         memcpy(wl->aggr_buf + buf_offset, skb->data, skb->len);
         memset(wl->aggr_buf + buf_offset + skb->len, 0, total_len - skb->len);
@@ -718,8 +685,8 @@ void wl1271_tx_work_locked(struct wl1271 *wl)
                          * Flush buffer and try again.
                          */
                         wl1271_skb_queue_head(wl, wlvif, skb);
-                        wl1271_write(wl, WL1271_SLV_MEM_DATA, wl->aggr_buf,
-                                     buf_offset, true);
+                        wlcore_write_data(wl, REG_SLV_MEM_DATA, wl->aggr_buf,
+                                          buf_offset, true);
                         sent_packets = true;
                         buf_offset = 0;
                         continue;
@@ -753,8 +720,8 @@ void wl1271_tx_work_locked(struct wl1271 *wl)
 
 out_ack:
         if (buf_offset) {
-                wl1271_write(wl, WL1271_SLV_MEM_DATA, wl->aggr_buf,
-                                buf_offset, true);
+                wlcore_write_data(wl, REG_SLV_MEM_DATA, wl->aggr_buf,
+                                  buf_offset, true);
                 sent_packets = true;
         }
         if (sent_packets) {
@@ -762,8 +729,8 @@ out_ack:
                  * Interrupt the firmware with the new packets. This is only
                  * required for older hardware revisions
                  */
-                if (wl->quirks & WL12XX_QUIRK_END_OF_TRANSACTION)
-                        wl1271_write32(wl, WL1271_HOST_WR_ACCESS,
+                if (wl->quirks & WLCORE_QUIRK_END_OF_TRANSACTION)
+                        wl1271_write32(wl, WL12XX_HOST_WR_ACCESS,
                                        wl->tx_packets_count);
 
                 wl1271_handle_tx_low_watermark(wl);
@@ -792,11 +759,20 @@ static u8 wl1271_tx_get_rate_flags(u8 rate_class_index)
 {
         u8 flags = 0;
 
-        if (rate_class_index >= CONF_HW_RXTX_RATE_MCS_MIN &&
-            rate_class_index <= CONF_HW_RXTX_RATE_MCS_MAX)
+        /*
+         * TODO: use wl12xx constants when this code is moved to wl12xx, as
+         * only it uses Tx-completion.
+         */
+        if (rate_class_index <= 8)
                 flags |= IEEE80211_TX_RC_MCS;
-        if (rate_class_index == CONF_HW_RXTX_RATE_MCS7_SGI)
+
+        /*
+         * TODO: use wl12xx constants when this code is moved to wl12xx, as
+         * only it uses Tx-completion.
+         */
+        if (rate_class_index == 0)
                 flags |= IEEE80211_TX_RC_SHORT_GI;
+
         return flags;
 }
 
@@ -813,7 +789,7 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
         u8 retries = 0;
 
         /* check for id legality */
-        if (unlikely(id >= ACX_TX_DESCRIPTORS || wl->tx_frames[id] == NULL)) {
+        if (unlikely(id >= wl->num_tx_desc || wl->tx_frames[id] == NULL)) {
                 wl1271_warning("TX result illegal id: %d", id);
                 return;
         }
@@ -834,7 +810,7 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
         if (result->status == TX_SUCCESS) {
                 if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
                         info->flags |= IEEE80211_TX_STAT_ACK;
-                rate = wl1271_rate_to_idx(result->rate_class_index,
+                rate = wlcore_rate_to_idx(wl, result->rate_class_index,
                                           wlvif->band);
                 rate_flags = wl1271_tx_get_rate_flags(result->rate_class_index);
                 retries = result->ack_failures;
@@ -929,6 +905,7 @@ void wl1271_tx_complete(struct wl1271 *wl)
                 wl->tx_results_count++;
         }
 }
+EXPORT_SYMBOL(wl1271_tx_complete);
 
 void wl1271_tx_reset_link_queues(struct wl1271 *wl, u8 hlid)
 {
@@ -1006,7 +983,7 @@ void wl12xx_tx_reset(struct wl1271 *wl, bool reset_tx_queues)
         if (reset_tx_queues)
                 wl1271_handle_tx_low_watermark(wl);
 
-        for (i = 0; i < ACX_TX_DESCRIPTORS; i++) {
+        for (i = 0; i < wl->num_tx_desc; i++) {
                 if (wl->tx_frames[i] == NULL)
                         continue;
 
diff --git a/drivers/net/wireless/wl12xx/tx.h b/drivers/net/wireless/ti/wlcore/tx.h
index 5cf8c32d40d1..2fd6e5dc6f75 100644
--- a/drivers/net/wireless/wl12xx/tx.h
+++ b/drivers/net/wireless/ti/wlcore/tx.h
@@ -25,9 +25,6 @@
 #ifndef __TX_H__
 #define __TX_H__
 
-#define TX_HW_BLOCK_SPARE_DEFAULT        1
-#define TX_HW_BLOCK_SIZE                 252
-
 #define TX_HW_MGMT_PKT_LIFETIME_TU       2000
 #define TX_HW_AP_MODE_PKT_LIFETIME_TU    8000
 
@@ -212,7 +209,7 @@ void wl1271_tx_complete(struct wl1271 *wl);
 void wl12xx_tx_reset_wlvif(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 void wl12xx_tx_reset(struct wl1271 *wl, bool reset_tx_queues);
 void wl1271_tx_flush(struct wl1271 *wl);
-u8 wl1271_rate_to_idx(int rate, enum ieee80211_band band);
+u8 wlcore_rate_to_idx(struct wl1271 *wl, u8 rate, enum ieee80211_band band);
 u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set,
                                 enum ieee80211_band rate_band);
 u32 wl1271_tx_min_rate_get(struct wl1271 *wl, u32 rate_set);
@@ -224,6 +221,8 @@ void wl1271_tx_reset_link_queues(struct wl1271 *wl, u8 hlid);
 void wl1271_handle_tx_low_watermark(struct wl1271 *wl);
 bool wl12xx_is_dummy_packet(struct wl1271 *wl, struct sk_buff *skb);
 void wl12xx_rearm_rx_streaming(struct wl1271 *wl, unsigned long *active_hlids);
+unsigned int wlcore_calc_packet_alignment(struct wl1271 *wl,
+                                          unsigned int packet_length);
 
 /* from main.c */
 void wl1271_free_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 hlid);
diff --git a/drivers/net/wireless/wl12xx/wl12xx.h b/drivers/net/wireless/ti/wlcore/wl12xx.h
index 749a15a75d38..a9b220c43e54 100644
--- a/drivers/net/wireless/wl12xx/wl12xx.h
+++ b/drivers/net/wireless/ti/wlcore/wl12xx.h
@@ -89,8 +89,6 @@
 #define WL1271_AP_BSS_INDEX        0
 #define WL1271_AP_DEF_BEACON_EXP   20
 
-#define ACX_TX_DESCRIPTORS         16
-
 #define WL1271_AGGR_BUFFER_SIZE (4 * PAGE_SIZE)
 
 enum wl1271_state {
@@ -105,26 +103,6 @@ enum wl12xx_fw_type {
         WL12XX_FW_TYPE_PLT,
 };
 
-enum wl1271_partition_type {
-        PART_DOWN,
-        PART_WORK,
-        PART_DRPW,
-
-        PART_TABLE_LEN
-};
-
-struct wl1271_partition {
-        u32 size;
-        u32 start;
-};
-
-struct wl1271_partition_set {
-        struct wl1271_partition mem;
-        struct wl1271_partition reg;
-        struct wl1271_partition mem2;
-        struct wl1271_partition mem3;
-};
-
 struct wl1271;
 
 enum {
@@ -167,8 +145,21 @@ struct wl1271_stats {
 
 #define AP_MAX_STATIONS            8
 
+struct wl_fw_packet_counters {
+        /* Cumulative counter of released packets per AC */
+        u8 tx_released_pkts[NUM_TX_QUEUES];
+
+        /* Cumulative counter of freed packets per HLID */
+        u8 tx_lnk_free_pkts[WL12XX_MAX_LINKS];
+
+        /* Cumulative counter of released Voice memory blocks */
+        u8 tx_voice_released_blks;
+
+        u8 padding[3];
+} __packed;
+
 /* FW status registers */
-struct wl12xx_fw_status {
+struct wl_fw_status {
         __le32 intr;
         u8  fw_rx_counter;
         u8  drv_rx_counter;
@@ -195,16 +186,12 @@ struct wl12xx_fw_status {
         /* Size (in Memory Blocks) of TX pool */
         __le32 tx_total;
 
-        /* Cumulative counter of released packets per AC */
-        u8 tx_released_pkts[NUM_TX_QUEUES];
+        struct wl_fw_packet_counters counters;
 
-        /* Cumulative counter of freed packets per HLID */
-        u8 tx_lnk_free_pkts[WL12XX_MAX_LINKS];
-
-        /* Cumulative counter of released Voice memory blocks */
-        u8 tx_voice_released_blks;
-        u8 padding_1[3];
         __le32 log_start_addr;
+
+        /* Private status to be used by the lower drivers */
+        u8 priv[0];
 } __packed;
 
 struct wl1271_rx_mem_pool_addr {
@@ -292,214 +279,6 @@ struct wl1271_link {
         u8 ba_bitmap;
 };
 
-struct wl1271 {
-        struct ieee80211_hw *hw;
-        bool mac80211_registered;
-
-        struct device *dev;
-
-        void *if_priv;
-
-        struct wl1271_if_operations *if_ops;
-
-        void (*set_power)(bool enable);
-        int irq;
-        int ref_clock;
-
-        spinlock_t wl_lock;
-
-        enum wl1271_state state;
-        enum wl12xx_fw_type fw_type;
-        bool plt;
-        u8 last_vif_count;
-        struct mutex mutex;
-
-        unsigned long flags;
-
-        struct wl1271_partition_set part;
-
-        struct wl1271_chip chip;
-
-        int cmd_box_addr;
-        int event_box_addr;
-
-        u8 *fw;
-        size_t fw_len;
-        void *nvs;
-        size_t nvs_len;
-
-        s8 hw_pg_ver;
-
-        /* address read from the fuse ROM */
-        u32 fuse_oui_addr;
-        u32 fuse_nic_addr;
-
-        /* we have up to 2 MAC addresses */
-        struct mac_address addresses[2];
-        int channel;
-        u8 system_hlid;
-
-        unsigned long links_map[BITS_TO_LONGS(WL12XX_MAX_LINKS)];
-        unsigned long roles_map[BITS_TO_LONGS(WL12XX_MAX_ROLES)];
-        unsigned long roc_map[BITS_TO_LONGS(WL12XX_MAX_ROLES)];
-        unsigned long rate_policies_map[
-                        BITS_TO_LONGS(WL12XX_MAX_RATE_POLICIES)];
-
-        struct list_head wlvif_list;
-
-        u8 sta_count;
-        u8 ap_count;
-
-        struct wl1271_acx_mem_map *target_mem_map;
-
-        /* Accounting for allocated / available TX blocks on HW */
-        u32 tx_blocks_freed;
-        u32 tx_blocks_available;
-        u32 tx_allocated_blocks;
-        u32 tx_results_count;
-
-        /* amount of spare TX blocks to use */
-        u32 tx_spare_blocks;
-
-        /* Accounting for allocated / available Tx packets in HW */
-        u32 tx_pkts_freed[NUM_TX_QUEUES];
-        u32 tx_allocated_pkts[NUM_TX_QUEUES];
-
-        /* Transmitted TX packets counter for chipset interface */
-        u32 tx_packets_count;
-
-        /* Time-offset between host and chipset clocks */
-        s64 time_offset;
-
-        /* Frames scheduled for transmission, not handled yet */
-        int tx_queue_count[NUM_TX_QUEUES];
-        long stopped_queues_map;
-
-        /* Frames received, not handled yet by mac80211 */
-        struct sk_buff_head deferred_rx_queue;
-
-        /* Frames sent, not returned yet to mac80211 */
-        struct sk_buff_head deferred_tx_queue;
-
-        struct work_struct tx_work;
-        struct workqueue_struct *freezable_wq;
-
-        /* Pending TX frames */
-        unsigned long tx_frames_map[BITS_TO_LONGS(ACX_TX_DESCRIPTORS)];
-        struct sk_buff *tx_frames[ACX_TX_DESCRIPTORS];
-        int tx_frames_cnt;
-
-        /* FW Rx counter */
-        u32 rx_counter;
-
-        /* Rx memory pool address */
-        struct wl1271_rx_mem_pool_addr rx_mem_pool_addr;
-
-        /* Intermediate buffer, used for packet aggregation */
-        u8 *aggr_buf;
-
-        /* Reusable dummy packet template */
-        struct sk_buff *dummy_packet;
-
-        /* Network stack work  */
-        struct work_struct netstack_work;
-
-        /* FW log buffer */
-        u8 *fwlog;
-
-        /* Number of valid bytes in the FW log buffer */
-        ssize_t fwlog_size;
-
-        /* Sysfs FW log entry readers wait queue */
-        wait_queue_head_t fwlog_waitq;
-
-        /* Hardware recovery work */
-        struct work_struct recovery_work;
-
-        /* The mbox event mask */
-        u32 event_mask;
-
-        /* Mailbox pointers */
-        u32 mbox_ptr[2];
-
-        /* Are we currently scanning */
-        struct ieee80211_vif *scan_vif;
-        struct wl1271_scan scan;
-        struct delayed_work scan_complete_work;
-
-        bool sched_scanning;
-
-        /* The current band */
-        enum ieee80211_band band;
-
-        struct completion *elp_compl;
-        struct delayed_work elp_work;
-
-        /* in dBm */
-        int power_level;
-
-        struct wl1271_stats stats;
-
-        __le32 buffer_32;
-        u32 buffer_cmd;
-        u32 buffer_busyword[WL1271_BUSY_WORD_CNT];
-
-        struct wl12xx_fw_status *fw_status;
-        struct wl1271_tx_hw_res_if *tx_res_if;
-
-        /* Current chipset configuration */
-        struct conf_drv_settings conf;
-
-        bool sg_enabled;
-
-        bool enable_11a;
-
-        /* Most recently reported noise in dBm */
-        s8 noise;
-
-        /* bands supported by this instance of wl12xx */
-        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
-
-        int tcxo_clock;
-
-        /*
-         * wowlan trigger was configured during suspend.
-         * (currently, only "ANY" trigger is supported)
-         */
-        bool wow_enabled;
-        bool irq_wake_enabled;
-
-        /*
-         * AP-mode - links indexed by HLID. The global and broadcast links
-         * are always active.
-         */
-        struct wl1271_link links[WL12XX_MAX_LINKS];
-
-        /* AP-mode - a bitmap of links currently in PS mode according to FW */
-        u32 ap_fw_ps_map;
-
-        /* AP-mode - a bitmap of links currently in PS mode in mac80211 */
-        unsigned long ap_ps_map;
-
-        /* Quirks of specific hardware revisions */
-        unsigned int quirks;
-
-        /* Platform limitations */
-        unsigned int platform_quirks;
-
-        /* number of currently active RX BA sessions */
-        int ba_rx_session_count;
-
-        /* AP-mode - number of currently connected stations */
-        int active_sta_count;
-
-        /* last wlvif we transmitted from */
-        struct wl12xx_vif *last_wlvif;
-
-        /* work to fire when Tx is stuck */
-        struct delayed_work tx_watchdog_work;
-};
-
 struct wl1271_station {
         u8 hlid;
 };
@@ -605,6 +384,9 @@ struct wl12xx_vif {
         struct work_struct rx_streaming_disable_work;
         struct timer_list rx_streaming_timer;
 
+        /* does the current role use GEM for encryption (AP or STA) */
+        bool is_gem;
+
         /*
          * This struct must be last!
          * data that has to be saved acrossed reconfigs (e.g. recovery)
@@ -679,17 +461,6 @@ size_t wl12xx_copy_fwlog(struct wl1271 *wl, u8 *memblock, size_t maxlen);
 #define HW_BG_RATES_MASK        0xffff
 #define HW_HT_RATES_OFFSET      16
 
-/* Quirks */
-
-/* Each RX/TX transaction requires an end-of-transaction transfer */
-#define WL12XX_QUIRK_END_OF_TRANSACTION         BIT(0)
-
-/* wl127x and SPI don't support SDIO block size alignment */
-#define WL12XX_QUIRK_NO_BLOCKSIZE_ALIGNMENT     BIT(2)
-
-/* Older firmwares did not implement the FW logger over bus feature */
-#define WL12XX_QUIRK_FWLOG_NOT_IMPLEMENTED      BIT(4)
-
 #define WL12XX_HW_BLOCK_SIZE    256
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl12xx_80211.h b/drivers/net/wireless/ti/wlcore/wl12xx_80211.h
index 22b0bc98d7b5..22b0bc98d7b5 100644
--- a/drivers/net/wireless/wl12xx/wl12xx_80211.h
+++ b/drivers/net/wireless/ti/wlcore/wl12xx_80211.h
diff --git a/drivers/net/wireless/wl12xx/wl12xx_platform_data.c b/drivers/net/wireless/ti/wlcore/wl12xx_platform_data.c
index 998e95895f9d..998e95895f9d 100644
--- a/drivers/net/wireless/wl12xx/wl12xx_platform_data.c
+++ b/drivers/net/wireless/ti/wlcore/wl12xx_platform_data.c
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
new file mode 100644
index 000000000000..39f9fadfebd9
--- /dev/null
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -0,0 +1,448 @@
+/*
+ * This file is part of wlcore
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WLCORE_H__
+#define __WLCORE_H__
+
+#include <linux/platform_device.h>
+
+#include "wl12xx.h"
+#include "event.h"
+
+/* The maximum number of Tx descriptors in all chip families */
+#define WLCORE_MAX_TX_DESCRIPTORS 32
+
+/* forward declaration */
+struct wl1271_tx_hw_descr;
+enum wl_rx_buf_align;
+
+struct wlcore_ops {
+        int (*identify_chip)(struct wl1271 *wl);
+        int (*identify_fw)(struct wl1271 *wl);
+        int (*boot)(struct wl1271 *wl);
+        void (*trigger_cmd)(struct wl1271 *wl, int cmd_box_addr,
+                            void *buf, size_t len);
+        void (*ack_event)(struct wl1271 *wl);
+        u32 (*calc_tx_blocks)(struct wl1271 *wl, u32 len, u32 spare_blks);
+        void (*set_tx_desc_blocks)(struct wl1271 *wl,
+                                   struct wl1271_tx_hw_descr *desc,
+                                   u32 blks, u32 spare_blks);
+        void (*set_tx_desc_data_len)(struct wl1271 *wl,
+                                     struct wl1271_tx_hw_descr *desc,
+                                     struct sk_buff *skb);
+        enum wl_rx_buf_align (*get_rx_buf_align)(struct wl1271 *wl,
+                                                 u32 rx_desc);
+        void (*prepare_read)(struct wl1271 *wl, u32 rx_desc, u32 len);
+        u32 (*get_rx_packet_len)(struct wl1271 *wl, void *rx_data,
+                                 u32 data_len);
+        void (*tx_delayed_compl)(struct wl1271 *wl);
+        void (*tx_immediate_compl)(struct wl1271 *wl);
+        int (*hw_init)(struct wl1271 *wl);
+        int (*init_vif)(struct wl1271 *wl, struct wl12xx_vif *wlvif);
+        u32 (*sta_get_ap_rate_mask)(struct wl1271 *wl,
+                                    struct wl12xx_vif *wlvif);
+        s8 (*get_pg_ver)(struct wl1271 *wl);
+        void (*get_mac)(struct wl1271 *wl);
+};
+
+enum wlcore_partitions {
+        PART_DOWN,
+        PART_WORK,
+        PART_BOOT,
+        PART_DRPW,
+        PART_TOP_PRCM_ELP_SOC,
+        PART_PHY_INIT,
+
+        PART_TABLE_LEN,
+};
+
+struct wlcore_partition {
+        u32 size;
+        u32 start;
+};
+
+struct wlcore_partition_set {
+        struct wlcore_partition mem;
+        struct wlcore_partition reg;
+        struct wlcore_partition mem2;
+        struct wlcore_partition mem3;
+};
+
+enum wlcore_registers {
+        /* register addresses, used with partition translation */
+        REG_ECPU_CONTROL,
+        REG_INTERRUPT_NO_CLEAR,
+        REG_INTERRUPT_ACK,
+        REG_COMMAND_MAILBOX_PTR,
+        REG_EVENT_MAILBOX_PTR,
+        REG_INTERRUPT_TRIG,
+        REG_INTERRUPT_MASK,
+        REG_PC_ON_RECOVERY,
+        REG_CHIP_ID_B,
+        REG_CMD_MBOX_ADDRESS,
+
+        /* data access memory addresses, used with partition translation */
+        REG_SLV_MEM_DATA,
+        REG_SLV_REG_DATA,
+
+        /* raw data access memory addresses */
+        REG_RAW_FW_STATUS_ADDR,
+
+        REG_TABLE_LEN,
+};
+
+struct wl1271 {
+        struct ieee80211_hw *hw;
+        bool mac80211_registered;
+
+        struct device *dev;
+
+        void *if_priv;
+
+        struct wl1271_if_operations *if_ops;
+
+        void (*set_power)(bool enable);
+        int irq;
+        int ref_clock;
+
+        spinlock_t wl_lock;
+
+        enum wl1271_state state;
+        enum wl12xx_fw_type fw_type;
+        bool plt;
+        u8 last_vif_count;
+        struct mutex mutex;
+
+        unsigned long flags;
+
+        struct wlcore_partition_set curr_part;
+
+        struct wl1271_chip chip;
+
+        int cmd_box_addr;
+
+        u8 *fw;
+        size_t fw_len;
+        void *nvs;
+        size_t nvs_len;
+
+        s8 hw_pg_ver;
+
+        /* address read from the fuse ROM */
+        u32 fuse_oui_addr;
+        u32 fuse_nic_addr;
+
+        /* we have up to 2 MAC addresses */
+        struct mac_address addresses[2];
+        int channel;
+        u8 system_hlid;
+
+        unsigned long links_map[BITS_TO_LONGS(WL12XX_MAX_LINKS)];
+        unsigned long roles_map[BITS_TO_LONGS(WL12XX_MAX_ROLES)];
+        unsigned long roc_map[BITS_TO_LONGS(WL12XX_MAX_ROLES)];
+        unsigned long rate_policies_map[
+                        BITS_TO_LONGS(WL12XX_MAX_RATE_POLICIES)];
+
+        struct list_head wlvif_list;
+
+        u8 sta_count;
+        u8 ap_count;
+
+        struct wl1271_acx_mem_map *target_mem_map;
+
+        /* Accounting for allocated / available TX blocks on HW */
+        u32 tx_blocks_freed;
+        u32 tx_blocks_available;
+        u32 tx_allocated_blocks;
+        u32 tx_results_count;
+
+        /* Accounting for allocated / available Tx packets in HW */
+        u32 tx_pkts_freed[NUM_TX_QUEUES];
+        u32 tx_allocated_pkts[NUM_TX_QUEUES];
+
+        /* Transmitted TX packets counter for chipset interface */
+        u32 tx_packets_count;
+
+        /* Time-offset between host and chipset clocks */
+        s64 time_offset;
+
+        /* Frames scheduled for transmission, not handled yet */
+        int tx_queue_count[NUM_TX_QUEUES];
+        long stopped_queues_map;
+
+        /* Frames received, not handled yet by mac80211 */
+        struct sk_buff_head deferred_rx_queue;
+
+        /* Frames sent, not returned yet to mac80211 */
+        struct sk_buff_head deferred_tx_queue;
+
+        struct work_struct tx_work;
+        struct workqueue_struct *freezable_wq;
+
+        /* Pending TX frames */
+        unsigned long tx_frames_map[BITS_TO_LONGS(WLCORE_MAX_TX_DESCRIPTORS)];
+        struct sk_buff *tx_frames[WLCORE_MAX_TX_DESCRIPTORS];
+        int tx_frames_cnt;
+
+        /* FW Rx counter */
+        u32 rx_counter;
+
+        /* Rx memory pool address */
+        struct wl1271_rx_mem_pool_addr rx_mem_pool_addr;
+
+        /* Intermediate buffer, used for packet aggregation */
+        u8 *aggr_buf;
+
+        /* Reusable dummy packet template */
+        struct sk_buff *dummy_packet;
+
+        /* Network stack work  */
+        struct work_struct netstack_work;
+
+        /* FW log buffer */
+        u8 *fwlog;
+
+        /* Number of valid bytes in the FW log buffer */
+        ssize_t fwlog_size;
+
+        /* Sysfs FW log entry readers wait queue */
+        wait_queue_head_t fwlog_waitq;
+
+        /* Hardware recovery work */
+        struct work_struct recovery_work;
+
+        /* Pointer that holds DMA-friendly block for the mailbox */
+        struct event_mailbox *mbox;
+
+        /* The mbox event mask */
+        u32 event_mask;
+
+        /* Mailbox pointers */
+        u32 mbox_ptr[2];
+
+        /* Are we currently scanning */
+        struct ieee80211_vif *scan_vif;
+        struct wl1271_scan scan;
+        struct delayed_work scan_complete_work;
+
+        bool sched_scanning;
+
+        /* The current band */
+        enum ieee80211_band band;
+
+        struct completion *elp_compl;
+        struct delayed_work elp_work;
+
+        /* in dBm */
+        int power_level;
+
+        struct wl1271_stats stats;
+
+        __le32 buffer_32;
+        u32 buffer_cmd;
+        u32 buffer_busyword[WL1271_BUSY_WORD_CNT];
+
+        struct wl_fw_status *fw_status;
+        struct wl1271_tx_hw_res_if *tx_res_if;
+
+        /* Current chipset configuration */
+        struct wlcore_conf conf;
+
+        bool sg_enabled;
+
+        bool enable_11a;
+
+        /* Most recently reported noise in dBm */
+        s8 noise;
+
+        /* bands supported by this instance of wl12xx */
+        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
+
+        int tcxo_clock;
+
+        /*
+         * wowlan trigger was configured during suspend.
+         * (currently, only "ANY" trigger is supported)
+         */
+        bool wow_enabled;
+        bool irq_wake_enabled;
+
+        /*
+         * AP-mode - links indexed by HLID. The global and broadcast links
+         * are always active.
+         */
+        struct wl1271_link links[WL12XX_MAX_LINKS];
+
+        /* AP-mode - a bitmap of links currently in PS mode according to FW */
+        u32 ap_fw_ps_map;
+
+        /* AP-mode - a bitmap of links currently in PS mode in mac80211 */
+        unsigned long ap_ps_map;
+
+        /* Quirks of specific hardware revisions */
+        unsigned int quirks;
+
+        /* Platform limitations */
+        unsigned int platform_quirks;
+
+        /* number of currently active RX BA sessions */
+        int ba_rx_session_count;
+
+        /* AP-mode - number of currently connected stations */
+        int active_sta_count;
+
+        /* last wlvif we transmitted from */
+        struct wl12xx_vif *last_wlvif;
+
+        /* work to fire when Tx is stuck */
+        struct delayed_work tx_watchdog_work;
+
+        struct wlcore_ops *ops;
+        /* pointer to the lower driver partition table */
+        const struct wlcore_partition_set *ptable;
+        /* pointer to the lower driver register table */
+        const int *rtable;
+        /* name of the firmwares to load - for PLT, single role, multi-role */
+        const char *plt_fw_name;
+        const char *sr_fw_name;
+        const char *mr_fw_name;
+
+        /* per-chip-family private structure */
+        void *priv;
+
+        /* number of TX descriptors the HW supports. */
+        u32 num_tx_desc;
+
+        /* spare Tx blocks for normal/GEM operating modes */
+        u32 normal_tx_spare;
+        u32 gem_tx_spare;
+
+        /* translate HW Tx rates to standard rate-indices */
+        const u8 **band_rate_to_idx;
+
+        /* size of table for HW rates that can be received from chip */
+        u8 hw_tx_rate_tbl_size;
+
+        /* this HW rate and below are considered HT rates for this chip */
+        u8 hw_min_ht_rate;
+
+        /* HW HT (11n) capabilities */
+        struct ieee80211_sta_ht_cap ht_cap;
+
+        /* size of the private FW status data */
+        size_t fw_status_priv_len;
+};
+
+int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev);
+int __devexit wlcore_remove(struct platform_device *pdev);
+struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size);
+int wlcore_free_hw(struct wl1271 *wl);
+
+/* Firmware image load chunk size */
+#define CHUNK_SIZE      16384
+
+/* Quirks */
+
+/* Each RX/TX transaction requires an end-of-transaction transfer */
+#define WLCORE_QUIRK_END_OF_TRANSACTION         BIT(0)
+
+/* wl127x and SPI don't support SDIO block size alignment */
+#define WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN         BIT(2)
+
+/* means aggregated Rx packets are aligned to a SDIO block */
+#define WLCORE_QUIRK_RX_BLOCKSIZE_ALIGN         BIT(3)
+
+/* Older firmwares did not implement the FW logger over bus feature */
+#define WLCORE_QUIRK_FWLOG_NOT_IMPLEMENTED      BIT(4)
+
+/* Older firmwares use an old NVS format */
+#define WLCORE_QUIRK_LEGACY_NVS                 BIT(5)
+
+/* Some firmwares may not support ELP */
+#define WLCORE_QUIRK_NO_ELP                     BIT(6)
+
+/* TODO: move to the lower drivers when all usages are abstracted */
+#define CHIP_ID_1271_PG10              (0x4030101)
+#define CHIP_ID_1271_PG20              (0x4030111)
+#define CHIP_ID_1283_PG10              (0x05030101)
+#define CHIP_ID_1283_PG20              (0x05030111)
+
+/* TODO: move all these common registers and values elsewhere */
+#define HW_ACCESS_ELP_CTRL_REG          0x1FFFC
+
+/* ELP register commands */
+#define ELPCTRL_WAKE_UP             0x1
+#define ELPCTRL_WAKE_UP_WLAN_READY  0x5
+#define ELPCTRL_SLEEP               0x0
+/* ELP WLAN_READY bit */
+#define ELPCTRL_WLAN_READY          0x2
+
+/*************************************************************************
+
+    Interrupt Trigger Register (Host -> WiLink)
+
+**************************************************************************/
+
+/* Hardware to Embedded CPU Interrupts - first 32-bit register set */
+
+/*
+ * The host sets this bit to inform the Wlan
+ * FW that a TX packet is in the XFER
+ * Buffer #0.
+ */
+#define INTR_TRIG_TX_PROC0 BIT(2)
+
+/*
+ * The host sets this bit to inform the FW
+ * that it read a packet from RX XFER
+ * Buffer #0.
+ */
+#define INTR_TRIG_RX_PROC0 BIT(3)
+
+#define INTR_TRIG_DEBUG_ACK BIT(4)
+
+#define INTR_TRIG_STATE_CHANGED BIT(5)
+
+/* Hardware to Embedded CPU Interrupts - second 32-bit register set */
+
+/*
+ * The host sets this bit to inform the FW
+ * that it read a packet from RX XFER
+ * Buffer #1.
+ */
+#define INTR_TRIG_RX_PROC1 BIT(17)
+
+/*
+ * The host sets this bit to inform the Wlan
+ * hardware that a TX packet is in the XFER
+ * Buffer #1.
+ */
+#define INTR_TRIG_TX_PROC1 BIT(18)
+
+#define ACX_SLV_SOFT_RESET_BIT  BIT(1)
+#define SOFT_RESET_MAX_TIME     1000000
+#define SOFT_RESET_STALL_TIME   1000
+
+#define ECPU_CONTROL_HALT       0x00000101
+
+#define WELP_ARM_COMMAND_VAL    0x4
+
+#endif /* __WLCORE_H__ */
diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
deleted file mode 100644
index af08c8609c63..000000000000
--- a/drivers/net/wireless/wl12xx/Kconfig
+++ /dev/null
@@ -1,48 +0,0 @@
-menuconfig WL12XX_MENU
-        tristate "TI wl12xx driver support"
-        depends on MAC80211 && EXPERIMENTAL
-        ---help---
-          This will enable TI wl12xx driver support for the following chips:
-          wl1271, wl1273, wl1281 and wl1283.
-          The drivers make use of the mac80211 stack.
-
-config WL12XX
-        tristate "TI wl12xx support"
-        depends on WL12XX_MENU && GENERIC_HARDIRQS
-        depends on INET
-        select FW_LOADER
-        ---help---
-          This module adds support for wireless adapters based on TI wl1271 and
-          TI wl1273 chipsets. This module does *not* include support for wl1251.
-          For wl1251 support, use the separate homonymous driver instead.
-
-          If you choose to build a module, it will be called wl12xx. Say N if
-          unsure.
-
-config WL12XX_SPI
-        tristate "TI wl12xx SPI support"
-        depends on WL12XX && SPI_MASTER
-        select CRC7
-        ---help---
-          This module adds support for the SPI interface of adapters using
-          TI wl12xx chipsets.  Select this if your platform is using
-          the SPI bus.
-
-          If you choose to build a module, it'll be called wl12xx_spi.
-          Say N if unsure.
-
-config WL12XX_SDIO
-        tristate "TI wl12xx SDIO support"
-        depends on WL12XX && MMC
-        ---help---
-          This module adds support for the SDIO interface of adapters using
-          TI wl12xx chipsets.  Select this if your platform is using
-          the SDIO bus.
-
-          If you choose to build a module, it'll be called wl12xx_sdio.
-          Say N if unsure.
-
-config WL12XX_PLATFORM_DATA
-        bool
-        depends on WL12XX_SDIO != n || WL1251_SDIO != n
-        default y
diff --git a/drivers/net/wireless/wl12xx/Makefile b/drivers/net/wireless/wl12xx/Makefile
deleted file mode 100644
index 98f289c907a9..000000000000
--- a/drivers/net/wireless/wl12xx/Makefile
+++ /dev/null
@@ -1,15 +0,0 @@
-wl12xx-objs             = main.o cmd.o io.o event.o tx.o rx.o ps.o acx.o \
-                          boot.o init.o debugfs.o scan.o
-
-wl12xx_spi-objs         = spi.o
-wl12xx_sdio-objs        = sdio.o
-
-wl12xx-$(CONFIG_NL80211_TESTMODE)       += testmode.o
-obj-$(CONFIG_WL12XX)                    += wl12xx.o
-obj-$(CONFIG_WL12XX_SPI)                += wl12xx_spi.o
-obj-$(CONFIG_WL12XX_SDIO)               += wl12xx_sdio.o
-
-# small builtin driver bit
-obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wl12xx_platform_data.o
-
-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
deleted file mode 100644
index 954101d03f06..000000000000
--- a/drivers/net/wireless/wl12xx/boot.c
+++ /dev/null
@@ -1,786 +0,0 @@
-/*
- * This file is part of wl1271
- *
- * Copyright (C) 2008-2010 Nokia Corporation
- *
- * Contact: Luciano Coelho <luciano.coelho@nokia.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
- * 02110-1301 USA
- *
- */
-
-#include <linux/slab.h>
-#include <linux/wl12xx.h>
-#include <linux/export.h>
-
-#include "debug.h"
-#include "acx.h"
-#include "reg.h"
-#include "boot.h"
-#include "io.h"
-#include "event.h"
-#include "rx.h"
-
-static void wl1271_boot_set_ecpu_ctrl(struct wl1271 *wl, u32 flag)
-{
-        u32 cpu_ctrl;
-
-        /* 10.5.0 run the firmware (I) */
-        cpu_ctrl = wl1271_read32(wl, ACX_REG_ECPU_CONTROL);
-
-        /* 10.5.1 run the firmware (II) */
-        cpu_ctrl |= flag;
-        wl1271_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
-}
-
-static unsigned int wl12xx_get_fw_ver_quirks(struct wl1271 *wl)
-{
-        unsigned int quirks = 0;
-        unsigned int *fw_ver = wl->chip.fw_ver;
-
-        /* Only new station firmwares support routing fw logs to the host */
-        if ((fw_ver[FW_VER_IF_TYPE] == FW_VER_IF_TYPE_STA) &&
-            (fw_ver[FW_VER_MINOR] < FW_VER_MINOR_FWLOG_STA_MIN))
-                quirks |= WL12XX_QUIRK_FWLOG_NOT_IMPLEMENTED;
-
-        /* This feature is not yet supported for AP mode */
-        if (fw_ver[FW_VER_IF_TYPE] == FW_VER_IF_TYPE_AP)
-                quirks |= WL12XX_QUIRK_FWLOG_NOT_IMPLEMENTED;
-
-        return quirks;
-}
-
-static void wl1271_parse_fw_ver(struct wl1271 *wl)
-{
-        int ret;
-
-        ret = sscanf(wl->chip.fw_ver_str + 4, "%u.%u.%u.%u.%u",
-                     &wl->chip.fw_ver[0], &wl->chip.fw_ver[1],
-                     &wl->chip.fw_ver[2], &wl->chip.fw_ver[3],
-                     &wl->chip.fw_ver[4]);
-
-        if (ret != 5) {
-                wl1271_warning("fw version incorrect value");
-                memset(wl->chip.fw_ver, 0, sizeof(wl->chip.fw_ver));
-                return;
-        }
-
-        /* Check if any quirks are needed with older fw versions */
-        wl->quirks |= wl12xx_get_fw_ver_quirks(wl);
-}
-
-static void wl1271_boot_fw_version(struct wl1271 *wl)
-{
-        struct wl1271_static_data static_data;
-
-        wl1271_read(wl, wl->cmd_box_addr, &static_data, sizeof(static_data),
-                    false);
-
-        strncpy(wl->chip.fw_ver_str, static_data.fw_version,
-                sizeof(wl->chip.fw_ver_str));
-
-        /* make sure the string is NULL-terminated */
-        wl->chip.fw_ver_str[sizeof(wl->chip.fw_ver_str) - 1] = '\0';
-
-        wl1271_parse_fw_ver(wl);
-}
-
-static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
-                                             size_t fw_data_len, u32 dest)
-{
-        struct wl1271_partition_set partition;
-        int addr, chunk_num, partition_limit;
-        u8 *p, *chunk;
-
-        /* whal_FwCtrl_LoadFwImageSm() */
-
-        wl1271_debug(DEBUG_BOOT, "starting firmware upload");
-
-        wl1271_debug(DEBUG_BOOT, "fw_data_len %zd chunk_size %d",
-                     fw_data_len, CHUNK_SIZE);
-
-        if ((fw_data_len % 4) != 0) {
-                wl1271_error("firmware length not multiple of four");
-                return -EIO;
-        }
-
-        chunk = kmalloc(CHUNK_SIZE, GFP_KERNEL);
-        if (!chunk) {
-                wl1271_error("allocation for firmware upload chunk failed");
-                return -ENOMEM;
-        }
-
-        memcpy(&partition, &wl12xx_part_table[PART_DOWN], sizeof(partition));
-        partition.mem.start = dest;
-        wl1271_set_partition(wl, &partition);
-
-        /* 10.1 set partition limit and chunk num */
-        chunk_num = 0;
-        partition_limit = wl12xx_part_table[PART_DOWN].mem.size;
-
-        while (chunk_num < fw_data_len / CHUNK_SIZE) {
-                /* 10.2 update partition, if needed */
-                addr = dest + (chunk_num + 2) * CHUNK_SIZE;
-                if (addr > partition_limit) {
-                        addr = dest + chunk_num * CHUNK_SIZE;
-                        partition_limit = chunk_num * CHUNK_SIZE +
-                                wl12xx_part_table[PART_DOWN].mem.size;
-                        partition.mem.start = addr;
-                        wl1271_set_partition(wl, &partition);
-                }
-
-                /* 10.3 upload the chunk */
-                addr = dest + chunk_num * CHUNK_SIZE;
-                p = buf + chunk_num * CHUNK_SIZE;
-                memcpy(chunk, p, CHUNK_SIZE);
-                wl1271_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
-                             p, addr);
-                wl1271_write(wl, addr, chunk, CHUNK_SIZE, false);
-
-                chunk_num++;
-        }
-
-        /* 10.4 upload the last chunk */
-        addr = dest + chunk_num * CHUNK_SIZE;
-        p = buf + chunk_num * CHUNK_SIZE;
-        memcpy(chunk, p, fw_data_len % CHUNK_SIZE);
-        wl1271_debug(DEBUG_BOOT, "uploading fw last chunk (%zd B) 0x%p to 0x%x",
-                     fw_data_len % CHUNK_SIZE, p, addr);
-        wl1271_write(wl, addr, chunk, fw_data_len % CHUNK_SIZE, false);
-
-        kfree(chunk);
-        return 0;
-}
-
-static int wl1271_boot_upload_firmware(struct wl1271 *wl)
-{
-        u32 chunks, addr, len;
-        int ret = 0;
-        u8 *fw;
-
-        fw = wl->fw;
-        chunks = be32_to_cpup((__be32 *) fw);
-        fw += sizeof(u32);
-
-        wl1271_debug(DEBUG_BOOT, "firmware chunks to be uploaded: %u", chunks);
-
-        while (chunks--) {
-                addr = be32_to_cpup((__be32 *) fw);
-                fw += sizeof(u32);
-                len = be32_to_cpup((__be32 *) fw);
-                fw += sizeof(u32);
-
-                if (len > 300000) {
-                        wl1271_info("firmware chunk too long: %u", len);
-                        return -EINVAL;
-                }
-                wl1271_debug(DEBUG_BOOT, "chunk %d addr 0x%x len %u",
-                             chunks, addr, len);
-                ret = wl1271_boot_upload_firmware_chunk(wl, fw, len, addr);
-                if (ret != 0)
-                        break;
-                fw += len;
-        }
-
-        return ret;
-}
-
-static int wl1271_boot_upload_nvs(struct wl1271 *wl)
-{
-        size_t nvs_len, burst_len;
-        int i;
-        u32 dest_addr, val;
-        u8 *nvs_ptr, *nvs_aligned;
-
-        if (wl->nvs == NULL)
-                return -ENODEV;
-
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
-                struct wl128x_nvs_file *nvs = (struct wl128x_nvs_file *)wl->nvs;
-
-                if (wl->nvs_len == sizeof(struct wl128x_nvs_file)) {
-                        if (nvs->general_params.dual_mode_select)
-                                wl->enable_11a = true;
-                } else {
-                        wl1271_error("nvs size is not as expected: %zu != %zu",
-                                     wl->nvs_len,
-                                     sizeof(struct wl128x_nvs_file));
-                        kfree(wl->nvs);
-                        wl->nvs = NULL;
-                        wl->nvs_len = 0;
-                        return -EILSEQ;
-                }
-
-                /* only the first part of the NVS needs to be uploaded */
-                nvs_len = sizeof(nvs->nvs);
-                nvs_ptr = (u8 *)nvs->nvs;
-
-        } else {
-                struct wl1271_nvs_file *nvs =
-                        (struct wl1271_nvs_file *)wl->nvs;
-                /*
-                 * FIXME: the LEGACY NVS image support (NVS's missing the 5GHz
-                 * band configurations) can be removed when those NVS files stop
-                 * floating around.
-                 */
-                if (wl->nvs_len == sizeof(struct wl1271_nvs_file) ||
-                    wl->nvs_len == WL1271_INI_LEGACY_NVS_FILE_SIZE) {
-                        if (nvs->general_params.dual_mode_select)
-                                wl->enable_11a = true;
-                }
-
-                if (wl->nvs_len != sizeof(struct wl1271_nvs_file) &&
-                    (wl->nvs_len != WL1271_INI_LEGACY_NVS_FILE_SIZE ||
-                     wl->enable_11a)) {
-                        wl1271_error("nvs size is not as expected: %zu != %zu",
-                                wl->nvs_len, sizeof(struct wl1271_nvs_file));
-                        kfree(wl->nvs);
-                        wl->nvs = NULL;
-                        wl->nvs_len = 0;
-                        return -EILSEQ;
-                }
-
-                /* only the first part of the NVS needs to be uploaded */
-                nvs_len = sizeof(nvs->nvs);
-                nvs_ptr = (u8 *) nvs->nvs;
-        }
-
-        /* update current MAC address to NVS */
-        nvs_ptr[11] = wl->addresses[0].addr[0];
-        nvs_ptr[10] = wl->addresses[0].addr[1];
-        nvs_ptr[6] = wl->addresses[0].addr[2];
-        nvs_ptr[5] = wl->addresses[0].addr[3];
-        nvs_ptr[4] = wl->addresses[0].addr[4];
-        nvs_ptr[3] = wl->addresses[0].addr[5];
-
-        /*
-         * Layout before the actual NVS tables:
-         * 1 byte : burst length.
-         * 2 bytes: destination address.
-         * n bytes: data to burst copy.
-         *
-         * This is ended by a 0 length, then the NVS tables.
-         */
-
-        /* FIXME: Do we need to check here whether the LSB is 1? */
-        while (nvs_ptr[0]) {
-                burst_len = nvs_ptr[0];
-                dest_addr = (nvs_ptr[1] & 0xfe) | ((u32)(nvs_ptr[2] << 8));
-
-                /*
-                 * Due to our new wl1271_translate_reg_addr function,
-                 * we need to add the REGISTER_BASE to the destination
-                 */
-                dest_addr += REGISTERS_BASE;
-
-                /* We move our pointer to the data */
-                nvs_ptr += 3;
-
-                for (i = 0; i < burst_len; i++) {
-                        if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
-                                goto out_badnvs;
-
-                        val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
-                               | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
-
-                        wl1271_debug(DEBUG_BOOT,
-                                     "nvs burst write 0x%x: 0x%x",
-                                     dest_addr, val);
-                        wl1271_write32(wl, dest_addr, val);
-
-                        nvs_ptr += 4;
-                        dest_addr += 4;
-                }
-
-                if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
-                        goto out_badnvs;
-        }
-
-        /*
-         * We've reached the first zero length, the first NVS table
-         * is located at an aligned offset which is at least 7 bytes further.
-         * NOTE: The wl->nvs->nvs element must be first, in order to
-         * simplify the casting, we assume it is at the beginning of
-         * the wl->nvs structure.
-         */
-        nvs_ptr = (u8 *)wl->nvs +
-                        ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
-
-        if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
-                goto out_badnvs;
-
-        nvs_len -= nvs_ptr - (u8 *)wl->nvs;
-
-        /* Now we must set the partition correctly */
-        wl1271_set_partition(wl, &wl12xx_part_table[PART_WORK]);
-
-        /* Copy the NVS tables to a new block to ensure alignment */
-        nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL);
-        if (!nvs_aligned)
-                return -ENOMEM;
-
-        /* And finally we upload the NVS tables */
-        wl1271_write(wl, CMD_MBOX_ADDRESS, nvs_aligned, nvs_len, false);
-
-        kfree(nvs_aligned);
-        return 0;
-
-out_badnvs:
-        wl1271_error("nvs data is malformed");
-        return -EILSEQ;
-}
-
-static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
-{
-        wl1271_enable_interrupts(wl);
-        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
-                       WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
-        wl1271_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
-}
-
-static int wl1271_boot_soft_reset(struct wl1271 *wl)
-{
-        unsigned long timeout;
-        u32 boot_data;
-
-        /* perform soft reset */
-        wl1271_write32(wl, ACX_REG_SLV_SOFT_RESET, ACX_SLV_SOFT_RESET_BIT);
-
-        /* SOFT_RESET is self clearing */
-        timeout = jiffies + usecs_to_jiffies(SOFT_RESET_MAX_TIME);
-        while (1) {
-                boot_data = wl1271_read32(wl, ACX_REG_SLV_SOFT_RESET);
-                wl1271_debug(DEBUG_BOOT, "soft reset bootdata 0x%x", boot_data);
-                if ((boot_data & ACX_SLV_SOFT_RESET_BIT) == 0)
-                        break;
-
-                if (time_after(jiffies, timeout)) {
-                        /* 1.2 check pWhalBus->uSelfClearTime if the
-                         * timeout was reached */
-                        wl1271_error("soft reset timeout");
-                        return -1;
-                }
-
-                udelay(SOFT_RESET_STALL_TIME);
-        }
-
-        /* disable Rx/Tx */
-        wl1271_write32(wl, ENABLE, 0x0);
-
-        /* disable auto calibration on start*/
-        wl1271_write32(wl, SPARE_A2, 0xffff);
-
-        return 0;
-}
-
-static int wl1271_boot_run_firmware(struct wl1271 *wl)
-{
-        int loop, ret;
-        u32 chip_id, intr;
-
-        wl1271_boot_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
-
-        chip_id = wl1271_read32(wl, CHIP_ID_B);
-
-        wl1271_debug(DEBUG_BOOT, "chip id after firmware boot: 0x%x", chip_id);
-
-        if (chip_id != wl->chip.id) {
-                wl1271_error("chip id doesn't match after firmware boot");
-                return -EIO;
-        }
-
-        /* wait for init to complete */
-        loop = 0;
-        while (loop++ < INIT_LOOP) {
-                udelay(INIT_LOOP_DELAY);
-                intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
-
-                if (intr == 0xffffffff) {
-                        wl1271_error("error reading hardware complete "
-                                     "init indication");
-                        return -EIO;
-                }
-                /* check that ACX_INTR_INIT_COMPLETE is enabled */
-                else if (intr & WL1271_ACX_INTR_INIT_COMPLETE) {
-                        wl1271_write32(wl, ACX_REG_INTERRUPT_ACK,
-                                       WL1271_ACX_INTR_INIT_COMPLETE);
-                        break;
-                }
-        }
-
-        if (loop > INIT_LOOP) {
-                wl1271_error("timeout waiting for the hardware to "
-                             "complete initialization");
-                return -EIO;
-        }
-
-        /* get hardware config command mail box */
-        wl->cmd_box_addr = wl1271_read32(wl, REG_COMMAND_MAILBOX_PTR);
-
-        /* get hardware config event mail box */
-        wl->event_box_addr = wl1271_read32(wl, REG_EVENT_MAILBOX_PTR);
-
-        /* set the working partition to its "running" mode offset */
-        wl1271_set_partition(wl, &wl12xx_part_table[PART_WORK]);
-
-        wl1271_debug(DEBUG_MAILBOX, "cmd_box_addr 0x%x event_box_addr 0x%x",
-                     wl->cmd_box_addr, wl->event_box_addr);
-
-        wl1271_boot_fw_version(wl);
-
-        /*
-         * in case of full asynchronous mode the firmware event must be
-         * ready to receive event from the command mailbox
-         */
-
-        /* unmask required mbox events  */
-        wl->event_mask = BSS_LOSE_EVENT_ID |
-                SCAN_COMPLETE_EVENT_ID |
-                ROLE_STOP_COMPLETE_EVENT_ID |
-                RSSI_SNR_TRIGGER_0_EVENT_ID |
-                PSPOLL_DELIVERY_FAILURE_EVENT_ID |
-                SOFT_GEMINI_SENSE_EVENT_ID |
-                PERIODIC_SCAN_REPORT_EVENT_ID |
-                PERIODIC_SCAN_COMPLETE_EVENT_ID |
-                DUMMY_PACKET_EVENT_ID |
-                PEER_REMOVE_COMPLETE_EVENT_ID |
-                BA_SESSION_RX_CONSTRAINT_EVENT_ID |
-                REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID |
-                INACTIVE_STA_EVENT_ID |
-                MAX_TX_RETRY_EVENT_ID |
-                CHANNEL_SWITCH_COMPLETE_EVENT_ID;
-
-        ret = wl1271_event_unmask(wl);
-        if (ret < 0) {
-                wl1271_error("EVENT mask setting failed");
-                return ret;
-        }
-
-        wl1271_event_mbox_config(wl);
-
-        /* firmware startup completed */
-        return 0;
-}
-
-static int wl1271_boot_write_irq_polarity(struct wl1271 *wl)
-{
-        u32 polarity;
-
-        polarity = wl1271_top_reg_read(wl, OCP_REG_POLARITY);
-
-        /* We use HIGH polarity, so unset the LOW bit */
-        polarity &= ~POLARITY_LOW;
-        wl1271_top_reg_write(wl, OCP_REG_POLARITY, polarity);
-
-        return 0;
-}
-
-static int wl128x_switch_tcxo_to_fref(struct wl1271 *wl)
-{
-        u16 spare_reg;
-
-        /* Mask bits [2] & [8:4] in the sys_clk_cfg register */
-        spare_reg = wl1271_top_reg_read(wl, WL_SPARE_REG);
-        if (spare_reg == 0xFFFF)
-                return -EFAULT;
-        spare_reg |= (BIT(3) | BIT(5) | BIT(6));
-        wl1271_top_reg_write(wl, WL_SPARE_REG, spare_reg);
-
-        /* Enable FREF_CLK_REQ & mux MCS and coex PLLs to FREF */
-        wl1271_top_reg_write(wl, SYS_CLK_CFG_REG,
-                             WL_CLK_REQ_TYPE_PG2 | MCS_PLL_CLK_SEL_FREF);
-
-        /* Delay execution for 15msec, to let the HW settle */
-        mdelay(15);
-
-        return 0;
-}
-
-static bool wl128x_is_tcxo_valid(struct wl1271 *wl)
-{
-        u16 tcxo_detection;
-
-        tcxo_detection = wl1271_top_reg_read(wl, TCXO_CLK_DETECT_REG);
-        if (tcxo_detection & TCXO_DET_FAILED)
-                return false;
-
-        return true;
-}
-
-static bool wl128x_is_fref_valid(struct wl1271 *wl)
-{
-        u16 fref_detection;
-
-        fref_detection = wl1271_top_reg_read(wl, FREF_CLK_DETECT_REG);
-        if (fref_detection & FREF_CLK_DETECT_FAIL)
-                return false;
-
-        return true;
-}
-
-static int wl128x_manually_configure_mcs_pll(struct wl1271 *wl)
-{
-        wl1271_top_reg_write(wl, MCS_PLL_M_REG, MCS_PLL_M_REG_VAL);
-        wl1271_top_reg_write(wl, MCS_PLL_N_REG, MCS_PLL_N_REG_VAL);
-        wl1271_top_reg_write(wl, MCS_PLL_CONFIG_REG, MCS_PLL_CONFIG_REG_VAL);
-
-        return 0;
-}
-
-static int wl128x_configure_mcs_pll(struct wl1271 *wl, int clk)
-{
-        u16 spare_reg;
-        u16 pll_config;
-        u8 input_freq;
-
-        /* Mask bits [3:1] in the sys_clk_cfg register */
-        spare_reg = wl1271_top_reg_read(wl, WL_SPARE_REG);
-        if (spare_reg == 0xFFFF)
-                return -EFAULT;
-        spare_reg |= BIT(2);
-        wl1271_top_reg_write(wl, WL_SPARE_REG, spare_reg);
-
-        /* Handle special cases of the TCXO clock */
-        if (wl->tcxo_clock == WL12XX_TCXOCLOCK_16_8 ||
-            wl->tcxo_clock == WL12XX_TCXOCLOCK_33_6)
-                return wl128x_manually_configure_mcs_pll(wl);
-
-        /* Set the input frequency according to the selected clock source */
-        input_freq = (clk & 1) + 1;
-
-        pll_config = wl1271_top_reg_read(wl, MCS_PLL_CONFIG_REG);
-        if (pll_config == 0xFFFF)
-                return -EFAULT;
-        pll_config |= (input_freq << MCS_SEL_IN_FREQ_SHIFT);
-        pll_config |= MCS_PLL_ENABLE_HP;
-        wl1271_top_reg_write(wl, MCS_PLL_CONFIG_REG, pll_config);
-
-        return 0;
-}
-
-/*
- * WL128x has two clocks input - TCXO and FREF.
- * TCXO is the main clock of the device, while FREF is used to sync
- * between the GPS and the cellular modem.
- * In cases where TCXO is 32.736MHz or 16.368MHz, the FREF will be used
- * as the WLAN/BT main clock.
- */
-static int wl128x_boot_clk(struct wl1271 *wl, int *selected_clock)
-{
-        u16 sys_clk_cfg;
-
-        /* For XTAL-only modes, FREF will be used after switching from TCXO */
-        if (wl->ref_clock == WL12XX_REFCLOCK_26_XTAL ||
-            wl->ref_clock == WL12XX_REFCLOCK_38_XTAL) {
-                if (!wl128x_switch_tcxo_to_fref(wl))
-                        return -EINVAL;
-                goto fref_clk;
-        }
-
-        /* Query the HW, to determine which clock source we should use */
-        sys_clk_cfg = wl1271_top_reg_read(wl, SYS_CLK_CFG_REG);
-        if (sys_clk_cfg == 0xFFFF)
-                return -EINVAL;
-        if (sys_clk_cfg & PRCM_CM_EN_MUX_WLAN_FREF)
-                goto fref_clk;
-
-        /* If TCXO is either 32.736MHz or 16.368MHz, switch to FREF */
-        if (wl->tcxo_clock == WL12XX_TCXOCLOCK_16_368 ||
-            wl->tcxo_clock == WL12XX_TCXOCLOCK_32_736) {
-                if (!wl128x_switch_tcxo_to_fref(wl))
-                        return -EINVAL;
-                goto fref_clk;
-        }
-
-        /* TCXO clock is selected */
-        if (!wl128x_is_tcxo_valid(wl))
-                return -EINVAL;
-        *selected_clock = wl->tcxo_clock;
-        goto config_mcs_pll;
-
-fref_clk:
-        /* FREF clock is selected */
-        if (!wl128x_is_fref_valid(wl))
-                return -EINVAL;
-        *selected_clock = wl->ref_clock;
-
-config_mcs_pll:
-        return wl128x_configure_mcs_pll(wl, *selected_clock);
-}
-
-static int wl127x_boot_clk(struct wl1271 *wl)
-{
-        u32 pause;
-        u32 clk;
-
-        if (WL127X_PG_GET_MAJOR(wl->hw_pg_ver) < 3)
-                wl->quirks |= WL12XX_QUIRK_END_OF_TRANSACTION;
-
-        if (wl->ref_clock == CONF_REF_CLK_19_2_E ||
-            wl->ref_clock == CONF_REF_CLK_38_4_E ||
-            wl->ref_clock == CONF_REF_CLK_38_4_M_XTAL)
-                /* ref clk: 19.2/38.4/38.4-XTAL */
-                clk = 0x3;
-        else if (wl->ref_clock == CONF_REF_CLK_26_E ||
-                 wl->ref_clock == CONF_REF_CLK_52_E)
-                /* ref clk: 26/52 */
-                clk = 0x5;
-        else
-                return -EINVAL;
-
-        if (wl->ref_clock != CONF_REF_CLK_19_2_E) {
-                u16 val;
-                /* Set clock type (open drain) */
-                val = wl1271_top_reg_read(wl, OCP_REG_CLK_TYPE);
-                val &= FREF_CLK_TYPE_BITS;
-                wl1271_top_reg_write(wl, OCP_REG_CLK_TYPE, val);
-
-                /* Set clock pull mode (no pull) */
-                val = wl1271_top_reg_read(wl, OCP_REG_CLK_PULL);
-                val |= NO_PULL;
-                wl1271_top_reg_write(wl, OCP_REG_CLK_PULL, val);
-        } else {
-                u16 val;
-                /* Set clock polarity */
-                val = wl1271_top_reg_read(wl, OCP_REG_CLK_POLARITY);
-                val &= FREF_CLK_POLARITY_BITS;
-                val |= CLK_REQ_OUTN_SEL;
-                wl1271_top_reg_write(wl, OCP_REG_CLK_POLARITY, val);
-        }
-
-        wl1271_write32(wl, PLL_PARAMETERS, clk);
-
-        pause = wl1271_read32(wl, PLL_PARAMETERS);
-
-        wl1271_debug(DEBUG_BOOT, "pause1 0x%x", pause);
-
-        pause &= ~(WU_COUNTER_PAUSE_VAL);
-        pause |= WU_COUNTER_PAUSE_VAL;
-        wl1271_write32(wl, WU_COUNTER_PAUSE, pause);
-
-        return 0;
-}
-
-/* uploads NVS and firmware */
-int wl1271_load_firmware(struct wl1271 *wl)
-{
-        int ret = 0;
-        u32 tmp, clk;
-        int selected_clock = -1;
-
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
-                ret = wl128x_boot_clk(wl, &selected_clock);
-                if (ret < 0)
-                        goto out;
-        } else {
-                ret = wl127x_boot_clk(wl);
-                if (ret < 0)
-                        goto out;
-        }
-
-        /* Continue the ELP wake up sequence */
-        wl1271_write32(wl, WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
-        udelay(500);
-
-        wl1271_set_partition(wl, &wl12xx_part_table[PART_DRPW]);
-
-        /* Read-modify-write DRPW_SCRATCH_START register (see next state)
-           to be used by DRPw FW. The RTRIM value will be added by the FW
-           before taking DRPw out of reset */
-
-        wl1271_debug(DEBUG_BOOT, "DRPW_SCRATCH_START %08x", DRPW_SCRATCH_START);
-        clk = wl1271_read32(wl, DRPW_SCRATCH_START);
-
-        wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
-
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
-                clk |= ((selected_clock & 0x3) << 1) << 4;
-        } else {
-                clk |= (wl->ref_clock << 1) << 4;
-        }
-
-        wl1271_write32(wl, DRPW_SCRATCH_START, clk);
-
-        wl1271_set_partition(wl, &wl12xx_part_table[PART_WORK]);
-
-        /* Disable interrupts */
-        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
-
-        ret = wl1271_boot_soft_reset(wl);
-        if (ret < 0)
-                goto out;
-
-        /* 2. start processing NVS file */
-        ret = wl1271_boot_upload_nvs(wl);
-        if (ret < 0)
-                goto out;
-
-        /* write firmware's last address (ie. it's length) to
-         * ACX_EEPROMLESS_IND_REG */
-        wl1271_debug(DEBUG_BOOT, "ACX_EEPROMLESS_IND_REG");
-
-        wl1271_write32(wl, ACX_EEPROMLESS_IND_REG, ACX_EEPROMLESS_IND_REG);
-
-        tmp = wl1271_read32(wl, CHIP_ID_B);
-
-        wl1271_debug(DEBUG_BOOT, "chip id 0x%x", tmp);
-
-        /* 6. read the EEPROM parameters */
-        tmp = wl1271_read32(wl, SCR_PAD2);
-
-        /* WL1271: The reference driver skips steps 7 to 10 (jumps directly
-         * to upload_fw) */
-
-        if (wl->chip.id == CHIP_ID_1283_PG20)
-                wl1271_top_reg_write(wl, SDIO_IO_DS, wl->conf.hci_io_ds);
-
-        ret = wl1271_boot_upload_firmware(wl);
-        if (ret < 0)
-                goto out;
-
-out:
-        return ret;
-}
-EXPORT_SYMBOL_GPL(wl1271_load_firmware);
-
-int wl1271_boot(struct wl1271 *wl)
-{
-        int ret;
-
-        /* upload NVS and firmware */
-        ret = wl1271_load_firmware(wl);
-        if (ret)
-                return ret;
-
-        /* 10.5 start firmware */
-        ret = wl1271_boot_run_firmware(wl);
-        if (ret < 0)
-                goto out;
-
-        ret = wl1271_boot_write_irq_polarity(wl);
-        if (ret < 0)
-                goto out;
-
-        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
-                       WL1271_ACX_ALL_EVENTS_VECTOR);
-
-        /* Enable firmware interrupts now */
-        wl1271_boot_enable_interrupts(wl);
-
-        wl1271_event_mbox_config(wl);
-
-out:
-        return ret;
-}
diff --git a/drivers/net/wireless/wl12xx/boot.h b/drivers/net/wireless/wl12xx/boot.h
deleted file mode 100644
index c3adc09f403d..000000000000
--- a/drivers/net/wireless/wl12xx/boot.h
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * This file is part of wl1271
- *
- * Copyright (C) 2008-2009 Nokia Corporation
- *
- * Contact: Luciano Coelho <luciano.coelho@nokia.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
- * 02110-1301 USA
- *
- */
-
-#ifndef __BOOT_H__
-#define __BOOT_H__
-
-#include "wl12xx.h"
-
-int wl1271_boot(struct wl1271 *wl);
-int wl1271_load_firmware(struct wl1271 *wl);
-
-#define WL1271_NO_SUBBANDS 8
-#define WL1271_NO_POWER_LEVELS 4
-#define WL1271_FW_VERSION_MAX_LEN 20
-
-struct wl1271_static_data {
-        u8 mac_address[ETH_ALEN];
-        u8 padding[2];
-        u8 fw_version[WL1271_FW_VERSION_MAX_LEN];
-        u32 hw_version;
-        u8 tx_power_table[WL1271_NO_SUBBANDS][WL1271_NO_POWER_LEVELS];
-};
-
-/* number of times we try to read the INIT interrupt */
-#define INIT_LOOP 20000
-
-/* delay between retries */
-#define INIT_LOOP_DELAY 50
-
-#define WU_COUNTER_PAUSE_VAL 0x3FF
-#define WELP_ARM_COMMAND_VAL 0x4
-
-#define OCP_REG_POLARITY     0x0064
-#define OCP_REG_CLK_TYPE     0x0448
-#define OCP_REG_CLK_POLARITY 0x0cb2
-#define OCP_REG_CLK_PULL     0x0cb4
-
-#define CMD_MBOX_ADDRESS     0x407B4
-
-#define POLARITY_LOW         BIT(1)
-#define NO_PULL              (BIT(14) | BIT(15))
-
-#define FREF_CLK_TYPE_BITS     0xfffffe7f
-#define CLK_REQ_PRCM           0x100
-#define FREF_CLK_POLARITY_BITS 0xfffff8ff
-#define CLK_REQ_OUTN_SEL       0x700
-
-/* PLL configuration algorithm for wl128x */
-#define SYS_CLK_CFG_REG              0x2200
-/* Bit[0]   -  0-TCXO,  1-FREF */
-#define MCS_PLL_CLK_SEL_FREF         BIT(0)
-/* Bit[3:2] - 01-TCXO, 10-FREF */
-#define WL_CLK_REQ_TYPE_FREF         BIT(3)
-#define WL_CLK_REQ_TYPE_PG2          (BIT(3) | BIT(2))
-/* Bit[4]   -  0-TCXO,  1-FREF */
-#define PRCM_CM_EN_MUX_WLAN_FREF     BIT(4)
-
-#define TCXO_ILOAD_INT_REG           0x2264
-#define TCXO_CLK_DETECT_REG          0x2266
-
-#define TCXO_DET_FAILED              BIT(4)
-
-#define FREF_ILOAD_INT_REG           0x2084
-#define FREF_CLK_DETECT_REG          0x2086
-#define FREF_CLK_DETECT_FAIL         BIT(4)
-
-/* Use this reg for masking during driver access */
-#define WL_SPARE_REG                 0x2320
-#define WL_SPARE_VAL                 BIT(2)
-/* Bit[6:5:3] -  mask wl write SYS_CLK_CFG[8:5:2:4] */
-#define WL_SPARE_MASK_8526           (BIT(6) | BIT(5) | BIT(3))
-
-#define PLL_LOCK_COUNTERS_REG        0xD8C
-#define PLL_LOCK_COUNTERS_COEX       0x0F
-#define PLL_LOCK_COUNTERS_MCS        0xF0
-#define MCS_PLL_OVERRIDE_REG         0xD90
-#define MCS_PLL_CONFIG_REG           0xD92
-#define MCS_SEL_IN_FREQ_MASK         0x0070
-#define MCS_SEL_IN_FREQ_SHIFT        4
-#define MCS_PLL_CONFIG_REG_VAL       0x73
-#define MCS_PLL_ENABLE_HP            (BIT(0) | BIT(1))
-
-#define MCS_PLL_M_REG                0xD94
-#define MCS_PLL_N_REG                0xD96
-#define MCS_PLL_M_REG_VAL            0xC8
-#define MCS_PLL_N_REG_VAL            0x07
-
-#define SDIO_IO_DS                   0xd14
-
-/* SDIO/wSPI DS configuration values */
-enum {
-        HCI_IO_DS_8MA = 0,
-        HCI_IO_DS_4MA = 1, /* default */
-        HCI_IO_DS_6MA = 2,
-        HCI_IO_DS_2MA = 3,
-};
-
-/* end PLL configuration algorithm for wl128x */
-
-#endif