519 files changed, 36452 insertions, 8266 deletions

diff --git a/Documentation/device-mapper/dm-raid.txt b/Documentation/device-mapper/dm-raid.txt
index 56fb62b09fc5..b428556197c9 100644
--- a/Documentation/device-mapper/dm-raid.txt
+++ b/Documentation/device-mapper/dm-raid.txt
@@ -30,6 +30,7 @@ The target is named "raid" and it accepts the following parameters:
   raid10        Various RAID10 inspired algorithms chosen by additional params
                 - RAID10: Striped Mirrors (aka 'Striping on top of mirrors')
                 - RAID1E: Integrated Adjacent Stripe Mirroring
+                - RAID1E: Integrated Offset Stripe Mirroring
                 -  and other similar RAID10 variants
 
   Reference: Chapter 4 of
@@ -64,15 +65,15 @@ The target is named "raid" and it accepts the following parameters:
                 synchronisation state for each region.
 
         [raid10_copies   <# copies>]
-        [raid10_format   near]
+        [raid10_format   <near|far|offset>]
                 These two options are used to alter the default layout of
                 a RAID10 configuration.  The number of copies is can be
-                specified, but the default is 2.  There are other variations
-                to how the copies are laid down - the default and only current
-                option is "near".  Near copies are what most people think of
-                with respect to mirroring.  If these options are left
-                unspecified, or 'raid10_copies 2' and/or 'raid10_format near'
-                are given, then the layouts for 2, 3 and 4 devices are:
+                specified, but the default is 2.  There are also three
+                variations to how the copies are laid down - the default
+                is "near".  Near copies are what most people think of with
+                respect to mirroring.  If these options are left unspecified,
+                or 'raid10_copies 2' and/or 'raid10_format near' are given,
+                then the layouts for 2, 3 and 4 devices are:
                 2 drives         3 drives          4 drives
                 --------         ----------        --------------
                 A1  A1           A1  A1  A2        A1  A1  A2  A2
@@ -85,6 +86,33 @@ The target is named "raid" and it accepts the following parameters:
                 3-device layout is what might be called a 'RAID1E - Integrated
                 Adjacent Stripe Mirroring'.
 
+                If 'raid10_copies 2' and 'raid10_format far', then the layouts
+                for 2, 3 and 4 devices are:
+                2 drives             3 drives             4 drives
+                --------             --------------       --------------------
+                A1  A2               A1   A2   A3         A1   A2   A3   A4
+                A3  A4               A4   A5   A6         A5   A6   A7   A8
+                A5  A6               A7   A8   A9         A9   A10  A11  A12
+                ..  ..               ..   ..   ..         ..   ..   ..   ..
+                A2  A1               A3   A1   A2         A2   A1   A4   A3
+                A4  A3               A6   A4   A5         A6   A5   A8   A7
+                A6  A5               A9   A7   A8         A10  A9   A12  A11
+                ..  ..               ..   ..   ..         ..   ..   ..   ..
+
+                If 'raid10_copies 2' and 'raid10_format offset', then the
+                layouts for 2, 3 and 4 devices are:
+                2 drives       3 drives           4 drives
+                --------       ------------       -----------------
+                A1  A2         A1  A2  A3         A1  A2  A3  A4
+                A2  A1         A3  A1  A2         A2  A1  A4  A3
+                A3  A4         A4  A5  A6         A5  A6  A7  A8
+                A4  A3         A6  A4  A5         A6  A5  A8  A7
+                A5  A6         A7  A8  A9         A9  A10 A11 A12
+                A6  A5         A9  A7  A8         A10 A9  A12 A11
+                ..  ..         ..  ..  ..         ..  ..  ..  ..
+                Here we see layouts closely akin to 'RAID1E - Integrated
+                Offset Stripe Mirroring'.
+
 <#raid_devs>: The number of devices composing the array.
         Each device consists of two entries.  The first is the device
         containing the metadata (if any); the second is the one containing the
@@ -142,3 +170,5 @@ Version History
 1.3.0   Added support for RAID 10
 1.3.1   Allow device replacement/rebuild for RAID 10
 1.3.2   Fix/improve redundancy checking for RAID10
+1.4.0   Non-functional change.  Removes arg from mapping function.
+1.4.1   Add RAID10 "far" and "offset" algorithm support.
diff --git a/Documentation/networking/tuntap.txt b/Documentation/networking/tuntap.txt
index c0aab985bad9..949d5dcdd9a3 100644
--- a/Documentation/networking/tuntap.txt
+++ b/Documentation/networking/tuntap.txt
@@ -105,6 +105,83 @@ Copyright (C) 1999-2000 Maxim Krasnyansky <max_mk@yahoo.com>
      Proto [2 bytes]
      Raw protocol(IP, IPv6, etc) frame.
 
+  3.3 Multiqueue tuntap interface:
+
+  From version 3.8, Linux supports multiqueue tuntap which can uses multiple
+  file descriptors (queues) to parallelize packets sending or receiving. The
+  device allocation is the same as before, and if user wants to create multiple
+  queues, TUNSETIFF with the same device name must be called many times with
+  IFF_MULTI_QUEUE flag.
+
+  char *dev should be the name of the device, queues is the number of queues to
+  be created, fds is used to store and return the file descriptors (queues)
+  created to the caller. Each file descriptor were served as the interface of a
+  queue which could be accessed by userspace.
+
+  #include <linux/if.h>
+  #include <linux/if_tun.h>
+
+  int tun_alloc_mq(char *dev, int queues, int *fds)
+  {
+      struct ifreq ifr;
+      int fd, err, i;
+
+      if (!dev)
+          return -1;
+
+      memset(&ifr, 0, sizeof(ifr));
+      /* Flags: IFF_TUN   - TUN device (no Ethernet headers)
+       *        IFF_TAP   - TAP device
+       *
+       *        IFF_NO_PI - Do not provide packet information
+       *        IFF_MULTI_QUEUE - Create a queue of multiqueue device
+       */
+      ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_MULTI_QUEUE;
+      strcpy(ifr.ifr_name, dev);
+
+      for (i = 0; i < queues; i++) {
+          if ((fd = open("/dev/net/tun", O_RDWR)) < 0)
+             goto err;
+          err = ioctl(fd, TUNSETIFF, (void *)&ifr);
+          if (err) {
+             close(fd);
+             goto err;
+          }
+          fds[i] = fd;
+      }
+
+      return 0;
+  err:
+      for (--i; i >= 0; i--)
+          close(fds[i]);
+      return err;
+  }
+
+  A new ioctl(TUNSETQUEUE) were introduced to enable or disable a queue. When
+  calling it with IFF_DETACH_QUEUE flag, the queue were disabled. And when
+  calling it with IFF_ATTACH_QUEUE flag, the queue were enabled. The queue were
+  enabled by default after it was created through TUNSETIFF.
+
+  fd is the file descriptor (queue) that we want to enable or disable, when
+  enable is true we enable it, otherwise we disable it
+
+  #include <linux/if.h>
+  #include <linux/if_tun.h>
+
+  int tun_set_queue(int fd, int enable)
+  {
+      struct ifreq ifr;
+
+      memset(&ifr, 0, sizeof(ifr));
+
+      if (enable)
+         ifr.ifr_flags = IFF_ATTACH_QUEUE;
+      else
+         ifr.ifr_flags = IFF_DETACH_QUEUE;
+
+      return ioctl(fd, TUNSETQUEUE, (void *)&ifr);
+  }
+
 Universal TUN/TAP device driver Frequently Asked Question.
    
 1. What platforms are supported by TUN/TAP driver ?
diff --git a/MAINTAINERS b/MAINTAINERS
index e95b1e944eb7..685949bb8838 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -114,12 +114,6 @@ Maintainers List (try to look for most precise areas first)
 
                 -----------------------------------
 
-3C505 NETWORK DRIVER
-M:      Philip Blundell <philb@gnu.org>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/i825xx/3c505*
-
 3C59X NETWORK DRIVER
 M:      Steffen Klassert <klassert@mathematik.tu-chemnitz.de>
 L:      netdev@vger.kernel.org
@@ -2361,12 +2355,6 @@ W:	http://www.arm.linux.org.uk/
 S:      Maintained
 F:      drivers/video/cyber2000fb.*
 
-CYCLADES 2X SYNC CARD DRIVER
-M:      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
-W:      http://oops.ghostprotocols.net:81/blog
-S:      Maintained
-F:      drivers/net/wan/cycx*
-
 CYCLADES ASYNC MUX DRIVER
 W:      http://www.cyclades.com/
 S:      Orphan
@@ -3067,12 +3055,6 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kristoffer/linux-hpc.git
 F:      drivers/video/s1d13xxxfb.c
 F:      include/video/s1d13xxxfb.h
 
-ETHEREXPRESS-16 NETWORK DRIVER
-M:      Philip Blundell <philb@gnu.org>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/i825xx/eexpress.*
-
 ETHERNET BRIDGE
 M:      Stephen Hemminger <stephen@networkplumber.org>
 L:      bridge@lists.linux-foundation.org
@@ -5061,9 +5043,8 @@ S:	Maintained
 F:      drivers/net/ethernet/marvell/sk*
 
 MARVELL LIBERTAS WIRELESS DRIVER
-M:      Dan Williams <dcbw@redhat.com>
 L:      libertas-dev@lists.infradead.org
-S:      Maintained
+S:      Orphan
 F:      drivers/net/wireless/libertas/
 
 MARVELL MV643XX ETHERNET DRIVER
@@ -8504,7 +8485,7 @@ F:	drivers/usb/gadget/*uvc*.c
 F:      drivers/usb/gadget/webcam.c
 
 USB WIRELESS RNDIS DRIVER (rndis_wlan)
-M:      Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+M:      Jussi Kivilinna <jussi.kivilinna@iki.fi>
 L:      linux-wireless@vger.kernel.org
 S:      Maintained
 F:      drivers/net/wireless/rndis_wlan.c
diff --git a/arch/powerpc/crypto/sha1-powerpc-asm.S b/arch/powerpc/crypto/sha1-powerpc-asm.S
index a5f8264d2d3c..125e16520061 100644
--- a/arch/powerpc/crypto/sha1-powerpc-asm.S
+++ b/arch/powerpc/crypto/sha1-powerpc-asm.S
@@ -113,7 +113,7 @@
         STEPUP4((t)+16, fn)
 
 _GLOBAL(powerpc_sha_transform)
-        PPC_STLU r1,-STACKFRAMESIZE(r1)
+        PPC_STLU r1,-INT_FRAME_SIZE(r1)
         SAVE_8GPRS(14, r1)
         SAVE_10GPRS(22, r1)
 
@@ -175,5 +175,5 @@ _GLOBAL(powerpc_sha_transform)
 
         REST_8GPRS(14, r1)
         REST_10GPRS(22, r1)
-        addi    r1,r1,STACKFRAMESIZE
+        addi    r1,r1,INT_FRAME_SIZE
         blr
diff --git a/arch/powerpc/include/asm/bitops.h b/arch/powerpc/include/asm/bitops.h
index ef918a2328bb..08bd299c75b1 100644
--- a/arch/powerpc/include/asm/bitops.h
+++ b/arch/powerpc/include/asm/bitops.h
@@ -52,8 +52,6 @@
 #define smp_mb__before_clear_bit()      smp_mb()
 #define smp_mb__after_clear_bit()       smp_mb()
 
-#define BITOP_LE_SWIZZLE        ((BITS_PER_LONG-1) & ~0x7)
-
 /* Macro for generating the ***_bits() functions */
 #define DEFINE_BITOP(fn, op, prefix, postfix)   \
 static __inline__ void fn(unsigned long mask,   \
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index e66586122030..c9c67fc888c9 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -266,7 +266,8 @@
 #define SPRN_HSRR0      0x13A   /* Hypervisor Save/Restore 0 */
 #define SPRN_HSRR1      0x13B   /* Hypervisor Save/Restore 1 */
 #define SPRN_FSCR       0x099   /* Facility Status & Control Register */
-#define FSCR_TAR        (1<<8)  /* Enable Target Adress Register */
+#define   FSCR_TAR      (1 << (63-55)) /* Enable Target Address Register */
+#define   FSCR_DSCR     (1 << (63-61)) /* Enable Data Stream Control Register */
 #define SPRN_TAR        0x32f   /* Target Address Register */
 #define SPRN_LPCR       0x13E   /* LPAR Control Register */
 #define   LPCR_VPM0     (1ul << (63-0))
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index 535b6d8a41cc..ebbec52d21bd 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -358,3 +358,4 @@ SYSCALL_SPU(setns)
 COMPAT_SYS(process_vm_readv)
 COMPAT_SYS(process_vm_writev)
 SYSCALL(finit_module)
+SYSCALL(ni_syscall) /* sys_kcmp */
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index f25b5c45c435..1487f0f12293 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define __NR_syscalls           354
+#define __NR_syscalls           355
 
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 8c478c6c6b1e..74cb4d72d673 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -376,6 +376,7 @@
 #define __NR_process_vm_readv   351
 #define __NR_process_vm_writev  352
 #define __NR_finit_module       353
+#define __NR_kcmp               354
 
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
index d29facbf9a28..ea847abb0d0a 100644
--- a/arch/powerpc/kernel/cpu_setup_power.S
+++ b/arch/powerpc/kernel/cpu_setup_power.S
@@ -48,6 +48,7 @@ _GLOBAL(__restore_cpu_power7)
 
 _GLOBAL(__setup_cpu_power8)
         mflr    r11
+        bl      __init_FSCR
         bl      __init_hvmode_206
         mtlr    r11
         beqlr
@@ -56,13 +57,13 @@ _GLOBAL(__setup_cpu_power8)
         mfspr   r3,SPRN_LPCR
         oris    r3, r3, LPCR_AIL_3@h
         bl      __init_LPCR
-        bl      __init_FSCR
         bl      __init_TLB
         mtlr    r11
         blr
 
 _GLOBAL(__restore_cpu_power8)
         mflr    r11
+        bl      __init_FSCR
         mfmsr   r3
         rldicl. r0,r3,4,63
         beqlr
@@ -115,7 +116,7 @@ __init_LPCR:
 
 __init_FSCR:
         mfspr   r3,SPRN_FSCR
-        ori     r3,r3,FSCR_TAR
+        ori     r3,r3,FSCR_TAR|FSCR_DSCR
         mtspr   SPRN_FSCR,r3
         blr
 
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index a8a5361fb70c..87ef8f5ee5bc 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -74,13 +74,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_REAL_LE)				\
         mflr    r10 ;                                           \
         ld      r12,PACAKBASE(r13) ;                            \
         LOAD_HANDLER(r12, system_call_entry_direct) ;           \
-        mtlr    r12 ;                                           \
+        mtctr   r12 ;                                           \
         mfspr   r12,SPRN_SRR1 ;                                 \
         /* Re-use of r13... No spare regs to do this */ \
         li      r13,MSR_RI ;                                    \
         mtmsrd  r13,1 ;                                         \
         GET_PACA(r13) ; /* get r13 back */                      \
-        blr ;
+        bctr ;
 #else
         /* We can branch directly */
 #define SYSCALL_PSERIES_2_DIRECT                                \
diff --git a/arch/powerpc/platforms/pseries/hvcserver.c b/arch/powerpc/platforms/pseries/hvcserver.c
index fcf4b4cbeaf3..4557e91626c4 100644
--- a/arch/powerpc/platforms/pseries/hvcserver.c
+++ b/arch/powerpc/platforms/pseries/hvcserver.c
@@ -23,6 +23,7 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/string.h>
 
 #include <asm/hvcall.h>
 #include <asm/hvcserver.h>
@@ -188,9 +189,9 @@ int hvcs_get_partner_info(uint32_t unit_address, struct list_head *head,
                         = (unsigned int)last_p_partition_ID;
 
                 /* copy the Null-term char too */
-                strncpy(&next_partner_info->location_code[0],
+                strlcpy(&next_partner_info->location_code[0],
                         (char *)&pi_buff[2],
-                        strlen((char *)&pi_buff[2]) + 1);
+                        sizeof(next_partner_info->location_code));
 
                 list_add_tail(&(next_partner_info->node), head);
                 next_partner_info = NULL;
diff --git a/drivers/bcma/core.c b/drivers/bcma/core.c
index 03bbe104338f..17b26ce7e051 100644
--- a/drivers/bcma/core.c
+++ b/drivers/bcma/core.c
@@ -104,7 +104,13 @@ void bcma_core_pll_ctl(struct bcma_device *core, u32 req, u32 status, bool on)
                 if (i)
                         bcma_err(core->bus, "PLL enable timeout\n");
         } else {
-                bcma_warn(core->bus, "Disabling PLL not supported yet!\n");
+                /*
+                 * Mask the PLL but don't wait for it to be disabled. PLL may be
+                 * shared between cores and will be still up if there is another
+                 * core using it.
+                 */
+                bcma_mask32(core, BCMA_CLKCTLST, ~req);
+                bcma_read32(core, BCMA_CLKCTLST);
         }
 }
 EXPORT_SYMBOL_GPL(bcma_core_pll_ctl);
diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
index 28fa50ad87be..036c6744b39b 100644
--- a/drivers/bcma/driver_chipcommon.c
+++ b/drivers/bcma/driver_chipcommon.c
@@ -25,13 +25,14 @@ static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
         return value;
 }
 
-static u32 bcma_chipco_get_alp_clock(struct bcma_drv_cc *cc)
+u32 bcma_chipco_get_alp_clock(struct bcma_drv_cc *cc)
 {
         if (cc->capabilities & BCMA_CC_CAP_PMU)
                 return bcma_pmu_get_alp_clock(cc);
 
         return 20000000;
 }
+EXPORT_SYMBOL_GPL(bcma_chipco_get_alp_clock);
 
 static u32 bcma_chipco_watchdog_get_max_timer(struct bcma_drv_cc *cc)
 {
@@ -213,6 +214,7 @@ u32 bcma_chipco_gpio_out(struct bcma_drv_cc *cc, u32 mask, u32 value)
 
         return res;
 }
+EXPORT_SYMBOL_GPL(bcma_chipco_gpio_out);
 
 u32 bcma_chipco_gpio_outen(struct bcma_drv_cc *cc, u32 mask, u32 value)
 {
@@ -225,6 +227,7 @@ u32 bcma_chipco_gpio_outen(struct bcma_drv_cc *cc, u32 mask, u32 value)
 
         return res;
 }
+EXPORT_SYMBOL_GPL(bcma_chipco_gpio_outen);
 
 /*
  * If the bit is set to 0, chipcommon controlls this GPIO,
diff --git a/drivers/bcma/driver_chipcommon_pmu.c b/drivers/bcma/driver_chipcommon_pmu.c
index 932b101dee36..edca73af3cc0 100644
--- a/drivers/bcma/driver_chipcommon_pmu.c
+++ b/drivers/bcma/driver_chipcommon_pmu.c
@@ -174,19 +174,35 @@ u32 bcma_pmu_get_alp_clock(struct bcma_drv_cc *cc)
         struct bcma_bus *bus = cc->core->bus;
 
         switch (bus->chipinfo.id) {
+        case BCMA_CHIP_ID_BCM4313:
+        case BCMA_CHIP_ID_BCM43224:
+        case BCMA_CHIP_ID_BCM43225:
+        case BCMA_CHIP_ID_BCM43227:
+        case BCMA_CHIP_ID_BCM43228:
+        case BCMA_CHIP_ID_BCM4331:
+        case BCMA_CHIP_ID_BCM43421:
+        case BCMA_CHIP_ID_BCM43428:
+        case BCMA_CHIP_ID_BCM43431:
         case BCMA_CHIP_ID_BCM4716:
-        case BCMA_CHIP_ID_BCM4748:
         case BCMA_CHIP_ID_BCM47162:
-        case BCMA_CHIP_ID_BCM4313:
-        case BCMA_CHIP_ID_BCM5357:
+        case BCMA_CHIP_ID_BCM4748:
         case BCMA_CHIP_ID_BCM4749:
+        case BCMA_CHIP_ID_BCM5357:
         case BCMA_CHIP_ID_BCM53572:
+        case BCMA_CHIP_ID_BCM6362:
                 /* always 20Mhz */
                 return 20000 * 1000;
-        case BCMA_CHIP_ID_BCM5356:
         case BCMA_CHIP_ID_BCM4706:
+        case BCMA_CHIP_ID_BCM5356:
                 /* always 25Mhz */
                 return 25000 * 1000;
+        case BCMA_CHIP_ID_BCM43460:
+        case BCMA_CHIP_ID_BCM4352:
+        case BCMA_CHIP_ID_BCM4360:
+                if (cc->status & BCMA_CC_CHIPST_4360_XTAL_40MZ)
+                        return 40000 * 1000;
+                else
+                        return 20000 * 1000;
         default:
                 bcma_warn(bus, "No ALP clock specified for %04X device, pmu rev. %d, using default %d Hz\n",
                           bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_ALP_CLOCK);
@@ -373,7 +389,7 @@ void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
                 tmp |= (bcm5357_bcm43236_ndiv[spuravoid]) << BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT;
                 bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
 
-                tmp = 1 << 10;
+                tmp = BCMA_CC_PMU_CTL_PLL_UPD;
                 break;
 
         case BCMA_CHIP_ID_BCM4331:
@@ -394,7 +410,7 @@ void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
                         bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
                                                      0x03000a08);
                 }
-                tmp = 1 << 10;
+                tmp = BCMA_CC_PMU_CTL_PLL_UPD;
                 break;
 
         case BCMA_CHIP_ID_BCM43224:
@@ -427,7 +443,7 @@ void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
                         bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
                                                      0x88888815);
                 }
-                tmp = 1 << 10;
+                tmp = BCMA_CC_PMU_CTL_PLL_UPD;
                 break;
 
         case BCMA_CHIP_ID_BCM4716:
@@ -461,7 +477,7 @@ void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
                                                      0x88888815);
                 }
 
-                tmp = 3 << 9;
+                tmp = BCMA_CC_PMU_CTL_PLL_UPD | BCMA_CC_PMU_CTL_NOILPONW;
                 break;
 
         case BCMA_CHIP_ID_BCM43227:
@@ -497,7 +513,7 @@ void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
                         bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
                                                      0x88888815);
                 }
-                tmp = 1 << 10;
+                tmp = BCMA_CC_PMU_CTL_PLL_UPD;
                 break;
         default:
                 bcma_err(bus, "Unknown spuravoidance settings for chip 0x%04X, not changing PLL\n",
diff --git a/drivers/bcma/driver_pci_host.c b/drivers/bcma/driver_pci_host.c
index d3bde6cec927..30629a3d44cc 100644
--- a/drivers/bcma/driver_pci_host.c
+++ b/drivers/bcma/driver_pci_host.c
@@ -404,6 +404,8 @@ void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
                 return;
         }
 
+        spin_lock_init(&pc_host->cfgspace_lock);
+
         pc->host_controller = pc_host;
         pc_host->pci_controller.io_resource = &pc_host->io_resource;
         pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 9a6188add590..f72f52b4b1dd 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -120,6 +120,11 @@ static int bcma_register_cores(struct bcma_bus *bus)
                         continue;
                 }
 
+                /* Only first GMAC core on BCM4706 is connected and working */
+                if (core->id.id == BCMA_CORE_4706_MAC_GBIT &&
+                    core->core_unit > 0)
+                        continue;
+
                 core->dev.release = bcma_release_core_dev;
                 core->dev.bus = &bcma_bus_type;
                 dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index 8d0b57164018..bca9c80056fe 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -137,19 +137,19 @@ static void bcma_scan_switch_core(struct bcma_bus *bus, u32 addr)
                                        addr);
 }
 
-static u32 bcma_erom_get_ent(struct bcma_bus *bus, u32 **eromptr)
+static u32 bcma_erom_get_ent(struct bcma_bus *bus, u32 __iomem **eromptr)
 {
         u32 ent = readl(*eromptr);
         (*eromptr)++;
         return ent;
 }
 
-static void bcma_erom_push_ent(u32 **eromptr)
+static void bcma_erom_push_ent(u32 __iomem **eromptr)
 {
         (*eromptr)--;
 }
 
-static s32 bcma_erom_get_ci(struct bcma_bus *bus, u32 **eromptr)
+static s32 bcma_erom_get_ci(struct bcma_bus *bus, u32 __iomem **eromptr)
 {
         u32 ent = bcma_erom_get_ent(bus, eromptr);
         if (!(ent & SCAN_ER_VALID))
@@ -159,14 +159,14 @@ static s32 bcma_erom_get_ci(struct bcma_bus *bus, u32 **eromptr)
         return ent;
 }
 
-static bool bcma_erom_is_end(struct bcma_bus *bus, u32 **eromptr)
+static bool bcma_erom_is_end(struct bcma_bus *bus, u32 __iomem **eromptr)
 {
         u32 ent = bcma_erom_get_ent(bus, eromptr);
         bcma_erom_push_ent(eromptr);
         return (ent == (SCAN_ER_TAG_END | SCAN_ER_VALID));
 }
 
-static bool bcma_erom_is_bridge(struct bcma_bus *bus, u32 **eromptr)
+static bool bcma_erom_is_bridge(struct bcma_bus *bus, u32 __iomem **eromptr)
 {
         u32 ent = bcma_erom_get_ent(bus, eromptr);
         bcma_erom_push_ent(eromptr);
@@ -175,7 +175,7 @@ static bool bcma_erom_is_bridge(struct bcma_bus *bus, u32 **eromptr)
                 ((ent & SCAN_ADDR_TYPE) == SCAN_ADDR_TYPE_BRIDGE));
 }
 
-static void bcma_erom_skip_component(struct bcma_bus *bus, u32 **eromptr)
+static void bcma_erom_skip_component(struct bcma_bus *bus, u32 __iomem **eromptr)
 {
         u32 ent;
         while (1) {
@@ -189,7 +189,7 @@ static void bcma_erom_skip_component(struct bcma_bus *bus, u32 **eromptr)
         bcma_erom_push_ent(eromptr);
 }
 
-static s32 bcma_erom_get_mst_port(struct bcma_bus *bus, u32 **eromptr)
+static s32 bcma_erom_get_mst_port(struct bcma_bus *bus, u32 __iomem **eromptr)
 {
         u32 ent = bcma_erom_get_ent(bus, eromptr);
         if (!(ent & SCAN_ER_VALID))
@@ -199,7 +199,7 @@ static s32 bcma_erom_get_mst_port(struct bcma_bus *bus, u32 **eromptr)
         return ent;
 }
 
-static s32 bcma_erom_get_addr_desc(struct bcma_bus *bus, u32 **eromptr,
+static s32 bcma_erom_get_addr_desc(struct bcma_bus *bus, u32 __iomem **eromptr,
                                   u32 type, u8 port)
 {
         u32 addrl, addrh, sizel, sizeh = 0;
diff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c
index 4adf9ef9a113..8934298a638d 100644
--- a/drivers/bcma/sprom.c
+++ b/drivers/bcma/sprom.c
@@ -217,6 +217,7 @@ static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
         }
 
         SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
+        SPEX(board_type, SSB_SPROM1_SPID, ~0, 0);
 
         SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
              SSB_SPROM4_TXPID2G0_SHIFT);
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index a8a41e07a221..6aab00ef4379 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -73,9 +73,13 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x03F0, 0x311D) },
 
         /* Atheros AR3012 with sflash firmware*/
+        { USB_DEVICE(0x0CF3, 0x0036) },
         { USB_DEVICE(0x0CF3, 0x3004) },
+        { USB_DEVICE(0x0CF3, 0x3008) },
         { USB_DEVICE(0x0CF3, 0x311D) },
+        { USB_DEVICE(0x0CF3, 0x817a) },
         { USB_DEVICE(0x13d3, 0x3375) },
+        { USB_DEVICE(0x04CA, 0x3004) },
         { USB_DEVICE(0x04CA, 0x3005) },
         { USB_DEVICE(0x04CA, 0x3006) },
         { USB_DEVICE(0x04CA, 0x3008) },
@@ -105,9 +109,13 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
 static struct usb_device_id ath3k_blist_tbl[] = {
 
         /* Atheros AR3012 with sflash firmware*/
+        { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index 9959d4cb23dc..1cb51839912d 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -83,8 +83,8 @@ static const struct btmrvl_sdio_card_reg btmrvl_reg_87xx = {
 };
 
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
-        .helper         = "sd8688_helper.bin",
-        .firmware       = "sd8688.bin",
+        .helper         = "mrvl/sd8688_helper.bin",
+        .firmware       = "mrvl/sd8688.bin",
         .reg            = &btmrvl_reg_8688,
         .sd_blksz_fw_dl = 64,
 };
@@ -1185,7 +1185,7 @@ MODULE_AUTHOR("Marvell International Ltd.");
 MODULE_DESCRIPTION("Marvell BT-over-SDIO driver ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL v2");
-MODULE_FIRMWARE("sd8688_helper.bin");
-MODULE_FIRMWARE("sd8688.bin");
+MODULE_FIRMWARE("mrvl/sd8688_helper.bin");
+MODULE_FIRMWARE("mrvl/sd8688.bin");
 MODULE_FIRMWARE("mrvl/sd8787_uapsta.bin");
 MODULE_FIRMWARE("mrvl/sd8797_uapsta.bin");
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7e351e345476..2cc5f774a29c 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -131,9 +131,13 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 
         /* Atheros 3012 with sflash firmware */
+        { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 1bafb40ec8a2..69ae5972713c 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -40,6 +40,7 @@
 #include <linux/init.h>
 #include <linux/miscdevice.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 
 
@@ -52,8 +53,12 @@ static struct hwrng *current_rng;
 static LIST_HEAD(rng_list);
 static DEFINE_MUTEX(rng_mutex);
 static int data_avail;
-static u8 rng_buffer[SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES]
-        __cacheline_aligned;
+static u8 *rng_buffer;
+
+static size_t rng_buffer_size(void)
+{
+        return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
+}
 
 static inline int hwrng_init(struct hwrng *rng)
 {
@@ -116,7 +121,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
 
                 if (!data_avail) {
                         bytes_read = rng_get_data(current_rng, rng_buffer,
-                                sizeof(rng_buffer),
+                                rng_buffer_size(),
                                 !(filp->f_flags & O_NONBLOCK));
                         if (bytes_read < 0) {
                                 err = bytes_read;
@@ -307,6 +312,14 @@ int hwrng_register(struct hwrng *rng)
 
         mutex_lock(&rng_mutex);
 
+        /* kmalloc makes this safe for virt_to_page() in virtio_rng.c */
+        err = -ENOMEM;
+        if (!rng_buffer) {
+                rng_buffer = kmalloc(rng_buffer_size(), GFP_KERNEL);
+                if (!rng_buffer)
+                        goto out_unlock;
+        }
+
         /* Must not register two RNGs with the same name. */
         err = -EEXIST;
         list_for_each_entry(tmp, &rng_list, list) {
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index fce2000eec31..1110478dd0fd 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -313,6 +313,12 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
             (task_active_pid_ns(current) != &init_pid_ns))
                 return;
 
+        /* Can only change if privileged. */
+        if (!capable(CAP_NET_ADMIN)) {
+                err = EPERM;
+                goto out;
+        }
+
         mc_op = (enum proc_cn_mcast_op *)msg->data;
         switch (*mc_op) {
         case PROC_CN_MCAST_LISTEN:
@@ -325,6 +331,8 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
                 err = EINVAL;
                 break;
         }
+
+out:
         cn_proc_ack(err, msg->seq, msg->ack);
 }
 
diff --git a/drivers/gpio/gpio-ich.c b/drivers/gpio/gpio-ich.c
index 6f2306db8591..f9dbd503fc40 100644
--- a/drivers/gpio/gpio-ich.c
+++ b/drivers/gpio/gpio-ich.c
@@ -128,9 +128,9 @@ static int ichx_read_bit(int reg, unsigned nr)
         return data & (1 << bit) ? 1 : 0;
 }
 
-static int ichx_gpio_check_available(struct gpio_chip *gpio, unsigned nr)
+static bool ichx_gpio_check_available(struct gpio_chip *gpio, unsigned nr)
 {
-        return (ichx_priv.use_gpio & (1 << (nr / 32))) ? 0 : -ENXIO;
+        return ichx_priv.use_gpio & (1 << (nr / 32));
 }
 
 static int ichx_gpio_direction_input(struct gpio_chip *gpio, unsigned nr)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index fff9786cdc64..c2534d62911c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -88,13 +88,14 @@ static int gpiod_request(struct gpio_desc *desc, const char *label);
 static void gpiod_free(struct gpio_desc *desc);
 static int gpiod_direction_input(struct gpio_desc *desc);
 static int gpiod_direction_output(struct gpio_desc *desc, int value);
+static int gpiod_get_direction(const struct gpio_desc *desc);
 static int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce);
-static int gpiod_get_value_cansleep(struct gpio_desc *desc);
+static int gpiod_get_value_cansleep(const struct gpio_desc *desc);
 static void gpiod_set_value_cansleep(struct gpio_desc *desc, int value);
-static int gpiod_get_value(struct gpio_desc *desc);
+static int gpiod_get_value(const struct gpio_desc *desc);
 static void gpiod_set_value(struct gpio_desc *desc, int value);
-static int gpiod_cansleep(struct gpio_desc *desc);
-static int gpiod_to_irq(struct gpio_desc *desc);
+static int gpiod_cansleep(const struct gpio_desc *desc);
+static int gpiod_to_irq(const struct gpio_desc *desc);
 static int gpiod_export(struct gpio_desc *desc, bool direction_may_change);
 static int gpiod_export_link(struct device *dev, const char *name,
                              struct gpio_desc *desc);
@@ -171,12 +172,12 @@ static int gpio_ensure_requested(struct gpio_desc *desc)
         return 0;
 }
 
-/* caller holds gpio_lock *OR* gpio is marked as requested */
-static struct gpio_chip *gpiod_to_chip(struct gpio_desc *desc)
+static struct gpio_chip *gpiod_to_chip(const struct gpio_desc *desc)
 {
-        return desc->chip;
+        return desc ? desc->chip : NULL;
 }
 
+/* caller holds gpio_lock *OR* gpio is marked as requested */
 struct gpio_chip *gpio_to_chip(unsigned gpio)
 {
         return gpiod_to_chip(gpio_to_desc(gpio));
@@ -207,7 +208,7 @@ static int gpiochip_find_base(int ngpio)
 }
 
 /* caller ensures gpio is valid and requested, chip->get_direction may sleep  */
-static int gpiod_get_direction(struct gpio_desc *desc)
+static int gpiod_get_direction(const struct gpio_desc *desc)
 {
         struct gpio_chip        *chip;
         unsigned                offset;
@@ -223,11 +224,13 @@ static int gpiod_get_direction(struct gpio_desc *desc)
         if (status > 0) {
                 /* GPIOF_DIR_IN, or other positive */
                 status = 1;
-                clear_bit(FLAG_IS_OUT, &desc->flags);
+                /* FLAG_IS_OUT is just a cache of the result of get_direction(),
+                 * so it does not affect constness per se */
+                clear_bit(FLAG_IS_OUT, &((struct gpio_desc *)desc)->flags);
         }
         if (status == 0) {
                 /* GPIOF_DIR_OUT */
-                set_bit(FLAG_IS_OUT, &desc->flags);
+                set_bit(FLAG_IS_OUT, &((struct gpio_desc *)desc)->flags);
         }
         return status;
 }
@@ -263,7 +266,7 @@ static DEFINE_MUTEX(sysfs_lock);
 static ssize_t gpio_direction_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
-        struct gpio_desc        *desc = dev_get_drvdata(dev);
+        const struct gpio_desc  *desc = dev_get_drvdata(dev);
         ssize_t                 status;
 
         mutex_lock(&sysfs_lock);
@@ -654,6 +657,11 @@ static ssize_t export_store(struct class *class,
                 goto done;
 
         desc = gpio_to_desc(gpio);
+        /* reject invalid GPIOs */
+        if (!desc) {
+                pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
+                return -EINVAL;
+        }
 
         /* No extra locking here; FLAG_SYSFS just signifies that the
          * request and export were done by on behalf of userspace, so
@@ -690,12 +698,14 @@ static ssize_t unexport_store(struct class *class,
         if (status < 0)
                 goto done;
 
-        status = -EINVAL;
-
         desc = gpio_to_desc(gpio);
         /* reject bogus commands (gpio_unexport ignores them) */
-        if (!desc)
-                goto done;
+        if (!desc) {
+                pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
+                return -EINVAL;
+        }
+
+        status = -EINVAL;
 
         /* No extra locking here; FLAG_SYSFS just signifies that the
          * request and export were done by on behalf of userspace, so
@@ -846,8 +856,10 @@ static int gpiod_export_link(struct device *dev, const char *name,
 {
         int                     status = -EINVAL;
 
-        if (!desc)
-                goto done;
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
 
         mutex_lock(&sysfs_lock);
 
@@ -865,7 +877,6 @@ static int gpiod_export_link(struct device *dev, const char *name,
 
         mutex_unlock(&sysfs_lock);
 
-done:
         if (status)
                 pr_debug("%s: gpio%d status %d\n", __func__, desc_to_gpio(desc),
                          status);
@@ -896,8 +907,10 @@ static int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value)
         struct device           *dev = NULL;
         int                     status = -EINVAL;
 
-        if (!desc)
-                goto done;
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
 
         mutex_lock(&sysfs_lock);
 
@@ -914,7 +927,6 @@ static int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value)
 unlock:
         mutex_unlock(&sysfs_lock);
 
-done:
         if (status)
                 pr_debug("%s: gpio%d status %d\n", __func__, desc_to_gpio(desc),
                          status);
@@ -940,8 +952,8 @@ static void gpiod_unexport(struct gpio_desc *desc)
         struct device           *dev = NULL;
 
         if (!desc) {
-                status = -EINVAL;
-                goto done;
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return;
         }
 
         mutex_lock(&sysfs_lock);
@@ -962,7 +974,7 @@ static void gpiod_unexport(struct gpio_desc *desc)
                 device_unregister(dev);
                 put_device(dev);
         }
-done:
+
         if (status)
                 pr_debug("%s: gpio%d status %d\n", __func__, desc_to_gpio(desc),
                          status);
@@ -1384,12 +1396,13 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
         int                     status = -EPROBE_DEFER;
         unsigned long           flags;
 
-        spin_lock_irqsave(&gpio_lock, flags);
-
         if (!desc) {
-                status = -EINVAL;
-                goto done;
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
         }
+
+        spin_lock_irqsave(&gpio_lock, flags);
+
         chip = desc->chip;
         if (chip == NULL)
                 goto done;
@@ -1432,8 +1445,7 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
 done:
         if (status)
                 pr_debug("_gpio_request: gpio-%d (%s) status %d\n",
-                         desc ? desc_to_gpio(desc) : -1,
-                         label ? : "?", status);
+                         desc_to_gpio(desc), label ? : "?", status);
         spin_unlock_irqrestore(&gpio_lock, flags);
         return status;
 }
@@ -1616,10 +1628,13 @@ static int gpiod_direction_input(struct gpio_desc *desc)
         int                     status = -EINVAL;
         int                     offset;
 
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
+
         spin_lock_irqsave(&gpio_lock, flags);
 
-        if (!desc)
-                goto fail;
         chip = desc->chip;
         if (!chip || !chip->get || !chip->direction_input)
                 goto fail;
@@ -1655,13 +1670,9 @@ lose:
         return status;
 fail:
         spin_unlock_irqrestore(&gpio_lock, flags);
-        if (status) {
-                int gpio = -1;
-                if (desc)
-                        gpio = desc_to_gpio(desc);
-                pr_debug("%s: gpio-%d status %d\n",
-                        __func__, gpio, status);
-        }
+        if (status)
+                pr_debug("%s: gpio-%d status %d\n", __func__,
+                         desc_to_gpio(desc), status);
         return status;
 }
 
@@ -1678,6 +1689,11 @@ static int gpiod_direction_output(struct gpio_desc *desc, int value)
         int                     status = -EINVAL;
         int offset;
 
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
+
         /* Open drain pin should not be driven to 1 */
         if (value && test_bit(FLAG_OPEN_DRAIN,  &desc->flags))
                 return gpiod_direction_input(desc);
@@ -1688,8 +1704,6 @@ static int gpiod_direction_output(struct gpio_desc *desc, int value)
 
         spin_lock_irqsave(&gpio_lock, flags);
 
-        if (!desc)
-                goto fail;
         chip = desc->chip;
         if (!chip || !chip->set || !chip->direction_output)
                 goto fail;
@@ -1725,13 +1739,9 @@ lose:
         return status;
 fail:
         spin_unlock_irqrestore(&gpio_lock, flags);
-        if (status) {
-                int gpio = -1;
-                if (desc)
-                        gpio = desc_to_gpio(desc);
-                pr_debug("%s: gpio-%d status %d\n",
-                        __func__, gpio, status);
-        }
+        if (status)
+                pr_debug("%s: gpio-%d status %d\n", __func__,
+                         desc_to_gpio(desc), status);
         return status;
 }
 
@@ -1753,10 +1763,13 @@ static int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce)
         int                     status = -EINVAL;
         int                     offset;
 
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
+
         spin_lock_irqsave(&gpio_lock, flags);
 
-        if (!desc)
-                goto fail;
         chip = desc->chip;
         if (!chip || !chip->set || !chip->set_debounce)
                 goto fail;
@@ -1776,13 +1789,9 @@ static int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce)
 
 fail:
         spin_unlock_irqrestore(&gpio_lock, flags);
-        if (status) {
-                int gpio = -1;
-                if (desc)
-                        gpio = desc_to_gpio(desc);
-                pr_debug("%s: gpio-%d status %d\n",
-                        __func__, gpio, status);
-        }
+        if (status)
+                pr_debug("%s: gpio-%d status %d\n", __func__,
+                         desc_to_gpio(desc), status);
 
         return status;
 }
@@ -1824,12 +1833,14 @@ EXPORT_SYMBOL_GPL(gpio_set_debounce);
  * It returns the zero or nonzero value provided by the associated
  * gpio_chip.get() method; or zero if no such method is provided.
  */
-static int gpiod_get_value(struct gpio_desc *desc)
+static int gpiod_get_value(const struct gpio_desc *desc)
 {
         struct gpio_chip        *chip;
         int value;
         int offset;
 
+        if (!desc)
+                return 0;
         chip = desc->chip;
         offset = gpio_chip_hwgpio(desc);
         /* Should be using gpio_get_value_cansleep() */
@@ -1912,6 +1923,8 @@ static void gpiod_set_value(struct gpio_desc *desc, int value)
 {
         struct gpio_chip        *chip;
 
+        if (!desc)
+                return;
         chip = desc->chip;
         /* Should be using gpio_set_value_cansleep() */
         WARN_ON(chip->can_sleep);
@@ -1938,8 +1951,10 @@ EXPORT_SYMBOL_GPL(__gpio_set_value);
  * This is used directly or indirectly to implement gpio_cansleep().  It
  * returns nonzero if access reading or writing the GPIO value can sleep.
  */
-static int gpiod_cansleep(struct gpio_desc *desc)
+static int gpiod_cansleep(const struct gpio_desc *desc)
 {
+        if (!desc)
+                return 0;
         /* only call this on GPIOs that are valid! */
         return desc->chip->can_sleep;
 }
@@ -1959,11 +1974,13 @@ EXPORT_SYMBOL_GPL(__gpio_cansleep);
  * It returns the number of the IRQ signaled by this (input) GPIO,
  * or a negative errno.
  */
-static int gpiod_to_irq(struct gpio_desc *desc)
+static int gpiod_to_irq(const struct gpio_desc *desc)
 {
         struct gpio_chip        *chip;
         int                     offset;
 
+        if (!desc)
+                return -EINVAL;
         chip = desc->chip;
         offset = gpio_chip_hwgpio(desc);
         return chip->to_irq ? chip->to_irq(chip, offset) : -ENXIO;
@@ -1980,13 +1997,15 @@ EXPORT_SYMBOL_GPL(__gpio_to_irq);
  * Common examples include ones connected to I2C or SPI chips.
  */
 
-static int gpiod_get_value_cansleep(struct gpio_desc *desc)
+static int gpiod_get_value_cansleep(const struct gpio_desc *desc)
 {
         struct gpio_chip        *chip;
         int value;
         int offset;
 
         might_sleep_if(extra_checks);
+        if (!desc)
+                return 0;
         chip = desc->chip;
         offset = gpio_chip_hwgpio(desc);
         value = chip->get ? chip->get(chip, offset) : 0;
@@ -2005,6 +2024,8 @@ static void gpiod_set_value_cansleep(struct gpio_desc *desc, int value)
         struct gpio_chip        *chip;
 
         might_sleep_if(extra_checks);
+        if (!desc)
+                return;
         chip = desc->chip;
         trace_gpio_value(desc_to_gpio(desc), 0, value);
         if (test_bit(FLAG_OPEN_DRAIN,  &desc->flags))
diff --git a/drivers/isdn/hisax/st5481_usb.c b/drivers/isdn/hisax/st5481_usb.c
index 017c67ea3f4c..ead0a4fb7448 100644
--- a/drivers/isdn/hisax/st5481_usb.c
+++ b/drivers/isdn/hisax/st5481_usb.c
@@ -294,13 +294,13 @@ int st5481_setup_usb(struct st5481_adapter *adapter)
         // Allocate URBs and buffers for interrupt endpoint
         urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!urb) {
-                return -ENOMEM;
+                goto err1;
         }
         intr->urb = urb;
 
         buf = kmalloc(INT_PKT_SIZE, GFP_KERNEL);
         if (!buf) {
-                return -ENOMEM;
+                goto err2;
         }
 
         endpoint = &altsetting->endpoint[EP_INT-1];
@@ -313,6 +313,14 @@ int st5481_setup_usb(struct st5481_adapter *adapter)
                          endpoint->desc.bInterval);
 
         return 0;
+err2:
+        usb_free_urb(intr->urb);
+        intr->urb = NULL;
+err1:
+        usb_free_urb(ctrl->urb);
+        ctrl->urb = NULL;
+
+        return -ENOMEM;
 }
 
 /*
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index e30b490055aa..4d8d90b4fe78 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -154,17 +154,6 @@ config MD_RAID456
 
           If unsure, say Y.
 
-config MULTICORE_RAID456
-        bool "RAID-4/RAID-5/RAID-6 Multicore processing (EXPERIMENTAL)"
-        depends on MD_RAID456
-        depends on SMP
-        depends on EXPERIMENTAL
-        ---help---
-          Enable the raid456 module to dispatch per-stripe raid operations to a
-          thread pool.
-
-          If unsure, say N.
-
 config MD_MULTIPATH
         tristate "Multipath I/O support"
         depends on BLK_DEV_MD
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 9a01d1e4c783..311e3d35b272 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -91,15 +91,44 @@ static struct raid_type {
         {"raid6_nc", "RAID6 (N continue)",              2, 4, 6, ALGORITHM_ROTATING_N_CONTINUE}
 };
 
+static char *raid10_md_layout_to_format(int layout)
+{
+        /*
+         * Bit 16 and 17 stand for "offset" and "use_far_sets"
+         * Refer to MD's raid10.c for details
+         */
+        if ((layout & 0x10000) && (layout & 0x20000))
+                return "offset";
+
+        if ((layout & 0xFF) > 1)
+                return "near";
+
+        return "far";
+}
+
 static unsigned raid10_md_layout_to_copies(int layout)
 {
-        return layout & 0xFF;
+        if ((layout & 0xFF) > 1)
+                return layout & 0xFF;
+        return (layout >> 8) & 0xFF;
 }
 
 static int raid10_format_to_md_layout(char *format, unsigned copies)
 {
-        /* 1 "far" copy, and 'copies' "near" copies */
-        return (1 << 8) | (copies & 0xFF);
+        unsigned n = 1, f = 1;
+
+        if (!strcmp("near", format))
+                n = copies;
+        else
+                f = copies;
+
+        if (!strcmp("offset", format))
+                return 0x30000 | (f << 8) | n;
+
+        if (!strcmp("far", format))
+                return 0x20000 | (f << 8) | n;
+
+        return (f << 8) | n;
 }
 
 static struct raid_type *get_raid_type(char *name)
@@ -352,6 +381,7 @@ static int validate_raid_redundancy(struct raid_set *rs)
 {
         unsigned i, rebuild_cnt = 0;
         unsigned rebuilds_per_group, copies, d;
+        unsigned group_size, last_group_start;
 
         for (i = 0; i < rs->md.raid_disks; i++)
                 if (!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
@@ -379,9 +409,6 @@ static int validate_raid_redundancy(struct raid_set *rs)
                  * as long as the failed devices occur in different mirror
                  * groups (i.e. different stripes).
                  *
-                 * Right now, we only allow for "near" copies.  When other
-                 * formats are added, we will have to check those too.
-                 *
                  * When checking "near" format, make sure no adjacent devices
                  * have failed beyond what can be handled.  In addition to the
                  * simple case where the number of devices is a multiple of the
@@ -391,14 +418,41 @@ static int validate_raid_redundancy(struct raid_set *rs)
                  *          A    A    B    B    C
                  *          C    D    D    E    E
                  */
-                for (i = 0; i < rs->md.raid_disks * copies; i++) {
-                        if (!(i % copies))
+                if (!strcmp("near", raid10_md_layout_to_format(rs->md.layout))) {
+                        for (i = 0; i < rs->md.raid_disks * copies; i++) {
+                                if (!(i % copies))
+                                        rebuilds_per_group = 0;
+                                d = i % rs->md.raid_disks;
+                                if ((!rs->dev[d].rdev.sb_page ||
+                                     !test_bit(In_sync, &rs->dev[d].rdev.flags)) &&
+                                    (++rebuilds_per_group >= copies))
+                                        goto too_many;
+                        }
+                        break;
+                }
+
+                /*
+                 * When checking "far" and "offset" formats, we need to ensure
+                 * that the device that holds its copy is not also dead or
+                 * being rebuilt.  (Note that "far" and "offset" formats only
+                 * support two copies right now.  These formats also only ever
+                 * use the 'use_far_sets' variant.)
+                 *
+                 * This check is somewhat complicated by the need to account
+                 * for arrays that are not a multiple of (far) copies.  This
+                 * results in the need to treat the last (potentially larger)
+                 * set differently.
+                 */
+                group_size = (rs->md.raid_disks / copies);
+                last_group_start = (rs->md.raid_disks / group_size) - 1;
+                last_group_start *= group_size;
+                for (i = 0; i < rs->md.raid_disks; i++) {
+                        if (!(i % copies) && !(i > last_group_start))
                                 rebuilds_per_group = 0;
-                        d = i % rs->md.raid_disks;
-                        if ((!rs->dev[d].rdev.sb_page ||
-                             !test_bit(In_sync, &rs->dev[d].rdev.flags)) &&
+                        if ((!rs->dev[i].rdev.sb_page ||
+                             !test_bit(In_sync, &rs->dev[i].rdev.flags)) &&
                             (++rebuilds_per_group >= copies))
-                                goto too_many;
+                                        goto too_many;
                 }
                 break;
         default:
@@ -433,7 +487,7 @@ too_many:
  *
  * RAID10-only options:
  *    [raid10_copies <# copies>]        Number of copies.  (Default: 2)
- *    [raid10_format <near>]            Layout algorithm.  (Default: near)
+ *    [raid10_format <near|far|offset>] Layout algorithm.  (Default: near)
  */
 static int parse_raid_params(struct raid_set *rs, char **argv,
                              unsigned num_raid_params)
@@ -520,7 +574,9 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
                                 rs->ti->error = "'raid10_format' is an invalid parameter for this RAID type";
                                 return -EINVAL;
                         }
-                        if (strcmp("near", argv[i])) {
+                        if (strcmp("near", argv[i]) &&
+                            strcmp("far", argv[i]) &&
+                            strcmp("offset", argv[i])) {
                                 rs->ti->error = "Invalid 'raid10_format' value given";
                                 return -EINVAL;
                         }
@@ -644,6 +700,15 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
                         return -EINVAL;
                 }
 
+                /*
+                 * If the format is not "near", we only support
+                 * two copies at the moment.
+                 */
+                if (strcmp("near", raid10_format) && (raid10_copies > 2)) {
+                        rs->ti->error = "Too many copies for given RAID10 format.";
+                        return -EINVAL;
+                }
+
                 /* (Len * #mirrors) / #devices */
                 sectors_per_dev = rs->ti->len * raid10_copies;
                 sector_div(sectors_per_dev, rs->md.raid_disks);
@@ -854,17 +919,30 @@ static int super_init_validation(struct mddev *mddev, struct md_rdev *rdev)
         /*
          * Reshaping is not currently allowed
          */
-        if ((le32_to_cpu(sb->level) != mddev->level) ||
-            (le32_to_cpu(sb->layout) != mddev->layout) ||
-            (le32_to_cpu(sb->stripe_sectors) != mddev->chunk_sectors)) {
-                DMERR("Reshaping arrays not yet supported.");
+        if (le32_to_cpu(sb->level) != mddev->level) {
+                DMERR("Reshaping arrays not yet supported. (RAID level change)");
+                return -EINVAL;
+        }
+        if (le32_to_cpu(sb->layout) != mddev->layout) {
+                DMERR("Reshaping arrays not yet supported. (RAID layout change)");
+                DMERR("  0x%X vs 0x%X", le32_to_cpu(sb->layout), mddev->layout);
+                DMERR("  Old layout: %s w/ %d copies",
+                      raid10_md_layout_to_format(le32_to_cpu(sb->layout)),
+                      raid10_md_layout_to_copies(le32_to_cpu(sb->layout)));
+                DMERR("  New layout: %s w/ %d copies",
+                      raid10_md_layout_to_format(mddev->layout),
+                      raid10_md_layout_to_copies(mddev->layout));
+                return -EINVAL;
+        }
+        if (le32_to_cpu(sb->stripe_sectors) != mddev->chunk_sectors) {
+                DMERR("Reshaping arrays not yet supported. (stripe sectors change)");
                 return -EINVAL;
         }
 
         /* We can only change the number of devices in RAID1 right now */
         if ((rs->raid_type->level != 1) &&
             (le32_to_cpu(sb->num_devices) != mddev->raid_disks)) {
-                DMERR("Reshaping arrays not yet supported.");
+                DMERR("Reshaping arrays not yet supported. (device count change)");
                 return -EINVAL;
         }
 
@@ -1329,7 +1407,8 @@ static void raid_status(struct dm_target *ti, status_type_t type,
                                raid10_md_layout_to_copies(rs->md.layout));
 
                 if (rs->print_flags & DMPF_RAID10_FORMAT)
-                        DMEMIT(" raid10_format near");
+                        DMEMIT(" raid10_format %s",
+                               raid10_md_layout_to_format(rs->md.layout));
 
                 DMEMIT(" %d", rs->md.raid_disks);
                 for (i = 0; i < rs->md.raid_disks; i++) {
@@ -1418,6 +1497,10 @@ static struct target_type raid_target = {
 
 static int __init dm_raid_init(void)
 {
+        DMINFO("Loading target version %u.%u.%u",
+               raid_target.version[0],
+               raid_target.version[1],
+               raid_target.version[2]);
         return dm_register_target(&raid_target);
 }
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3db3d1b271f7..fcb878f88796 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -307,6 +307,10 @@ static void md_make_request(struct request_queue *q, struct bio *bio)
                 bio_io_error(bio);
                 return;
         }
+        if (mddev->ro == 1 && unlikely(rw == WRITE)) {
+                bio_endio(bio, bio_sectors(bio) == 0 ? 0 : -EROFS);
+                return;
+        }
         smp_rmb(); /* Ensure implications of  'active' are visible */
         rcu_read_lock();
         if (mddev->suspended) {
@@ -2994,6 +2998,9 @@ rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)
                 } else if (!sectors)
                         sectors = (i_size_read(rdev->bdev->bd_inode) >> 9) -
                                 rdev->data_offset;
+                if (!my_mddev->pers->resize)
+                        /* Cannot change size for RAID0 or Linear etc */
+                        return -EINVAL;
         }
         if (sectors < my_mddev->dev_sectors)
                 return -EINVAL; /* component must fit device */
@@ -6525,7 +6532,17 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
                         mddev->ro = 0;
                         sysfs_notify_dirent_safe(mddev->sysfs_state);
                         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
-                        md_wakeup_thread(mddev->thread);
+                        /* mddev_unlock will wake thread */
+                        /* If a device failed while we were read-only, we
+                         * need to make sure the metadata is updated now.
+                         */
+                        if (test_bit(MD_CHANGE_DEVS, &mddev->flags)) {
+                                mddev_unlock(mddev);
+                                wait_event(mddev->sb_wait,
+                                           !test_bit(MD_CHANGE_DEVS, &mddev->flags) &&
+                                           !test_bit(MD_CHANGE_PENDING, &mddev->flags));
+                                mddev_lock(mddev);
+                        }
                 } else {
                         err = -EROFS;
                         goto abort_unlock;
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 24b359717a7e..0505452de8d6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -175,7 +175,13 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
                         rdev1->new_raid_disk = j;
                 }
 
-                if (j < 0 || j >= mddev->raid_disks) {
+                if (j < 0) {
+                        printk(KERN_ERR
+                               "md/raid0:%s: remove inactive devices before converting to RAID0\n",
+                               mdname(mddev));
+                        goto abort;
+                }
+                if (j >= mddev->raid_disks) {
                         printk(KERN_ERR "md/raid0:%s: bad disk number %d - "
                                "aborting!\n", mdname(mddev), j);
                         goto abort;
@@ -289,7 +295,7 @@ abort:
         kfree(conf->strip_zone);
         kfree(conf->devlist);
         kfree(conf);
-        *private_conf = NULL;
+        *private_conf = ERR_PTR(err);
         return err;
 }
 
@@ -411,7 +417,8 @@ static sector_t raid0_size(struct mddev *mddev, sector_t sectors, int raid_disks
                   "%s does not support generic reshape\n", __func__);
 
         rdev_for_each(rdev, mddev)
-                array_sectors += rdev->sectors;
+                array_sectors += (rdev->sectors &
+                                  ~(sector_t)(mddev->chunk_sectors-1));
 
         return array_sectors;
 }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d5bddfc4010e..fd86b372692d 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -967,6 +967,7 @@ static void raid1_unplug(struct blk_plug_cb *cb, bool from_schedule)
                 bio_list_merge(&conf->pending_bio_list, &plug->pending);
                 conf->pending_count += plug->pending_cnt;
                 spin_unlock_irq(&conf->device_lock);
+                wake_up(&conf->wait_barrier);
                 md_wakeup_thread(mddev->thread);
                 kfree(plug);
                 return;
@@ -1000,6 +1001,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
         const unsigned long do_flush_fua = (bio->bi_rw & (REQ_FLUSH | REQ_FUA));
         const unsigned long do_discard = (bio->bi_rw
                                           & (REQ_DISCARD | REQ_SECURE));
+        const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
         struct md_rdev *blocked_rdev;
         struct blk_plug_cb *cb;
         struct raid1_plug_cb *plug = NULL;
@@ -1301,7 +1303,8 @@ read_again:
                                    conf->mirrors[i].rdev->data_offset);
                 mbio->bi_bdev = conf->mirrors[i].rdev->bdev;
                 mbio->bi_end_io = raid1_end_write_request;
-                mbio->bi_rw = WRITE | do_flush_fua | do_sync | do_discard;
+                mbio->bi_rw =
+                        WRITE | do_flush_fua | do_sync | do_discard | do_same;
                 mbio->bi_private = r1_bio;
 
                 atomic_inc(&r1_bio->remaining);
@@ -2818,6 +2821,9 @@ static int run(struct mddev *mddev)
         if (IS_ERR(conf))
                 return PTR_ERR(conf);
 
+        if (mddev->queue)
+                blk_queue_max_write_same_sectors(mddev->queue,
+                                                 mddev->chunk_sectors);
         rdev_for_each(rdev, mddev) {
                 if (!mddev->gendisk)
                         continue;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 64d48249c03b..77b562d18a90 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -38,21 +38,36 @@
  *    near_copies (stored in low byte of layout)
  *    far_copies (stored in second byte of layout)
  *    far_offset (stored in bit 16 of layout )
+ *    use_far_sets (stored in bit 17 of layout )
  *
- * The data to be stored is divided into chunks using chunksize.
- * Each device is divided into far_copies sections.
- * In each section, chunks are laid out in a style similar to raid0, but
- * near_copies copies of each chunk is stored (each on a different drive).
- * The starting device for each section is offset near_copies from the starting
- * device of the previous section.
- * Thus they are (near_copies*far_copies) of each chunk, and each is on a different
- * drive.
- * near_copies and far_copies must be at least one, and their product is at most
- * raid_disks.
+ * The data to be stored is divided into chunks using chunksize.  Each device
+ * is divided into far_copies sections.   In each section, chunks are laid out
+ * in a style similar to raid0, but near_copies copies of each chunk is stored
+ * (each on a different drive).  The starting device for each section is offset
+ * near_copies from the starting device of the previous section.  Thus there
+ * are (near_copies * far_copies) of each chunk, and each is on a different
+ * drive.  near_copies and far_copies must be at least one, and their product
+ * is at most raid_disks.
  *
  * If far_offset is true, then the far_copies are handled a bit differently.
- * The copies are still in different stripes, but instead of be very far apart
- * on disk, there are adjacent stripes.
+ * The copies are still in different stripes, but instead of being very far
+ * apart on disk, there are adjacent stripes.
+ *
+ * The far and offset algorithms are handled slightly differently if
+ * 'use_far_sets' is true.  In this case, the array's devices are grouped into
+ * sets that are (near_copies * far_copies) in size.  The far copied stripes
+ * are still shifted by 'near_copies' devices, but this shifting stays confined
+ * to the set rather than the entire array.  This is done to improve the number
+ * of device combinations that can fail without causing the array to fail.
+ * Example 'far' algorithm w/o 'use_far_sets' (each letter represents a chunk
+ * on a device):
+ *    A B C D    A B C D E
+ *      ...         ...
+ *    D A B C    E A B C D
+ * Example 'far' algorithm w/ 'use_far_sets' enabled (sets illustrated w/ []'s):
+ *    [A B] [C D]    [A B] [C D E]
+ *    |...| |...|    |...| | ... |
+ *    [B A] [D C]    [B A] [E C D]
  */
 
 /*
@@ -535,6 +550,13 @@ static void __raid10_find_phys(struct geom *geo, struct r10bio *r10bio)
         sector_t stripe;
         int dev;
         int slot = 0;
+        int last_far_set_start, last_far_set_size;
+
+        last_far_set_start = (geo->raid_disks / geo->far_set_size) - 1;
+        last_far_set_start *= geo->far_set_size;
+
+        last_far_set_size = geo->far_set_size;
+        last_far_set_size += (geo->raid_disks % geo->far_set_size);
 
         /* now calculate first sector/dev */
         chunk = r10bio->sector >> geo->chunk_shift;
@@ -551,15 +573,25 @@ static void __raid10_find_phys(struct geom *geo, struct r10bio *r10bio)
         /* and calculate all the others */
         for (n = 0; n < geo->near_copies; n++) {
                 int d = dev;
+                int set;
                 sector_t s = sector;
-                r10bio->devs[slot].addr = sector;
                 r10bio->devs[slot].devnum = d;
+                r10bio->devs[slot].addr = s;
                 slot++;
 
                 for (f = 1; f < geo->far_copies; f++) {
+                        set = d / geo->far_set_size;
                         d += geo->near_copies;
-                        if (d >= geo->raid_disks)
-                                d -= geo->raid_disks;
+
+                        if ((geo->raid_disks % geo->far_set_size) &&
+                            (d > last_far_set_start)) {
+                                d -= last_far_set_start;
+                                d %= last_far_set_size;
+                                d += last_far_set_start;
+                        } else {
+                                d %= geo->far_set_size;
+                                d += geo->far_set_size * set;
+                        }
                         s += geo->stride;
                         r10bio->devs[slot].devnum = d;
                         r10bio->devs[slot].addr = s;
@@ -595,6 +627,20 @@ static sector_t raid10_find_virt(struct r10conf *conf, sector_t sector, int dev)
          * or recovery, so reshape isn't happening
          */
         struct geom *geo = &conf->geo;
+        int far_set_start = (dev / geo->far_set_size) * geo->far_set_size;
+        int far_set_size = geo->far_set_size;
+        int last_far_set_start;
+
+        if (geo->raid_disks % geo->far_set_size) {
+                last_far_set_start = (geo->raid_disks / geo->far_set_size) - 1;
+                last_far_set_start *= geo->far_set_size;
+
+                if (dev >= last_far_set_start) {
+                        far_set_size = geo->far_set_size;
+                        far_set_size += (geo->raid_disks % geo->far_set_size);
+                        far_set_start = last_far_set_start;
+                }
+        }
 
         offset = sector & geo->chunk_mask;
         if (geo->far_offset) {
@@ -602,13 +648,13 @@ static sector_t raid10_find_virt(struct r10conf *conf, sector_t sector, int dev)
                 chunk = sector >> geo->chunk_shift;
                 fc = sector_div(chunk, geo->far_copies);
                 dev -= fc * geo->near_copies;
-                if (dev < 0)
-                        dev += geo->raid_disks;
+                if (dev < far_set_start)
+                        dev += far_set_size;
         } else {
                 while (sector >= geo->stride) {
                         sector -= geo->stride;
-                        if (dev < geo->near_copies)
-                                dev += geo->raid_disks - geo->near_copies;
+                        if (dev < (geo->near_copies + far_set_start))
+                                dev += far_set_size - geo->near_copies;
                         else
                                 dev -= geo->near_copies;
                 }
@@ -1073,6 +1119,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
                 bio_list_merge(&conf->pending_bio_list, &plug->pending);
                 conf->pending_count += plug->pending_cnt;
                 spin_unlock_irq(&conf->device_lock);
+                wake_up(&conf->wait_barrier);
                 md_wakeup_thread(mddev->thread);
                 kfree(plug);
                 return;
@@ -1105,6 +1152,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
         const unsigned long do_fua = (bio->bi_rw & REQ_FUA);
         const unsigned long do_discard = (bio->bi_rw
                                           & (REQ_DISCARD | REQ_SECURE));
+        const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
         unsigned long flags;
         struct md_rdev *blocked_rdev;
         struct blk_plug_cb *cb;
@@ -1460,7 +1508,8 @@ retry_write:
                                                               rdev));
                         mbio->bi_bdev = rdev->bdev;
                         mbio->bi_end_io = raid10_end_write_request;
-                        mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
+                        mbio->bi_rw =
+                                WRITE | do_sync | do_fua | do_discard | do_same;
                         mbio->bi_private = r10_bio;
 
                         atomic_inc(&r10_bio->remaining);
@@ -1502,7 +1551,8 @@ retry_write:
                                                    r10_bio, rdev));
                         mbio->bi_bdev = rdev->bdev;
                         mbio->bi_end_io = raid10_end_write_request;
-                        mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
+                        mbio->bi_rw =
+                                WRITE | do_sync | do_fua | do_discard | do_same;
                         mbio->bi_private = r10_bio;
 
                         atomic_inc(&r10_bio->remaining);
@@ -3436,7 +3486,7 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
                 disks = mddev->raid_disks + mddev->delta_disks;
                 break;
         }
-        if (layout >> 17)
+        if (layout >> 18)
                 return -1;
         if (chunk < (PAGE_SIZE >> 9) ||
             !is_power_of_2(chunk))
@@ -3448,6 +3498,7 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
         geo->near_copies = nc;
         geo->far_copies = fc;
         geo->far_offset = fo;
+        geo->far_set_size = (layout & (1<<17)) ? disks / fc : disks;
         geo->chunk_mask = chunk - 1;
         geo->chunk_shift = ffz(~chunk);
         return nc*fc;
@@ -3569,6 +3620,8 @@ static int run(struct mddev *mddev)
         if (mddev->queue) {
                 blk_queue_max_discard_sectors(mddev->queue,
                                               mddev->chunk_sectors);
+                blk_queue_max_write_same_sectors(mddev->queue,
+                                                 mddev->chunk_sectors);
                 blk_queue_io_min(mddev->queue, chunk_size);
                 if (conf->geo.raid_disks % conf->geo.near_copies)
                         blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks);
diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
index 1054cf602345..157d69e83ff4 100644
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -33,6 +33,11 @@ struct r10conf {
                                                * far_offset, in which case it is
                                                * 1 stripe.
                                                */
+                int             far_set_size; /* The number of devices in a set,
+                                               * where a 'set' are devices that
+                                               * contain far/offset copies of
+                                               * each other.
+                                               */
                 int             chunk_shift; /* shift from chunks to sectors */
                 sector_t        chunk_mask;
         } prev, geo;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 5af2d2709081..3ee2912889e7 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1403,7 +1403,7 @@ static void ops_run_check_pq(struct stripe_head *sh, struct raid5_percpu *percpu
                            &sh->ops.zero_sum_result, percpu->spare_page, &submit);
 }
 
-static void __raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
+static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
 {
         int overlap_clear = 0, i, disks = sh->disks;
         struct dma_async_tx_descriptor *tx = NULL;
@@ -1468,36 +1468,6 @@ static void __raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
         put_cpu();
 }
 
-#ifdef CONFIG_MULTICORE_RAID456
-static void async_run_ops(void *param, async_cookie_t cookie)
-{
-        struct stripe_head *sh = param;
-        unsigned long ops_request = sh->ops.request;
-
-        clear_bit_unlock(STRIPE_OPS_REQ_PENDING, &sh->state);
-        wake_up(&sh->ops.wait_for_ops);
-
-        __raid_run_ops(sh, ops_request);
-        release_stripe(sh);
-}
-
-static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
-{
-        /* since handle_stripe can be called outside of raid5d context
-         * we need to ensure sh->ops.request is de-staged before another
-         * request arrives
-         */
-        wait_event(sh->ops.wait_for_ops,
-                   !test_and_set_bit_lock(STRIPE_OPS_REQ_PENDING, &sh->state));
-        sh->ops.request = ops_request;
-
-        atomic_inc(&sh->count);
-        async_schedule(async_run_ops, sh);
-}
-#else
-#define raid_run_ops __raid_run_ops
-#endif
-
 static int grow_one_stripe(struct r5conf *conf)
 {
         struct stripe_head *sh;
@@ -1506,9 +1476,6 @@ static int grow_one_stripe(struct r5conf *conf)
                 return 0;
 
         sh->raid_conf = conf;
-        #ifdef CONFIG_MULTICORE_RAID456
-        init_waitqueue_head(&sh->ops.wait_for_ops);
-        #endif
 
         spin_lock_init(&sh->stripe_lock);
 
@@ -1627,9 +1594,6 @@ static int resize_stripes(struct r5conf *conf, int newsize)
                         break;
 
                 nsh->raid_conf = conf;
-                #ifdef CONFIG_MULTICORE_RAID456
-                init_waitqueue_head(&nsh->ops.wait_for_ops);
-                #endif
                 spin_lock_init(&nsh->stripe_lock);
 
                 list_add(&nsh->lru, &newstripes);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 11d01d67b3f5..7bd068a6056a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1629,7 +1629,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         /* If this is the first slave, then we need to set the master's hardware
          * address to be the same as the slave's. */
-        if (bond->dev_addr_from_first)
+        if (bond->slave_cnt == 0 && bond->dev_addr_from_first)
                 bond_set_dev_addr(bond->dev, slave_dev);
 
         new_slave = kzalloc(sizeof(struct slave), GFP_KERNEL);
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 639049d7e92d..da5f4397f87c 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -301,12 +301,16 @@ static int bgmac_dma_rx_read(struct bgmac *bgmac, struct bgmac_dma_ring *ring,
                         bgmac_err(bgmac, "Found poisoned packet at slot %d, DMA issue!\n",
                                   ring->start);
                 } else {
+                        /* Omit CRC. */
+                        len -= ETH_FCS_LEN;
+
                         new_skb = netdev_alloc_skb_ip_align(bgmac->net_dev, len);
                         if (new_skb) {
                                 skb_put(new_skb, len);
                                 skb_copy_from_linear_data_offset(skb, BGMAC_RX_FRAME_OFFSET,
                                                                  new_skb->data,
                                                                  len);
+                                skb_checksum_none_assert(skb);
                                 new_skb->protocol =
                                         eth_type_trans(new_skb, bgmac->net_dev);
                                 netif_receive_skb(new_skb);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ecac04a3687c..a923bc4d5a1f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3142,7 +3142,7 @@ static inline __le16 bnx2x_csum_fix(unsigned char *t_header, u16 csum, s8 fix)
                 tsum = ~csum_fold(csum_add((__force __wsum) csum,
                                   csum_partial(t_header, -fix, 0)));
 
-        return bswab16(csum);
+        return bswab16(tsum);
 }
 
 static inline u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 9a674b14b403..edfa67adf2f9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -281,6 +281,8 @@ static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                         cmd->lp_advertising |= ADVERTISED_2500baseX_Full;
                 if (status & LINK_STATUS_LINK_PARTNER_10GXFD_CAPABLE)
                         cmd->lp_advertising |= ADVERTISED_10000baseT_Full;
+                if (status & LINK_STATUS_LINK_PARTNER_20GXFD_CAPABLE)
+                        cmd->lp_advertising |= ADVERTISED_20000baseKR2_Full;
         }
 
         cmd->maxtxpkt = 0;
@@ -463,6 +465,10 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                                 ADVERTISED_10000baseKR_Full))
                                 bp->link_params.speed_cap_mask[cfg_idx] |=
                                         PORT_HW_CFG_SPEED_CAPABILITY_D0_10G;
+
+                        if (cmd->advertising & ADVERTISED_20000baseKR2_Full)
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_20G;
                 }
         } else { /* forced speed */
                 /* advertise the requested speed and duplex if supported */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 1663e0b6b5a0..31c5787970db 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -10422,6 +10422,28 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LED1_MASK,
                                          0x0);
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
+                                /* Disable MI_INT interrupt before setting LED4
+                                 * source to constant off.
+                                 */
+                                if (REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 +
+                                           params->port*4) &
+                                    NIG_MASK_MI_INT) {
+                                        params->link_flags |=
+                                        LINK_FLAGS_INT_DISABLED;
+
+                                        bnx2x_bits_dis(
+                                                bp,
+                                                NIG_REG_MASK_INTERRUPT_PORT0 +
+                                                params->port*4,
+                                                NIG_MASK_MI_INT);
+                                }
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_SIGNAL_MASK,
+                                                 0x0);
+                        }
                 }
                 break;
         case LED_MODE_ON:
@@ -10468,6 +10490,28 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LED1_MASK,
                                          0x20);
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
+                                /* Disable MI_INT interrupt before setting LED4
+                                 * source to constant on.
+                                 */
+                                if (REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 +
+                                           params->port*4) &
+                                    NIG_MASK_MI_INT) {
+                                        params->link_flags |=
+                                        LINK_FLAGS_INT_DISABLED;
+
+                                        bnx2x_bits_dis(
+                                                bp,
+                                                NIG_REG_MASK_INTERRUPT_PORT0 +
+                                                params->port*4,
+                                                NIG_MASK_MI_INT);
+                                }
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_SIGNAL_MASK,
+                                                 0x20);
+                        }
                 }
                 break;
 
@@ -10532,6 +10576,22 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LINK_SIGNAL,
                                          val);
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
+                                /* Restore LED4 source to external link,
+                                 * and re-enable interrupts.
+                                 */
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_SIGNAL_MASK,
+                                                 0x40);
+                                if (params->link_flags &
+                                    LINK_FLAGS_INT_DISABLED) {
+                                        bnx2x_link_int_enable(params);
+                                        params->link_flags &=
+                                                ~LINK_FLAGS_INT_DISABLED;
+                                }
+                        }
                 }
                 break;
         }
@@ -11791,6 +11851,8 @@ static int bnx2x_populate_int_phy(struct bnx2x *bp, u32 shmem_base, u8 port,
                         phy->media_type = ETH_PHY_KR;
                         phy->flags |= FLAGS_WC_DUAL_MODE;
                         phy->supported &= (SUPPORTED_20000baseKR2_Full |
+                                           SUPPORTED_10000baseT_Full |
+                                           SUPPORTED_1000baseT_Full |
                                            SUPPORTED_Autoneg |
                                            SUPPORTED_FIBRE |
                                            SUPPORTED_Pause |
@@ -13437,7 +13499,7 @@ void bnx2x_period_func(struct link_params *params, struct link_vars *vars)
                 struct bnx2x_phy *phy = &params->phy[INT_PHY];
                 bnx2x_set_aer_mmd(params, phy);
                 if ((phy->supported & SUPPORTED_20000baseKR2_Full) &&
-                    (phy->speed_cap_mask & SPEED_20000))
+                    (phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_20G))
                         bnx2x_check_kr2_wa(params, vars, phy);
                 bnx2x_check_over_curr(params, vars);
                 if (vars->rx_tx_asic_rst)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
index d25c7d79787a..be5c195d03dd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
@@ -307,7 +307,8 @@ struct link_params {
         struct bnx2x *bp;
         u16 req_fc_auto_adv; /* Should be set to TX / BOTH when
                                 req_flow_ctrl is set to AUTO */
-        u16 rsrv1;
+        u16 link_flags;
+#define LINK_FLAGS_INT_DISABLED         (1<<0)
         u32 lfa_base;
 };
 
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 28ceb8414185..29aff55f2eea 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -349,6 +349,7 @@ struct be_adapter {
         struct pci_dev *pdev;
         struct net_device *netdev;
 
+        u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
         u8 __iomem *db;         /* Door Bell */
 
         struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 071aea79d218..3c9b4f12e3e5 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -473,19 +473,17 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
         return 0;
 }
 
-static int be_POST_stage_get(struct be_adapter *adapter, u16 *stage)
+static u16 be_POST_stage_get(struct be_adapter *adapter)
 {
         u32 sem;
-        u32 reg = skyhawk_chip(adapter) ? SLIPORT_SEMAPHORE_OFFSET_SH :
-                                          SLIPORT_SEMAPHORE_OFFSET_BE;
 
-        pci_read_config_dword(adapter->pdev, reg, &sem);
-        *stage = sem & POST_STAGE_MASK;
-
-        if ((sem >> POST_ERR_SHIFT) & POST_ERR_MASK)
-                return -1;
+        if (BEx_chip(adapter))
+                sem  = ioread32(adapter->csr + SLIPORT_SEMAPHORE_OFFSET_BEx);
         else
-                return 0;
+                pci_read_config_dword(adapter->pdev,
+                                      SLIPORT_SEMAPHORE_OFFSET_SH, &sem);
+
+        return sem & POST_STAGE_MASK;
 }
 
 int lancer_wait_ready(struct be_adapter *adapter)
@@ -579,19 +577,17 @@ int be_fw_wait_ready(struct be_adapter *adapter)
         }
 
         do {
-                status = be_POST_stage_get(adapter, &stage);
-                if (status) {
-                        dev_err(dev, "POST error; stage=0x%x\n", stage);
-                        return -1;
-                } else if (stage != POST_STAGE_ARMFW_RDY) {
-                        if (msleep_interruptible(2000)) {
-                                dev_err(dev, "Waiting for POST aborted\n");
-                                return -EINTR;
-                        }
-                        timeout += 2;
-                } else {
+                stage = be_POST_stage_get(adapter);
+                if (stage == POST_STAGE_ARMFW_RDY)
                         return 0;
+
+                dev_info(dev, "Waiting for POST, %ds elapsed\n",
+                         timeout);
+                if (msleep_interruptible(2000)) {
+                        dev_err(dev, "Waiting for POST aborted\n");
+                        return -EINTR;
                 }
+                timeout += 2;
         } while (timeout < 60);
 
         dev_err(dev, "POST timeout; stage=0x%x\n", stage);
diff --git a/drivers/net/ethernet/emulex/benet/be_hw.h b/drivers/net/ethernet/emulex/benet/be_hw.h
index 541d4530d5bf..62dc220695f7 100644
--- a/drivers/net/ethernet/emulex/benet/be_hw.h
+++ b/drivers/net/ethernet/emulex/benet/be_hw.h
@@ -32,8 +32,8 @@
 #define MPU_EP_CONTROL          0
 
 /********** MPU semphore: used for SH & BE  *************/
-#define SLIPORT_SEMAPHORE_OFFSET_BE             0x7c
-#define SLIPORT_SEMAPHORE_OFFSET_SH             0x94
+#define SLIPORT_SEMAPHORE_OFFSET_BEx            0xac  /* CSR BAR offset */
+#define SLIPORT_SEMAPHORE_OFFSET_SH             0x94  /* PCI-CFG offset */
 #define POST_STAGE_MASK                         0x0000FFFF
 #define POST_ERR_MASK                           0x1
 #define POST_ERR_SHIFT                          31
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 3860888ac711..08e54f3d288b 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3688,6 +3688,8 @@ static void be_netdev_init(struct net_device *netdev)
 
 static void be_unmap_pci_bars(struct be_adapter *adapter)
 {
+        if (adapter->csr)
+                pci_iounmap(adapter->pdev, adapter->csr);
         if (adapter->db)
                 pci_iounmap(adapter->pdev, adapter->db);
 }
@@ -3721,6 +3723,12 @@ static int be_map_pci_bars(struct be_adapter *adapter)
         adapter->if_type = (sli_intf & SLI_INTF_IF_TYPE_MASK) >>
                                 SLI_INTF_IF_TYPE_SHIFT;
 
+        if (BEx_chip(adapter) && be_physfn(adapter)) {
+                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                if (adapter->csr == NULL)
+                        return -ENOMEM;
+        }
+
         addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
         if (addr == NULL)
                 goto pci_map_err;
@@ -4329,6 +4337,8 @@ static pci_ers_result_t be_eeh_reset(struct pci_dev *pdev)
         pci_restore_state(pdev);
 
         /* Check if card is ok and fw is ready */
+        dev_info(&adapter->pdev->dev,
+                 "Waiting for FW to be ready after EEH reset\n");
         status = be_fw_wait_ready(adapter);
         if (status)
                 return PCI_ERS_RESULT_DISCONNECT;
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index fccc3bf2141d..069a155d16ed 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -246,14 +246,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct bufdesc *bdp;
         void *bufaddr;
         unsigned short  status;
-        unsigned long flags;
+        unsigned int index;
 
         if (!fep->link) {
                 /* Link is down or autonegotiation is in progress. */
                 return NETDEV_TX_BUSY;
         }
 
-        spin_lock_irqsave(&fep->hw_lock, flags);
         /* Fill in a Tx ring entry */
         bdp = fep->cur_tx;
 
@@ -264,7 +263,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                  * This should not happen, since ndev->tbusy should be set.
                  */
                 printk("%s: tx queue full!.\n", ndev->name);
-                spin_unlock_irqrestore(&fep->hw_lock, flags);
                 return NETDEV_TX_BUSY;
         }
 
@@ -280,13 +278,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
          * 4-byte boundaries. Use bounce buffers to copy data
          * and get it aligned. Ugh.
          */
+        if (fep->bufdesc_ex)
+                index = (struct bufdesc_ex *)bdp -
+                        (struct bufdesc_ex *)fep->tx_bd_base;
+        else
+                index = bdp - fep->tx_bd_base;
+
         if (((unsigned long) bufaddr) & FEC_ALIGNMENT) {
-                unsigned int index;
-                if (fep->bufdesc_ex)
-                        index = (struct bufdesc_ex *)bdp -
-                                (struct bufdesc_ex *)fep->tx_bd_base;
-                else
-                        index = bdp - fep->tx_bd_base;
                 memcpy(fep->tx_bounce[index], skb->data, skb->len);
                 bufaddr = fep->tx_bounce[index];
         }
@@ -300,10 +298,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 swap_buffer(bufaddr, skb->len);
 
         /* Save skb pointer */
-        fep->tx_skbuff[fep->skb_cur] = skb;
-
-        ndev->stats.tx_bytes += skb->len;
-        fep->skb_cur = (fep->skb_cur+1) & TX_RING_MOD_MASK;
+        fep->tx_skbuff[index] = skb;
 
         /* Push the data cache so the CPM does not get stale memory
          * data.
@@ -331,26 +326,22 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                         ebdp->cbd_esc = BD_ENET_TX_INT;
                 }
         }
-        /* Trigger transmission start */
-        writel(0, fep->hwp + FEC_X_DES_ACTIVE);
-
         /* If this was the last BD in the ring, start at the beginning again. */
         if (status & BD_ENET_TX_WRAP)
                 bdp = fep->tx_bd_base;
         else
                 bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
 
-        if (bdp == fep->dirty_tx) {
-                fep->tx_full = 1;
+        fep->cur_tx = bdp;
+
+        if (fep->cur_tx == fep->dirty_tx)
                 netif_stop_queue(ndev);
-        }
 
-        fep->cur_tx = bdp;
+        /* Trigger transmission start */
+        writel(0, fep->hwp + FEC_X_DES_ACTIVE);
 
         skb_tx_timestamp(skb);
 
-        spin_unlock_irqrestore(&fep->hw_lock, flags);
-
         return NETDEV_TX_OK;
 }
 
@@ -406,11 +397,8 @@ fec_restart(struct net_device *ndev, int duplex)
                 writel((unsigned long)fep->bd_dma + sizeof(struct bufdesc)
                         * RX_RING_SIZE, fep->hwp + FEC_X_DES_START);
 
-        fep->dirty_tx = fep->cur_tx = fep->tx_bd_base;
         fep->cur_rx = fep->rx_bd_base;
 
-        /* Reset SKB transmit buffers. */
-        fep->skb_cur = fep->skb_dirty = 0;
         for (i = 0; i <= TX_RING_MOD_MASK; i++) {
                 if (fep->tx_skbuff[i]) {
                         dev_kfree_skb_any(fep->tx_skbuff[i]);
@@ -573,20 +561,35 @@ fec_enet_tx(struct net_device *ndev)
         struct bufdesc *bdp;
         unsigned short status;
         struct  sk_buff *skb;
+        int     index = 0;
 
         fep = netdev_priv(ndev);
-        spin_lock(&fep->hw_lock);
         bdp = fep->dirty_tx;
 
+        /* get next bdp of dirty_tx */
+        if (bdp->cbd_sc & BD_ENET_TX_WRAP)
+                bdp = fep->tx_bd_base;
+        else
+                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
+
         while (((status = bdp->cbd_sc) & BD_ENET_TX_READY) == 0) {
-                if (bdp == fep->cur_tx && fep->tx_full == 0)
+
+                /* current queue is empty */
+                if (bdp == fep->cur_tx)
                         break;
 
+                if (fep->bufdesc_ex)
+                        index = (struct bufdesc_ex *)bdp -
+                                (struct bufdesc_ex *)fep->tx_bd_base;
+                else
+                        index = bdp - fep->tx_bd_base;
+
                 dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
                                 FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
                 bdp->cbd_bufaddr = 0;
 
-                skb = fep->tx_skbuff[fep->skb_dirty];
+                skb = fep->tx_skbuff[index];
+
                 /* Check for errors. */
                 if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
                                    BD_ENET_TX_RL | BD_ENET_TX_UN |
@@ -631,8 +634,9 @@ fec_enet_tx(struct net_device *ndev)
 
                 /* Free the sk buffer associated with this last transmit */
                 dev_kfree_skb_any(skb);
-                fep->tx_skbuff[fep->skb_dirty] = NULL;
-                fep->skb_dirty = (fep->skb_dirty + 1) & TX_RING_MOD_MASK;
+                fep->tx_skbuff[index] = NULL;
+
+                fep->dirty_tx = bdp;
 
                 /* Update pointer to next buffer descriptor to be transmitted */
                 if (status & BD_ENET_TX_WRAP)
@@ -642,14 +646,12 @@ fec_enet_tx(struct net_device *ndev)
 
                 /* Since we have freed up a buffer, the ring is no longer full
                  */
-                if (fep->tx_full) {
-                        fep->tx_full = 0;
+                if (fep->dirty_tx != fep->cur_tx) {
                         if (netif_queue_stopped(ndev))
                                 netif_wake_queue(ndev);
                 }
         }
-        fep->dirty_tx = bdp;
-        spin_unlock(&fep->hw_lock);
+        return;
 }
 
 
@@ -816,7 +818,7 @@ fec_enet_interrupt(int irq, void *dev_id)
                 int_events = readl(fep->hwp + FEC_IEVENT);
                 writel(int_events, fep->hwp + FEC_IEVENT);
 
-                if (int_events & FEC_ENET_RXF) {
+                if (int_events & (FEC_ENET_RXF | FEC_ENET_TXF)) {
                         ret = IRQ_HANDLED;
 
                         /* Disable the RX interrupt */
@@ -827,15 +829,6 @@ fec_enet_interrupt(int irq, void *dev_id)
                         }
                 }
 
-                /* Transmit OK, or non-fatal error. Update the buffer
-                 * descriptors. FEC handles all errors, we just discover
-                 * them as part of the transmit process.
-                 */
-                if (int_events & FEC_ENET_TXF) {
-                        ret = IRQ_HANDLED;
-                        fec_enet_tx(ndev);
-                }
-
                 if (int_events & FEC_ENET_MII) {
                         ret = IRQ_HANDLED;
                         complete(&fep->mdio_done);
@@ -851,6 +844,8 @@ static int fec_enet_rx_napi(struct napi_struct *napi, int budget)
         int pkts = fec_enet_rx(ndev, budget);
         struct fec_enet_private *fep = netdev_priv(ndev);
 
+        fec_enet_tx(ndev);
+
         if (pkts < budget) {
                 napi_complete(napi);
                 writel(FEC_DEFAULT_IMASK, fep->hwp + FEC_IMASK);
@@ -1646,6 +1641,7 @@ static int fec_enet_init(struct net_device *ndev)
 
         /* ...and the same for transmit */
         bdp = fep->tx_bd_base;
+        fep->cur_tx = bdp;
         for (i = 0; i < TX_RING_SIZE; i++) {
 
                 /* Initialize the BD for every fragment in the page. */
@@ -1657,6 +1653,7 @@ static int fec_enet_init(struct net_device *ndev)
         /* Set the last buffer to wrap */
         bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
         bdp->cbd_sc |= BD_SC_WRAP;
+        fep->dirty_tx = bdp;
 
         fec_restart(ndev, 0);
 
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 01579b8e37c4..f5390071efd0 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -97,6 +97,13 @@ struct bufdesc {
         unsigned short cbd_sc;  /* Control and status info */
         unsigned long cbd_bufaddr;      /* Buffer address */
 };
+#else
+struct bufdesc {
+        unsigned short  cbd_sc;                 /* Control and status info */
+        unsigned short  cbd_datlen;             /* Data length */
+        unsigned long   cbd_bufaddr;            /* Buffer address */
+};
+#endif
 
 struct bufdesc_ex {
         struct bufdesc desc;
@@ -107,14 +114,6 @@ struct bufdesc_ex {
         unsigned short res0[4];
 };
 
-#else
-struct bufdesc {
-        unsigned short  cbd_sc;                 /* Control and status info */
-        unsigned short  cbd_datlen;             /* Data length */
-        unsigned long   cbd_bufaddr;            /* Buffer address */
-};
-#endif
-
 /*
  *      The following definitions courtesy of commproc.h, which where
  *      Copyright (c) 1997 Dan Malek (dmalek@jlc.net).
@@ -214,8 +213,6 @@ struct fec_enet_private {
         unsigned char *tx_bounce[TX_RING_SIZE];
         struct  sk_buff *tx_skbuff[TX_RING_SIZE];
         struct  sk_buff *rx_skbuff[RX_RING_SIZE];
-        ushort  skb_cur;
-        ushort  skb_dirty;
 
         /* CPM dual port RAM relative addresses */
         dma_addr_t      bd_dma;
@@ -227,7 +224,6 @@ struct fec_enet_private {
         /* The ring entries to be free()ed */
         struct bufdesc  *dirty_tx;
 
-        uint    tx_full;
         /* hold while accessing the HW like ringbuffer for tx/rx but not MAC */
         spinlock_t hw_lock;
 
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index dff7bff8b8e0..121a865c7fbd 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -782,6 +782,59 @@ release:
 }
 
 /**
+ *  e1000_k1_workaround_lpt_lp - K1 workaround on Lynxpoint-LP
+ *  @hw:   pointer to the HW structure
+ *  @link: link up bool flag
+ *
+ *  When K1 is enabled for 1Gbps, the MAC can miss 2 DMA completion indications
+ *  preventing further DMA write requests.  Workaround the issue by disabling
+ *  the de-assertion of the clock request when in 1Gpbs mode.
+ **/
+static s32 e1000_k1_workaround_lpt_lp(struct e1000_hw *hw, bool link)
+{
+        u32 fextnvm6 = er32(FEXTNVM6);
+        s32 ret_val = 0;
+
+        if (link && (er32(STATUS) & E1000_STATUS_SPEED_1000)) {
+                u16 kmrn_reg;
+
+                ret_val = hw->phy.ops.acquire(hw);
+                if (ret_val)
+                        return ret_val;
+
+                ret_val =
+                    e1000e_read_kmrn_reg_locked(hw, E1000_KMRNCTRLSTA_K1_CONFIG,
+                                                &kmrn_reg);
+                if (ret_val)
+                        goto release;
+
+                ret_val =
+                    e1000e_write_kmrn_reg_locked(hw,
+                                                 E1000_KMRNCTRLSTA_K1_CONFIG,
+                                                 kmrn_reg &
+                                                 ~E1000_KMRNCTRLSTA_K1_ENABLE);
+                if (ret_val)
+                        goto release;
+
+                usleep_range(10, 20);
+
+                ew32(FEXTNVM6, fextnvm6 | E1000_FEXTNVM6_REQ_PLL_CLK);
+
+                ret_val =
+                    e1000e_write_kmrn_reg_locked(hw,
+                                                 E1000_KMRNCTRLSTA_K1_CONFIG,
+                                                 kmrn_reg);
+release:
+                hw->phy.ops.release(hw);
+        } else {
+                /* clear FEXTNVM6 bit 8 on link down or 10/100 */
+                ew32(FEXTNVM6, fextnvm6 & ~E1000_FEXTNVM6_REQ_PLL_CLK);
+        }
+
+        return ret_val;
+}
+
+/**
  *  e1000_check_for_copper_link_ich8lan - Check for link (Copper)
  *  @hw: pointer to the HW structure
  *
@@ -818,6 +871,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                         return ret_val;
         }
 
+        /* Work-around I218 hang issue */
+        if ((hw->adapter->pdev->device == E1000_DEV_ID_PCH_LPTLP_I218_LM) ||
+            (hw->adapter->pdev->device == E1000_DEV_ID_PCH_LPTLP_I218_V)) {
+                ret_val = e1000_k1_workaround_lpt_lp(hw, link);
+                if (ret_val)
+                        return ret_val;
+        }
+
         /* Clear link partner's EEE ability */
         hw->dev_spec.ich8lan.eee_lp_ability = 0;
 
@@ -3954,8 +4015,16 @@ void e1000_suspend_workarounds_ich8lan(struct e1000_hw *hw)
 
         phy_ctrl = er32(PHY_CTRL);
         phy_ctrl |= E1000_PHY_CTRL_GBE_DISABLE;
+
         if (hw->phy.type == e1000_phy_i217) {
-                u16 phy_reg;
+                u16 phy_reg, device_id = hw->adapter->pdev->device;
+
+                if ((device_id == E1000_DEV_ID_PCH_LPTLP_I218_LM) ||
+                    (device_id == E1000_DEV_ID_PCH_LPTLP_I218_V)) {
+                        u32 fextnvm6 = er32(FEXTNVM6);
+
+                        ew32(FEXTNVM6, fextnvm6 & ~E1000_FEXTNVM6_REQ_PLL_CLK);
+                }
 
                 ret_val = hw->phy.ops.acquire(hw);
                 if (ret_val)
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index b6d3174d7d2d..8bf4655c2e17 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -92,6 +92,8 @@
 #define E1000_FEXTNVM4_BEACON_DURATION_8USEC    0x7
 #define E1000_FEXTNVM4_BEACON_DURATION_16USEC   0x3
 
+#define E1000_FEXTNVM6_REQ_PLL_CLK      0x00000100
+
 #define PCIE_ICH8_SNOOP_ALL     PCIE_NO_SNOOP_ALL
 
 #define E1000_ICH_RAR_ENTRIES   7
diff --git a/drivers/net/ethernet/intel/e1000e/regs.h b/drivers/net/ethernet/intel/e1000e/regs.h
index 794fe1497666..a7e6a3e37257 100644
--- a/drivers/net/ethernet/intel/e1000e/regs.h
+++ b/drivers/net/ethernet/intel/e1000e/regs.h
@@ -42,6 +42,7 @@
 #define E1000_FEXTNVM   0x00028 /* Future Extended NVM - RW */
 #define E1000_FEXTNVM3  0x0003C /* Future Extended NVM 3 - RW */
 #define E1000_FEXTNVM4  0x00024 /* Future Extended NVM 4 - RW */
+#define E1000_FEXTNVM6  0x00010 /* Future Extended NVM 6 - RW */
 #define E1000_FEXTNVM7  0x000E4 /* Future Extended NVM 7 - RW */
 #define E1000_FCT       0x00030 /* Flow Control Type - RW */
 #define E1000_VET       0x00038 /* VLAN Ether Type - RW */
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 84e7e0909def..b64542acfa34 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1361,11 +1361,16 @@ static s32 igb_setup_copper_link_82575(struct e1000_hw *hw)
         switch (hw->phy.type) {
         case e1000_phy_i210:
         case e1000_phy_m88:
-                if (hw->phy.id == I347AT4_E_PHY_ID ||
-                    hw->phy.id == M88E1112_E_PHY_ID)
+                switch (hw->phy.id) {
+                case I347AT4_E_PHY_ID:
+                case M88E1112_E_PHY_ID:
+                case I210_I_PHY_ID:
                         ret_val = igb_copper_link_setup_m88_gen2(hw);
-                else
+                        break;
+                default:
                         ret_val = igb_copper_link_setup_m88(hw);
+                        break;
+                }
                 break;
         case e1000_phy_igp_3:
                 ret_val = igb_copper_link_setup_igp(hw);
diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index d27edbc63923..25151401c2ab 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -447,7 +447,7 @@ struct igb_adapter {
 #endif
         struct i2c_algo_bit_data i2c_algo;
         struct i2c_adapter i2c_adap;
-        struct igb_i2c_client_list *i2c_clients;
+        struct i2c_client *i2c_client;
 };
 
 #define IGB_FLAG_HAS_MSI                (1 << 0)
diff --git a/drivers/net/ethernet/intel/igb/igb_hwmon.c b/drivers/net/ethernet/intel/igb/igb_hwmon.c
index 0a9b073d0b03..4623502054d5 100644
--- a/drivers/net/ethernet/intel/igb/igb_hwmon.c
+++ b/drivers/net/ethernet/intel/igb/igb_hwmon.c
@@ -39,6 +39,10 @@
 #include <linux/pci.h>
 
 #ifdef CONFIG_IGB_HWMON
+struct i2c_board_info i350_sensor_info = {
+        I2C_BOARD_INFO("i350bb", (0Xf8 >> 1)),
+};
+
 /* hwmon callback functions */
 static ssize_t igb_hwmon_show_location(struct device *dev,
                                          struct device_attribute *attr,
@@ -188,6 +192,7 @@ int igb_sysfs_init(struct igb_adapter *adapter)
         unsigned int i;
         int n_attrs;
         int rc = 0;
+        struct i2c_client *client = NULL;
 
         /* If this method isn't defined we don't support thermals */
         if (adapter->hw.mac.ops.init_thermal_sensor_thresh == NULL)
@@ -198,6 +203,15 @@ int igb_sysfs_init(struct igb_adapter *adapter)
                 if (rc)
                         goto exit;
 
+        /* init i2c_client */
+        client = i2c_new_device(&adapter->i2c_adap, &i350_sensor_info);
+        if (client == NULL) {
+                dev_info(&adapter->pdev->dev,
+                        "Failed to create new i2c device..\n");
+                goto exit;
+        }
+        adapter->i2c_client = client;
+
         /* Allocation space for max attributes
          * max num sensors * values (loc, temp, max, caution)
          */
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index ed79a1c53b59..4dbd62968c7a 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1923,10 +1923,6 @@ void igb_set_fw_version(struct igb_adapter *adapter)
         return;
 }
 
-static const struct i2c_board_info i350_sensor_info = {
-        I2C_BOARD_INFO("i350bb", 0Xf8),
-};
-
 /*  igb_init_i2c - Init I2C interface
  *  @adapter: pointer to adapter structure
  *
@@ -6227,13 +6223,6 @@ static struct sk_buff *igb_build_rx_buffer(struct igb_ring *rx_ring,
         /* If we spanned a buffer we have a huge mess so test for it */
         BUG_ON(unlikely(!igb_test_staterr(rx_desc, E1000_RXD_STAT_EOP)));
 
-        /* Guarantee this function can be used by verifying buffer sizes */
-        BUILD_BUG_ON(SKB_WITH_OVERHEAD(IGB_RX_BUFSZ) < (NET_SKB_PAD +
-                                                        NET_IP_ALIGN +
-                                                        IGB_TS_HDR_LEN +
-                                                        ETH_FRAME_LEN +
-                                                        ETH_FCS_LEN));
-
         rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
         page = rx_buffer->page;
         prefetchw(page);
@@ -7724,67 +7713,6 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba)
         }
 }
 
-static DEFINE_SPINLOCK(i2c_clients_lock);
-
-/*  igb_get_i2c_client - returns matching client
- *  in adapters's client list.
- *  @adapter: adapter struct
- *  @dev_addr: device address of i2c needed.
- */
-static struct i2c_client *
-igb_get_i2c_client(struct igb_adapter *adapter, u8 dev_addr)
-{
-        ulong flags;
-        struct igb_i2c_client_list *client_list;
-        struct i2c_client *client = NULL;
-        struct i2c_board_info client_info = {
-                I2C_BOARD_INFO("igb", 0x00),
-        };
-
-        spin_lock_irqsave(&i2c_clients_lock, flags);
-        client_list = adapter->i2c_clients;
-
-        /* See if we already have an i2c_client */
-        while (client_list) {
-                if (client_list->client->addr == (dev_addr >> 1)) {
-                        client = client_list->client;
-                        goto exit;
-                } else {
-                        client_list = client_list->next;
-                }
-        }
-
-        /* no client_list found, create a new one */
-        client_list = kzalloc(sizeof(*client_list), GFP_ATOMIC);
-        if (client_list == NULL)
-                goto exit;
-
-        /* dev_addr passed to us is left-shifted by 1 bit
-         * i2c_new_device call expects it to be flush to the right.
-         */
-        client_info.addr = dev_addr >> 1;
-        client_info.platform_data = adapter;
-        client_list->client = i2c_new_device(&adapter->i2c_adap, &client_info);
-        if (client_list->client == NULL) {
-                dev_info(&adapter->pdev->dev,
-                        "Failed to create new i2c device..\n");
-                goto err_no_client;
-        }
-
-        /* insert new client at head of list */
-        client_list->next = adapter->i2c_clients;
-        adapter->i2c_clients = client_list;
-
-        client = client_list->client;
-        goto exit;
-
-err_no_client:
-        kfree(client_list);
-exit:
-        spin_unlock_irqrestore(&i2c_clients_lock, flags);
-        return client;
-}
-
 /*  igb_read_i2c_byte - Reads 8 bit word over I2C
  *  @hw: pointer to hardware structure
  *  @byte_offset: byte offset to read
@@ -7798,7 +7726,7 @@ s32 igb_read_i2c_byte(struct e1000_hw *hw, u8 byte_offset,
                                 u8 dev_addr, u8 *data)
 {
         struct igb_adapter *adapter = container_of(hw, struct igb_adapter, hw);
-        struct i2c_client *this_client = igb_get_i2c_client(adapter, dev_addr);
+        struct i2c_client *this_client = adapter->i2c_client;
         s32 status;
         u16 swfw_mask = 0;
 
@@ -7835,7 +7763,7 @@ s32 igb_write_i2c_byte(struct e1000_hw *hw, u8 byte_offset,
                                  u8 dev_addr, u8 data)
 {
         struct igb_adapter *adapter = container_of(hw, struct igb_adapter, hw);
-        struct i2c_client *this_client = igb_get_i2c_client(adapter, dev_addr);
+        struct i2c_client *this_client = adapter->i2c_client;
         s32 status;
         u16 swfw_mask = E1000_SWFW_PHY0_SM;
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 8900398ba103..28fb50a1e9c3 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4765,8 +4765,10 @@ static void rtl_hw_start_8168bb(struct rtl8169_private *tp)
 
         RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 
-        rtl_tx_performance_tweak(pdev,
-                (0x5 << MAX_READ_REQUEST_SHIFT) | PCI_EXP_DEVCTL_NOSNOOP_EN);
+        if (tp->dev->mtu <= ETH_DATA_LEN) {
+                rtl_tx_performance_tweak(pdev, (0x5 << MAX_READ_REQUEST_SHIFT) |
+                                         PCI_EXP_DEVCTL_NOSNOOP_EN);
+        }
 }
 
 static void rtl_hw_start_8168bef(struct rtl8169_private *tp)
@@ -4789,7 +4791,8 @@ static void __rtl_hw_start_8168cp(struct rtl8169_private *tp)
 
         RTL_W8(Config3, RTL_R8(Config3) & ~Beacon_en);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         rtl_disable_clock_request(pdev);
 
@@ -4822,7 +4825,8 @@ static void rtl_hw_start_8168cp_2(struct rtl8169_private *tp)
 
         RTL_W8(Config3, RTL_R8(Config3) & ~Beacon_en);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 }
@@ -4841,7 +4845,8 @@ static void rtl_hw_start_8168cp_3(struct rtl8169_private *tp)
 
         RTL_W8(MaxTxPacketSize, TxPacketMax);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 }
@@ -4901,7 +4906,8 @@ static void rtl_hw_start_8168d(struct rtl8169_private *tp)
 
         RTL_W8(MaxTxPacketSize, TxPacketMax);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 }
@@ -4913,7 +4919,8 @@ static void rtl_hw_start_8168dp(struct rtl8169_private *tp)
 
         rtl_csi_access_enable_1(tp);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W8(MaxTxPacketSize, TxPacketMax);
 
@@ -4972,7 +4979,8 @@ static void rtl_hw_start_8168e_1(struct rtl8169_private *tp)
 
         rtl_ephy_init(tp, e_info_8168e_1, ARRAY_SIZE(e_info_8168e_1));
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W8(MaxTxPacketSize, TxPacketMax);
 
@@ -4998,7 +5006,8 @@ static void rtl_hw_start_8168e_2(struct rtl8169_private *tp)
 
         rtl_ephy_init(tp, e_info_8168e_2, ARRAY_SIZE(e_info_8168e_2));
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         rtl_eri_write(tp, 0xc0, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xb8, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index bf57b3cb16ab..0bc00991d310 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -779,6 +779,7 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
                                                 tx_queue->txd.entries);
         }
 
+        efx_device_detach_sync(efx);
         efx_stop_all(efx);
         efx_stop_interrupts(efx, true);
 
@@ -832,6 +833,7 @@ out:
 
         efx_start_interrupts(efx, true);
         efx_start_all(efx);
+        netif_device_attach(efx->net_dev);
         return rc;
 
 rollback:
@@ -1641,8 +1643,12 @@ static void efx_stop_all(struct efx_nic *efx)
         /* Flush efx_mac_work(), refill_workqueue, monitor_work */
         efx_flush_all(efx);
 
-        /* Stop the kernel transmit interface late, so the watchdog
-         * timer isn't ticking over the flush */
+        /* Stop the kernel transmit interface.  This is only valid if
+         * the device is stopped or detached; otherwise the watchdog
+         * may fire immediately.
+         */
+        WARN_ON(netif_running(efx->net_dev) &&
+                netif_device_present(efx->net_dev));
         netif_tx_disable(efx->net_dev);
 
         efx_stop_datapath(efx);
@@ -1963,16 +1969,18 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
         if (new_mtu > EFX_MAX_MTU)
                 return -EINVAL;
 
-        efx_stop_all(efx);
-
         netif_dbg(efx, drv, efx->net_dev, "changing MTU to %d\n", new_mtu);
 
+        efx_device_detach_sync(efx);
+        efx_stop_all(efx);
+
         mutex_lock(&efx->mac_lock);
         net_dev->mtu = new_mtu;
         efx->type->reconfigure_mac(efx);
         mutex_unlock(&efx->mac_lock);
 
         efx_start_all(efx);
+        netif_device_attach(efx->net_dev);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
index 50247dfe8f57..d2f790df6dcb 100644
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -171,9 +171,9 @@ static inline void efx_device_detach_sync(struct efx_nic *efx)
          * TX scheduler is stopped when we're done and before
          * netif_device_present() becomes false.
          */
-        netif_tx_lock(dev);
+        netif_tx_lock_bh(dev);
         netif_device_detach(dev);
-        netif_tx_unlock(dev);
+        netif_tx_unlock_bh(dev);
 }
 
 #endif /* EFX_EFX_H */
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index 2d756c1d7142..0a90abd2421b 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -210,6 +210,7 @@ struct efx_tx_queue {
  *      Will be %NULL if the buffer slot is currently free.
  * @page: The associated page buffer. Valif iff @flags & %EFX_RX_BUF_PAGE.
  *      Will be %NULL if the buffer slot is currently free.
+ * @page_offset: Offset within page. Valid iff @flags & %EFX_RX_BUF_PAGE.
  * @len: Buffer length, in bytes.
  * @flags: Flags for buffer and packet state.
  */
@@ -219,7 +220,8 @@ struct efx_rx_buffer {
                 struct sk_buff *skb;
                 struct page *page;
         } u;
-        unsigned int len;
+        u16 page_offset;
+        u16 len;
         u16 flags;
 };
 #define EFX_RX_BUF_PAGE         0x0001
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index d780a0d096b4..bb579a6128c8 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -90,11 +90,7 @@ static unsigned int rx_refill_threshold;
 static inline unsigned int efx_rx_buf_offset(struct efx_nic *efx,
                                              struct efx_rx_buffer *buf)
 {
-        /* Offset is always within one page, so we don't need to consider
-         * the page order.
-         */
-        return ((unsigned int) buf->dma_addr & (PAGE_SIZE - 1)) +
-                efx->type->rx_buffer_hash_size;
+        return buf->page_offset + efx->type->rx_buffer_hash_size;
 }
 static inline unsigned int efx_rx_buf_size(struct efx_nic *efx)
 {
@@ -187,6 +183,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
         struct efx_nic *efx = rx_queue->efx;
         struct efx_rx_buffer *rx_buf;
         struct page *page;
+        unsigned int page_offset;
         struct efx_rx_page_state *state;
         dma_addr_t dma_addr;
         unsigned index, count;
@@ -211,12 +208,14 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
                 state->dma_addr = dma_addr;
 
                 dma_addr += sizeof(struct efx_rx_page_state);
+                page_offset = sizeof(struct efx_rx_page_state);
 
         split:
                 index = rx_queue->added_count & rx_queue->ptr_mask;
                 rx_buf = efx_rx_buffer(rx_queue, index);
                 rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN;
                 rx_buf->u.page = page;
+                rx_buf->page_offset = page_offset + EFX_PAGE_IP_ALIGN;
                 rx_buf->len = efx->rx_buffer_len - EFX_PAGE_IP_ALIGN;
                 rx_buf->flags = EFX_RX_BUF_PAGE;
                 ++rx_queue->added_count;
@@ -227,6 +226,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
                         /* Use the second half of the page */
                         get_page(page);
                         dma_addr += (PAGE_SIZE >> 1);
+                        page_offset += (PAGE_SIZE >> 1);
                         ++count;
                         goto split;
                 }
@@ -236,7 +236,8 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
 }
 
 static void efx_unmap_rx_buffer(struct efx_nic *efx,
-                                struct efx_rx_buffer *rx_buf)
+                                struct efx_rx_buffer *rx_buf,
+                                unsigned int used_len)
 {
         if ((rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.page) {
                 struct efx_rx_page_state *state;
@@ -247,6 +248,10 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
                                        state->dma_addr,
                                        efx_rx_buf_size(efx),
                                        DMA_FROM_DEVICE);
+                } else if (used_len) {
+                        dma_sync_single_for_cpu(&efx->pci_dev->dev,
+                                                rx_buf->dma_addr, used_len,
+                                                DMA_FROM_DEVICE);
                 }
         } else if (!(rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.skb) {
                 dma_unmap_single(&efx->pci_dev->dev, rx_buf->dma_addr,
@@ -269,7 +274,7 @@ static void efx_free_rx_buffer(struct efx_nic *efx,
 static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
                                struct efx_rx_buffer *rx_buf)
 {
-        efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
+        efx_unmap_rx_buffer(rx_queue->efx, rx_buf, 0);
         efx_free_rx_buffer(rx_queue->efx, rx_buf);
 }
 
@@ -535,10 +540,10 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
                 goto out;
         }
 
-        /* Release card resources - assumes all RX buffers consumed in-order
-         * per RX queue
+        /* Release and/or sync DMA mapping - assumes all RX buffers
+         * consumed in-order per RX queue
          */
-        efx_unmap_rx_buffer(efx, rx_buf);
+        efx_unmap_rx_buffer(efx, rx_buf, len);
 
         /* Prefetch nice and early so data will (hopefully) be in cache by
          * the time we look at it.
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 7e93df6585e7..01ffbc486982 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -731,7 +731,7 @@ static inline void cpsw_add_default_vlan(struct cpsw_priv *priv)
 
         writel(vlan, &priv->host_port_regs->port_vlan);
 
-        for (i = 0; i < 2; i++)
+        for (i = 0; i < priv->data.slaves; i++)
                 slave_write(priv->slaves + i, vlan, reg);
 
         cpsw_ale_add_vlan(priv->ale, vlan, ALE_ALL_PORTS << port,
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 29934446436a..abf7b6153d00 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -257,8 +257,7 @@ static struct phy_driver ksphy_driver[] = {
         .phy_id         = PHY_ID_KSZ9021,
         .phy_id_mask    = 0x000ffffe,
         .name           = "Micrel KSZ9021 Gigabit PHY",
-        .features       = (PHY_GBIT_FEATURES | SUPPORTED_Pause
-                                | SUPPORTED_Asym_Pause),
+        .features       = (PHY_GBIT_FEATURES | SUPPORTED_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
         .config_init    = kszphy_config_init,
         .config_aneg    = genphy_config_aneg,
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 9930f9999561..3657b4a29124 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -44,13 +44,13 @@ MODULE_LICENSE("GPL");
 
 void phy_device_free(struct phy_device *phydev)
 {
-        kfree(phydev);
+        put_device(&phydev->dev);
 }
 EXPORT_SYMBOL(phy_device_free);
 
 static void phy_device_release(struct device *dev)
 {
-        phy_device_free(to_phy_device(dev));
+        kfree(to_phy_device(dev));
 }
 
 static struct phy_driver genphy_driver;
@@ -201,6 +201,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
            there's no driver _already_ loaded. */
         request_module(MDIO_MODULE_PREFIX MDIO_ID_FMT, MDIO_ID_ARGS(phy_id));
 
+        device_initialize(&dev->dev);
+
         return dev;
 }
 EXPORT_SYMBOL(phy_device_create);
@@ -363,9 +365,9 @@ int phy_device_register(struct phy_device *phydev)
         /* Run all of the fixups for this PHY */
         phy_scan_fixups(phydev);
 
-        err = device_register(&phydev->dev);
+        err = device_add(&phydev->dev);
         if (err) {
-                pr_err("phy %d failed to register\n", phydev->addr);
+                pr_err("PHY %d failed to add\n", phydev->addr);
                 goto out;
         }
 
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index da92ed3797aa..3b6e9b83342d 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -156,6 +156,24 @@ config USB_NET_AX8817X
           This driver creates an interface named "ethX", where X depends on
           what other networking devices you have in use.
 
+config USB_NET_AX88179_178A
+        tristate "ASIX AX88179/178A USB 3.0/2.0 to Gigabit Ethernet"
+        depends on USB_USBNET
+        select CRC32
+        select PHYLIB
+        default y
+        help
+          This option adds support for ASIX AX88179 based USB 3.0/2.0
+          to Gigabit Ethernet adapters.
+
+          This driver should work with at least the following devices:
+            * ASIX AX88179
+            * ASIX AX88178A
+            * Sitcomm LN-032
+
+          This driver creates an interface named "ethX", where X depends on
+          what other networking devices you have in use.
+
 config USB_NET_CDCETHER
         tristate "CDC Ethernet support (smart devices such as cable modems)"
         depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 478691326f37..119b06c9aa16 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_RTL8150)	+= rtl8150.o
 obj-$(CONFIG_USB_HSO)           += hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 asix-y := asix_devices.o asix_common.o ax88172a.o
+obj-$(CONFIG_USB_NET_AX88179_178A)      += ax88179_178a.o
 obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 2205dbc8d32f..709753469099 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -924,6 +924,29 @@ static const struct driver_info ax88178_info = {
         .tx_fixup = asix_tx_fixup,
 };
 
+/*
+ * USBLINK 20F9 "USB 2.0 LAN" USB ethernet adapter, typically found in
+ * no-name packaging.
+ * USB device strings are:
+ *   1: Manufacturer: USBLINK
+ *   2: Product: HG20F9 USB2.0
+ *   3: Serial: 000003
+ * Appears to be compatible with Asix 88772B.
+ */
+static const struct driver_info hg20f9_info = {
+        .description = "HG20F9 USB 2.0 Ethernet",
+        .bind = ax88772_bind,
+        .unbind = ax88772_unbind,
+        .status = asix_status,
+        .link_reset = ax88772_link_reset,
+        .reset = ax88772_reset,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
+                 FLAG_MULTI_PACKET,
+        .rx_fixup = asix_rx_fixup_common,
+        .tx_fixup = asix_tx_fixup,
+        .data = FLAG_EEPROM_MAC,
+};
+
 extern const struct driver_info ax88172a_info;
 
 static const struct usb_device_id       products [] = {
@@ -1063,6 +1086,14 @@ static const struct usb_device_id	products [] = {
         /* ASIX 88172a demo board */
         USB_DEVICE(0x0b95, 0x172a),
         .driver_info = (unsigned long) &ax88172a_info,
+}, {
+        /*
+         * USBLINK HG20F9 "USB 2.0 LAN"
+         * Appears to have gazumped Linksys's manufacturer ID but
+         * doesn't (yet) conflict with any known Linksys product.
+         */
+        USB_DEVICE(0x066b, 0x20f9),
+        .driver_info = (unsigned long) &hg20f9_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
new file mode 100644
index 000000000000..71c27d8d214f
--- /dev/null
+++ b/drivers/net/usb/ax88179_178a.c
@@ -0,0 +1,1448 @@
+/*
+ * ASIX AX88179/178A USB 3.0/2.0 to Gigabit Ethernet Devices
+ *
+ * Copyright (C) 2011-2013 ASIX
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/usbnet.h>
+
+#define AX88179_PHY_ID                          0x03
+#define AX_EEPROM_LEN                           0x100
+#define AX88179_EEPROM_MAGIC                    0x17900b95
+#define AX_MCAST_FLTSIZE                        8
+#define AX_MAX_MCAST                            64
+#define AX_INT_PPLS_LINK                        ((u32)BIT(16))
+#define AX_RXHDR_L4_TYPE_MASK                   0x1c
+#define AX_RXHDR_L4_TYPE_UDP                    4
+#define AX_RXHDR_L4_TYPE_TCP                    16
+#define AX_RXHDR_L3CSUM_ERR                     2
+#define AX_RXHDR_L4CSUM_ERR                     1
+#define AX_RXHDR_CRC_ERR                        ((u32)BIT(31))
+#define AX_RXHDR_DROP_ERR                       ((u32)BIT(30))
+#define AX_ACCESS_MAC                           0x01
+#define AX_ACCESS_PHY                           0x02
+#define AX_ACCESS_EEPROM                        0x04
+#define AX_ACCESS_EFUS                          0x05
+#define AX_PAUSE_WATERLVL_HIGH                  0x54
+#define AX_PAUSE_WATERLVL_LOW                   0x55
+
+#define PHYSICAL_LINK_STATUS                    0x02
+        #define AX_USB_SS               0x04
+        #define AX_USB_HS               0x02
+
+#define GENERAL_STATUS                          0x03
+/* Check AX88179 version. UA1:Bit2 = 0,  UA2:Bit2 = 1 */
+        #define AX_SECLD                0x04
+
+#define AX_SROM_ADDR                            0x07
+#define AX_SROM_CMD                             0x0a
+        #define EEP_RD                  0x04
+        #define EEP_BUSY                0x10
+
+#define AX_SROM_DATA_LOW                        0x08
+#define AX_SROM_DATA_HIGH                       0x09
+
+#define AX_RX_CTL                               0x0b
+        #define AX_RX_CTL_DROPCRCERR    0x0100
+        #define AX_RX_CTL_IPE           0x0200
+        #define AX_RX_CTL_START         0x0080
+        #define AX_RX_CTL_AP            0x0020
+        #define AX_RX_CTL_AM            0x0010
+        #define AX_RX_CTL_AB            0x0008
+        #define AX_RX_CTL_AMALL         0x0002
+        #define AX_RX_CTL_PRO           0x0001
+        #define AX_RX_CTL_STOP          0x0000
+
+#define AX_NODE_ID                              0x10
+#define AX_MULFLTARY                            0x16
+
+#define AX_MEDIUM_STATUS_MODE                   0x22
+        #define AX_MEDIUM_GIGAMODE      0x01
+        #define AX_MEDIUM_FULL_DUPLEX   0x02
+        #define AX_MEDIUM_ALWAYS_ONE    0x04
+        #define AX_MEDIUM_EN_125MHZ     0x08
+        #define AX_MEDIUM_RXFLOW_CTRLEN 0x10
+        #define AX_MEDIUM_TXFLOW_CTRLEN 0x20
+        #define AX_MEDIUM_RECEIVE_EN    0x100
+        #define AX_MEDIUM_PS            0x200
+        #define AX_MEDIUM_JUMBO_EN      0x8040
+
+#define AX_MONITOR_MOD                          0x24
+        #define AX_MONITOR_MODE_RWLC    0x02
+        #define AX_MONITOR_MODE_RWMP    0x04
+        #define AX_MONITOR_MODE_PMEPOL  0x20
+        #define AX_MONITOR_MODE_PMETYPE 0x40
+
+#define AX_GPIO_CTRL                            0x25
+        #define AX_GPIO_CTRL_GPIO3EN    0x80
+        #define AX_GPIO_CTRL_GPIO2EN    0x40
+        #define AX_GPIO_CTRL_GPIO1EN    0x20
+
+#define AX_PHYPWR_RSTCTL                        0x26
+        #define AX_PHYPWR_RSTCTL_BZ     0x0010
+        #define AX_PHYPWR_RSTCTL_IPRL   0x0020
+        #define AX_PHYPWR_RSTCTL_AT     0x1000
+
+#define AX_RX_BULKIN_QCTRL                      0x2e
+#define AX_CLK_SELECT                           0x33
+        #define AX_CLK_SELECT_BCS       0x01
+        #define AX_CLK_SELECT_ACS       0x02
+        #define AX_CLK_SELECT_ULR       0x08
+
+#define AX_RXCOE_CTL                            0x34
+        #define AX_RXCOE_IP             0x01
+        #define AX_RXCOE_TCP            0x02
+        #define AX_RXCOE_UDP            0x04
+        #define AX_RXCOE_TCPV6          0x20
+        #define AX_RXCOE_UDPV6          0x40
+
+#define AX_TXCOE_CTL                            0x35
+        #define AX_TXCOE_IP             0x01
+        #define AX_TXCOE_TCP            0x02
+        #define AX_TXCOE_UDP            0x04
+        #define AX_TXCOE_TCPV6          0x20
+        #define AX_TXCOE_UDPV6          0x40
+
+#define AX_LEDCTRL                              0x73
+
+#define GMII_PHY_PHYSR                          0x11
+        #define GMII_PHY_PHYSR_SMASK    0xc000
+        #define GMII_PHY_PHYSR_GIGA     0x8000
+        #define GMII_PHY_PHYSR_100      0x4000
+        #define GMII_PHY_PHYSR_FULL     0x2000
+        #define GMII_PHY_PHYSR_LINK     0x400
+
+#define GMII_LED_ACT                            0x1a
+        #define GMII_LED_ACTIVE_MASK    0xff8f
+        #define GMII_LED0_ACTIVE        BIT(4)
+        #define GMII_LED1_ACTIVE        BIT(5)
+        #define GMII_LED2_ACTIVE        BIT(6)
+
+#define GMII_LED_LINK                           0x1c
+        #define GMII_LED_LINK_MASK      0xf888
+        #define GMII_LED0_LINK_10       BIT(0)
+        #define GMII_LED0_LINK_100      BIT(1)
+        #define GMII_LED0_LINK_1000     BIT(2)
+        #define GMII_LED1_LINK_10       BIT(4)
+        #define GMII_LED1_LINK_100      BIT(5)
+        #define GMII_LED1_LINK_1000     BIT(6)
+        #define GMII_LED2_LINK_10       BIT(8)
+        #define GMII_LED2_LINK_100      BIT(9)
+        #define GMII_LED2_LINK_1000     BIT(10)
+        #define LED0_ACTIVE             BIT(0)
+        #define LED0_LINK_10            BIT(1)
+        #define LED0_LINK_100           BIT(2)
+        #define LED0_LINK_1000          BIT(3)
+        #define LED0_FD                 BIT(4)
+        #define LED0_USB3_MASK          0x001f
+        #define LED1_ACTIVE             BIT(5)
+        #define LED1_LINK_10            BIT(6)
+        #define LED1_LINK_100           BIT(7)
+        #define LED1_LINK_1000          BIT(8)
+        #define LED1_FD                 BIT(9)
+        #define LED1_USB3_MASK          0x03e0
+        #define LED2_ACTIVE             BIT(10)
+        #define LED2_LINK_1000          BIT(13)
+        #define LED2_LINK_100           BIT(12)
+        #define LED2_LINK_10            BIT(11)
+        #define LED2_FD                 BIT(14)
+        #define LED_VALID               BIT(15)
+        #define LED2_USB3_MASK          0x7c00
+
+#define GMII_PHYPAGE                            0x1e
+#define GMII_PHY_PAGE_SELECT                    0x1f
+        #define GMII_PHY_PGSEL_EXT      0x0007
+        #define GMII_PHY_PGSEL_PAGE0    0x0000
+
+struct ax88179_data {
+        u16 rxctl;
+        u16 reserved;
+};
+
+struct ax88179_int_data {
+        __le32 intdata1;
+        __le32 intdata2;
+};
+
+static const struct {
+        unsigned char ctrl, timer_l, timer_h, size, ifg;
+} AX88179_BULKIN_SIZE[] =       {
+        {7, 0x4f, 0,    0x12, 0xff},
+        {7, 0x20, 3,    0x16, 0xff},
+        {7, 0xae, 7,    0x18, 0xff},
+        {7, 0xcc, 0x4c, 0x18, 8},
+};
+
+static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                              u16 size, void *data, int in_pm)
+{
+        int ret;
+        int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16);
+
+        BUG_ON(!dev);
+
+        if (!in_pm)
+                fn = usbnet_read_cmd;
+        else
+                fn = usbnet_read_cmd_nopm;
+
+        ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                 value, index, data, size);
+
+        if (unlikely(ret < 0))
+                netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n",
+                            index, ret);
+
+        return ret;
+}
+
+static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                               u16 size, void *data, int in_pm)
+{
+        int ret;
+        int (*fn)(struct usbnet *, u8, u8, u16, u16, const void *, u16);
+
+        BUG_ON(!dev);
+
+        if (!in_pm)
+                fn = usbnet_write_cmd;
+        else
+                fn = usbnet_write_cmd_nopm;
+
+        ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                 value, index, data, size);
+
+        if (unlikely(ret < 0))
+                netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n",
+                            index, ret);
+
+        return ret;
+}
+
+static void ax88179_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value,
+                                    u16 index, u16 size, void *data)
+{
+        u16 buf;
+
+        if (2 == size) {
+                buf = *((u16 *)data);
+                cpu_to_le16s(&buf);
+                usbnet_write_cmd_async(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR |
+                                       USB_RECIP_DEVICE, value, index, &buf,
+                                       size);
+        } else {
+                usbnet_write_cmd_async(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR |
+                                       USB_RECIP_DEVICE, value, index, data,
+                                       size);
+        }
+}
+
+static int ax88179_read_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
+                                 u16 index, u16 size, void *data)
+{
+        int ret;
+
+        if (2 == size) {
+                u16 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1);
+                le16_to_cpus(&buf);
+                *((u16 *)data) = buf;
+        } else if (4 == size) {
+                u32 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1);
+                le32_to_cpus(&buf);
+                *((u32 *)data) = buf;
+        } else {
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 1);
+        }
+
+        return ret;
+}
+
+static int ax88179_write_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
+                                  u16 index, u16 size, void *data)
+{
+        int ret;
+
+        if (2 == size) {
+                u16 buf;
+                buf = *((u16 *)data);
+                cpu_to_le16s(&buf);
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, &buf, 1);
+        } else {
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, data, 1);
+        }
+
+        return ret;
+}
+
+static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                            u16 size, void *data)
+{
+        int ret;
+
+        if (2 == size) {
+                u16 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+                le16_to_cpus(&buf);
+                *((u16 *)data) = buf;
+        } else if (4 == size) {
+                u32 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+                le32_to_cpus(&buf);
+                *((u32 *)data) = buf;
+        } else {
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 0);
+        }
+
+        return ret;
+}
+
+static int ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                             u16 size, void *data)
+{
+        int ret;
+
+        if (2 == size) {
+                u16 buf;
+                buf = *((u16 *)data);
+                cpu_to_le16s(&buf);
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, &buf, 0);
+        } else {
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, data, 0);
+        }
+
+        return ret;
+}
+
+static void ax88179_status(struct usbnet *dev, struct urb *urb)
+{
+        struct ax88179_int_data *event;
+        u32 link;
+
+        if (urb->actual_length < 8)
+                return;
+
+        event = urb->transfer_buffer;
+        le32_to_cpus((void *)&event->intdata1);
+
+        link = (((__force u32)event->intdata1) & AX_INT_PPLS_LINK) >> 16;
+
+        if (netif_carrier_ok(dev->net) != link) {
+                if (link)
+                        usbnet_defer_kevent(dev, EVENT_LINK_RESET);
+                else
+                        netif_carrier_off(dev->net);
+
+                netdev_info(dev->net, "ax88179 - Link status is: %d\n", link);
+        }
+}
+
+static int ax88179_mdio_read(struct net_device *netdev, int phy_id, int loc)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        u16 res;
+
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
+        return res;
+}
+
+static void ax88179_mdio_write(struct net_device *netdev, int phy_id, int loc,
+                               int val)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        u16 res = (u16) val;
+
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
+}
+
+static int ax88179_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        struct usbnet *dev = usb_get_intfdata(intf);
+        u16 tmp16;
+        u8 tmp8;
+
+        usbnet_suspend(intf, message);
+
+        /* Disable RX path */
+        ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                              2, 2, &tmp16);
+        tmp16 &= ~AX_MEDIUM_RECEIVE_EN;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                               2, 2, &tmp16);
+
+        /* Force bulk-in zero length */
+        ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                              2, 2, &tmp16);
+
+        tmp16 |= AX_PHYPWR_RSTCTL_BZ | AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                               2, 2, &tmp16);
+
+        /* change clock */
+        tmp8 = 0;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+
+        /* Configure RX control register => stop operation */
+        tmp16 = AX_RX_CTL_STOP;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &tmp16);
+
+        return 0;
+}
+
+/* This function is used to enable the autodetach function. */
+/* This function is determined by offset 0x43 of EEPROM */
+static int ax88179_auto_detach(struct usbnet *dev, int in_pm)
+{
+        u16 tmp16;
+        u8 tmp8;
+        int (*fnr)(struct usbnet *, u8, u16, u16, u16, void *);
+        int (*fnw)(struct usbnet *, u8, u16, u16, u16, void *);
+
+        if (!in_pm) {
+                fnr = ax88179_read_cmd;
+                fnw = ax88179_write_cmd;
+        } else {
+                fnr = ax88179_read_cmd_nopm;
+                fnw = ax88179_write_cmd_nopm;
+        }
+
+        if (fnr(dev, AX_ACCESS_EEPROM, 0x43, 1, 2, &tmp16) < 0)
+                return 0;
+
+        if ((tmp16 == 0xFFFF) || (!(tmp16 & 0x0100)))
+                return 0;
+
+        /* Enable Auto Detach bit */
+        tmp8 = 0;
+        fnr(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+        tmp8 |= AX_CLK_SELECT_ULR;
+        fnw(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+
+        fnr(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+        tmp16 |= AX_PHYPWR_RSTCTL_AT;
+        fnw(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+
+        return 0;
+}
+
+static int ax88179_resume(struct usb_interface *intf)
+{
+        struct usbnet *dev = usb_get_intfdata(intf);
+        u16 tmp16;
+        u8 tmp8;
+
+        netif_carrier_off(dev->net);
+
+        /* Power up ethernet PHY */
+        tmp16 = 0;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                               2, 2, &tmp16);
+        udelay(1000);
+
+        tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                               2, 2, &tmp16);
+        msleep(200);
+
+        /* Ethernet PHY Auto Detach*/
+        ax88179_auto_detach(dev, 1);
+
+        /* Enable clock */
+        ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC,  AX_CLK_SELECT, 1, 1, &tmp8);
+        tmp8 |= AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+        msleep(100);
+
+        /* Configure RX control register => start operation */
+        tmp16 = AX_RX_CTL_DROPCRCERR | AX_RX_CTL_IPE | AX_RX_CTL_START |
+                AX_RX_CTL_AP | AX_RX_CTL_AMALL | AX_RX_CTL_AB;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &tmp16);
+
+        return usbnet_resume(intf);
+}
+
+static void
+ax88179_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt;
+
+        if (ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD,
+                             1, 1, &opt) < 0) {
+                wolinfo->supported = 0;
+                wolinfo->wolopts = 0;
+                return;
+        }
+
+        wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
+        wolinfo->wolopts = 0;
+        if (opt & AX_MONITOR_MODE_RWLC)
+                wolinfo->wolopts |= WAKE_PHY;
+        if (opt & AX_MONITOR_MODE_RWMP)
+                wolinfo->wolopts |= WAKE_MAGIC;
+}
+
+static int
+ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt = 0;
+
+        if (wolinfo->wolopts & WAKE_PHY)
+                opt |= AX_MONITOR_MODE_RWLC;
+        if (wolinfo->wolopts & WAKE_MAGIC)
+                opt |= AX_MONITOR_MODE_RWMP;
+
+        if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD,
+                              1, 1, &opt) < 0)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int ax88179_get_eeprom_len(struct net_device *net)
+{
+        return AX_EEPROM_LEN;
+}
+
+static int
+ax88179_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
+                   u8 *data)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u16 *eeprom_buff;
+        int first_word, last_word;
+        int i, ret;
+
+        if (eeprom->len == 0)
+                return -EINVAL;
+
+        eeprom->magic = AX88179_EEPROM_MAGIC;
+
+        first_word = eeprom->offset >> 1;
+        last_word = (eeprom->offset + eeprom->len - 1) >> 1;
+        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
+                              GFP_KERNEL);
+        if (!eeprom_buff)
+                return -ENOMEM;
+
+        /* ax88179/178A returns 2 bytes from eeprom on read */
+        for (i = first_word; i <= last_word; i++) {
+                ret = __ax88179_read_cmd(dev, AX_ACCESS_EEPROM, i, 1, 2,
+                                         &eeprom_buff[i - first_word],
+                                         0);
+                if (ret < 0) {
+                        kfree(eeprom_buff);
+                        return -EIO;
+                }
+        }
+
+        memcpy(data, (u8 *)eeprom_buff + (eeprom->offset & 1), eeprom->len);
+        kfree(eeprom_buff);
+        return 0;
+}
+
+static int ax88179_get_settings(struct net_device *net, struct ethtool_cmd *cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return mii_ethtool_gset(&dev->mii, cmd);
+}
+
+static int ax88179_set_settings(struct net_device *net, struct ethtool_cmd *cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return mii_ethtool_sset(&dev->mii, cmd);
+}
+
+
+static int ax88179_ioctl(struct net_device *net, struct ifreq *rq, int cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
+}
+
+static const struct ethtool_ops ax88179_ethtool_ops = {
+        .get_link               = ethtool_op_get_link,
+        .get_msglevel           = usbnet_get_msglevel,
+        .set_msglevel           = usbnet_set_msglevel,
+        .get_wol                = ax88179_get_wol,
+        .set_wol                = ax88179_set_wol,
+        .get_eeprom_len         = ax88179_get_eeprom_len,
+        .get_eeprom             = ax88179_get_eeprom,
+        .get_settings           = ax88179_get_settings,
+        .set_settings           = ax88179_set_settings,
+        .nway_reset             = usbnet_nway_reset,
+};
+
+static void ax88179_set_multicast(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct ax88179_data *data = (struct ax88179_data *)dev->data;
+        u8 *m_filter = ((u8 *)dev->data) + 12;
+
+        data->rxctl = (AX_RX_CTL_START | AX_RX_CTL_AB | AX_RX_CTL_IPE);
+
+        if (net->flags & IFF_PROMISC) {
+                data->rxctl |= AX_RX_CTL_PRO;
+        } else if (net->flags & IFF_ALLMULTI ||
+                   netdev_mc_count(net) > AX_MAX_MCAST) {
+                data->rxctl |= AX_RX_CTL_AMALL;
+        } else if (netdev_mc_empty(net)) {
+                /* just broadcast and directed */
+        } else {
+                /* We use the 20 byte dev->data for our 8 byte filter buffer
+                 * to avoid allocating memory that is tricky to free later
+                 */
+                u32 crc_bits;
+                struct netdev_hw_addr *ha;
+
+                memset(m_filter, 0, AX_MCAST_FLTSIZE);
+
+                netdev_for_each_mc_addr(ha, net) {
+                        crc_bits = ether_crc(ETH_ALEN, ha->addr) >> 26;
+                        *(m_filter + (crc_bits >> 3)) |= (1 << (crc_bits & 7));
+                }
+
+                ax88179_write_cmd_async(dev, AX_ACCESS_MAC, AX_MULFLTARY,
+                                        AX_MCAST_FLTSIZE, AX_MCAST_FLTSIZE,
+                                        m_filter);
+
+                data->rxctl |= AX_RX_CTL_AM;
+        }
+
+        ax88179_write_cmd_async(dev, AX_ACCESS_MAC, AX_RX_CTL,
+                                2, 2, &data->rxctl);
+}
+
+static int
+ax88179_set_features(struct net_device *net, netdev_features_t features)
+{
+        u8 tmp;
+        struct usbnet *dev = netdev_priv(net);
+        netdev_features_t changed = net->features ^ features;
+
+        if (changed & NETIF_F_IP_CSUM) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+                tmp ^= AX_TXCOE_TCP | AX_TXCOE_UDP;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+        }
+
+        if (changed & NETIF_F_IPV6_CSUM) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+                tmp ^= AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+        }
+
+        if (changed & NETIF_F_RXCSUM) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
+                tmp ^= AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+                       AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
+        }
+
+        return 0;
+}
+
+static int ax88179_change_mtu(struct net_device *net, int new_mtu)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u16 tmp16;
+
+        if (new_mtu <= 0 || new_mtu > 4088)
+                return -EINVAL;
+
+        net->mtu = new_mtu;
+        dev->hard_mtu = net->mtu + net->hard_header_len;
+
+        if (net->mtu > 1500) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                 2, 2, &tmp16);
+                tmp16 |= AX_MEDIUM_JUMBO_EN;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                  2, 2, &tmp16);
+        } else {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                 2, 2, &tmp16);
+                tmp16 &= ~AX_MEDIUM_JUMBO_EN;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                  2, 2, &tmp16);
+        }
+
+        return 0;
+}
+
+static int ax88179_set_mac_addr(struct net_device *net, void *p)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sockaddr *addr = p;
+
+        if (netif_running(net))
+                return -EBUSY;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+
+        memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
+
+        /* Set the MAC address */
+        return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+                                 ETH_ALEN, net->dev_addr);
+}
+
+static const struct net_device_ops ax88179_netdev_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = ax88179_change_mtu,
+        .ndo_set_mac_address    = ax88179_set_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_do_ioctl           = ax88179_ioctl,
+        .ndo_set_rx_mode        = ax88179_set_multicast,
+        .ndo_set_features       = ax88179_set_features,
+};
+
+static int ax88179_check_eeprom(struct usbnet *dev)
+{
+        u8 i, buf, eeprom[20];
+        u16 csum, delay = HZ / 10;
+        unsigned long jtimeout;
+
+        /* Read EEPROM content */
+        for (i = 0; i < 6; i++) {
+                buf = i;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_ADDR,
+                                      1, 1, &buf) < 0)
+                        return -EINVAL;
+
+                buf = EEP_RD;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                      1, 1, &buf) < 0)
+                        return -EINVAL;
+
+                jtimeout = jiffies + delay;
+                do {
+                        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                         1, 1, &buf);
+
+                        if (time_after(jiffies, jtimeout))
+                                return -EINVAL;
+
+                } while (buf & EEP_BUSY);
+
+                __ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
+                                   2, 2, &eeprom[i * 2], 0);
+
+                if ((i == 0) && (eeprom[0] == 0xFF))
+                        return -EINVAL;
+        }
+
+        csum = eeprom[6] + eeprom[7] + eeprom[8] + eeprom[9];
+        csum = (csum >> 8) + (csum & 0xff);
+        if ((csum + eeprom[10]) != 0xff)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int ax88179_check_efuse(struct usbnet *dev, u16 *ledmode)
+{
+        u8      i;
+        u8      efuse[64];
+        u16     csum = 0;
+
+        if (ax88179_read_cmd(dev, AX_ACCESS_EFUS, 0, 64, 64, efuse) < 0)
+                return -EINVAL;
+
+        if (*efuse == 0xFF)
+                return -EINVAL;
+
+        for (i = 0; i < 64; i++)
+                csum = csum + efuse[i];
+
+        while (csum > 255)
+                csum = (csum & 0x00FF) + ((csum >> 8) & 0x00FF);
+
+        if (csum != 0xFF)
+                return -EINVAL;
+
+        *ledmode = (efuse[51] << 8) | efuse[52];
+
+        return 0;
+}
+
+static int ax88179_convert_old_led(struct usbnet *dev, u16 *ledvalue)
+{
+        u16 led;
+
+        /* Loaded the old eFuse LED Mode */
+        if (ax88179_read_cmd(dev, AX_ACCESS_EEPROM, 0x3C, 1, 2, &led) < 0)
+                return -EINVAL;
+
+        led >>= 8;
+        switch (led) {
+        case 0xFF:
+                led = LED0_ACTIVE | LED1_LINK_10 | LED1_LINK_100 |
+                      LED1_LINK_1000 | LED2_ACTIVE | LED2_LINK_10 |
+                      LED2_LINK_100 | LED2_LINK_1000 | LED_VALID;
+                break;
+        case 0xFE:
+                led = LED0_ACTIVE | LED1_LINK_1000 | LED2_LINK_100 | LED_VALID;
+                break;
+        case 0xFD:
+                led = LED0_ACTIVE | LED1_LINK_1000 | LED2_LINK_100 |
+                      LED2_LINK_10 | LED_VALID;
+                break;
+        case 0xFC:
+                led = LED0_ACTIVE | LED1_ACTIVE | LED1_LINK_1000 | LED2_ACTIVE |
+                      LED2_LINK_100 | LED2_LINK_10 | LED_VALID;
+                break;
+        default:
+                led = LED0_ACTIVE | LED1_LINK_10 | LED1_LINK_100 |
+                      LED1_LINK_1000 | LED2_ACTIVE | LED2_LINK_10 |
+                      LED2_LINK_100 | LED2_LINK_1000 | LED_VALID;
+                break;
+        }
+
+        *ledvalue = led;
+
+        return 0;
+}
+
+static int ax88179_led_setting(struct usbnet *dev)
+{
+        u8 ledfd, value = 0;
+        u16 tmp, ledact, ledlink, ledvalue = 0, delay = HZ / 10;
+        unsigned long jtimeout;
+
+        /* Check AX88179 version. UA1 or UA2*/
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, &value);
+
+        if (!(value & AX_SECLD)) {      /* UA1 */
+                value = AX_GPIO_CTRL_GPIO3EN | AX_GPIO_CTRL_GPIO2EN |
+                        AX_GPIO_CTRL_GPIO1EN;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_GPIO_CTRL,
+                                      1, 1, &value) < 0)
+                        return -EINVAL;
+        }
+
+        /* Check EEPROM */
+        if (!ax88179_check_eeprom(dev)) {
+                value = 0x42;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_ADDR,
+                                      1, 1, &value) < 0)
+                        return -EINVAL;
+
+                value = EEP_RD;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                      1, 1, &value) < 0)
+                        return -EINVAL;
+
+                jtimeout = jiffies + delay;
+                do {
+                        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                         1, 1, &value);
+
+                        if (time_after(jiffies, jtimeout))
+                                return -EINVAL;
+
+                } while (value & EEP_BUSY);
+
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH,
+                                 1, 1, &value);
+                ledvalue = (value << 8);
+
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
+                                 1, 1, &value);
+                ledvalue |= value;
+
+                /* load internal ROM for defaule setting */
+                if ((ledvalue == 0xFFFF) || ((ledvalue & LED_VALID) == 0))
+                        ax88179_convert_old_led(dev, &ledvalue);
+
+        } else if (!ax88179_check_efuse(dev, &ledvalue)) {
+                if ((ledvalue == 0xFFFF) || ((ledvalue & LED_VALID) == 0))
+                        ax88179_convert_old_led(dev, &ledvalue);
+        } else {
+                ax88179_convert_old_led(dev, &ledvalue);
+        }
+
+        tmp = GMII_PHY_PGSEL_EXT;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_PHY_PAGE_SELECT, 2, &tmp);
+
+        tmp = 0x2c;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_PHYPAGE, 2, &tmp);
+
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                         GMII_LED_ACT, 2, &ledact);
+
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                         GMII_LED_LINK, 2, &ledlink);
+
+        ledact &= GMII_LED_ACTIVE_MASK;
+        ledlink &= GMII_LED_LINK_MASK;
+
+        if (ledvalue & LED0_ACTIVE)
+                ledact |= GMII_LED0_ACTIVE;
+
+        if (ledvalue & LED1_ACTIVE)
+                ledact |= GMII_LED1_ACTIVE;
+
+        if (ledvalue & LED2_ACTIVE)
+                ledact |= GMII_LED2_ACTIVE;
+
+        if (ledvalue & LED0_LINK_10)
+                ledlink |= GMII_LED0_LINK_10;
+
+        if (ledvalue & LED1_LINK_10)
+                ledlink |= GMII_LED1_LINK_10;
+
+        if (ledvalue & LED2_LINK_10)
+                ledlink |= GMII_LED2_LINK_10;
+
+        if (ledvalue & LED0_LINK_100)
+                ledlink |= GMII_LED0_LINK_100;
+
+        if (ledvalue & LED1_LINK_100)
+                ledlink |= GMII_LED1_LINK_100;
+
+        if (ledvalue & LED2_LINK_100)
+                ledlink |= GMII_LED2_LINK_100;
+
+        if (ledvalue & LED0_LINK_1000)
+                ledlink |= GMII_LED0_LINK_1000;
+
+        if (ledvalue & LED1_LINK_1000)
+                ledlink |= GMII_LED1_LINK_1000;
+
+        if (ledvalue & LED2_LINK_1000)
+                ledlink |= GMII_LED2_LINK_1000;
+
+        tmp = ledact;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_LED_ACT, 2, &tmp);
+
+        tmp = ledlink;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_LED_LINK, 2, &tmp);
+
+        tmp = GMII_PHY_PGSEL_PAGE0;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_PHY_PAGE_SELECT, 2, &tmp);
+
+        /* LED full duplex setting */
+        ledfd = 0;
+        if (ledvalue & LED0_FD)
+                ledfd |= 0x01;
+        else if ((ledvalue & LED0_USB3_MASK) == 0)
+                ledfd |= 0x02;
+
+        if (ledvalue & LED1_FD)
+                ledfd |= 0x04;
+        else if ((ledvalue & LED1_USB3_MASK) == 0)
+                ledfd |= 0x08;
+
+        if (ledvalue & LED2_FD)
+                ledfd |= 0x10;
+        else if ((ledvalue & LED2_USB3_MASK) == 0)
+                ledfd |= 0x20;
+
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_LEDCTRL, 1, 1, &ledfd);
+
+        return 0;
+}
+
+static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8 buf[5];
+        u16 *tmp16;
+        u8 *tmp;
+        struct ax88179_data *ax179_data = (struct ax88179_data *)dev->data;
+
+        usbnet_get_endpoints(dev, intf);
+
+        tmp16 = (u16 *)buf;
+        tmp = (u8 *)buf;
+
+        memset(ax179_data, 0, sizeof(*ax179_data));
+
+        /* Power up ethernet PHY */
+        *tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        *tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        msleep(200);
+
+        *tmp = AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, tmp);
+        msleep(100);
+
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+                         ETH_ALEN, dev->net->dev_addr);
+        memcpy(dev->net->perm_addr, dev->net->dev_addr, ETH_ALEN);
+
+        /* RX bulk configuration */
+        memcpy(tmp, &AX88179_BULKIN_SIZE[0], 5);
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_BULKIN_QCTRL, 5, 5, tmp);
+
+        dev->rx_urb_size = 1024 * 20;
+
+        *tmp = 0x34;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_LOW, 1, 1, tmp);
+
+        *tmp = 0x52;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_HIGH,
+                          1, 1, tmp);
+
+        dev->net->netdev_ops = &ax88179_netdev_ops;
+        dev->net->ethtool_ops = &ax88179_ethtool_ops;
+        dev->net->needed_headroom = 8;
+
+        /* Initialize MII structure */
+        dev->mii.dev = dev->net;
+        dev->mii.mdio_read = ax88179_mdio_read;
+        dev->mii.mdio_write = ax88179_mdio_write;
+        dev->mii.phy_id_mask = 0xff;
+        dev->mii.reg_num_mask = 0xff;
+        dev->mii.phy_id = 0x03;
+        dev->mii.supports_gmii = 1;
+
+        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+
+        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+
+        /* Enable checksum offload */
+        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+               AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, tmp);
+
+        *tmp = AX_TXCOE_IP | AX_TXCOE_TCP | AX_TXCOE_UDP |
+               AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, tmp);
+
+        /* Configure RX control register => start operation */
+        *tmp16 = AX_RX_CTL_DROPCRCERR | AX_RX_CTL_IPE | AX_RX_CTL_START |
+                 AX_RX_CTL_AP | AX_RX_CTL_AMALL | AX_RX_CTL_AB;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, tmp16);
+
+        *tmp = AX_MONITOR_MODE_PMETYPE | AX_MONITOR_MODE_PMEPOL |
+               AX_MONITOR_MODE_RWMP;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD, 1, 1, tmp);
+
+        /* Configure default medium type => giga */
+        *tmp16 = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
+                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE |
+                 AX_MEDIUM_FULL_DUPLEX | AX_MEDIUM_GIGAMODE;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, tmp16);
+
+        ax88179_led_setting(dev);
+
+        /* Restart autoneg */
+        mii_nway_restart(&dev->mii);
+
+        netif_carrier_off(dev->net);
+
+        return 0;
+}
+
+static void ax88179_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u16 tmp16;
+
+        /* Configure RX control register => stop operation */
+        tmp16 = AX_RX_CTL_STOP;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &tmp16);
+
+        tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp16);
+
+        /* Power down ethernet PHY */
+        tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+}
+
+static void
+ax88179_rx_checksum(struct sk_buff *skb, u32 *pkt_hdr)
+{
+        skb->ip_summed = CHECKSUM_NONE;
+
+        /* checksum error bit is set */
+        if ((*pkt_hdr & AX_RXHDR_L3CSUM_ERR) ||
+            (*pkt_hdr & AX_RXHDR_L4CSUM_ERR))
+                return;
+
+        /* It must be a TCP or UDP packet with a valid checksum */
+        if (((*pkt_hdr & AX_RXHDR_L4_TYPE_MASK) == AX_RXHDR_L4_TYPE_TCP) ||
+            ((*pkt_hdr & AX_RXHDR_L4_TYPE_MASK) == AX_RXHDR_L4_TYPE_UDP))
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
+
+static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct sk_buff *ax_skb;
+        int pkt_cnt;
+        u32 rx_hdr;
+        u16 hdr_off;
+        u32 *pkt_hdr;
+
+        skb_trim(skb, skb->len - 4);
+        memcpy(&rx_hdr, skb_tail_pointer(skb), 4);
+        le32_to_cpus(&rx_hdr);
+
+        pkt_cnt = (u16)rx_hdr;
+        hdr_off = (u16)(rx_hdr >> 16);
+        pkt_hdr = (u32 *)(skb->data + hdr_off);
+
+        while (pkt_cnt--) {
+                u16 pkt_len;
+
+                le32_to_cpus(pkt_hdr);
+                pkt_len = (*pkt_hdr >> 16) & 0x1fff;
+
+                /* Check CRC or runt packet */
+                if ((*pkt_hdr & AX_RXHDR_CRC_ERR) ||
+                    (*pkt_hdr & AX_RXHDR_DROP_ERR)) {
+                        skb_pull(skb, (pkt_len + 7) & 0xFFF8);
+                        pkt_hdr++;
+                        continue;
+                }
+
+                if (pkt_cnt == 0) {
+                        /* Skip IP alignment psudo header */
+                        skb_pull(skb, 2);
+                        skb->len = pkt_len;
+                        skb_set_tail_pointer(skb, pkt_len);
+                        skb->truesize = pkt_len + sizeof(struct sk_buff);
+                        ax88179_rx_checksum(skb, pkt_hdr);
+                        return 1;
+                }
+
+                ax_skb = skb_clone(skb, GFP_ATOMIC);
+                if (ax_skb) {
+                        ax_skb->len = pkt_len;
+                        ax_skb->data = skb->data + 2;
+                        skb_set_tail_pointer(ax_skb, pkt_len);
+                        ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
+                        ax88179_rx_checksum(ax_skb, pkt_hdr);
+                        usbnet_skb_return(dev, ax_skb);
+                } else {
+                        return 0;
+                }
+
+                skb_pull(skb, (pkt_len + 7) & 0xFFF8);
+                pkt_hdr++;
+        }
+        return 1;
+}
+
+static struct sk_buff *
+ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+{
+        u32 tx_hdr1, tx_hdr2;
+        int frame_size = dev->maxpacket;
+        int mss = skb_shinfo(skb)->gso_size;
+        int headroom;
+        int tailroom;
+
+        tx_hdr1 = skb->len;
+        tx_hdr2 = mss;
+        if (((skb->len + 8) % frame_size) == 0)
+                tx_hdr2 |= 0x80008000;  /* Enable padding */
+
+        skb_linearize(skb);
+        headroom = skb_headroom(skb);
+        tailroom = skb_tailroom(skb);
+
+        if (!skb_header_cloned(skb) &&
+            !skb_cloned(skb) &&
+            (headroom + tailroom) >= 8) {
+                if (headroom < 8) {
+                        skb->data = memmove(skb->head + 8, skb->data, skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                }
+        } else {
+                struct sk_buff *skb2;
+
+                skb2 = skb_copy_expand(skb, 8, 0, flags);
+                dev_kfree_skb_any(skb);
+                skb = skb2;
+                if (!skb)
+                        return NULL;
+        }
+
+        skb_push(skb, 4);
+        cpu_to_le32s(&tx_hdr2);
+        skb_copy_to_linear_data(skb, &tx_hdr2, 4);
+
+        skb_push(skb, 4);
+        cpu_to_le32s(&tx_hdr1);
+        skb_copy_to_linear_data(skb, &tx_hdr1, 4);
+
+        return skb;
+}
+
+static int ax88179_link_reset(struct usbnet *dev)
+{
+        struct ax88179_data *ax179_data = (struct ax88179_data *)dev->data;
+        u8 tmp[5], link_sts;
+        u16 mode, tmp16, delay = HZ / 10;
+        u32 tmp32 = 0x40000000;
+        unsigned long jtimeout;
+
+        jtimeout = jiffies + delay;
+        while (tmp32 & 0x40000000) {
+                mode = 0;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &mode);
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2,
+                                  &ax179_data->rxctl);
+
+                /*link up, check the usb device control TX FIFO full or empty*/
+                ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32);
+
+                if (time_after(jiffies, jtimeout))
+                        return 0;
+        }
+
+        mode = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
+               AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE;
+
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS,
+                         1, 1, &link_sts);
+
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                         GMII_PHY_PHYSR, 2, &tmp16);
+
+        if (!(tmp16 & GMII_PHY_PHYSR_LINK)) {
+                return 0;
+        } else if (GMII_PHY_PHYSR_GIGA == (tmp16 & GMII_PHY_PHYSR_SMASK)) {
+                mode |= AX_MEDIUM_GIGAMODE | AX_MEDIUM_EN_125MHZ;
+                if (dev->net->mtu > 1500)
+                        mode |= AX_MEDIUM_JUMBO_EN;
+
+                if (link_sts & AX_USB_SS)
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[0], 5);
+                else if (link_sts & AX_USB_HS)
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[1], 5);
+                else
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[3], 5);
+        } else if (GMII_PHY_PHYSR_100 == (tmp16 & GMII_PHY_PHYSR_SMASK)) {
+                mode |= AX_MEDIUM_PS;
+
+                if (link_sts & (AX_USB_SS | AX_USB_HS))
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[2], 5);
+                else
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[3], 5);
+        } else {
+                memcpy(tmp, &AX88179_BULKIN_SIZE[3], 5);
+        }
+
+        /* RX bulk configuration */
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_BULKIN_QCTRL, 5, 5, tmp);
+
+        dev->rx_urb_size = (1024 * (tmp[3] + 2));
+
+        if (tmp16 & GMII_PHY_PHYSR_FULL)
+                mode |= AX_MEDIUM_FULL_DUPLEX;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, &mode);
+
+        netif_carrier_on(dev->net);
+
+        return 0;
+}
+
+static int ax88179_reset(struct usbnet *dev)
+{
+        u8 buf[5];
+        u16 *tmp16;
+        u8 *tmp;
+
+        tmp16 = (u16 *)buf;
+        tmp = (u8 *)buf;
+
+        /* Power up ethernet PHY */
+        *tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+
+        *tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        msleep(200);
+
+        *tmp = AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, tmp);
+        msleep(100);
+
+        /* Ethernet PHY Auto Detach*/
+        ax88179_auto_detach(dev, 0);
+
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, ETH_ALEN,
+                         dev->net->dev_addr);
+        memcpy(dev->net->perm_addr, dev->net->dev_addr, ETH_ALEN);
+
+        /* RX bulk configuration */
+        memcpy(tmp, &AX88179_BULKIN_SIZE[0], 5);
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_BULKIN_QCTRL, 5, 5, tmp);
+
+        dev->rx_urb_size = 1024 * 20;
+
+        *tmp = 0x34;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_LOW, 1, 1, tmp);
+
+        *tmp = 0x52;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_HIGH,
+                          1, 1, tmp);
+
+        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+
+        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+
+        /* Enable checksum offload */
+        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+               AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, tmp);
+
+        *tmp = AX_TXCOE_IP | AX_TXCOE_TCP | AX_TXCOE_UDP |
+               AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, tmp);
+
+        /* Configure RX control register => start operation */
+        *tmp16 = AX_RX_CTL_DROPCRCERR | AX_RX_CTL_IPE | AX_RX_CTL_START |
+                 AX_RX_CTL_AP | AX_RX_CTL_AMALL | AX_RX_CTL_AB;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, tmp16);
+
+        *tmp = AX_MONITOR_MODE_PMETYPE | AX_MONITOR_MODE_PMEPOL |
+               AX_MONITOR_MODE_RWMP;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD, 1, 1, tmp);
+
+        /* Configure default medium type => giga */
+        *tmp16 = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
+                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE |
+                 AX_MEDIUM_FULL_DUPLEX | AX_MEDIUM_GIGAMODE;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, tmp16);
+
+        ax88179_led_setting(dev);
+
+        /* Restart autoneg */
+        mii_nway_restart(&dev->mii);
+
+        netif_carrier_off(dev->net);
+
+        return 0;
+}
+
+static int ax88179_stop(struct usbnet *dev)
+{
+        u16 tmp16;
+
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                         2, 2, &tmp16);
+        tmp16 &= ~AX_MEDIUM_RECEIVE_EN;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, &tmp16);
+
+        return 0;
+}
+
+static const struct driver_info ax88179_info = {
+        .description = "ASIX AX88179 USB 3.0 Gigibit Ethernet",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
+static const struct driver_info ax88178a_info = {
+        .description = "ASIX AX88178A USB 2.0 Gigibit Ethernet",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
+static const struct driver_info sitecom_info = {
+        .description = "Sitecom USB 3.0 to Gigabit Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
+static const struct usb_device_id products[] = {
+{
+        /* ASIX AX88179 10/100/1000 */
+        USB_DEVICE(0x0b95, 0x1790),
+        .driver_info = (unsigned long)&ax88179_info,
+}, {
+        /* ASIX AX88178A 10/100/1000 */
+        USB_DEVICE(0x0b95, 0x178a),
+        .driver_info = (unsigned long)&ax88178a_info,
+}, {
+        /* Sitecom USB 3.0 to Gigabit Adapter */
+        USB_DEVICE(0x0df6, 0x0072),
+        .driver_info = (unsigned long) &sitecom_info,
+},
+        { },
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver ax88179_178a_driver = {
+        .name =         "ax88179_178a",
+        .id_table =     products,
+        .probe =        usbnet_probe,
+        .suspend =      ax88179_suspend,
+        .resume =       ax88179_resume,
+        .disconnect =   usbnet_disconnect,
+        .supports_autosuspend = 1,
+        .disable_hub_initiated_lpm = 1,
+};
+
+module_usb_driver(ax88179_178a_driver);
+
+MODULE_DESCRIPTION("ASIX AX88179/178A based USB 3.0/2.0 Gigabit Ethernet Devices");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 4a8c25a22294..61b74a2b89ac 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1213,6 +1213,14 @@ static const struct usb_device_id cdc_devs[] = {
           .driver_info = (unsigned long) &wwan_info,
         },
 
+        /* tag Huawei devices as wwan */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1,
+                                        USB_CLASS_COMM,
+                                        USB_CDC_SUBCLASS_NCM,
+                                        USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_info,
+        },
+
         /* Huawei NCM devices disguised as vendor specific */
         { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x16),
           .driver_info = (unsigned long)&wwan_info,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f10e58ac9c1b..c3e3d2929ee3 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -961,6 +961,8 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)
         iph->ttl        = ttl ? : ip4_dst_hoplimit(&rt->dst);
         tunnel_ip_select_ident(skb, old_iph, &rt->dst);
 
+        nf_reset(skb);
+
         vxlan_set_owner(dev, skb);
 
         /* See iptunnel_xmit() */
diff --git a/drivers/net/wireless/ath/ath5k/Makefile b/drivers/net/wireless/ath/ath5k/Makefile
index f60b3899afc4..1b3a34f7f224 100644
--- a/drivers/net/wireless/ath/ath5k/Makefile
+++ b/drivers/net/wireless/ath/ath5k/Makefile
@@ -10,6 +10,7 @@ ath5k-y				+= phy.o
 ath5k-y                         += reset.o
 ath5k-y                         += attach.o
 ath5k-y                         += base.o
+CFLAGS_base.o                   += -I$(src)
 ath5k-y                         += led.o
 ath5k-y                         += rfkill.o
 ath5k-y                         += ani.o
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 3150def17193..2d691b8b95b9 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -1523,7 +1523,8 @@ int ath5k_hw_dma_stop(struct ath5k_hw *ah);
 /* EEPROM access functions */
 int ath5k_eeprom_init(struct ath5k_hw *ah);
 void ath5k_eeprom_detach(struct ath5k_hw *ah);
-
+int ath5k_eeprom_mode_from_channel(struct ath5k_hw *ah,
+                struct ieee80211_channel *channel);
 
 /* Protocol Control Unit Functions */
 /* Helpers */
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index b7e0258887e7..94d34ee02265 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -1779,7 +1779,8 @@ ath5k_eeprom_detach(struct ath5k_hw *ah)
 }
 
 int
-ath5k_eeprom_mode_from_channel(struct ieee80211_channel *channel)
+ath5k_eeprom_mode_from_channel(struct ath5k_hw *ah,
+                struct ieee80211_channel *channel)
 {
         switch (channel->hw_value) {
         case AR5K_MODE_11A:
@@ -1789,6 +1790,7 @@ ath5k_eeprom_mode_from_channel(struct ieee80211_channel *channel)
         case AR5K_MODE_11B:
                 return AR5K_EEPROM_MODE_11B;
         default:
-                return -1;
+                ATH5K_WARN(ah, "channel is not A/B/G!");
+                return AR5K_EEPROM_MODE_11A;
         }
 }
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index 94a9bbea6874..693296ee9693 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -493,6 +493,3 @@ struct ath5k_eeprom_info {
         /* Antenna raw switch tables */
         u32     ee_antenna[AR5K_EEPROM_N_MODES][AR5K_ANT_MAX];
 };
-
-int
-ath5k_eeprom_mode_from_channel(struct ieee80211_channel *channel);
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index a78afa98c650..d6bc7cb61bfb 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1612,11 +1612,7 @@ ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
 
         ah->ah_cal_mask |= AR5K_CALIBRATION_NF;
 
-        ee_mode = ath5k_eeprom_mode_from_channel(ah->ah_current_channel);
-        if (WARN_ON(ee_mode < 0)) {
-                ah->ah_cal_mask &= ~AR5K_CALIBRATION_NF;
-                return;
-        }
+        ee_mode = ath5k_eeprom_mode_from_channel(ah, ah->ah_current_channel);
 
         /* completed NF calibration, test threshold */
         nf = ath5k_hw_read_measured_noise_floor(ah);
@@ -2317,12 +2313,7 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
 
         def_ant = ah->ah_def_ant;
 
-        ee_mode = ath5k_eeprom_mode_from_channel(channel);
-        if (ee_mode < 0) {
-                ATH5K_ERR(ah,
-                        "invalid channel: %d\n", channel->center_freq);
-                return;
-        }
+        ee_mode = ath5k_eeprom_mode_from_channel(ah, channel);
 
         switch (ant_mode) {
         case AR5K_ANTMODE_DEFAULT:
@@ -3622,12 +3613,7 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                 return -EINVAL;
         }
 
-        ee_mode = ath5k_eeprom_mode_from_channel(channel);
-        if (ee_mode < 0) {
-                ATH5K_ERR(ah,
-                        "invalid channel: %d\n", channel->center_freq);
-                return -EINVAL;
-        }
+        ee_mode = ath5k_eeprom_mode_from_channel(ah, channel);
 
         /* Initialize TX power table */
         switch (ah->ah_radio) {
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index e2d8b2cf19eb..a3399c4f13a9 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -984,9 +984,7 @@ ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
         if (ah->ah_version == AR5K_AR5210)
                 return;
 
-        ee_mode = ath5k_eeprom_mode_from_channel(channel);
-        if (WARN_ON(ee_mode < 0))
-                return;
+        ee_mode = ath5k_eeprom_mode_from_channel(ah, channel);
 
         /* Adjust power delta for channel 14 */
         if (channel->center_freq == 2484)
diff --git a/drivers/net/wireless/ath/ath5k/trace.h b/drivers/net/wireless/ath/ath5k/trace.h
index 00f015819344..c6eef519bb61 100644
--- a/drivers/net/wireless/ath/ath5k/trace.h
+++ b/drivers/net/wireless/ath/ath5k/trace.h
@@ -97,7 +97,7 @@ TRACE_EVENT(ath5k_tx_complete,
 #if defined(CONFIG_ATH5K_TRACER) && !defined(__CHECKER__)
 
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH ../../drivers/net/wireless/ath/ath5k
+#define TRACE_INCLUDE_PATH .
 #undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE trace
 
diff --git a/drivers/net/wireless/ath/ath6kl/Kconfig b/drivers/net/wireless/ath/ath6kl/Kconfig
index 630c83db056e..e39e5860a2e9 100644
--- a/drivers/net/wireless/ath/ath6kl/Kconfig
+++ b/drivers/net/wireless/ath/ath6kl/Kconfig
@@ -30,6 +30,15 @@ config ATH6KL_DEBUG
         ---help---
           Enables debug support
 
+config ATH6KL_TRACING
+        bool "Atheros ath6kl tracing support"
+        depends on ATH6KL
+        depends on EVENT_TRACING
+        ---help---
+          Select this to ath6kl use tracing infrastructure.
+
+          If unsure, say Y to make it easier to debug problems.
+
 config ATH6KL_REGDOMAIN
         bool "Atheros ath6kl regdomain support"
         depends on ATH6KL
diff --git a/drivers/net/wireless/ath/ath6kl/Makefile b/drivers/net/wireless/ath/ath6kl/Makefile
index cab0ec0d5380..dc2b3b46781e 100644
--- a/drivers/net/wireless/ath/ath6kl/Makefile
+++ b/drivers/net/wireless/ath/ath6kl/Makefile
@@ -35,10 +35,15 @@ ath6kl_core-y += txrx.o
 ath6kl_core-y += wmi.o
 ath6kl_core-y += core.o
 ath6kl_core-y += recovery.o
+
 ath6kl_core-$(CONFIG_NL80211_TESTMODE) += testmode.o
+ath6kl_core-$(CONFIG_ATH6KL_TRACING) += trace.o
 
 obj-$(CONFIG_ATH6KL_SDIO) += ath6kl_sdio.o
 ath6kl_sdio-y += sdio.o
 
 obj-$(CONFIG_ATH6KL_USB) += ath6kl_usb.o
 ath6kl_usb-y += usb.o
+
+# for tracing framework to find trace.h
+CFLAGS_trace.o := -I$(src)
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 28c413f861a2..5c9736a94e54 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -402,7 +402,7 @@ static bool ath6kl_is_valid_iftype(struct ath6kl *ar, enum nl80211_iftype type,
         if (type == NL80211_IFTYPE_STATION ||
             type == NL80211_IFTYPE_AP || type == NL80211_IFTYPE_ADHOC) {
                 for (i = 0; i < ar->vif_max; i++) {
-                        if ((ar->avail_idx_map >> i) & BIT(0)) {
+                        if ((ar->avail_idx_map) & BIT(i)) {
                                 *if_idx = i;
                                 return true;
                         }
@@ -412,7 +412,7 @@ static bool ath6kl_is_valid_iftype(struct ath6kl *ar, enum nl80211_iftype type,
         if (type == NL80211_IFTYPE_P2P_CLIENT ||
             type == NL80211_IFTYPE_P2P_GO) {
                 for (i = ar->max_norm_iface; i < ar->vif_max; i++) {
-                        if ((ar->avail_idx_map >> i) & BIT(0)) {
+                        if ((ar->avail_idx_map) & BIT(i)) {
                                 *if_idx = i;
                                 return true;
                         }
@@ -1535,7 +1535,9 @@ static int ath6kl_cfg80211_del_iface(struct wiphy *wiphy,
 
         ath6kl_cfg80211_vif_stop(vif, test_bit(WMI_READY, &ar->flag));
 
+        rtnl_lock();
         ath6kl_cfg80211_vif_cleanup(vif);
+        rtnl_unlock();
 
         return 0;
 }
@@ -3661,7 +3663,6 @@ struct wireless_dev *ath6kl_interface_add(struct ath6kl *ar, const char *name,
         vif->sme_state = SME_DISCONNECTED;
         set_bit(WLAN_ENABLED, &vif->flags);
         ar->wlan_pwr_state = WLAN_POWER_STATE_ON;
-        set_bit(NETDEV_REGISTERED, &vif->flags);
 
         if (type == NL80211_IFTYPE_ADHOC)
                 ar->ibss_if_active = true;
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 61b2f98b4e77..26b0f92424e1 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -560,7 +560,6 @@ enum ath6kl_vif_state {
         WMM_ENABLED,
         NETQ_STOPPED,
         DTIM_EXPIRED,
-        NETDEV_REGISTERED,
         CLEAR_BSSFILTER_ON_BEACON,
         DTIM_PERIOD_AVAIL,
         WLAN_ENABLED,
@@ -936,8 +935,6 @@ void aggr_recv_addba_req_evt(struct ath6kl_vif *vif, u8 tid, u16 seq_no,
                              u8 win_sz);
 void ath6kl_wakeup_event(void *dev);
 
-void ath6kl_reset_device(struct ath6kl *ar, u32 target_type,
-                         bool wait_fot_compltn, bool cold_reset);
 void ath6kl_init_control_info(struct ath6kl_vif *vif);
 struct ath6kl_vif *ath6kl_vif_first(struct ath6kl *ar);
 void ath6kl_cfg80211_vif_stop(struct ath6kl_vif *vif, bool wmi_ready);
diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c
index 15cfe30e54fd..fe38b836cb26 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.c
+++ b/drivers/net/wireless/ath/ath6kl/debug.c
@@ -56,6 +56,60 @@ int ath6kl_printk(const char *level, const char *fmt, ...)
 }
 EXPORT_SYMBOL(ath6kl_printk);
 
+int ath6kl_info(const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+        int ret;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        ret = ath6kl_printk(KERN_INFO, "%pV", &vaf);
+        trace_ath6kl_log_info(&vaf);
+        va_end(args);
+
+        return ret;
+}
+EXPORT_SYMBOL(ath6kl_info);
+
+int ath6kl_err(const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+        int ret;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        ret = ath6kl_printk(KERN_ERR, "%pV", &vaf);
+        trace_ath6kl_log_err(&vaf);
+        va_end(args);
+
+        return ret;
+}
+EXPORT_SYMBOL(ath6kl_err);
+
+int ath6kl_warn(const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+        int ret;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        ret = ath6kl_printk(KERN_WARNING, "%pV", &vaf);
+        trace_ath6kl_log_warn(&vaf);
+        va_end(args);
+
+        return ret;
+}
+EXPORT_SYMBOL(ath6kl_warn);
+
 #ifdef CONFIG_ATH6KL_DEBUG
 
 void ath6kl_dbg(enum ATH6K_DEBUG_MASK mask, const char *fmt, ...)
@@ -63,15 +117,15 @@ void ath6kl_dbg(enum ATH6K_DEBUG_MASK mask, const char *fmt, ...)
         struct va_format vaf;
         va_list args;
 
-        if (!(debug_mask & mask))
-                return;
-
         va_start(args, fmt);
 
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        ath6kl_printk(KERN_DEBUG, "%pV", &vaf);
+        if (debug_mask & mask)
+                ath6kl_printk(KERN_DEBUG, "%pV", &vaf);
+
+        trace_ath6kl_log_dbg(mask, &vaf);
 
         va_end(args);
 }
@@ -87,6 +141,10 @@ void ath6kl_dbg_dump(enum ATH6K_DEBUG_MASK mask,
 
                 print_hex_dump_bytes(prefix, DUMP_PREFIX_OFFSET, buf, len);
         }
+
+        /* tracing code doesn't like null strings :/ */
+        trace_ath6kl_log_dbg_dump(msg ? msg : "", prefix ? prefix : "",
+                                  buf, len);
 }
 EXPORT_SYMBOL(ath6kl_dbg_dump);
 
@@ -1752,8 +1810,10 @@ int ath6kl_debug_init_fs(struct ath6kl *ar)
         debugfs_create_file("tgt_stats", S_IRUSR, ar->debugfs_phy, ar,
                             &fops_tgt_stats);
 
-        debugfs_create_file("credit_dist_stats", S_IRUSR, ar->debugfs_phy, ar,
-                            &fops_credit_dist_stats);
+        if (ar->hif_type == ATH6KL_HIF_TYPE_SDIO)
+                debugfs_create_file("credit_dist_stats", S_IRUSR,
+                                    ar->debugfs_phy, ar,
+                                    &fops_credit_dist_stats);
 
         debugfs_create_file("endpoint_stats", S_IRUSR | S_IWUSR,
                             ar->debugfs_phy, ar, &fops_endpoint_stats);
diff --git a/drivers/net/wireless/ath/ath6kl/debug.h b/drivers/net/wireless/ath/ath6kl/debug.h
index f97cd4ead543..74369de00fb5 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.h
+++ b/drivers/net/wireless/ath/ath6kl/debug.h
@@ -19,6 +19,7 @@
 #define DEBUG_H
 
 #include "hif.h"
+#include "trace.h"
 
 enum ATH6K_DEBUG_MASK {
         ATH6KL_DBG_CREDIT       = BIT(0),
@@ -51,13 +52,9 @@ enum ATH6K_DEBUG_MASK {
 extern unsigned int debug_mask;
 extern __printf(2, 3)
 int ath6kl_printk(const char *level, const char *fmt, ...);
-
-#define ath6kl_info(fmt, ...)                           \
-        ath6kl_printk(KERN_INFO, fmt, ##__VA_ARGS__)
-#define ath6kl_err(fmt, ...)                                    \
-        ath6kl_printk(KERN_ERR, fmt, ##__VA_ARGS__)
-#define ath6kl_warn(fmt, ...)                                   \
-        ath6kl_printk(KERN_WARNING, fmt, ##__VA_ARGS__)
+extern __printf(1, 2) int ath6kl_info(const char *fmt, ...);
+extern __printf(1, 2) int ath6kl_err(const char *fmt, ...);
+extern __printf(1, 2) int ath6kl_warn(const char *fmt, ...);
 
 enum ath6kl_war {
         ATH6KL_WAR_INVALID_RATE,
diff --git a/drivers/net/wireless/ath/ath6kl/hif.c b/drivers/net/wireless/ath/ath6kl/hif.c
index a6b614421fa4..fea7709b5dda 100644
--- a/drivers/net/wireless/ath/ath6kl/hif.c
+++ b/drivers/net/wireless/ath/ath6kl/hif.c
@@ -22,6 +22,7 @@
 #include "target.h"
 #include "hif-ops.h"
 #include "debug.h"
+#include "trace.h"
 
 #define MAILBOX_FOR_BLOCK_SIZE          1
 
@@ -436,6 +437,8 @@ static int proc_pending_irqs(struct ath6kl_device *dev, bool *done)
 
                 ath6kl_dump_registers(dev, &dev->irq_proc_reg,
                                       &dev->irq_en_reg);
+                trace_ath6kl_sdio_irq(&dev->irq_en_reg,
+                                      sizeof(dev->irq_en_reg));
 
                 /* Update only those registers that are enabled */
                 host_int_status = dev->irq_proc_reg.host_int_status &
diff --git a/drivers/net/wireless/ath/ath6kl/htc_mbox.c b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
index fbb78dfe078f..65e5b719093d 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_mbox.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
@@ -19,6 +19,8 @@
 #include "hif.h"
 #include "debug.h"
 #include "hif-ops.h"
+#include "trace.h"
+
 #include <asm/unaligned.h>
 
 #define CALC_TXRX_PADDED_LEN(dev, len)  (__ALIGN_MASK((len), (dev)->block_mask))
@@ -537,6 +539,8 @@ static int ath6kl_htc_tx_issue(struct htc_target *target,
                                 packet->buf, padded_len,
                                 HIF_WR_ASYNC_BLOCK_INC, packet);
 
+        trace_ath6kl_htc_tx(status, packet->endpoint, packet->buf, send_len);
+
         return status;
 }
 
@@ -757,7 +761,8 @@ static void ath6kl_htc_tx_bundle(struct htc_endpoint *endpoint,
 {
         struct htc_target *target = endpoint->target;
         struct hif_scatter_req *scat_req = NULL;
-        int n_scat, n_sent_bundle = 0, tot_pkts_bundle = 0;
+        int n_scat, n_sent_bundle = 0, tot_pkts_bundle = 0, i;
+        struct htc_packet *packet;
         int status;
         u32 txb_mask;
         u8 ac = WMM_NUM_AC;
@@ -832,6 +837,13 @@ static void ath6kl_htc_tx_bundle(struct htc_endpoint *endpoint,
                 ath6kl_dbg(ATH6KL_DBG_HTC,
                            "htc tx scatter bytes %d entries %d\n",
                            scat_req->len, scat_req->scat_entries);
+
+                for (i = 0; i < scat_req->scat_entries; i++) {
+                        packet = scat_req->scat_list[i].packet;
+                        trace_ath6kl_htc_tx(packet->status, packet->endpoint,
+                                            packet->buf, packet->act_len);
+                }
+
                 ath6kl_hif_submit_scat_req(target->dev, scat_req, false);
 
                 if (status)
@@ -1903,6 +1915,7 @@ static void ath6kl_htc_rx_complete(struct htc_endpoint *endpoint,
                 ath6kl_dbg(ATH6KL_DBG_HTC,
                            "htc rx complete ep %d packet 0x%p\n",
                            endpoint->eid, packet);
+
                 endpoint->ep_cb.rx(endpoint->target, packet);
 }
 
@@ -2011,6 +2024,9 @@ static int ath6kl_htc_rx_process_packets(struct htc_target *target,
         list_for_each_entry_safe(packet, tmp_pkt, comp_pktq, list) {
                 ep = &target->endpoint[packet->endpoint];
 
+                trace_ath6kl_htc_rx(packet->status, packet->endpoint,
+                                    packet->buf, packet->act_len);
+
                 /* process header for each of the recv packet */
                 status = ath6kl_htc_rx_process_hdr(target, packet, lk_ahds,
                                                    n_lk_ahd);
@@ -2291,6 +2307,9 @@ static struct htc_packet *htc_wait_for_ctrl_msg(struct htc_target *target)
         if (ath6kl_htc_rx_packet(target, packet, packet->act_len))
                 goto fail_ctrl_rx;
 
+        trace_ath6kl_htc_rx(packet->status, packet->endpoint,
+                            packet->buf, packet->act_len);
+
         /* process receive header */
         packet->status = ath6kl_htc_rx_process_hdr(target, packet, NULL, NULL);
 
diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
index 281390178e3d..67aa924ed8b3 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
@@ -988,8 +988,6 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
 
         htc_hdr = (struct htc_frame_hdr *) netdata;
 
-        ep = &target->endpoint[htc_hdr->eid];
-
         if (htc_hdr->eid >= ENDPOINT_MAX) {
                 ath6kl_dbg(ATH6KL_DBG_HTC,
                            "HTC Rx: invalid EndpointID=%d\n",
@@ -997,6 +995,7 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
                 status = -EINVAL;
                 goto free_skb;
         }
+        ep = &target->endpoint[htc_hdr->eid];
 
         payload_len = le16_to_cpu(get_unaligned(&htc_hdr->payld_len));
 
@@ -1168,8 +1167,8 @@ static int htc_wait_recv_ctrl_message(struct htc_target *target)
         }
 
         if (count <= 0) {
-                ath6kl_dbg(ATH6KL_DBG_HTC, "%s: Timeout!\n", __func__);
-                return -ECOMM;
+                ath6kl_warn("htc pipe control receive timeout!\n");
+                return -ETIMEDOUT;
         }
 
         return 0;
@@ -1582,16 +1581,16 @@ static int ath6kl_htc_pipe_wait_target(struct htc_target *target)
                 return status;
 
         if (target->pipe.ctrl_response_len < sizeof(*ready_msg)) {
-                ath6kl_dbg(ATH6KL_DBG_HTC, "invalid htc ready msg len:%d!\n",
-                           target->pipe.ctrl_response_len);
+                ath6kl_warn("invalid htc pipe ready msg len: %d\n",
+                            target->pipe.ctrl_response_len);
                 return -ECOMM;
         }
 
         ready_msg = (struct htc_ready_ext_msg *) target->pipe.ctrl_response_buf;
 
         if (ready_msg->ver2_0_info.msg_id != cpu_to_le16(HTC_MSG_READY_ID)) {
-                ath6kl_dbg(ATH6KL_DBG_HTC, "invalid htc ready msg : 0x%X !\n",
-                           ready_msg->ver2_0_info.msg_id);
+                ath6kl_warn("invalid htc pipe ready msg: 0x%x\n",
+                            ready_msg->ver2_0_info.msg_id);
                 return -ECOMM;
         }
 
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index 5d434cf88f35..40ffee6184fd 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -201,8 +201,8 @@ struct sk_buff *ath6kl_buf_alloc(int size)
         u16 reserved;
 
         /* Add chacheline space at front and back of buffer */
-        reserved = (2 * L1_CACHE_BYTES) + ATH6KL_DATA_OFFSET +
-                   sizeof(struct htc_packet) + ATH6KL_HTC_ALIGN_BYTES;
+        reserved = roundup((2 * L1_CACHE_BYTES) + ATH6KL_DATA_OFFSET +
+                   sizeof(struct htc_packet) + ATH6KL_HTC_ALIGN_BYTES, 4);
         skb = dev_alloc_skb(size + reserved);
 
         if (skb)
@@ -1549,10 +1549,89 @@ static const char *ath6kl_init_get_hif_name(enum ath6kl_hif_type type)
         return NULL;
 }
 
+
+static const struct fw_capa_str_map {
+        int id;
+        const char *name;
+} fw_capa_map[] = {
+        { ATH6KL_FW_CAPABILITY_HOST_P2P, "host-p2p" },
+        { ATH6KL_FW_CAPABILITY_SCHED_SCAN, "sched-scan" },
+        { ATH6KL_FW_CAPABILITY_STA_P2PDEV_DUPLEX, "sta-p2pdev-duplex" },
+        { ATH6KL_FW_CAPABILITY_INACTIVITY_TIMEOUT, "inactivity-timeout" },
+        { ATH6KL_FW_CAPABILITY_RSN_CAP_OVERRIDE, "rsn-cap-override" },
+        { ATH6KL_FW_CAPABILITY_WOW_MULTICAST_FILTER, "wow-mc-filter" },
+        { ATH6KL_FW_CAPABILITY_BMISS_ENHANCE, "bmiss-enhance" },
+        { ATH6KL_FW_CAPABILITY_SCHED_SCAN_MATCH_LIST, "sscan-match-list" },
+        { ATH6KL_FW_CAPABILITY_RSSI_SCAN_THOLD, "rssi-scan-thold" },
+        { ATH6KL_FW_CAPABILITY_CUSTOM_MAC_ADDR, "custom-mac-addr" },
+        { ATH6KL_FW_CAPABILITY_TX_ERR_NOTIFY, "tx-err-notify" },
+        { ATH6KL_FW_CAPABILITY_REGDOMAIN, "regdomain" },
+        { ATH6KL_FW_CAPABILITY_SCHED_SCAN_V2, "sched-scan-v2" },
+        { ATH6KL_FW_CAPABILITY_HEART_BEAT_POLL, "hb-poll" },
+};
+
+static const char *ath6kl_init_get_fw_capa_name(unsigned int id)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(fw_capa_map); i++) {
+                if (fw_capa_map[i].id == id)
+                        return fw_capa_map[i].name;
+        }
+
+        return "<unknown>";
+}
+
+static void ath6kl_init_get_fwcaps(struct ath6kl *ar, char *buf, size_t buf_len)
+{
+        u8 *data = (u8 *) ar->fw_capabilities;
+        size_t trunc_len, len = 0;
+        int i, index, bit;
+        char *trunc = "...";
+
+        for (i = 0; i < ATH6KL_FW_CAPABILITY_MAX; i++) {
+                index = i / 8;
+                bit = i % 8;
+
+                if (index >= sizeof(ar->fw_capabilities) * 4)
+                        break;
+
+                if (buf_len - len < 4) {
+                        ath6kl_warn("firmware capability buffer too small!\n");
+
+                        /* add "..." to the end of string */
+                        trunc_len = strlen(trunc) + 1;
+                        strncpy(buf + buf_len - trunc_len, trunc, trunc_len);
+
+                        return;
+                }
+
+                if (data[index] & (1 << bit)) {
+                        len += scnprintf(buf + len, buf_len - len, "%s,",
+                                            ath6kl_init_get_fw_capa_name(i));
+                }
+        }
+
+        /* overwrite the last comma */
+        if (len > 0)
+                len--;
+
+        buf[len] = '\0';
+}
+
+static int ath6kl_init_hw_reset(struct ath6kl *ar)
+{
+        ath6kl_dbg(ATH6KL_DBG_BOOT, "cold resetting the device");
+
+        return ath6kl_diag_write32(ar, RESET_CONTROL_ADDRESS,
+                                   cpu_to_le32(RESET_CONTROL_COLD_RST));
+}
+
 static int __ath6kl_init_hw_start(struct ath6kl *ar)
 {
         long timeleft;
         int ret, i;
+        char buf[200];
 
         ath6kl_dbg(ATH6KL_DBG_BOOT, "hw start\n");
 
@@ -1569,24 +1648,35 @@ static int __ath6kl_init_hw_start(struct ath6kl *ar)
                 goto err_power_off;
 
         /* Do we need to finish the BMI phase */
-        /* FIXME: return error from ath6kl_bmi_done() */
-        if (ath6kl_bmi_done(ar)) {
-                ret = -EIO;
+        ret = ath6kl_bmi_done(ar);
+        if (ret)
                 goto err_power_off;
-        }
 
         /*
          * The reason we have to wait for the target here is that the
          * driver layer has to init BMI in order to set the host block
          * size.
          */
-        if (ath6kl_htc_wait_target(ar->htc_target)) {
-                ret = -EIO;
+        ret = ath6kl_htc_wait_target(ar->htc_target);
+
+        if (ret == -ETIMEDOUT) {
+                /*
+                 * Most likely USB target is in odd state after reboot and
+                 * needs a reset. A cold reset makes the whole device
+                 * disappear from USB bus and initialisation starts from
+                 * beginning.
+                 */
+                ath6kl_warn("htc wait target timed out, resetting device\n");
+                ath6kl_init_hw_reset(ar);
+                goto err_power_off;
+        } else if (ret) {
+                ath6kl_err("htc wait target failed: %d\n", ret);
                 goto err_power_off;
         }
 
-        if (ath6kl_init_service_ep(ar)) {
-                ret = -EIO;
+        ret = ath6kl_init_service_ep(ar);
+        if (ret) {
+                ath6kl_err("Endpoint service initilisation failed: %d\n", ret);
                 goto err_cleanup_scatter;
         }
 
@@ -1617,6 +1707,8 @@ static int __ath6kl_init_hw_start(struct ath6kl *ar)
                             ar->wiphy->fw_version,
                             ar->fw_api,
                             test_bit(TESTMODE, &ar->flag) ? " testmode" : "");
+                ath6kl_init_get_fwcaps(ar, buf, sizeof(buf));
+                ath6kl_info("firmware supports: %s\n", buf);
         }
 
         if (ar->version.abi_ver != ATH6KL_ABI_VERSION) {
@@ -1765,9 +1857,7 @@ void ath6kl_stop_txrx(struct ath6kl *ar)
          * Try to reset the device if we can. The driver may have been
          * configure NOT to reset the target during a debug session.
          */
-        ath6kl_dbg(ATH6KL_DBG_TRC,
-                   "attempting to reset target on instance destroy\n");
-        ath6kl_reset_device(ar, ar->target_type, true, true);
+        ath6kl_init_hw_reset(ar);
 
         up(&ar->sem);
 }
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index bd50b6b7b492..d4fcfcad57d0 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -345,39 +345,6 @@ out:
         return ret;
 }
 
-/* FIXME: move to a better place, target.h? */
-#define AR6003_RESET_CONTROL_ADDRESS 0x00004000
-#define AR6004_RESET_CONTROL_ADDRESS 0x00004000
-
-void ath6kl_reset_device(struct ath6kl *ar, u32 target_type,
-                         bool wait_fot_compltn, bool cold_reset)
-{
-        int status = 0;
-        u32 address;
-        __le32 data;
-
-        if (target_type != TARGET_TYPE_AR6003 &&
-            target_type != TARGET_TYPE_AR6004)
-                return;
-
-        data = cold_reset ? cpu_to_le32(RESET_CONTROL_COLD_RST) :
-                            cpu_to_le32(RESET_CONTROL_MBOX_RST);
-
-        switch (target_type) {
-        case TARGET_TYPE_AR6003:
-                address = AR6003_RESET_CONTROL_ADDRESS;
-                break;
-        case TARGET_TYPE_AR6004:
-                address = AR6004_RESET_CONTROL_ADDRESS;
-                break;
-        }
-
-        status = ath6kl_diag_write32(ar, address, data);
-
-        if (status)
-                ath6kl_err("failed to reset target\n");
-}
-
 static void ath6kl_install_static_wep_keys(struct ath6kl_vif *vif)
 {
         u8 index;
@@ -1327,9 +1294,11 @@ void init_netdev(struct net_device *dev)
         dev->watchdog_timeo = ATH6KL_TX_TIMEOUT;
 
         dev->needed_headroom = ETH_HLEN;
-        dev->needed_headroom += sizeof(struct ath6kl_llc_snap_hdr) +
-                                sizeof(struct wmi_data_hdr) + HTC_HDR_LENGTH
-                                + WMI_MAX_TX_META_SZ + ATH6KL_HTC_ALIGN_BYTES;
+        dev->needed_headroom += roundup(sizeof(struct ath6kl_llc_snap_hdr) +
+                                        sizeof(struct wmi_data_hdr) +
+                                        HTC_HDR_LENGTH +
+                                        WMI_MAX_TX_META_SZ +
+                                        ATH6KL_HTC_ALIGN_BYTES, 4);
 
         dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
 
diff --git a/drivers/net/wireless/ath/ath6kl/sdio.c b/drivers/net/wireless/ath/ath6kl/sdio.c
index d111980d44c0..fb141454c6d2 100644
--- a/drivers/net/wireless/ath/ath6kl/sdio.c
+++ b/drivers/net/wireless/ath/ath6kl/sdio.c
@@ -28,6 +28,7 @@
 #include "target.h"
 #include "debug.h"
 #include "cfg80211.h"
+#include "trace.h"
 
 struct ath6kl_sdio {
         struct sdio_func *func;
@@ -179,6 +180,8 @@ static int ath6kl_sdio_io(struct sdio_func *func, u32 request, u32 addr,
                    request & HIF_FIXED_ADDRESS ? " (fixed)" : "", buf, len);
         ath6kl_dbg_dump(ATH6KL_DBG_SDIO_DUMP, NULL, "sdio ", buf, len);
 
+        trace_ath6kl_sdio(addr, request, buf, len);
+
         return ret;
 }
 
@@ -309,6 +312,13 @@ static int ath6kl_sdio_scat_rw(struct ath6kl_sdio *ar_sdio,
         sdio_claim_host(ar_sdio->func);
 
         mmc_set_data_timeout(&data, ar_sdio->func->card);
+
+        trace_ath6kl_sdio_scat(scat_req->addr,
+                               scat_req->req,
+                               scat_req->len,
+                               scat_req->scat_entries,
+                               scat_req->scat_list);
+
         /* synchronous call to process request */
         mmc_wait_for_req(ar_sdio->func->card->host, &mmc_req);
 
@@ -1123,10 +1133,12 @@ static int ath6kl_sdio_bmi_write(struct ath6kl *ar, u8 *buf, u32 len)
 
         ret = ath6kl_sdio_read_write_sync(ar, addr, buf, len,
                                           HIF_WR_SYNC_BYTE_INC);
-        if (ret)
+        if (ret) {
                 ath6kl_err("unable to send the bmi data to the device\n");
+                return ret;
+        }
 
-        return ret;
+        return 0;
 }
 
 static int ath6kl_sdio_bmi_read(struct ath6kl *ar, u8 *buf, u32 len)
diff --git a/drivers/net/wireless/ath/ath6kl/target.h b/drivers/net/wireless/ath/ath6kl/target.h
index a98c12ba70c1..a580a629a0da 100644
--- a/drivers/net/wireless/ath/ath6kl/target.h
+++ b/drivers/net/wireless/ath/ath6kl/target.h
@@ -25,7 +25,7 @@
 #define AR6004_BOARD_DATA_SZ     6144
 #define AR6004_BOARD_EXT_DATA_SZ 0
 
-#define RESET_CONTROL_ADDRESS           0x00000000
+#define RESET_CONTROL_ADDRESS           0x00004000
 #define RESET_CONTROL_COLD_RST          0x00000100
 #define RESET_CONTROL_MBOX_RST          0x00000004
 
diff --git a/drivers/net/wireless/ath/ath6kl/trace.c b/drivers/net/wireless/ath/ath6kl/trace.c
new file mode 100644
index 000000000000..e7d64b1285cb
--- /dev/null
+++ b/drivers/net/wireless/ath/ath6kl/trace.c
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+
+#define CREATE_TRACE_POINTS
+#include "trace.h"
+
+EXPORT_TRACEPOINT_SYMBOL(ath6kl_sdio);
+EXPORT_TRACEPOINT_SYMBOL(ath6kl_sdio_scat);
diff --git a/drivers/net/wireless/ath/ath6kl/trace.h b/drivers/net/wireless/ath/ath6kl/trace.h
new file mode 100644
index 000000000000..1a1ea7881b4d
--- /dev/null
+++ b/drivers/net/wireless/ath/ath6kl/trace.h
@@ -0,0 +1,332 @@
+#if !defined(_ATH6KL_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+
+#include <net/cfg80211.h>
+#include <linux/skbuff.h>
+#include <linux/tracepoint.h>
+#include "wmi.h"
+#include "hif.h"
+
+#if !defined(_ATH6KL_TRACE_H)
+static inline unsigned int ath6kl_get_wmi_id(void *buf, size_t buf_len)
+{
+        struct wmi_cmd_hdr *hdr = buf;
+
+        if (buf_len < sizeof(*hdr))
+                return 0;
+
+        return le16_to_cpu(hdr->cmd_id);
+}
+#endif /* __ATH6KL_TRACE_H */
+
+#define _ATH6KL_TRACE_H
+
+/* create empty functions when tracing is disabled */
+#if !defined(CONFIG_ATH6KL_TRACING)
+#undef TRACE_EVENT
+#define TRACE_EVENT(name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#undef DECLARE_EVENT_CLASS
+#define DECLARE_EVENT_CLASS(...)
+#undef DEFINE_EVENT
+#define DEFINE_EVENT(evt_class, name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#endif /* !CONFIG_ATH6KL_TRACING || __CHECKER__ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM ath6kl
+
+TRACE_EVENT(ath6kl_wmi_cmd,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(unsigned int, id)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->id = ath6kl_get_wmi_id(buf, buf_len);
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "id %d len %zd",
+                __entry->id, __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_wmi_event,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(unsigned int, id)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->id = ath6kl_get_wmi_id(buf, buf_len);
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "id %d len %zd",
+                __entry->id, __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_sdio,
+        TP_PROTO(unsigned int addr, int flags,
+                 void *buf, size_t buf_len),
+
+        TP_ARGS(addr, flags, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(unsigned int, tx)
+                __field(unsigned int, addr)
+                __field(int, flags)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->addr = addr;
+                __entry->flags = flags;
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+
+                if (flags & HIF_WRITE)
+                        __entry->tx = 1;
+                else
+                        __entry->tx = 0;
+        ),
+
+        TP_printk(
+                "%s addr 0x%x flags 0x%x len %zd\n",
+                __entry->tx ? "tx" : "rx",
+                __entry->addr,
+                __entry->flags,
+                __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_sdio_scat,
+        TP_PROTO(unsigned int addr, int flags, unsigned int total_len,
+                 unsigned int entries, struct hif_scatter_item *list),
+
+        TP_ARGS(addr, flags, total_len, entries, list),
+
+        TP_STRUCT__entry(
+                __field(unsigned int, tx)
+                __field(unsigned int, addr)
+                __field(int, flags)
+                __field(unsigned int, entries)
+                __field(size_t, total_len)
+                __dynamic_array(unsigned int, len_array, entries)
+                __dynamic_array(u8, data, total_len)
+        ),
+
+        TP_fast_assign(
+                unsigned int *len_array;
+                int i, offset = 0;
+                size_t len;
+
+                __entry->addr = addr;
+                __entry->flags = flags;
+                __entry->entries = entries;
+                __entry->total_len = total_len;
+
+                if (flags & HIF_WRITE)
+                        __entry->tx = 1;
+                else
+                        __entry->tx = 0;
+
+                len_array = __get_dynamic_array(len_array);
+
+                for (i = 0; i < entries; i++) {
+                        len = list[i].len;
+
+                        memcpy((u8 *) __get_dynamic_array(data) + offset,
+                               list[i].buf, len);
+
+                        len_array[i] = len;
+                        offset += len;
+                }
+        ),
+
+        TP_printk(
+                "%s addr 0x%x flags 0x%x entries %d total_len %zd\n",
+                __entry->tx ? "tx" : "rx",
+                __entry->addr,
+                __entry->flags,
+                __entry->entries,
+                __entry->total_len
+        )
+);
+
+TRACE_EVENT(ath6kl_sdio_irq,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "irq len %zd\n", __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_htc_rx,
+        TP_PROTO(int status, int endpoint, void *buf,
+                 size_t buf_len),
+
+        TP_ARGS(status, endpoint, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(int, status)
+                __field(int, endpoint)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->status = status;
+                __entry->endpoint = endpoint;
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "status %d endpoint %d len %zd\n",
+                __entry->status,
+                __entry->endpoint,
+                __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_htc_tx,
+        TP_PROTO(int status, int endpoint, void *buf,
+                 size_t buf_len),
+
+        TP_ARGS(status, endpoint, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(int, status)
+                __field(int, endpoint)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->status = status;
+                __entry->endpoint = endpoint;
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "status %d endpoint %d len %zd\n",
+                __entry->status,
+                __entry->endpoint,
+                __entry->buf_len
+        )
+);
+
+#define ATH6KL_MSG_MAX 200
+
+DECLARE_EVENT_CLASS(ath6kl_log_event,
+        TP_PROTO(struct va_format *vaf),
+        TP_ARGS(vaf),
+        TP_STRUCT__entry(
+                __dynamic_array(char, msg, ATH6KL_MSG_MAX)
+        ),
+        TP_fast_assign(
+                WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+                                       ATH6KL_MSG_MAX,
+                                       vaf->fmt,
+                                       *vaf->va) >= ATH6KL_MSG_MAX);
+        ),
+        TP_printk("%s", __get_str(msg))
+);
+
+DEFINE_EVENT(ath6kl_log_event, ath6kl_log_err,
+             TP_PROTO(struct va_format *vaf),
+             TP_ARGS(vaf)
+);
+
+DEFINE_EVENT(ath6kl_log_event, ath6kl_log_warn,
+             TP_PROTO(struct va_format *vaf),
+             TP_ARGS(vaf)
+);
+
+DEFINE_EVENT(ath6kl_log_event, ath6kl_log_info,
+             TP_PROTO(struct va_format *vaf),
+             TP_ARGS(vaf)
+);
+
+TRACE_EVENT(ath6kl_log_dbg,
+        TP_PROTO(unsigned int level, struct va_format *vaf),
+        TP_ARGS(level, vaf),
+        TP_STRUCT__entry(
+                __field(unsigned int, level)
+                __dynamic_array(char, msg, ATH6KL_MSG_MAX)
+        ),
+        TP_fast_assign(
+                __entry->level = level;
+                WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+                                       ATH6KL_MSG_MAX,
+                                       vaf->fmt,
+                                       *vaf->va) >= ATH6KL_MSG_MAX);
+        ),
+        TP_printk("%s", __get_str(msg))
+);
+
+TRACE_EVENT(ath6kl_log_dbg_dump,
+        TP_PROTO(const char *msg, const char *prefix,
+                 const void *buf, size_t buf_len),
+
+        TP_ARGS(msg, prefix, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __string(msg, msg)
+                __string(prefix, prefix)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(msg, msg);
+                __assign_str(prefix, prefix);
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "%s/%s\n", __get_str(prefix), __get_str(msg)
+        )
+);
+
+#endif /* _ ATH6KL_TRACE_H || TRACE_HEADER_MULTI_READ*/
+
+/* we don't want to use include/trace/events */
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index 78b369286579..ebb24045a8ae 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -20,6 +20,7 @@
 #include "core.h"
 #include "debug.h"
 #include "htc-ops.h"
+#include "trace.h"
 
 /*
  * tid - tid_mux0..tid_mux3
@@ -288,6 +289,8 @@ int ath6kl_control_tx(void *devt, struct sk_buff *skb,
         int status = 0;
         struct ath6kl_cookie *cookie = NULL;
 
+        trace_ath6kl_wmi_cmd(skb->data, skb->len);
+
         if (WARN_ON_ONCE(ar->state == ATH6KL_STATE_WOW)) {
                 dev_kfree_skb(skb);
                 return -EACCES;
@@ -1324,7 +1327,7 @@ void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
                    __func__, ar, ept, skb, packet->buf,
                    packet->act_len, status);
 
-        if (status || !(skb->data + HTC_HDR_LENGTH)) {
+        if (status || packet->act_len < HTC_HDR_LENGTH) {
                 dev_kfree_skb(skb);
                 return;
         }
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 5fcd342762de..bed0d337712d 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -856,11 +856,9 @@ static int ath6kl_usb_submit_ctrl_out(struct ath6kl_usb *ar_usb,
         int ret;
 
         if (size > 0) {
-                buf = kmalloc(size, GFP_KERNEL);
+                buf = kmemdup(data, size, GFP_KERNEL);
                 if (buf == NULL)
                         return -ENOMEM;
-
-                memcpy(buf, data, size);
         }
 
         /* note: if successful returns number of bytes transfered */
@@ -872,8 +870,9 @@ static int ath6kl_usb_submit_ctrl_out(struct ath6kl_usb *ar_usb,
                               size, 1000);
 
         if (ret < 0) {
-                ath6kl_dbg(ATH6KL_DBG_USB, "%s failed,result = %d\n",
-                           __func__, ret);
+                ath6kl_warn("Failed to submit usb control message: %d\n", ret);
+                kfree(buf);
+                return ret;
         }
 
         kfree(buf);
@@ -903,8 +902,9 @@ static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb,
                                  size, 2 * HZ);
 
         if (ret < 0) {
-                ath6kl_dbg(ATH6KL_DBG_USB, "%s failed,result = %d\n",
-                           __func__, ret);
+                ath6kl_warn("Failed to read usb control message: %d\n", ret);
+                kfree(buf);
+                return ret;
         }
 
         memcpy((u8 *) data, buf, size);
@@ -961,8 +961,10 @@ static int ath6kl_usb_diag_read32(struct ath6kl *ar, u32 address, u32 *data)
                                 ATH6KL_USB_CONTROL_REQ_DIAG_RESP,
                                 ar_usb->diag_resp_buffer, &resp_len);
 
-        if (ret)
+        if (ret) {
+                ath6kl_warn("diag read32 failed: %d\n", ret);
                 return ret;
+        }
 
         resp = (struct ath6kl_usb_ctrl_diag_resp_read *)
                 ar_usb->diag_resp_buffer;
@@ -976,6 +978,7 @@ static int ath6kl_usb_diag_write32(struct ath6kl *ar, u32 address, __le32 data)
 {
         struct ath6kl_usb *ar_usb = ar->hif_priv;
         struct ath6kl_usb_ctrl_diag_cmd_write *cmd;
+        int ret;
 
         cmd = (struct ath6kl_usb_ctrl_diag_cmd_write *) ar_usb->diag_cmd_buffer;
 
@@ -984,12 +987,17 @@ static int ath6kl_usb_diag_write32(struct ath6kl *ar, u32 address, __le32 data)
         cmd->address = cpu_to_le32(address);
         cmd->value = data;
 
-        return ath6kl_usb_ctrl_msg_exchange(ar_usb,
-                                            ATH6KL_USB_CONTROL_REQ_DIAG_CMD,
-                                            (u8 *) cmd,
-                                            sizeof(*cmd),
-                                            0, NULL, NULL);
+        ret = ath6kl_usb_ctrl_msg_exchange(ar_usb,
+                                           ATH6KL_USB_CONTROL_REQ_DIAG_CMD,
+                                           (u8 *) cmd,
+                                           sizeof(*cmd),
+                                           0, NULL, NULL);
+        if (ret) {
+                ath6kl_warn("diag_write32 failed: %d\n", ret);
+                return ret;
+        }
 
+        return 0;
 }
 
 static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len)
@@ -1001,7 +1009,7 @@ static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len)
         ret = ath6kl_usb_submit_ctrl_in(ar_usb,
                                         ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP,
                                         0, 0, buf, len);
-        if (ret != 0) {
+        if (ret) {
                 ath6kl_err("Unable to read the bmi data from the device: %d\n",
                            ret);
                 return ret;
@@ -1019,7 +1027,7 @@ static int ath6kl_usb_bmi_write(struct ath6kl *ar, u8 *buf, u32 len)
         ret = ath6kl_usb_submit_ctrl_out(ar_usb,
                                          ATH6KL_USB_CONTROL_REQ_SEND_BMI_CMD,
                                          0, 0, buf, len);
-        if (ret != 0) {
+        if (ret) {
                 ath6kl_err("unable to send the bmi data to the device: %d\n",
                            ret);
                 return ret;
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index d76b5bd81a0d..87aefb4c4c23 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -20,6 +20,7 @@
 #include "core.h"
 #include "debug.h"
 #include "testmode.h"
+#include "trace.h"
 #include "../regd.h"
 #include "../regd_common.h"
 
@@ -2028,6 +2029,9 @@ int ath6kl_wmi_beginscan_cmd(struct wmi *wmi, u8 if_idx,
                 if (!sband)
                         continue;
 
+                if (WARN_ON(band >= ATH6KL_NUM_BANDS))
+                        break;
+
                 ratemask = rates[band];
                 supp_rates = sc->supp_rates[band].rates;
                 num_rates = 0;
@@ -4086,6 +4090,8 @@ int ath6kl_wmi_control_rx(struct wmi *wmi, struct sk_buff *skb)
                 return -EINVAL;
         }
 
+        trace_ath6kl_wmi_event(skb->data, skb->len);
+
         return ath6kl_wmi_proc_events(wmi, skb);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index fd69376ecc83..391da5ad6a99 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -18,6 +18,7 @@
 #include "hw-ops.h"
 #include "../regd.h"
 #include "ar9002_phy.h"
+#include "ar5008_initvals.h"
 
 /* All code below is for AR5008, AR9001, AR9002 */
 
@@ -43,23 +44,16 @@ static const int m2ThreshLowExt_off = 127;
 static const int m1ThreshExt_off = 127;
 static const int m2ThreshExt_off = 127;
 
+static const struct ar5416IniArray bank0 = STATIC_INI_ARRAY(ar5416Bank0);
+static const struct ar5416IniArray bank1 = STATIC_INI_ARRAY(ar5416Bank1);
+static const struct ar5416IniArray bank2 = STATIC_INI_ARRAY(ar5416Bank2);
+static const struct ar5416IniArray bank3 = STATIC_INI_ARRAY(ar5416Bank3);
+static const struct ar5416IniArray bank7 = STATIC_INI_ARRAY(ar5416Bank7);
 
-static void ar5008_rf_bank_setup(u32 *bank, struct ar5416IniArray *array,
-                                 int col)
-{
-        int i;
-
-        for (i = 0; i < array->ia_rows; i++)
-                bank[i] = INI_RA(array, i, col);
-}
-
-
-#define REG_WRITE_RF_ARRAY(iniarray, regData, regWr) \
-        ar5008_write_rf_array(ah, iniarray, regData, &(regWr))
-
-static void ar5008_write_rf_array(struct ath_hw *ah, struct ar5416IniArray *array,
-                                  u32 *data, unsigned int *writecnt)
+static void ar5008_write_bank6(struct ath_hw *ah, unsigned int *writecnt)
 {
+        struct ar5416IniArray *array = &ah->iniBank6;
+        u32 *data = ah->analogBank6Data;
         int r;
 
         ENABLE_REGWRITE_BUFFER(ah);
@@ -165,7 +159,7 @@ static void ar5008_hw_force_bias(struct ath_hw *ah, u16 synth_freq)
         ar5008_hw_phy_modify_rx_buffer(ah->analogBank6Data, tmp_reg, 3, 181, 3);
 
         /* write Bank 6 with new params */
-        REG_WRITE_RF_ARRAY(&ah->iniBank6, ah->analogBank6Data, reg_writes);
+        ar5008_write_bank6(ah, &reg_writes);
 }
 
 /**
@@ -469,31 +463,16 @@ static void ar5008_hw_spur_mitigate(struct ath_hw *ah,
  */
 static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
 {
-#define ATH_ALLOC_BANK(bank, size) do { \
-                bank = devm_kzalloc(ah->dev, sizeof(u32) * size, GFP_KERNEL); \
-                if (!bank) \
-                        goto error; \
-        } while (0);
-
-        struct ath_common *common = ath9k_hw_common(ah);
+        int size = ah->iniBank6.ia_rows * sizeof(u32);
 
         if (AR_SREV_9280_20_OR_LATER(ah))
             return 0;
 
-        ATH_ALLOC_BANK(ah->analogBank0Data, ah->iniBank0.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank1Data, ah->iniBank1.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank2Data, ah->iniBank2.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank3Data, ah->iniBank3.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
-        ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
+        ah->analogBank6Data = devm_kzalloc(ah->dev, size, GFP_KERNEL);
+        if (!ah->analogBank6Data)
+                return -ENOMEM;
 
         return 0;
-#undef ATH_ALLOC_BANK
-error:
-        ath_err(common, "Cannot allocate RF banks\n");
-        return -ENOMEM;
 }
 
 
@@ -517,6 +496,7 @@ static bool ar5008_hw_set_rf_regs(struct ath_hw *ah,
         u32 ob5GHz = 0, db5GHz = 0;
         u32 ob2GHz = 0, db2GHz = 0;
         int regWrites = 0;
+        int i;
 
         /*
          * Software does not need to program bank data
@@ -529,25 +509,8 @@ static bool ar5008_hw_set_rf_regs(struct ath_hw *ah,
         /* Setup rf parameters */
         eepMinorRev = ah->eep_ops->get_eeprom(ah, EEP_MINOR_REV);
 
-        /* Setup Bank 0 Write */
-        ar5008_rf_bank_setup(ah->analogBank0Data, &ah->iniBank0, 1);
-
-        /* Setup Bank 1 Write */
-        ar5008_rf_bank_setup(ah->analogBank1Data, &ah->iniBank1, 1);
-
-        /* Setup Bank 2 Write */
-        ar5008_rf_bank_setup(ah->analogBank2Data, &ah->iniBank2, 1);
-
-        /* Setup Bank 6 Write */
-        ar5008_rf_bank_setup(ah->analogBank3Data, &ah->iniBank3,
-                      modesIndex);
-        {
-                int i;
-                for (i = 0; i < ah->iniBank6TPC.ia_rows; i++) {
-                        ah->analogBank6Data[i] =
-                            INI_RA(&ah->iniBank6TPC, i, modesIndex);
-                }
-        }
+        for (i = 0; i < ah->iniBank6.ia_rows; i++)
+                ah->analogBank6Data[i] = INI_RA(&ah->iniBank6, i, modesIndex);
 
         /* Only the 5 or 2 GHz OB/DB need to be set for a mode */
         if (eepMinorRev >= 2) {
@@ -568,22 +531,13 @@ static bool ar5008_hw_set_rf_regs(struct ath_hw *ah,
                 }
         }
 
-        /* Setup Bank 7 Setup */
-        ar5008_rf_bank_setup(ah->analogBank7Data, &ah->iniBank7, 1);
-
         /* Write Analog registers */
-        REG_WRITE_RF_ARRAY(&ah->iniBank0, ah->analogBank0Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank1, ah->analogBank1Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank2, ah->analogBank2Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank3, ah->analogBank3Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank6TPC, ah->analogBank6Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank7, ah->analogBank7Data,
-                           regWrites);
+        REG_WRITE_ARRAY(&bank0, 1, regWrites);
+        REG_WRITE_ARRAY(&bank1, 1, regWrites);
+        REG_WRITE_ARRAY(&bank2, 1, regWrites);
+        REG_WRITE_ARRAY(&bank3, modesIndex, regWrites);
+        ar5008_write_bank6(ah, &regWrites);
+        REG_WRITE_ARRAY(&bank7, 1, regWrites);
 
         return true;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index c55e5bbafc46..9f589744a9f9 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -731,7 +731,8 @@ static bool ar9285_hw_cl_cal(struct ath_hw *ah, struct ath9k_channel *chan)
                 if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
                                   AR_PHY_AGC_CONTROL_CAL, 0, AH_WAIT_TIMEOUT)) {
                         ath_dbg(common, CALIBRATE,
-                                "offset calibration failed to complete in 1ms; noisy environment?\n");
+                                "offset calibration failed to complete in %d ms; noisy environment?\n",
+                                AH_WAIT_TIMEOUT / 1000);
                         return false;
                 }
                 REG_CLR_BIT(ah, AR_PHY_TURBO, AR_PHY_FC_DYN2040_EN);
@@ -745,7 +746,8 @@ static bool ar9285_hw_cl_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
                           0, AH_WAIT_TIMEOUT)) {
                 ath_dbg(common, CALIBRATE,
-                        "offset calibration failed to complete in 1ms; noisy environment?\n");
+                        "offset calibration failed to complete in %d ms; noisy environment?\n",
+                        AH_WAIT_TIMEOUT / 1000);
                 return false;
         }
 
@@ -841,7 +843,8 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
                                    AR_PHY_AGC_CONTROL_CAL,
                                    0, AH_WAIT_TIMEOUT)) {
                         ath_dbg(common, CALIBRATE,
-                                "offset calibration failed to complete in 1ms; noisy environment?\n");
+                                "offset calibration failed to complete in %d ms; noisy environment?\n",
+                                AH_WAIT_TIMEOUT / 1000);
                         return false;
                 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index f053d978540e..830daa12feb6 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -67,12 +67,10 @@ static int ar9002_hw_init_mode_regs(struct ath_hw *ah)
         } else if (AR_SREV_9100_OR_LATER(ah)) {
                 INIT_INI_ARRAY(&ah->iniModes, ar5416Modes_9100);
                 INIT_INI_ARRAY(&ah->iniCommon, ar5416Common_9100);
-                INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6_9100);
                 INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac_9100);
         } else {
                 INIT_INI_ARRAY(&ah->iniModes, ar5416Modes);
                 INIT_INI_ARRAY(&ah->iniCommon, ar5416Common);
-                INIT_INI_ARRAY(&ah->iniBank6TPC, ar5416Bank6TPC);
                 INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac);
         }
 
@@ -80,20 +78,11 @@ static int ar9002_hw_init_mode_regs(struct ath_hw *ah)
                 /* Common for AR5416, AR913x, AR9160 */
                 INIT_INI_ARRAY(&ah->iniBB_RfGain, ar5416BB_RfGain);
 
-                INIT_INI_ARRAY(&ah->iniBank0, ar5416Bank0);
-                INIT_INI_ARRAY(&ah->iniBank1, ar5416Bank1);
-                INIT_INI_ARRAY(&ah->iniBank2, ar5416Bank2);
-                INIT_INI_ARRAY(&ah->iniBank3, ar5416Bank3);
-                INIT_INI_ARRAY(&ah->iniBank7, ar5416Bank7);
-
-                /* Common for AR5416, AR9160 */
-                if (!AR_SREV_9100(ah))
-                        INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6);
-
                 /* Common for AR913x, AR9160 */
                 if (!AR_SREV_5416(ah))
-                        INIT_INI_ARRAY(&ah->iniBank6TPC,
-                                      ar5416Bank6TPC_9100);
+                        INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6TPC_9100);
+                else
+                        INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6TPC);
         }
 
         /* iniAddac needs to be modified for these chips */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 4cc13940c895..639ba7d18ea4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -1023,6 +1023,7 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                                           AR_PHY_AGC_CONTROL_FLTR_CAL   |
                                           AR_PHY_AGC_CONTROL_PKDET_CAL;
 
+        /* Use chip chainmask only for calibration */
         ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
 
         if (rtt) {
@@ -1125,7 +1126,8 @@ skip_tx_iqcal:
                         ar9003_hw_rtt_disable(ah);
 
                 ath_dbg(common, CALIBRATE,
-                        "offset calibration failed to complete in 1ms; noisy environment?\n");
+                        "offset calibration failed to complete in %d ms; noisy environment?\n",
+                        AH_WAIT_TIMEOUT / 1000);
                 return false;
         }
 
@@ -1150,6 +1152,9 @@ skip_tx_iqcal:
                 ar9003_hw_rtt_disable(ah);
         }
 
+        /* Revert chainmask to runtime parameters */
+        ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
+
         /* Initialize list pointers */
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 881e989ea470..e6b92ff265fd 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3606,6 +3606,12 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
         value = ar9003_hw_ant_ctrl_common_2_get(ah, is2ghz);
         REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM_2, AR_SWITCH_TABLE_COM2_ALL, value);
 
+        if ((AR_SREV_9462(ah)) && (ah->rxchainmask == 0x2)) {
+                value = ar9003_hw_ant_ctrl_chain_get(ah, 1, is2ghz);
+                REG_RMW_FIELD(ah, switch_chain_reg[0],
+                              AR_SWITCH_TABLE_ALL, value);
+        }
+
         for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
                 if ((ah->rxchainmask & BIT(chain)) ||
                     (ah->txchainmask & BIT(chain))) {
@@ -3772,6 +3778,17 @@ static void ar9003_hw_atten_apply(struct ath_hw *ah, struct ath9k_channel *chan)
                                           AR_PHY_EXT_ATTEN_CTL_2,
                                          };
 
+        if ((AR_SREV_9462(ah)) && (ah->rxchainmask == 0x2)) {
+                value = ar9003_hw_atten_chain_get(ah, 1, chan);
+                REG_RMW_FIELD(ah, ext_atten_reg[0],
+                              AR_PHY_EXT_ATTEN_CTL_XATTEN1_DB, value);
+
+                value = ar9003_hw_atten_chain_get_margin(ah, 1, chan);
+                REG_RMW_FIELD(ah, ext_atten_reg[0],
+                              AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN,
+                              value);
+        }
+
         /* Test value. if 0 then attenuation is unused. Don't load anything. */
         for (i = 0; i < 3; i++) {
                 if (ah->txchainmask & BIT(i)) {
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index ccc42a71b436..999ab08c34e6 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -37,28 +37,28 @@ static const u32 ar9462_pciephy_clkreq_enable_L1_2p0[][2] = {
         /* Addr      allmodes  */
         {0x00018c00, 0x18253ede},
         {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0003580c},
+        {0x00018c08, 0x0003780c},
 };
 
 static const u32 ar9462_2p0_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a800d},
         {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a01ae},
-        {0x00009824, 0x5ac640de, 0x5ac640d0, 0x5ac640d0, 0x63c640da},
+        {0x00009824, 0x63c640de, 0x5ac640d0, 0x5ac640d0, 0x63c640da},
         {0x00009828, 0x0796be89, 0x0696b081, 0x0696b881, 0x09143e81},
         {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
         {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
         {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
-        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a2},
         {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
         {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000d8},
         {0x00009e10, 0x92c88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec86d2e},
-        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3376605e, 0x32395d5e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e3c, 0xcf946222, 0xcf946222, 0xcfd5c782, 0xcfd5c282},
+        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
         {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -82,9 +82,9 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x0000a2d0, 0x00041981, 0x00041981, 0x00041981, 0x00041982},
         {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a3a4, 0x00000010, 0x00000010, 0x00000000, 0x00000000},
+        {0x0000a3a4, 0x00000050, 0x00000050, 0x00000000, 0x00000000},
         {0x0000a3a8, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa},
-        {0x0000a3ac, 0xaaaaaa00, 0xaaaaaa30, 0xaaaaaa00, 0xaaaaaa00},
+        {0x0000a3ac, 0xaaaaaa00, 0xaa30aa30, 0xaaaaaa00, 0xaaaaaa00},
         {0x0000a41c, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
         {0x0000a420, 0x000001ce, 0x000001ce, 0x000001ce, 0x000001ce},
         {0x0000a424, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
@@ -363,14 +363,14 @@ static const u32 ar9462_pciephy_clkreq_disable_L1_2p0[][2] = {
         /* Addr      allmodes  */
         {0x00018c00, 0x18213ede},
         {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0003580c},
+        {0x00018c08, 0x0003780c},
 };
 
 static const u32 ar9462_pciephy_pll_on_clkreq_disable_L1_2p0[][2] = {
         /* Addr      allmodes  */
         {0x00018c00, 0x18212ede},
         {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0003580c},
+        {0x00018c08, 0x0003780c},
 };
 
 static const u32 ar9462_2p0_radio_postamble_sys2ant[][5] = {
@@ -775,7 +775,7 @@ static const u32 ar9462_2p0_baseband_core[][2] = {
         {0x00009fc0, 0x803e4788},
         {0x00009fc4, 0x0001efb5},
         {0x00009fcc, 0x40000014},
-        {0x00009fd0, 0x01193b93},
+        {0x00009fd0, 0x0a193b93},
         {0x0000a20c, 0x00000000},
         {0x0000a220, 0x00000000},
         {0x0000a224, 0x00000000},
@@ -850,7 +850,7 @@ static const u32 ar9462_2p0_baseband_core[][2] = {
         {0x0000a7cc, 0x00000000},
         {0x0000a7d0, 0x00000000},
         {0x0000a7d4, 0x00000004},
-        {0x0000a7dc, 0x00000001},
+        {0x0000a7dc, 0x00000000},
         {0x0000a7f0, 0x80000000},
         {0x0000a8d0, 0x004b6a8e},
         {0x0000a8d4, 0x00000820},
@@ -886,7 +886,7 @@ static const u32 ar9462_modes_high_ob_db_tx_gain_table_2p0[][5] = {
         {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
         {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
         {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a410, 0x000050da, 0x000050da, 0x000050de, 0x000050de},
         {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
         {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
@@ -906,20 +906,20 @@ static const u32 ar9462_modes_high_ob_db_tx_gain_table_2p0[][5] = {
         {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x34001640, 0x34001640},
         {0x0000a540, 0x48025e6c, 0x48025e6c, 0x38001660, 0x38001660},
         {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x53025eb2, 0x53025eb2, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x59025eb6, 0x59025eb6, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x5d025ef6, 0x5d025ef6, 0x44001c84, 0x44001c84},
+        {0x0000a548, 0x55025eb3, 0x55025eb3, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x58025ef3, 0x58025ef3, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x5d025ef6, 0x5d025ef6, 0x44001a84, 0x44001a84},
         {0x0000a554, 0x62025f56, 0x62025f56, 0x48001ce3, 0x48001ce3},
         {0x0000a558, 0x66027f56, 0x66027f56, 0x4c001ce5, 0x4c001ce5},
         {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x50001ce9, 0x50001ce9},
         {0x0000a560, 0x70049f56, 0x70049f56, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a56c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a570, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a574, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a578, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a57c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a564, 0x751ffff6, 0x751ffff6, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x751ffff6, 0x751ffff6, 0x58001ef0, 0x58001ef0},
+        {0x0000a56c, 0x751ffff6, 0x751ffff6, 0x5a001ef4, 0x5a001ef4},
+        {0x0000a570, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a574, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a578, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a57c, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
         {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
@@ -1053,7 +1053,6 @@ static const u32 ar9462_2p0_mac_core[][2] = {
         {0x00008044, 0x00000000},
         {0x00008048, 0x00000000},
         {0x0000804c, 0xffffffff},
-        {0x00008050, 0xffffffff},
         {0x00008054, 0x00000000},
         {0x00008058, 0x00000000},
         {0x0000805c, 0x000fc78f},
@@ -1117,9 +1116,9 @@ static const u32 ar9462_2p0_mac_core[][2] = {
         {0x000081f8, 0x00000000},
         {0x000081fc, 0x00000000},
         {0x00008240, 0x00100000},
-        {0x00008244, 0x0010f424},
+        {0x00008244, 0x0010f400},
         {0x00008248, 0x00000800},
-        {0x0000824c, 0x0001e848},
+        {0x0000824c, 0x0001e800},
         {0x00008250, 0x00000000},
         {0x00008254, 0x00000000},
         {0x00008258, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index a56b2416e2f9..86d35726edb4 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -311,6 +311,7 @@ struct ath_rx_edma {
 struct ath_rx {
         u8 defant;
         u8 rxotherant;
+        bool discard_next;
         u32 *rxlink;
         u32 num_pkts;
         unsigned int rxfilter;
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index b184f1ff0d38..7304e7585009 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -369,7 +369,6 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
         struct ieee80211_channel *c = chan->chan;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
 
-        chan->channelFlags &= (~CHANNEL_CW_INT);
         if (REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
                 ath_dbg(common, CALIBRATE,
                         "NF did not complete in calibration window\n");
@@ -384,7 +383,6 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
                 ath_dbg(common, CALIBRATE,
                         "noise floor failed detected; detected %d, threshold %d\n",
                         nf, nfThresh);
-                chan->channelFlags |= CHANNEL_CW_INT;
         }
 
         if (!caldata) {
@@ -410,7 +408,7 @@ void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
         int i, j;
 
         ah->caldata->channel = chan->channel;
-        ah->caldata->channelFlags = chan->channelFlags & ~CHANNEL_CW_INT;
+        ah->caldata->channelFlags = chan->channelFlags;
         ah->caldata->chanmode = chan->chanmode;
         h = ah->caldata->nfCalHist;
         default_nf = ath9k_hw_get_default_nf(ah, chan);
diff --git a/drivers/net/wireless/ath/ath9k/calib.h b/drivers/net/wireless/ath/ath9k/calib.h
index 60dcb6c22db9..3d70b8c2bcdd 100644
--- a/drivers/net/wireless/ath/ath9k/calib.h
+++ b/drivers/net/wireless/ath/ath9k/calib.h
@@ -33,6 +33,12 @@ struct ar5416IniArray {
         u32 ia_columns;
 };
 
+#define STATIC_INI_ARRAY(array) {                       \
+                .ia_array = (u32 *)(array),             \
+                .ia_rows = ARRAY_SIZE(array),           \
+                .ia_columns = ARRAY_SIZE(array[0]),     \
+        }
+
 #define INIT_INI_ARRAY(iniarray, array) do {    \
                 (iniarray)->ia_array = (u32 *)(array);          \
                 (iniarray)->ia_rows = ARRAY_SIZE(array);        \
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index 6c78fe7ca54d..344fdde1d7a3 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -27,20 +27,6 @@ MODULE_AUTHOR("Atheros Communications");
 MODULE_DESCRIPTION("Shared library for Atheros wireless 802.11n LAN cards.");
 MODULE_LICENSE("Dual BSD/GPL");
 
-int ath9k_cmn_padpos(__le16 frame_control)
-{
-        int padpos = 24;
-        if (ieee80211_has_a4(frame_control)) {
-                padpos += ETH_ALEN;
-        }
-        if (ieee80211_is_data_qos(frame_control)) {
-                padpos += IEEE80211_QOS_CTL_LEN;
-        }
-
-        return padpos;
-}
-EXPORT_SYMBOL(ath9k_cmn_padpos);
-
 int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 5f845beeb18b..207d06995b15 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -27,7 +27,7 @@
 #define WME_MAX_BA              WME_BA_BMP_SIZE
 #define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
 
-#define ATH_RSSI_DUMMY_MARKER   0x127
+#define ATH_RSSI_DUMMY_MARKER   127
 #define ATH_RSSI_LPF_LEN                10
 #define RSSI_LPF_THRESHOLD              -20
 #define ATH_RSSI_EP_MULTIPLIER     (1<<7)
@@ -40,9 +40,8 @@
         x = ATH_LPF_RSSI((x), ATH_RSSI_IN((y)), ATH_RSSI_LPF_LEN);      \
 } while (0)
 #define ATH_EP_RND(x, mul)                                              \
-        ((((x)%(mul)) >= ((mul)/2)) ? ((x) + ((mul) - 1)) / (mul) : (x)/(mul))
+        (((x) + ((mul)/2)) / (mul))
 
-int ath9k_cmn_padpos(__le16 frame_control);
 int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
 void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
                                struct ieee80211_channel *chan,
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 3714b971d18e..e6307b86363a 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -537,6 +537,7 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
         PR("AMPDUs Completed:", a_completed);
         PR("AMPDUs Retried:  ", a_retries);
         PR("AMPDUs XRetried: ", a_xretries);
+        PR("TXERR Filtered:  ", txerr_filtered);
         PR("FIFO Underrun:   ", fifo_underrun);
         PR("TXOP Exceeded:   ", xtxop);
         PR("TXTIMER Expiry:  ", timer_exp);
@@ -756,6 +757,8 @@ void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
                         TX_STAT_INC(qnum, completed);
         }
 
+        if (ts->ts_status & ATH9K_TXERR_FILT)
+                TX_STAT_INC(qnum, txerr_filtered);
         if (ts->ts_status & ATH9K_TXERR_FIFO)
                 TX_STAT_INC(qnum, fifo_underrun);
         if (ts->ts_status & ATH9K_TXERR_XTXOP)
@@ -1909,6 +1912,7 @@ static const char ath9k_gstrings_stats[][ETH_GSTRING_LEN] = {
         AMKSTR(d_tx_desc_cfg_err),
         AMKSTR(d_tx_data_underrun),
         AMKSTR(d_tx_delim_underrun),
+        "d_rx_crc_err",
         "d_rx_decrypt_crc_err",
         "d_rx_phy_err",
         "d_rx_mic_err",
@@ -1989,6 +1993,7 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,
         AWDATA(data_underrun);
         AWDATA(delim_underrun);
 
+        AWDATA_RX(crc_err);
         AWDATA_RX(decrypt_crc_err);
         AWDATA_RX(phy_err);
         AWDATA_RX(mic_err);
@@ -2067,7 +2072,7 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_modal_eeprom);
         sc->rfs_chan_spec_scan = relay_open("spectral_scan",
                                             sc->debug.debugfs_phy,
-                                            262144, 4, &rfs_spec_scan_cb,
+                                            1024, 256, &rfs_spec_scan_cb,
                                             NULL);
         debugfs_create_file("spectral_scan_ctl", S_IRUSR | S_IWUSR,
                             sc->debug.debugfs_phy, sc,
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 410d6d8f1aa7..794a7ec83a24 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -142,6 +142,7 @@ struct ath_interrupt_stats {
  * @a_completed: Total AMPDUs completed
  * @a_retries: No. of AMPDUs retried (SW)
  * @a_xretries: No. of AMPDUs dropped due to xretries
+ * @txerr_filtered: No. of frames with TXERR_FILT flag set.
  * @fifo_underrun: FIFO underrun occurrences
         Valid only for:
                 - non-aggregate condition.
@@ -168,6 +169,7 @@ struct ath_tx_stats {
         u32 a_completed;
         u32 a_retries;
         u32 a_xretries;
+        u32 txerr_filtered;
         u32 fifo_underrun;
         u32 xtxop;
         u32 timer_exp;
diff --git a/drivers/net/wireless/ath/ath9k/dfs.c b/drivers/net/wireless/ath/ath9k/dfs.c
index ecc81792f2dc..508f8b33f0ef 100644
--- a/drivers/net/wireless/ath/ath9k/dfs.c
+++ b/drivers/net/wireless/ath/ath9k/dfs.c
@@ -193,9 +193,7 @@ void ath9k_dfs_process_phyerr(struct ath_softc *sc, void *data,
                 DFS_STAT_INC(sc, pulses_processed);
                 if (pd != NULL && pd->add_pulse(pd, &pe)) {
                         DFS_STAT_INC(sc, radar_detected);
-                        /*
-                         * TODO: forward radar event to DFS management layer
-                         */
+                        ieee80211_radar_detected(sc->hw);
                 }
         }
 }
diff --git a/drivers/net/wireless/ath/ath9k/dfs_debug.c b/drivers/net/wireless/ath/ath9k/dfs_debug.c
index 55d28072adeb..b7611b7bbe43 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_debug.c
+++ b/drivers/net/wireless/ath/ath9k/dfs_debug.c
@@ -105,6 +105,24 @@ static ssize_t write_file_dfs(struct file *file, const char __user *user_buf,
         return count;
 }
 
+static ssize_t write_file_simulate_radar(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+
+        ieee80211_radar_detected(sc->hw);
+
+        return count;
+}
+
+static const struct file_operations fops_simulate_radar = {
+        .write = write_file_simulate_radar,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 static const struct file_operations fops_dfs_stats = {
         .read = read_file_dfs,
         .write = write_file_dfs,
@@ -117,4 +135,6 @@ void ath9k_dfs_init_debug(struct ath_softc *sc)
 {
         debugfs_create_file("dfs_stats", S_IRUSR,
                             sc->debug.debugfs_phy, sc, &fops_dfs_stats);
+        debugfs_create_file("dfs_simulate_radar", S_IWUSR,
+                            sc->debug.debugfs_phy, sc, &fops_simulate_radar);
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 96bfb18078fa..d3b099d7898b 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -22,6 +22,7 @@
 #include <linux/firmware.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/leds.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index d0ce1f5bba10..f13f458dd656 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -308,7 +308,7 @@ static void ath9k_htc_send_buffered(struct ath9k_htc_priv *priv,
         while(skb) {
                 hdr = (struct ieee80211_hdr *) skb->data;
 
-                padpos = ath9k_cmn_padpos(hdr->frame_control);
+                padpos = ieee80211_hdrlen(hdr->frame_control);
                 padsize = padpos & 3;
                 if (padsize && skb->len > padpos) {
                         if (skb_headroom(skb) < padsize) {
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 098e3545e512..0743a47cef8f 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -866,7 +866,7 @@ static void ath9k_htc_tx(struct ieee80211_hw *hw,
         hdr = (struct ieee80211_hdr *) skb->data;
 
         /* Add the padding after the header if this is not already done */
-        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padpos = ieee80211_hdrlen(hdr->frame_control);
         padsize = padpos & 3;
         if (padsize && skb->len > padpos) {
                 if (skb_headroom(skb) < padsize) {
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 306c55019e77..6bd0e92ea2aa 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -966,7 +966,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
         struct sk_buff *skb = rxbuf->skb;
         struct ath_common *common = ath9k_hw_common(priv->ah);
         struct ath_htc_rx_status *rxstatus;
-        int hdrlen, padpos, padsize;
+        int hdrlen, padsize;
         int last_rssi = ATH_RSSI_DUMMY_MARKER;
         __le16 fc;
 
@@ -996,11 +996,9 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
         fc = hdr->frame_control;
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
 
-        padpos = ath9k_cmn_padpos(fc);
-
-        padsize = padpos & 3;
-        if (padsize && skb->len >= padpos+padsize+FCS_LEN) {
-                memmove(skb->data + padsize, skb->data, padpos);
+        padsize = hdrlen & 3;
+        if (padsize && skb->len >= hdrlen+padsize+FCS_LEN) {
+                memmove(skb->data + padsize, skb->data, hdrlen);
                 skb_pull(skb, padsize);
         }
 
@@ -1067,15 +1065,19 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
 
         last_rssi = priv->rx.last_rssi;
 
-        if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
-                rxbuf->rxstatus.rs_rssi = ATH_EP_RND(last_rssi,
-                                                     ATH_RSSI_EP_MULTIPLIER);
+        if (ieee80211_is_beacon(hdr->frame_control) &&
+            !is_zero_ether_addr(common->curbssid) &&
+            ether_addr_equal(hdr->addr3, common->curbssid)) {
+                s8 rssi = rxbuf->rxstatus.rs_rssi;
+
+                if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
+                        rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
 
-        if (rxbuf->rxstatus.rs_rssi < 0)
-                rxbuf->rxstatus.rs_rssi = 0;
+                if (rssi < 0)
+                        rssi = 0;
 
-        if (ieee80211_is_beacon(fc))
-                priv->ah->stats.avgbrssi = rxbuf->rxstatus.rs_rssi;
+                priv->ah->stats.avgbrssi = rssi;
+        }
 
         rx_status->mactime = be64_to_cpu(rxbuf->rxstatus.rs_tstamp);
         rx_status->band = hw->conf.chandef.chan->band;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index d5e6a38fe74b..8a980a4bf4ec 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1464,7 +1464,9 @@ static bool ath9k_hw_chip_reset(struct ath_hw *ah,
                         reset_type = ATH9K_RESET_POWER_ON;
                 else
                         reset_type = ATH9K_RESET_COLD;
-        }
+        } else if (ah->chip_fullsleep || REG_READ(ah, AR_Q_TXE) ||
+                   (REG_READ(ah, AR_CR) & AR_CR_RXE))
+                reset_type = ATH9K_RESET_COLD;
 
         if (!ath9k_hw_set_reset_reg(ah, reset_type))
                 return false;
@@ -1668,6 +1670,104 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_check_alive);
 
+static void ath9k_hw_init_mfp(struct ath_hw *ah)
+{
+        /* Setup MFP options for CCMP */
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
+                /* Mask Retry(b11), PwrMgt(b12), MoreData(b13) to 0 in mgmt
+                 * frames when constructing CCMP AAD. */
+                REG_RMW_FIELD(ah, AR_AES_MUTE_MASK1, AR_AES_MUTE_MASK1_FC_MGMT,
+                              0xc7ff);
+                ah->sw_mgmt_crypto = false;
+        } else if (AR_SREV_9160_10_OR_LATER(ah)) {
+                /* Disable hardware crypto for management frames */
+                REG_CLR_BIT(ah, AR_PCU_MISC_MODE2,
+                            AR_PCU_MISC_MODE2_MGMT_CRYPTO_ENABLE);
+                REG_SET_BIT(ah, AR_PCU_MISC_MODE2,
+                            AR_PCU_MISC_MODE2_NO_CRYPTO_FOR_NON_DATA_PKT);
+                ah->sw_mgmt_crypto = true;
+        } else {
+                ah->sw_mgmt_crypto = true;
+        }
+}
+
+static void ath9k_hw_reset_opmode(struct ath_hw *ah,
+                                  u32 macStaId1, u32 saveDefAntenna)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
+        REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
+                  | macStaId1
+                  | AR_STA_ID1_RTS_USE_DEF
+                  | (ah->config.ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
+                  | ah->sta_id1_defaults);
+        ath_hw_setbssidmask(common);
+        REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
+        ath9k_hw_write_associd(ah);
+        REG_WRITE(ah, AR_ISR, ~0);
+        REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+
+        ath9k_hw_set_operating_mode(ah, ah->opmode);
+}
+
+static void ath9k_hw_init_queues(struct ath_hw *ah)
+{
+        int i;
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        for (i = 0; i < AR_NUM_DCU; i++)
+                REG_WRITE(ah, AR_DQCUMASK(i), 1 << i);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+
+        ah->intr_txqs = 0;
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+                ath9k_hw_resettxqueue(ah, i);
+}
+
+/*
+ * For big endian systems turn on swapping for descriptors
+ */
+static void ath9k_hw_init_desc(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (AR_SREV_9100(ah)) {
+                u32 mask;
+                mask = REG_READ(ah, AR_CFG);
+                if (mask & (AR_CFG_SWRB | AR_CFG_SWTB | AR_CFG_SWRG)) {
+                        ath_dbg(common, RESET, "CFG Byte Swap Set 0x%x\n",
+                                mask);
+                } else {
+                        mask = INIT_CONFIG_STATUS | AR_CFG_SWRB | AR_CFG_SWTB;
+                        REG_WRITE(ah, AR_CFG, mask);
+                        ath_dbg(common, RESET, "Setting CFG 0x%x\n",
+                                REG_READ(ah, AR_CFG));
+                }
+        } else {
+                if (common->bus_ops->ath_bus_type == ATH_USB) {
+                        /* Configure AR9271 target WLAN */
+                        if (AR_SREV_9271(ah))
+                                REG_WRITE(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB);
+                        else
+                                REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
+                }
+#ifdef __BIG_ENDIAN
+                else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
+                         AR_SREV_9550(ah))
+                        REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
+                else
+                        REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
+#endif
+        }
+}
+
 /*
  * Fast channel change:
  * (Change synthesizer based on channel freq without resetting chip)
@@ -1745,7 +1845,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         u32 saveDefAntenna;
         u32 macStaId1;
         u64 tsf = 0;
-        int i, r;
+        int r;
         bool start_mci_reset = false;
         bool save_fullsleep = ah->chip_fullsleep;
 
@@ -1762,10 +1862,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 ath9k_hw_getnf(ah, ah->curchan);
 
         ah->caldata = caldata;
-        if (caldata &&
-            (chan->channel != caldata->channel ||
-             (chan->channelFlags & ~CHANNEL_CW_INT) !=
-             (caldata->channelFlags & ~CHANNEL_CW_INT))) {
+        if (caldata && (chan->channel != caldata->channel ||
+                        chan->channelFlags != caldata->channelFlags)) {
                 /* Operating channel changed, reset channel calibration data */
                 memset(caldata, 0, sizeof(*caldata));
                 ath9k_init_nfcal_hist_buffer(ah, chan);
@@ -1852,22 +1950,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 ath9k_hw_settsf64(ah, tsf);
         }
 
-        /* Setup MFP options for CCMP */
-        if (AR_SREV_9280_20_OR_LATER(ah)) {
-                /* Mask Retry(b11), PwrMgt(b12), MoreData(b13) to 0 in mgmt
-                 * frames when constructing CCMP AAD. */
-                REG_RMW_FIELD(ah, AR_AES_MUTE_MASK1, AR_AES_MUTE_MASK1_FC_MGMT,
-                              0xc7ff);
-                ah->sw_mgmt_crypto = false;
-        } else if (AR_SREV_9160_10_OR_LATER(ah)) {
-                /* Disable hardware crypto for management frames */
-                REG_CLR_BIT(ah, AR_PCU_MISC_MODE2,
-                            AR_PCU_MISC_MODE2_MGMT_CRYPTO_ENABLE);
-                REG_SET_BIT(ah, AR_PCU_MISC_MODE2,
-                            AR_PCU_MISC_MODE2_NO_CRYPTO_FOR_NON_DATA_PKT);
-                ah->sw_mgmt_crypto = true;
-        } else
-                ah->sw_mgmt_crypto = true;
+        ath9k_hw_init_mfp(ah);
 
         if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
                 ath9k_hw_set_delta_slope(ah, chan);
@@ -1875,24 +1958,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         ath9k_hw_spur_mitigate_freq(ah, chan);
         ah->eep_ops->set_board_values(ah, chan);
 
-        ENABLE_REGWRITE_BUFFER(ah);
-
-        REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
-        REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
-                  | macStaId1
-                  | AR_STA_ID1_RTS_USE_DEF
-                  | (ah->config.
-                     ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
-                  | ah->sta_id1_defaults);
-        ath_hw_setbssidmask(common);
-        REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
-        ath9k_hw_write_associd(ah);
-        REG_WRITE(ah, AR_ISR, ~0);
-        REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
-
-        REGWRITE_BUFFER_FLUSH(ah);
-
-        ath9k_hw_set_operating_mode(ah, ah->opmode);
+        ath9k_hw_reset_opmode(ah, macStaId1, saveDefAntenna);
 
         r = ath9k_hw_rf_set_freq(ah, chan);
         if (r)
@@ -1900,17 +1966,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         ath9k_hw_set_clockrate(ah);
 
-        ENABLE_REGWRITE_BUFFER(ah);
-
-        for (i = 0; i < AR_NUM_DCU; i++)
-                REG_WRITE(ah, AR_DQCUMASK(i), 1 << i);
-
-        REGWRITE_BUFFER_FLUSH(ah);
-
-        ah->intr_txqs = 0;
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                ath9k_hw_resettxqueue(ah, i);
-
+        ath9k_hw_init_queues(ah);
         ath9k_hw_init_interrupt_masks(ah, ah->opmode);
         ath9k_hw_ani_cache_ini_regs(ah);
         ath9k_hw_init_qos(ah);
@@ -1965,38 +2021,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         REGWRITE_BUFFER_FLUSH(ah);
 
-        /*
-         * For big endian systems turn on swapping for descriptors
-         */
-        if (AR_SREV_9100(ah)) {
-                u32 mask;
-                mask = REG_READ(ah, AR_CFG);
-                if (mask & (AR_CFG_SWRB | AR_CFG_SWTB | AR_CFG_SWRG)) {
-                        ath_dbg(common, RESET, "CFG Byte Swap Set 0x%x\n",
-                                mask);
-                } else {
-                        mask =
-                                INIT_CONFIG_STATUS | AR_CFG_SWRB | AR_CFG_SWTB;
-                        REG_WRITE(ah, AR_CFG, mask);
-                        ath_dbg(common, RESET, "Setting CFG 0x%x\n",
-                                REG_READ(ah, AR_CFG));
-                }
-        } else {
-                if (common->bus_ops->ath_bus_type == ATH_USB) {
-                        /* Configure AR9271 target WLAN */
-                        if (AR_SREV_9271(ah))
-                                REG_WRITE(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB);
-                        else
-                                REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
-                }
-#ifdef __BIG_ENDIAN
-                else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-                         AR_SREV_9550(ah))
-                        REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
-                else
-                        REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
-#endif
-        }
+        ath9k_hw_init_desc(ah);
 
         if (ath9k_hw_btcoex_is_enabled(ah))
                 ath9k_hw_btcoex_enable(ah);
@@ -2009,7 +2034,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
                 ar9003_hw_bb_watchdog_config(ah);
-
                 ar9003_hw_disable_phy_restart(ah);
         }
 
@@ -2357,8 +2381,11 @@ static bool ath9k_hw_dfs_tested(struct ath_hw *ah)
 {
 
         switch (ah->hw_version.macVersion) {
+        /* for temporary testing DFS with 9280 */
+        case AR_SREV_VERSION_9280:
         /* AR9580 will likely be our first target to get testing on */
         case AR_SREV_VERSION_9580:
+                return true;
         default:
                 return false;
         }
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 784e81ccb903..ae3034374bc4 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -363,7 +363,6 @@ enum ath9k_int {
         ATH9K_INT_NOCARD = 0xffffffff
 };
 
-#define CHANNEL_CW_INT    0x00002
 #define CHANNEL_CCK       0x00020
 #define CHANNEL_OFDM      0x00040
 #define CHANNEL_2GHZ      0x00080
@@ -848,14 +847,7 @@ struct ath_hw {
         struct ath_hw_ops ops;
 
         /* Used to program the radio on non single-chip devices */
-        u32 *analogBank0Data;
-        u32 *analogBank1Data;
-        u32 *analogBank2Data;
-        u32 *analogBank3Data;
         u32 *analogBank6Data;
-        u32 *analogBank6TPCData;
-        u32 *analogBank7Data;
-        u32 *bank6Temp;
 
         int coverage_class;
         u32 slottime;
@@ -886,14 +878,8 @@ struct ath_hw {
 
         struct ar5416IniArray iniModes;
         struct ar5416IniArray iniCommon;
-        struct ar5416IniArray iniBank0;
         struct ar5416IniArray iniBB_RfGain;
-        struct ar5416IniArray iniBank1;
-        struct ar5416IniArray iniBank2;
-        struct ar5416IniArray iniBank3;
         struct ar5416IniArray iniBank6;
-        struct ar5416IniArray iniBank6TPC;
-        struct ar5416IniArray iniBank7;
         struct ar5416IniArray iniAddac;
         struct ar5416IniArray iniPcieSerdes;
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index af932c9444de..3be2eb0da84a 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -319,6 +319,10 @@ static void ath9k_reg_notifier(struct wiphy *wiphy,
                 ath9k_ps_wakeup(sc);
                 ath9k_hw_set_txpowerlimit(ah, sc->config.txpowlimit, false);
                 sc->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
+                /* synchronize DFS detector if regulatory domain changed */
+                if (sc->dfs_detector != NULL)
+                        sc->dfs_detector->set_dfs_domain(sc->dfs_detector,
+                                                         request->dfs_region);
                 ath9k_ps_restore(sc);
         }
 }
@@ -727,12 +731,28 @@ static const struct ieee80211_iface_limit if_limits[] = {
                                  BIT(NL80211_IFTYPE_P2P_GO) },
 };
 
-static const struct ieee80211_iface_combination if_comb = {
-        .limits = if_limits,
-        .n_limits = ARRAY_SIZE(if_limits),
-        .max_interfaces = 2048,
-        .num_different_channels = 1,
-        .beacon_int_infra_match = true,
+
+static const struct ieee80211_iface_limit if_dfs_limits[] = {
+        { .max = 1,     .types = BIT(NL80211_IFTYPE_AP) },
+};
+
+static const struct ieee80211_iface_combination if_comb[] = {
+        {
+                .limits = if_limits,
+                .n_limits = ARRAY_SIZE(if_limits),
+                .max_interfaces = 2048,
+                .num_different_channels = 1,
+                .beacon_int_infra_match = true,
+        },
+        {
+                .limits = if_dfs_limits,
+                .n_limits = ARRAY_SIZE(if_dfs_limits),
+                .max_interfaces = 1,
+                .num_different_channels = 1,
+                .beacon_int_infra_match = true,
+                .radar_detect_widths =  BIT(NL80211_CHAN_NO_HT) |
+                                        BIT(NL80211_CHAN_HT20),
+        }
 };
 
 void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
@@ -763,8 +783,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 BIT(NL80211_IFTYPE_ADHOC) |
                 BIT(NL80211_IFTYPE_MESH_POINT);
 
-        hw->wiphy->iface_combinations = &if_comb;
-        hw->wiphy->n_iface_combinations = 1;
+        hw->wiphy->iface_combinations = if_comb;
+        hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
 
         if (AR_SREV_5416(sc->sc_ah))
                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index b1433f561cd2..849259b07370 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -28,21 +28,21 @@ void ath_tx_complete_poll_work(struct work_struct *work)
         int i;
         bool needreset = false;
 
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                if (ATH_TXQ_SETUP(sc, i)) {
-                        txq = &sc->tx.txq[i];
-                        ath_txq_lock(sc, txq);
-                        if (txq->axq_depth) {
-                                if (txq->axq_tx_inprogress) {
-                                        needreset = true;
-                                        ath_txq_unlock(sc, txq);
-                                        break;
-                                } else {
-                                        txq->axq_tx_inprogress = true;
-                                }
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                txq = sc->tx.txq_map[i];
+
+                ath_txq_lock(sc, txq);
+                if (txq->axq_depth) {
+                        if (txq->axq_tx_inprogress) {
+                                needreset = true;
+                                ath_txq_unlock(sc, txq);
+                                break;
+                        } else {
+                                txq->axq_tx_inprogress = true;
                         }
-                        ath_txq_unlock_complete(sc, txq);
                 }
+                ath_txq_unlock_complete(sc, txq);
+        }
 
         if (needreset) {
                 ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
@@ -170,7 +170,8 @@ void ath_rx_poll(unsigned long data)
 {
         struct ath_softc *sc = (struct ath_softc *)data;
 
-        ieee80211_queue_work(sc->hw, &sc->hw_check_work);
+        if (!test_bit(SC_OP_INVALID, &sc->sc_flags))
+                ieee80211_queue_work(sc->hw, &sc->hw_check_work);
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 811007ec07a7..498fee04afa0 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -615,6 +615,14 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
                         rs->rs_status |= ATH9K_RXERR_DECRYPT;
                 else if (ads.ds_rxstatus8 & AR_MichaelErr)
                         rs->rs_status |= ATH9K_RXERR_MIC;
+        } else {
+                if (ads.ds_rxstatus8 &
+                    (AR_CRCErr | AR_PHYErr | AR_DecryptCRCErr | AR_MichaelErr))
+                        rs->rs_status |= ATH9K_RXERR_CORRUPT_DESC;
+
+                /* Only up to MCS16 supported, everything above is invalid */
+                if (rs->rs_rate >= 0x90)
+                        rs->rs_status |= ATH9K_RXERR_CORRUPT_DESC;
         }
 
         if (ads.ds_rxstatus8 & AR_KeyMiss)
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 1ff817061ebc..5865f92998e1 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -183,6 +183,7 @@ struct ath_htc_rx_status {
 #define ATH9K_RXERR_DECRYPT       0x08
 #define ATH9K_RXERR_MIC           0x10
 #define ATH9K_RXERR_KEYMISS       0x20
+#define ATH9K_RXERR_CORRUPT_DESC  0x40
 
 #define ATH9K_RX_MORE             0x01
 #define ATH9K_RX_MORE_AGGR        0x02
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index f984a03f912c..a383483d0387 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -280,6 +280,10 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
         if (r) {
                 ath_err(common,
                         "Unable to reset channel, reset status %d\n", r);
+
+                ath9k_hw_enable_interrupts(ah);
+                ath9k_queue_reset(sc, RESET_TYPE_BB_HANG);
+
                 goto out;
         }
 
@@ -1247,10 +1251,27 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 if (old_pos >= 0)
                         ath_update_survey_nf(sc, old_pos);
 
-                /* perform spectral scan if requested. */
-                if (sc->scanning && sc->spectral_mode == SPECTRAL_CHANSCAN)
-                        ath9k_spectral_scan_trigger(hw);
-
+                /*
+                 * Enable radar pulse detection if on a DFS channel. Spectral
+                 * scanning and radar detection can not be used concurrently.
+                 */
+                if (hw->conf.radar_enabled) {
+                        u32 rxfilter;
+
+                        /* set HW specific DFS configuration */
+                        ath9k_hw_set_radar_params(ah);
+                        rxfilter = ath9k_hw_getrxfilter(ah);
+                        rxfilter |= ATH9K_RX_FILTER_PHYRADAR |
+                                    ATH9K_RX_FILTER_PHYERR;
+                        ath9k_hw_setrxfilter(ah, rxfilter);
+                        ath_dbg(common, DFS, "DFS enabled at freq %d\n",
+                                curchan->center_freq);
+                } else {
+                        /* perform spectral scan if requested. */
+                        if (sc->scanning &&
+                            sc->spectral_mode == SPECTRAL_CHANSCAN)
+                                ath9k_spectral_scan_trigger(hw);
+                }
         }
 
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index c90ca57e3722..ebb8d361b981 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -381,6 +381,10 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
         rfilt = ATH9K_RX_FILTER_UCAST | ATH9K_RX_FILTER_BCAST
                 | ATH9K_RX_FILTER_MCAST;
 
+        /* if operating on a DFS channel, enable radar pulse detection */
+        if (sc->hw->conf.radar_enabled)
+                rfilt |= ATH9K_RX_FILTER_PHYRADAR | ATH9K_RX_FILTER_PHYERR;
+
         if (sc->rx.rxfilter & FIF_PROBE_REQ)
                 rfilt |= ATH9K_RX_FILTER_PROBEREQ;
 
@@ -723,6 +727,13 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
                 ret = ath9k_hw_rxprocdesc(ah, tds, &trs);
                 if (ret == -EINPROGRESS)
                         return NULL;
+
+                /*
+                 * mark descriptor as zero-length and set the 'more'
+                 * flag to ensure that both buffers get discarded
+                 */
+                rs->rs_datalen = 0;
+                rs->rs_more = true;
         }
 
         list_del(&bf->list);
@@ -929,14 +940,20 @@ static void ath9k_process_rssi(struct ath_common *common,
  * up the frame up to let mac80211 handle the actual error case, be it no
  * decryption key or real decryption error. This let us keep statistics there.
  */
-static int ath9k_rx_skb_preprocess(struct ath_common *common,
-                                   struct ieee80211_hw *hw,
+static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                                    struct ieee80211_hdr *hdr,
                                    struct ath_rx_status *rx_stats,
                                    struct ieee80211_rx_status *rx_status,
                                    bool *decrypt_error)
 {
-        struct ath_hw *ah = common->ah;
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        bool discard_current = sc->rx.discard_next;
+
+        sc->rx.discard_next = rx_stats->rs_more;
+        if (discard_current)
+                return -EINVAL;
 
         /*
          * everything but the rate is checked here, the rate check is done
@@ -962,6 +979,7 @@ static int ath9k_rx_skb_preprocess(struct ath_common *common,
         if (rx_stats->rs_moreaggr)
                 rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
 
+        sc->rx.discard_next = false;
         return 0;
 }
 
@@ -981,7 +999,7 @@ static void ath9k_rx_skb_postprocess(struct ath_common *common,
         hdr = (struct ieee80211_hdr *) skb->data;
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
         fc = hdr->frame_control;
-        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padpos = ieee80211_hdrlen(fc);
 
         /* The MAC header is padded to have 32-bit boundary if the
          * packet payload is non-zero. The general calculation for
@@ -1162,6 +1180,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         u64 tsf = 0;
         u32 tsf_lower = 0;
         unsigned long flags;
+        dma_addr_t new_buf_addr;
 
         if (edma)
                 dma_type = DMA_BIDIRECTIONAL;
@@ -1228,6 +1247,9 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                     unlikely(tsf_lower - rs.rs_tstamp > 0x10000000))
                         rxs->mactime += 0x100000000ULL;
 
+                if (rs.rs_phyerr == ATH9K_PHYERR_RADAR)
+                        ath9k_dfs_process_phyerr(sc, hdr, &rs, rxs->mactime);
+
                 if (rs.rs_status & ATH9K_RXERR_PHY) {
                         if (ath_process_fft(sc, hdr, &rs, rxs->mactime)) {
                                 RX_STAT_INC(rx_spectral);
@@ -1235,8 +1257,8 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         }
                 }
 
-                retval = ath9k_rx_skb_preprocess(common, hw, hdr, &rs,
-                                                 rxs, &decrypt_error);
+                retval = ath9k_rx_skb_preprocess(sc, hdr, &rs, rxs,
+                                                 &decrypt_error);
                 if (retval)
                         goto requeue_drop_frag;
 
@@ -1257,10 +1279,20 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         goto requeue_drop_frag;
                 }
 
+                /* We will now give hardware our shiny new allocated skb */
+                new_buf_addr = dma_map_single(sc->dev, requeue_skb->data,
+                                              common->rx_bufsize, dma_type);
+                if (unlikely(dma_mapping_error(sc->dev, new_buf_addr))) {
+                        dev_kfree_skb_any(requeue_skb);
+                        goto requeue_drop_frag;
+                }
+
+                bf->bf_mpdu = requeue_skb;
+                bf->bf_buf_addr = new_buf_addr;
+
                 /* Unmap the frame */
                 dma_unmap_single(sc->dev, bf->bf_buf_addr,
-                                 common->rx_bufsize,
-                                 dma_type);
+                                 common->rx_bufsize, dma_type);
 
                 skb_put(skb, rs.rs_datalen + ah->caps.rx_status_len);
                 if (ah->caps.rx_status_len)
@@ -1270,21 +1302,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         ath9k_rx_skb_postprocess(common, hdr_skb, &rs,
                                                  rxs, decrypt_error);
 
-                /* We will now give hardware our shiny new allocated skb */
-                bf->bf_mpdu = requeue_skb;
-                bf->bf_buf_addr = dma_map_single(sc->dev, requeue_skb->data,
-                                                 common->rx_bufsize,
-                                                 dma_type);
-                if (unlikely(dma_mapping_error(sc->dev,
-                          bf->bf_buf_addr))) {
-                        dev_kfree_skb_any(requeue_skb);
-                        bf->bf_mpdu = NULL;
-                        bf->bf_buf_addr = 0;
-                        ath_err(common, "dma_mapping_error() on RX\n");
-                        ieee80211_rx(hw, skb);
-                        break;
-                }
-
                 if (rs.rs_more) {
                         RX_STAT_INC(rx_frags);
                         /*
@@ -1302,6 +1319,8 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         sc->rx.frag = skb;
                         goto requeue;
                 }
+                if (rs.rs_status & ATH9K_RXERR_CORRUPT_DESC)
+                        goto requeue_drop_frag;
 
                 if (sc->rx.frag) {
                         int space = skb->len - skb_tailroom(hdr_skb);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 89a64411b82e..5bc580276493 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -516,8 +516,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                  * not a holding desc.
                  */
                 INIT_LIST_HEAD(&bf_head);
-                if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) ||
-                    bf_next != NULL || !bf_last->bf_stale)
+                if (bf_next != NULL || !bf_last->bf_stale)
                         list_move_tail(&bf->list, &bf_head);
 
                 if (!txpending || (tid->state & AGGR_CLEANUP)) {
@@ -537,8 +536,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                 !txfail);
                 } else {
                         /* retry the un-acked ones */
-                        if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
-                            bf->bf_next == NULL && bf_last->bf_stale) {
+                        if (bf->bf_next == NULL && bf_last->bf_stale) {
                                 struct ath_buf *tbf;
 
                                 tbf = ath_clone_txbuf(sc, bf_last);
@@ -1971,7 +1969,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         }
 
         /* Add the padding after the header if this is not already done */
-        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padpos = ieee80211_hdrlen(hdr->frame_control);
         padsize = padpos & 3;
         if (padsize && skb->len > padpos) {
                 if (skb_headroom(skb) < padsize)
@@ -2033,7 +2031,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 /* Frame was ACKed */
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
 
-        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padpos = ieee80211_hdrlen(hdr->frame_control);
         padsize = padpos & 3;
         if (padsize && skb->len>padpos+padsize) {
                 /*
@@ -2264,6 +2262,7 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
         struct ath_txq *txq;
         struct ath_buf *bf, *lastbf;
         struct list_head bf_head;
+        struct list_head *fifo_list;
         int status;
 
         for (;;) {
@@ -2291,20 +2290,24 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
 
                 TX_STAT_INC(txq->axq_qnum, txprocdesc);
 
-                if (list_empty(&txq->txq_fifo[txq->txq_tailidx])) {
+                fifo_list = &txq->txq_fifo[txq->txq_tailidx];
+                if (list_empty(fifo_list)) {
                         ath_txq_unlock(sc, txq);
                         return;
                 }
 
-                bf = list_first_entry(&txq->txq_fifo[txq->txq_tailidx],
-                                      struct ath_buf, list);
+                bf = list_first_entry(fifo_list, struct ath_buf, list);
+                if (bf->bf_stale) {
+                        list_del(&bf->list);
+                        ath_tx_return_buffer(sc, bf);
+                        bf = list_first_entry(fifo_list, struct ath_buf, list);
+                }
+
                 lastbf = bf->bf_lastbf;
 
                 INIT_LIST_HEAD(&bf_head);
-                list_cut_position(&bf_head, &txq->txq_fifo[txq->txq_tailidx],
-                                  &lastbf->list);
-
-                if (list_empty(&txq->txq_fifo[txq->txq_tailidx])) {
+                if (list_is_last(&lastbf->list, fifo_list)) {
+                        list_splice_tail_init(fifo_list, &bf_head);
                         INCR(txq->txq_tailidx, ATH_TXFIFO_DEPTH);
 
                         if (!list_empty(&txq->axq_q)) {
@@ -2315,6 +2318,11 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
                                 list_splice_tail_init(&txq->axq_q, &bf_q);
                                 ath_tx_txqaddbuf(sc, txq, &bf_q, true);
                         }
+                } else {
+                        lastbf->bf_stale = true;
+                        if (bf != lastbf)
+                                list_cut_position(&bf_head, fifo_list,
+                                                  lastbf->list.prev);
                 }
 
                 ath_tx_process_buffer(sc, txq, &ts, bf, &bf_head);
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 25599741cd8a..9dce106cd6d4 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -70,12 +70,6 @@
 
 static const u8 ar9170_qmap[__AR9170_NUM_TXQ] = { 3, 2, 1, 0 };
 
-enum carl9170_rf_init_mode {
-        CARL9170_RFI_NONE,
-        CARL9170_RFI_WARM,
-        CARL9170_RFI_COLD,
-};
-
 #define CARL9170_MAX_RX_BUFFER_SIZE             8192
 
 enum carl9170_device_state {
@@ -599,7 +593,7 @@ int carl9170_led_set_state(struct ar9170 *ar, const u32 led_state);
 
 /* PHY / RF */
 int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
-        enum nl80211_channel_type bw, enum carl9170_rf_init_mode rfi);
+                         enum nl80211_channel_type bw);
 int carl9170_get_noisefloor(struct ar9170 *ar);
 
 /* FW */
diff --git a/drivers/net/wireless/ath/carl9170/debug.c b/drivers/net/wireless/ath/carl9170/debug.c
index 7741fe8e0816..3d70cd277fd7 100644
--- a/drivers/net/wireless/ath/carl9170/debug.c
+++ b/drivers/net/wireless/ath/carl9170/debug.c
@@ -655,8 +655,7 @@ static ssize_t carl9170_debugfs_bug_write(struct ar9170 *ar, const char *buf,
 
         case 'P':
                 err = carl9170_set_channel(ar, ar->hw->conf.chandef.chan,
-                        cfg80211_get_chandef_type(&ar->hw->conf.chandef),
-                        CARL9170_RFI_COLD);
+                        cfg80211_get_chandef_type(&ar->hw->conf.chandef));
                 if (err < 0)
                         count = err;
 
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 4e268b1360d8..e9010a481dfd 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -942,7 +942,7 @@ static int carl9170_op_config(struct ieee80211_hw *hw, u32 changed)
                         goto out;
 
                 err = carl9170_set_channel(ar, hw->conf.chandef.chan,
-                                           channel_type, CARL9170_RFI_NONE);
+                                           channel_type);
                 if (err)
                         goto out;
 
diff --git a/drivers/net/wireless/ath/carl9170/phy.c b/drivers/net/wireless/ath/carl9170/phy.c
index c5f1fdd1eaeb..ab4ee7d39ad3 100644
--- a/drivers/net/wireless/ath/carl9170/phy.c
+++ b/drivers/net/wireless/ath/carl9170/phy.c
@@ -1569,16 +1569,14 @@ static enum carl9170_bw nl80211_to_carl(enum nl80211_channel_type type)
 }
 
 int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
-                         enum nl80211_channel_type _bw,
-                         enum carl9170_rf_init_mode rfi)
+                         enum nl80211_channel_type _bw)
 {
         const struct carl9170_phy_freq_params *freqpar;
         struct carl9170_rf_init_result rf_res;
         struct carl9170_rf_init rf;
-        u32 cmd, tmp, offs = 0, new_ht = 0;
+        u32 tmp, offs = 0, new_ht = 0;
         int err;
         enum carl9170_bw bw;
-        bool warm_reset;
         struct ieee80211_channel *old_channel = NULL;
 
         bw = nl80211_to_carl(_bw);
@@ -1592,51 +1590,27 @@ int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
         /* may be NULL at first setup */
         if (ar->channel) {
                 old_channel = ar->channel;
-                warm_reset = (old_channel->band != channel->band) ||
-                             (old_channel->center_freq ==
-                              channel->center_freq) ||
-                             (ar->ht_settings != new_ht);
-
                 ar->channel = NULL;
-        } else {
-                warm_reset = true;
         }
 
-        /* HW workaround */
-        if (!ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] &&
-            channel->center_freq <= 2417)
-                warm_reset = true;
-
-        if (rfi != CARL9170_RFI_NONE || warm_reset) {
-                u32 val;
-
-                if (rfi == CARL9170_RFI_COLD)
-                        val = AR9170_PWR_RESET_BB_COLD_RESET;
-                else
-                        val = AR9170_PWR_RESET_BB_WARM_RESET;
-
-                /* warm/cold reset BB/ADDA */
-                err = carl9170_write_reg(ar, AR9170_PWR_REG_RESET, val);
-                if (err)
-                        return err;
-
-                err = carl9170_write_reg(ar, AR9170_PWR_REG_RESET, 0x0);
-                if (err)
-                        return err;
+        /* cold reset BB/ADDA */
+        err = carl9170_write_reg(ar, AR9170_PWR_REG_RESET,
+                                 AR9170_PWR_RESET_BB_COLD_RESET);
+        if (err)
+                return err;
 
-                err = carl9170_init_phy(ar, channel->band);
-                if (err)
-                        return err;
+        err = carl9170_write_reg(ar, AR9170_PWR_REG_RESET, 0x0);
+        if (err)
+                return err;
 
-                err = carl9170_init_rf_banks_0_7(ar,
-                        channel->band == IEEE80211_BAND_5GHZ);
-                if (err)
-                        return err;
+        err = carl9170_init_phy(ar, channel->band);
+        if (err)
+                return err;
 
-                cmd = CARL9170_CMD_RF_INIT;
-        } else {
-                cmd = CARL9170_CMD_FREQUENCY;
-        }
+        err = carl9170_init_rf_banks_0_7(ar,
+                                         channel->band == IEEE80211_BAND_5GHZ);
+        if (err)
+                return err;
 
         err = carl9170_exec_cmd(ar, CARL9170_CMD_FREQ_START, 0, NULL, 0, NULL);
         if (err)
@@ -1648,8 +1622,8 @@ int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
                 return err;
 
         err = carl9170_init_rf_bank4_pwr(ar,
-                channel->band == IEEE80211_BAND_5GHZ,
-                channel->center_freq, bw);
+                                         channel->band == IEEE80211_BAND_5GHZ,
+                                         channel->center_freq, bw);
         if (err)
                 return err;
 
@@ -1703,13 +1677,8 @@ int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
         rf.delta_slope_coeff_man = cpu_to_le32(freqpar->coeff_man);
         rf.delta_slope_coeff_exp_shgi = cpu_to_le32(freqpar->coeff_exp_shgi);
         rf.delta_slope_coeff_man_shgi = cpu_to_le32(freqpar->coeff_man_shgi);
-
-        if (rfi != CARL9170_RFI_NONE)
-                rf.finiteLoopCount = cpu_to_le32(2000);
-        else
-                rf.finiteLoopCount = cpu_to_le32(1000);
-
-        err = carl9170_exec_cmd(ar, cmd, sizeof(rf), &rf,
+        rf.finiteLoopCount = cpu_to_le32(2000);
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_RF_INIT, sizeof(rf), &rf,
                                 sizeof(rf_res), &rf_res);
         if (err)
                 return err;
@@ -1724,9 +1693,8 @@ int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
                           old_channel->center_freq : -1, channel->center_freq,
                           err);
 
-                if ((rfi == CARL9170_RFI_COLD) || (ar->chan_fail > 3)) {
-                        /*
-                         * We have tried very hard to change to _another_
+                if (ar->chan_fail > 3) {
+                        /* We have tried very hard to change to _another_
                          * channel and we've failed to do so!
                          * Chances are that the PHY/RF is no longer
                          * operable (due to corruptions/fatal events/bugs?)
@@ -1736,8 +1704,7 @@ int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
                         return 0;
                 }
 
-                err = carl9170_set_channel(ar, channel, _bw,
-                                           CARL9170_RFI_COLD);
+                err = carl9170_set_channel(ar, channel, _bw);
                 if (err)
                         return err;
         } else {
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index 9c0b150d5b8e..c61cafa2665b 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -387,8 +387,7 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
         u8 tid;
 
         if (!(txinfo->flags & IEEE80211_TX_CTL_AMPDU) ||
-            txinfo->flags & IEEE80211_TX_CTL_INJECTED ||
-           (!(super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_AGGR))))
+            txinfo->flags & IEEE80211_TX_CTL_INJECTED)
                 return;
 
         rcu_read_lock();
@@ -981,30 +980,6 @@ static int carl9170_tx_prepare(struct ar9170 *ar,
 
                 SET_VAL(CARL9170_TX_SUPER_AMPDU_FACTOR,
                         txc->s.ampdu_settings, factor);
-
-                for (i = 0; i < CARL9170_TX_MAX_RATES; i++) {
-                        txrate = &info->control.rates[i];
-                        if (txrate->idx >= 0) {
-                                txc->s.ri[i] =
-                                        CARL9170_TX_SUPER_RI_AMPDU;
-
-                                if (WARN_ON(!(txrate->flags &
-                                              IEEE80211_TX_RC_MCS))) {
-                                        /*
-                                         * Not sure if it's even possible
-                                         * to aggregate non-ht rates with
-                                         * this HW.
-                                         */
-                                        goto err_out;
-                                }
-                                continue;
-                        }
-
-                        txrate->idx = 0;
-                        txrate->count = ar->hw->max_rate_tries;
-                }
-
-                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_AGGR);
         }
 
         /*
@@ -1012,11 +987,31 @@ static int carl9170_tx_prepare(struct ar9170 *ar,
          * taken from mac_control. For all fallback rate, the firmware
          * updates the mac_control flags from the rate info field.
          */
-        for (i = 1; i < CARL9170_TX_MAX_RATES; i++) {
+        for (i = 0; i < CARL9170_TX_MAX_RATES; i++) {
+                __le32 phy_set;
                 txrate = &info->control.rates[i];
                 if (txrate->idx < 0)
                         break;
 
+                phy_set = carl9170_tx_physet(ar, info, txrate);
+                if (i == 0) {
+                        /* first rate - part of the hw's frame header */
+                        txc->f.phy_control = phy_set;
+
+                        if (ampdu && txrate->flags & IEEE80211_TX_RC_MCS)
+                                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_AGGR);
+                        if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
+                                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
+                        else if (carl9170_tx_cts_check(ar, txrate))
+                                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
+
+                } else {
+                        /* fallback rates are stored in the firmware's
+                         * retry rate set array.
+                         */
+                        txc->s.rr[i - 1] = phy_set;
+                }
+
                 SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[i],
                         txrate->count);
 
@@ -1027,21 +1022,13 @@ static int carl9170_tx_prepare(struct ar9170 *ar,
                         txc->s.ri[i] |= (AR9170_TX_MAC_PROT_CTS <<
                                 CARL9170_TX_SUPER_RI_ERP_PROT_S);
 
-                txc->s.rr[i - 1] = carl9170_tx_physet(ar, info, txrate);
+                if (ampdu && (txrate->flags & IEEE80211_TX_RC_MCS))
+                        txc->s.ri[i] |= CARL9170_TX_SUPER_RI_AMPDU;
         }
 
-        txrate = &info->control.rates[0];
-        SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[0], txrate->count);
-
-        if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
-                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
-        else if (carl9170_tx_cts_check(ar, txrate))
-                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
-
         txc->s.len = cpu_to_le16(skb->len);
         txc->f.length = cpu_to_le16(len + FCS_LEN);
         txc->f.mac_control = mac_tmp;
-        txc->f.phy_control = carl9170_tx_physet(ar, info, txrate);
 
         arinfo = (void *)info->rate_driver_data;
         arinfo->timeout = jiffies;
@@ -1381,9 +1368,9 @@ static void carl9170_tx(struct ar9170 *ar)
 }
 
 static bool carl9170_tx_ampdu_queue(struct ar9170 *ar,
-        struct ieee80211_sta *sta, struct sk_buff *skb)
+        struct ieee80211_sta *sta, struct sk_buff *skb,
+        struct ieee80211_tx_info *txinfo)
 {
-        struct _carl9170_tx_superframe *super = (void *) skb->data;
         struct carl9170_sta_info *sta_info;
         struct carl9170_sta_tid *agg;
         struct sk_buff *iter;
@@ -1450,7 +1437,7 @@ err_unlock:
 
 err_unlock_rcu:
         rcu_read_unlock();
-        super->f.mac_control &= ~cpu_to_le16(AR9170_TX_MAC_AGGR);
+        txinfo->flags &= ~IEEE80211_TX_CTL_AMPDU;
         carl9170_tx_status(ar, skb, false);
         ar->tx_dropped++;
         return false;
@@ -1492,7 +1479,7 @@ void carl9170_op_tx(struct ieee80211_hw *hw,
                  * sta == NULL checks are redundant in this
                  * special case.
                  */
-                run = carl9170_tx_ampdu_queue(ar, sta, skb);
+                run = carl9170_tx_ampdu_queue(ar, sta, skb, info);
                 if (run)
                         carl9170_tx_ampdu(ar);
 
diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
index 5c54aa43ca2d..1816b4e7dc26 100644
--- a/drivers/net/wireless/ath/key.c
+++ b/drivers/net/wireless/ath/key.c
@@ -45,7 +45,8 @@ bool ath_hw_keyreset(struct ath_common *common, u16 entry)
         void *ah = common->ah;
 
         if (entry >= common->keymax) {
-                ath_err(common, "keycache entry %u out of range\n", entry);
+                ath_err(common, "keyreset: keycache entry %u out of range\n",
+                        entry);
                 return false;
         }
 
@@ -91,7 +92,8 @@ static bool ath_hw_keysetmac(struct ath_common *common,
         void *ah = common->ah;
 
         if (entry >= common->keymax) {
-                ath_err(common, "keycache entry %u out of range\n", entry);
+                ath_err(common, "keysetmac: keycache entry %u out of range\n",
+                        entry);
                 return false;
         }
 
@@ -133,7 +135,8 @@ static bool ath_hw_set_keycache_entry(struct ath_common *common, u16 entry,
         u32 keyType;
 
         if (entry >= common->keymax) {
-                ath_err(common, "keycache entry %u out of range\n", entry);
+                ath_err(common, "set-entry: keycache entry %u out of range\n",
+                        entry);
                 return false;
         }
 
diff --git a/drivers/net/wireless/ath/wil6210/Makefile b/drivers/net/wireless/ath/wil6210/Makefile
index 9396dc9fe3c5..d288eea0a26a 100644
--- a/drivers/net/wireless/ath/wil6210/Makefile
+++ b/drivers/net/wireless/ath/wil6210/Makefile
@@ -9,5 +9,7 @@ wil6210-objs += wmi.o
 wil6210-objs += interrupt.o
 wil6210-objs += txrx.o
 
-subdir-ccflags-y += -Werror
+ifeq (, $(findstring -W,$(EXTRA_CFLAGS)))
+        subdir-ccflags-y += -Werror
+endif
 subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 9ecc1968262c..c5d4a87abaaf 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -14,16 +14,6 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
-#include <linux/sched.h>
-#include <linux/etherdevice.h>
-#include <linux/wireless.h>
-#include <linux/ieee80211.h>
-#include <linux/slab.h>
-#include <linux/version.h>
-#include <net/cfg80211.h>
-
 #include "wil6210.h"
 #include "wmi.h"
 
@@ -292,7 +282,7 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
 
         /* WMI_CONNECT_CMD */
         memset(&conn, 0, sizeof(conn));
-        switch (bss->capability & 0x03) {
+        switch (bss->capability & WLAN_CAPABILITY_DMG_TYPE_MASK) {
         case WLAN_CAPABILITY_DMG_TYPE_AP:
                 conn.network_type = WMI_NETTYPE_INFRA;
                 break;
@@ -437,17 +427,18 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
         if (rc)
                 return rc;
 
-        rc = wmi_set_channel(wil, channel->hw_value);
-        if (rc)
-                return rc;
-
         /* MAC address - pre-requisite for other commands */
         wmi_set_mac_address(wil, ndev->dev_addr);
 
         /* IE's */
         /* bcon 'head IE's are not relevant for 60g band */
-        wmi_set_ie(wil, WMI_FRAME_BEACON, bcon->beacon_ies_len,
-                   bcon->beacon_ies);
+        /*
+         * FW do not form regular beacon, so bcon IE's are not set
+         * For the DMG bcon, when it will be supported, bcon IE's will
+         * be reused; add something like:
+         * wmi_set_ie(wil, WMI_FRAME_BEACON, bcon->beacon_ies_len,
+         * bcon->beacon_ies);
+         */
         wmi_set_ie(wil, WMI_FRAME_PROBE_RESP, bcon->proberesp_ies_len,
                    bcon->proberesp_ies);
         wmi_set_ie(wil, WMI_FRAME_ASSOC_RESP, bcon->assocresp_ies_len,
@@ -455,7 +446,8 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
 
         wil->secure_pcp = info->privacy;
 
-        rc = wmi_set_bcon(wil, info->beacon_interval, wmi_nettype);
+        rc = wmi_pcp_start(wil, info->beacon_interval, wmi_nettype,
+                           channel->hw_value);
         if (rc)
                 return rc;
 
@@ -472,11 +464,8 @@ static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
 {
         int rc = 0;
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
-        struct wireless_dev *wdev = ndev->ieee80211_ptr;
-        u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
 
-        /* To stop beaconing, set BI to 0 */
-        rc = wmi_set_bcon(wil, 0, wmi_nettype);
+        rc = wmi_pcp_stop(wil);
 
         return rc;
 }
diff --git a/drivers/net/wireless/ath/wil6210/dbg_hexdump.h b/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
deleted file mode 100644
index e5712f026c47..000000000000
--- a/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
+++ /dev/null
@@ -1,20 +0,0 @@
-#ifndef WIL_DBG_HEXDUMP_H_
-#define WIL_DBG_HEXDUMP_H_
-
-#include <linux/printk.h>
-#include <linux/dynamic_debug.h>
-
-#if defined(CONFIG_DYNAMIC_DEBUG)
-#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
-                                 groupsize, buf, len, ascii)            \
-        dynamic_hex_dump(prefix_str, prefix_type, rowsize,              \
-                             groupsize, buf, len, ascii)
-
-#else /* defined(CONFIG_DYNAMIC_DEBUG) */
-#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
-                                 groupsize, buf, len, ascii)            \
-        print_hex_dump(KERN_DEBUG, prefix_str, prefix_type, rowsize,    \
-                       groupsize, buf, len, ascii)
-#endif /* defined(CONFIG_DYNAMIC_DEBUG) */
-
-#endif /* WIL_DBG_HEXDUMP_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 65fc9683bfd8..4be07f5e22b9 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -312,14 +312,6 @@ static const struct file_operations fops_memread = {
         .llseek         = seq_lseek,
 };
 
-static int wil_default_open(struct inode *inode, struct file *file)
-{
-        if (inode->i_private)
-                file->private_data = inode->i_private;
-
-        return 0;
-}
-
 static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
@@ -361,7 +353,7 @@ static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
 
 static const struct file_operations fops_ioblob = {
         .read =         wil_read_file_ioblob,
-        .open =         wil_default_open,
+        .open =         simple_open,
         .llseek =       default_llseek,
 };
 
@@ -396,7 +388,7 @@ static ssize_t wil_write_file_reset(struct file *file, const char __user *buf,
 
 static const struct file_operations fops_reset = {
         .write = wil_write_file_reset,
-        .open  = wil_default_open,
+        .open  = simple_open,
 };
 /*---------Tx descriptor------------*/
 
@@ -526,7 +518,50 @@ static ssize_t wil_write_file_ssid(struct file *file, const char __user *buf,
 static const struct file_operations fops_ssid = {
         .read = wil_read_file_ssid,
         .write = wil_write_file_ssid,
-        .open  = wil_default_open,
+        .open  = simple_open,
+};
+
+/*---------temp------------*/
+static void print_temp(struct seq_file *s, const char *prefix, u32 t)
+{
+        switch (t) {
+        case 0:
+        case ~(u32)0:
+                seq_printf(s, "%s N/A\n", prefix);
+        break;
+        default:
+                seq_printf(s, "%s %d.%03d\n", prefix, t / 1000, t % 1000);
+                break;
+        }
+}
+
+static int wil_temp_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        u32 t_m, t_r;
+
+        int rc = wmi_get_temperature(wil, &t_m, &t_r);
+        if (rc) {
+                seq_printf(s, "Failed\n");
+                return 0;
+        }
+
+        print_temp(s, "MAC temperature   :", t_m);
+        print_temp(s, "Radio temperature :", t_r);
+
+        return 0;
+}
+
+static int wil_temp_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_temp_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_temp = {
+        .open           = wil_temp_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
 };
 
 /*----------------*/
@@ -563,6 +598,7 @@ int wil6210_debugfs_init(struct wil6210_priv *wil)
         debugfs_create_file("mem_val", S_IRUGO, dbg, wil, &fops_memread);
 
         debugfs_create_file("reset", S_IWUSR, dbg, wil, &fops_reset);
+        debugfs_create_file("temp", S_IRUGO, dbg, wil, &fops_temp);
 
         wil->rgf_blob.data = (void * __force)wil->csr + 0;
         wil->rgf_blob.size = 0xa000;
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index dc97e7b2609c..e3c1e7684f9c 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -240,6 +240,15 @@ static void wil_notify_fw_error(struct wil6210_priv *wil)
         kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, envp);
 }
 
+static void wil_cache_mbox_regs(struct wil6210_priv *wil)
+{
+        /* make shadow copy of registers that should not change on run time */
+        wil_memcpy_fromio_32(&wil->mbox_ctl, wil->csr + HOST_MBOX,
+                             sizeof(struct wil6210_mbox_ctl));
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.rx);
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.tx);
+}
+
 static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
 {
         struct wil6210_priv *wil = cookie;
@@ -257,14 +266,19 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
         wil6210_mask_irq_misc(wil);
 
         if (isr & ISR_MISC_FW_ERROR) {
-                wil_dbg_irq(wil, "IRQ: Firmware error\n");
+                wil_err(wil, "Firmware error detected\n");
                 clear_bit(wil_status_fwready, &wil->status);
-                wil_notify_fw_error(wil);
-                isr &= ~ISR_MISC_FW_ERROR;
+                /*
+                 * do not clear @isr here - we do 2-nd part in thread
+                 * there, user space get notified, and it should be done
+                 * in non-atomic context
+                 */
         }
 
         if (isr & ISR_MISC_FW_READY) {
                 wil_dbg_irq(wil, "IRQ: FW ready\n");
+                wil_cache_mbox_regs(wil);
+                set_bit(wil_status_reset_done, &wil->status);
                 /**
                  * Actual FW ready indicated by the
                  * WMI_FW_READY_EVENTID
@@ -289,6 +303,11 @@ static irqreturn_t wil6210_irq_misc_thread(int irq, void *cookie)
 
         wil_dbg_irq(wil, "Thread ISR MISC 0x%08x\n", isr);
 
+        if (isr & ISR_MISC_FW_ERROR) {
+                wil_notify_fw_error(wil);
+                isr &= ~ISR_MISC_FW_ERROR;
+        }
+
         if (isr & ISR_MISC_MBOX_EVT) {
                 wil_dbg_irq(wil, "MBOX event\n");
                 wmi_recv_cmd(wil);
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 761c389586d4..a0478e2f6868 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -14,12 +14,6 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
-#include <linux/sched.h>
-#include <linux/ieee80211.h>
-#include <linux/wireless.h>
-#include <linux/slab.h>
 #include <linux/moduleparam.h>
 #include <linux/if_arp.h>
 
@@ -109,13 +103,24 @@ static void wil_connect_timer_fn(ulong x)
         schedule_work(&wil->disconnect_worker);
 }
 
-static void wil_cache_mbox_regs(struct wil6210_priv *wil)
+static void wil_connect_worker(struct work_struct *work)
 {
-        /* make shadow copy of registers that should not change on run time */
-        wil_memcpy_fromio_32(&wil->mbox_ctl, wil->csr + HOST_MBOX,
-                             sizeof(struct wil6210_mbox_ctl));
-        wil_mbox_ring_le2cpus(&wil->mbox_ctl.rx);
-        wil_mbox_ring_le2cpus(&wil->mbox_ctl.tx);
+        int rc;
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                connect_worker);
+        int cid = wil->pending_connect_cid;
+
+        if (cid < 0) {
+                wil_err(wil, "No connection pending\n");
+                return;
+        }
+
+        wil_dbg_wmi(wil, "Configure for connection CID %d\n", cid);
+
+        rc = wil_vring_init_tx(wil, 0, WIL6210_TX_RING_SIZE, cid, 0);
+        wil->pending_connect_cid = -1;
+        if (rc == 0)
+                wil_link_on(wil);
 }
 
 int wil_priv_init(struct wil6210_priv *wil)
@@ -130,7 +135,7 @@ int wil_priv_init(struct wil6210_priv *wil)
         wil->pending_connect_cid = -1;
         setup_timer(&wil->connect_timer, wil_connect_timer_fn, (ulong)wil);
 
-        INIT_WORK(&wil->wmi_connect_worker, wmi_connect_worker);
+        INIT_WORK(&wil->connect_worker, wil_connect_worker);
         INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
         INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
 
@@ -147,8 +152,6 @@ int wil_priv_init(struct wil6210_priv *wil)
                 return -EAGAIN;
         }
 
-        wil_cache_mbox_regs(wil);
-
         return 0;
 }
 
@@ -185,15 +188,11 @@ static void wil_target_reset(struct wil6210_priv *wil)
         W(RGF_USER_MAC_CPU_0,  BIT(1)); /* mac_cpu_man_rst */
         W(RGF_USER_USER_CPU_0, BIT(1)); /* user_cpu_man_rst */
 
-        msleep(100);
-
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000170);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FC00);
 
-        msleep(100);
-
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
@@ -203,12 +202,6 @@ static void wil_target_reset(struct wil6210_priv *wil)
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
 
-        msleep(2000);
-
-        W(RGF_USER_USER_CPU_0, BIT(0)); /* user_cpu_man_de_rst */
-
-        msleep(2000);
-
         wil_dbg_misc(wil, "Reset completed\n");
 
 #undef W
@@ -265,8 +258,6 @@ int wil_reset(struct wil6210_priv *wil)
         wil->pending_connect_cid = -1;
         INIT_COMPLETION(wil->wmi_ready);
 
-        wil_cache_mbox_regs(wil);
-
         /* TODO: release MAC reset */
         wil6210_enable_irq(wil);
 
@@ -352,9 +343,9 @@ static int __wil_up(struct wil6210_priv *wil)
                         wil_err(wil, "SSID not set\n");
                         return -EINVAL;
                 }
-                wmi_set_ssid(wil, wdev->ssid_len, wdev->ssid);
-                if (channel)
-                        wmi_set_channel(wil, channel->hw_value);
+                rc = wmi_set_ssid(wil, wdev->ssid_len, wdev->ssid);
+                if (rc)
+                        return rc;
                 break;
         default:
                 break;
@@ -364,9 +355,12 @@ static int __wil_up(struct wil6210_priv *wil)
         wmi_set_mac_address(wil, ndev->dev_addr);
 
         /* Set up beaconing if required. */
-        rc = wmi_set_bcon(wil, bi, wmi_nettype);
-        if (rc)
-                return rc;
+        if (bi > 0) {
+                rc = wmi_pcp_start(wil, bi, wmi_nettype,
+                                   (channel ? channel->hw_value : 0));
+                if (rc)
+                        return rc;
+        }
 
         /* Rx VRING. After MAC and beacon */
         wil_rx_init(wil);
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index 8ce2e33dce20..098a8ec6b841 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -14,10 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/module.h>
-#include <linux/netdevice.h>
 #include <linux/etherdevice.h>
-#include <linux/slab.h>
 
 #include "wil6210.h"
 
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index 81c35c6e3832..eb1dc7ad80fb 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -14,10 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/netdevice.h>
 #include <linux/debugfs.h>
 #include <linux/pci.h>
 #include <linux/moduleparam.h>
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index d1315b442375..1bfa736cc1f2 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -14,10 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
 #include <linux/etherdevice.h>
-#include <linux/hardirq.h>
 #include <net/ieee80211_radiotap.h>
 #include <linux/if_arp.h>
 #include <linux/moduleparam.h>
@@ -560,7 +557,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
         if (rc)
                 goto out_free;
 
-        if (reply.cmd.status != WMI_VRING_CFG_SUCCESS) {
+        if (reply.cmd.status != WMI_FW_STATUS_SUCCESS) {
                 wil_err(wil, "Tx config failed, status 0x%02x\n",
                         reply.cmd.status);
                 rc = -EINVAL;
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index aea961ff8f08..8f76ecd8a7e5 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -21,8 +21,6 @@
 #include <linux/wireless.h>
 #include <net/cfg80211.h>
 
-#include "dbg_hexdump.h"
-
 #define WIL_NAME "wil6210"
 
 /**
@@ -188,6 +186,7 @@ enum { /* for wil6210_priv.status */
         wil_status_fwready = 0,
         wil_status_fwconnected,
         wil_status_dontscan,
+        wil_status_reset_done,
         wil_status_irqen, /* FIXME: interrupts enabled - for debug */
 };
 
@@ -210,6 +209,8 @@ struct wil6210_priv {
         struct wireless_dev *wdev;
         void __iomem *csr;
         ulong status;
+        u32 fw_version;
+        u8 n_mids; /* number of additional MIDs as reported by FW */
         /* profile */
         u32 monitor_flags;
         u32 secure_pcp; /* create secure PCP? */
@@ -227,7 +228,7 @@ struct wil6210_priv {
         struct workqueue_struct *wmi_wq; /* for deferred calls */
         struct work_struct wmi_event_worker;
         struct workqueue_struct *wmi_wq_conn; /* for connect worker */
-        struct work_struct wmi_connect_worker;
+        struct work_struct connect_worker;
         struct work_struct disconnect_worker;
         struct timer_list connect_timer;
         int pending_connect_cid;
@@ -277,13 +278,13 @@ struct wil6210_priv {
 
 #define wil_hex_dump_txrx(prefix_str, prefix_type, rowsize,     \
                           groupsize, buf, len, ascii)           \
-                          wil_print_hex_dump_debug("DBG[TXRX]" prefix_str,\
+                          print_hex_dump_debug("DBG[TXRX]" prefix_str,\
                                          prefix_type, rowsize,  \
                                          groupsize, buf, len, ascii)
 
 #define wil_hex_dump_wmi(prefix_str, prefix_type, rowsize,      \
                          groupsize, buf, len, ascii)            \
-                         wil_print_hex_dump_debug("DBG[ WMI]" prefix_str,\
+                         print_hex_dump_debug("DBG[ WMI]" prefix_str,\
                                         prefix_type, rowsize,   \
                                         groupsize, buf, len, ascii)
 
@@ -313,7 +314,6 @@ int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len);
 void wmi_recv_cmd(struct wil6210_priv *wil);
 int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
              u16 reply_id, void *reply, u8 reply_size, int to_msec);
-void wmi_connect_worker(struct work_struct *work);
 void wmi_event_worker(struct work_struct *work);
 void wmi_event_flush(struct wil6210_priv *wil);
 int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid);
@@ -328,6 +328,8 @@ int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
 int wmi_echo(struct wil6210_priv *wil);
 int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie);
 int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring);
+int wmi_p2p_cfg(struct wil6210_priv *wil, int channel);
+int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r);
 
 int wil6210_init_irq(struct wil6210_priv *wil, int irq);
 void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
@@ -341,7 +343,8 @@ struct wireless_dev *wil_cfg80211_init(struct device *dev);
 void wil_wdev_free(struct wil6210_priv *wil);
 
 int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
-int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype);
+int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan);
+int wmi_pcp_stop(struct wil6210_priv *wil);
 void wil6210_disconnect(struct wil6210_priv *wil, void *bssid);
 
 int wil_rx_init(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 0bb3b76b4b58..45b04e383f9a 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -14,9 +14,6 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/pci.h>
-#include <linux/io.h>
-#include <linux/list.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 
@@ -272,16 +269,18 @@ static void wmi_evt_ready(struct wil6210_priv *wil, int id, void *d, int len)
         struct net_device *ndev = wil_to_ndev(wil);
         struct wireless_dev *wdev = wil->wdev;
         struct wmi_ready_event *evt = d;
-        u32 ver = le32_to_cpu(evt->sw_version);
+        wil->fw_version = le32_to_cpu(evt->sw_version);
+        wil->n_mids = evt->numof_additional_mids;
 
-        wil_dbg_wmi(wil, "FW ver. %d; MAC %pM\n", ver, evt->mac);
+        wil_dbg_wmi(wil, "FW ver. %d; MAC %pM; %d MID's\n", wil->fw_version,
+                    evt->mac, wil->n_mids);
 
         if (!is_valid_ether_addr(ndev->dev_addr)) {
                 memcpy(ndev->dev_addr, evt->mac, ETH_ALEN);
                 memcpy(ndev->perm_addr, evt->mac, ETH_ALEN);
         }
         snprintf(wdev->wiphy->fw_version, sizeof(wdev->wiphy->fw_version),
-                 "%d", ver);
+                 "%d", wil->fw_version);
 }
 
 static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
@@ -324,17 +323,9 @@ static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
 
         if (ieee80211_is_beacon(fc) || ieee80211_is_probe_resp(fc)) {
                 struct cfg80211_bss *bss;
-                u64 tsf = le64_to_cpu(rx_mgmt_frame->u.beacon.timestamp);
-                u16 cap = le16_to_cpu(rx_mgmt_frame->u.beacon.capab_info);
-                u16 bi = le16_to_cpu(rx_mgmt_frame->u.beacon.beacon_int);
-                const u8 *ie_buf = rx_mgmt_frame->u.beacon.variable;
-                size_t ie_len = d_len - offsetof(struct ieee80211_mgmt,
-                                                 u.beacon.variable);
-                wil_dbg_wmi(wil, "Capability info : 0x%04x\n", cap);
-
-                bss = cfg80211_inform_bss(wiphy, channel, rx_mgmt_frame->bssid,
-                                          tsf, cap, bi, ie_buf, ie_len,
-                                          signal, GFP_KERNEL);
+
+                bss = cfg80211_inform_bss_frame(wiphy, channel, rx_mgmt_frame,
+                                                d_len, signal, GFP_KERNEL);
                 if (bss) {
                         wil_dbg_wmi(wil, "Added BSS %pM\n",
                                     rx_mgmt_frame->bssid);
@@ -342,6 +333,9 @@ static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
                 } else {
                         wil_err(wil, "cfg80211_inform_bss() failed\n");
                 }
+        } else {
+                cfg80211_rx_mgmt(wil->wdev, freq, signal,
+                                 (void *)rx_mgmt_frame, d_len, GFP_KERNEL);
         }
 }
 
@@ -443,7 +437,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
         memcpy(wil->dst_addr[0], evt->bssid, ETH_ALEN);
 
         wil->pending_connect_cid = evt->cid;
-        queue_work(wil->wmi_wq_conn, &wil->wmi_connect_worker);
+        queue_work(wil->wmi_wq_conn, &wil->connect_worker);
 }
 
 static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
@@ -528,6 +522,37 @@ static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
         }
 }
 
+static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wmi_data_port_open_event *evt = d;
+
+        wil_dbg_wmi(wil, "Link UP for CID %d\n", evt->cid);
+
+        netif_carrier_on(ndev);
+}
+
+static void wmi_evt_linkdown(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wmi_wbe_link_down_event *evt = d;
+
+        wil_dbg_wmi(wil, "Link DOWN for CID %d, reason %d\n",
+                    evt->cid, le32_to_cpu(evt->reason));
+
+        netif_carrier_off(ndev);
+}
+
+static void wmi_evt_ba_status(struct wil6210_priv *wil, int id, void *d,
+                              int len)
+{
+        struct wmi_vring_ba_status_event *evt = d;
+
+        wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d\n",
+                    evt->ringid, evt->status ? "N/A" : "OK", evt->agg_wsize,
+                    __le16_to_cpu(evt->ba_timeout));
+}
+
 static const struct {
         int eventid;
         void (*handler)(struct wil6210_priv *wil, int eventid,
@@ -541,6 +566,9 @@ static const struct {
         {WMI_DISCONNECT_EVENTID,        wmi_evt_disconnect},
         {WMI_NOTIFY_REQ_DONE_EVENTID,   wmi_evt_notify},
         {WMI_EAPOL_RX_EVENTID,          wmi_evt_eapol_rx},
+        {WMI_DATA_PORT_OPEN_EVENTID,    wmi_evt_linkup},
+        {WMI_WBE_LINKDOWN_EVENTID,      wmi_evt_linkdown},
+        {WMI_BA_STATUS_EVENTID,         wmi_evt_ba_status},
 };
 
 /*
@@ -559,6 +587,11 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
         void __iomem *src;
         ulong flags;
 
+        if (!test_bit(wil_status_reset_done, &wil->status)) {
+                wil_err(wil, "Reset not completed\n");
+                return;
+        }
+
         for (;;) {
                 u16 len;
 
@@ -683,18 +716,39 @@ int wmi_set_mac_address(struct wil6210_priv *wil, void *addr)
         return wmi_send(wil, WMI_SET_MAC_ADDRESS_CMDID, &cmd, sizeof(cmd));
 }
 
-int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype)
+int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan)
 {
-        struct wmi_bcon_ctrl_cmd cmd = {
+        int rc;
+
+        struct wmi_pcp_start_cmd cmd = {
                 .bcon_interval = cpu_to_le16(bi),
                 .network_type = wmi_nettype,
                 .disable_sec_offload = 1,
+                .channel = chan,
         };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_pcp_started_event evt;
+        } __packed reply;
 
         if (!wil->secure_pcp)
                 cmd.disable_sec = 1;
 
-        return wmi_send(wil, WMI_BCON_CTRL_CMDID, &cmd, sizeof(cmd));
+        rc = wmi_call(wil, WMI_PCP_START_CMDID, &cmd, sizeof(cmd),
+                      WMI_PCP_STARTED_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                return rc;
+
+        if (reply.evt.status != WMI_FW_STATUS_SUCCESS)
+                rc = -EINVAL;
+
+        return rc;
+}
+
+int wmi_pcp_stop(struct wil6210_priv *wil)
+{
+        return wmi_call(wil, WMI_PCP_STOP_CMDID, NULL, 0,
+                        WMI_PCP_STOPPED_EVENTID, NULL, 0, 20);
 }
 
 int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid)
@@ -765,6 +819,16 @@ int wmi_get_channel(struct wil6210_priv *wil, int *channel)
         return 0;
 }
 
+int wmi_p2p_cfg(struct wil6210_priv *wil, int channel)
+{
+        struct wmi_p2p_cfg_cmd cmd = {
+                .discovery_mode = WMI_DISCOVERY_MODE_NON_OFFLOAD,
+                .channel = channel - 1,
+        };
+
+        return wmi_send(wil, WMI_P2P_CFG_CMDID, &cmd, sizeof(cmd));
+}
+
 int wmi_tx_eapol(struct wil6210_priv *wil, struct sk_buff *skb)
 {
         struct wmi_eapol_tx_cmd *cmd;
@@ -843,7 +907,7 @@ int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie)
         /* BUG: FW API define ieLen as u8. Will fix FW */
         cmd->ie_len = cpu_to_le16(ie_len);
         memcpy(cmd->ie_info, ie, ie_len);
-        rc = wmi_send(wil, WMI_SET_APPIE_CMDID, &cmd, len);
+        rc = wmi_send(wil, WMI_SET_APPIE_CMDID, cmd, len);
         kfree(cmd);
 
         return rc;
@@ -898,6 +962,31 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
         return rc;
 }
 
+int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r)
+{
+        int rc;
+        struct wmi_temp_sense_cmd cmd = {
+                .measure_marlon_m_en = cpu_to_le32(!!t_m),
+                .measure_marlon_r_en = cpu_to_le32(!!t_r),
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_temp_sense_done_event evt;
+        } __packed reply;
+
+        rc = wmi_call(wil, WMI_TEMP_SENSE_CMDID, &cmd, sizeof(cmd),
+                      WMI_TEMP_SENSE_DONE_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                return rc;
+
+        if (t_m)
+                *t_m = le32_to_cpu(reply.evt.marlon_m_t1000);
+        if (t_r)
+                *t_r = le32_to_cpu(reply.evt.marlon_r_t1000);
+
+        return 0;
+}
+
 void wmi_event_flush(struct wil6210_priv *wil)
 {
         struct pending_wmi_event *evt, *t;
@@ -997,24 +1086,3 @@ void wmi_event_worker(struct work_struct *work)
                 kfree(evt);
         }
 }
-
-void wmi_connect_worker(struct work_struct *work)
-{
-        int rc;
-        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
-                                                wmi_connect_worker);
-
-        if (wil->pending_connect_cid < 0) {
-                wil_err(wil, "No connection pending\n");
-                return;
-        }
-
-        wil_dbg_wmi(wil, "Configure for connection CID %d\n",
-                    wil->pending_connect_cid);
-
-        rc = wil_vring_init_tx(wil, 0, WIL6210_TX_RING_SIZE,
-                               wil->pending_connect_cid, 0);
-        wil->pending_connect_cid = -1;
-        if (rc == 0)
-                wil_link_on(wil);
-}
diff --git a/drivers/net/wireless/ath/wil6210/wmi.h b/drivers/net/wireless/ath/wil6210/wmi.h
index 3bbf87572b07..50b8528394f4 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.h
+++ b/drivers/net/wireless/ath/wil6210/wmi.h
@@ -36,6 +36,7 @@
 enum wmi_command_id {
         WMI_CONNECT_CMDID               = 0x0001,
         WMI_DISCONNECT_CMDID            = 0x0003,
+        WMI_DISCONNECT_STA_CMDID        = 0x0004,
         WMI_START_SCAN_CMDID            = 0x0007,
         WMI_SET_BSS_FILTER_CMDID        = 0x0009,
         WMI_SET_PROBED_SSID_CMDID       = 0x000a,
@@ -44,7 +45,6 @@ enum wmi_command_id {
         WMI_ADD_CIPHER_KEY_CMDID        = 0x0016,
         WMI_DELETE_CIPHER_KEY_CMDID     = 0x0017,
         WMI_SET_APPIE_CMDID             = 0x003f,
-        WMI_GET_APPIE_CMDID             = 0x0040,
         WMI_SET_WSC_STATUS_CMDID        = 0x0041,
         WMI_PXMT_RANGE_CFG_CMDID        = 0x0042,
         WMI_PXMT_SNR2_RANGE_CFG_CMDID   = 0x0043,
@@ -55,11 +55,11 @@ enum wmi_command_id {
         WMI_DEEP_ECHO_CMDID             = 0x0804,
         WMI_CONFIG_MAC_CMDID            = 0x0805,
         WMI_CONFIG_PHY_DEBUG_CMDID      = 0x0806,
-        WMI_ADD_STATION_CMDID           = 0x0807,
         WMI_ADD_DEBUG_TX_PCKT_CMDID     = 0x0808,
         WMI_PHY_GET_STATISTICS_CMDID    = 0x0809,
         WMI_FS_TUNE_CMDID               = 0x080a,
         WMI_CORR_MEASURE_CMDID          = 0x080b,
+        WMI_READ_RSSI_CMDID             = 0x080c,
         WMI_TEMP_SENSE_CMDID            = 0x080e,
         WMI_DC_CALIB_CMDID              = 0x080f,
         WMI_SEND_TONE_CMDID             = 0x0810,
@@ -75,9 +75,9 @@ enum wmi_command_id {
         MAC_IO_STATIC_PARAMS_CMDID      = 0x081b,
         MAC_IO_DYNAMIC_PARAMS_CMDID     = 0x081c,
         WMI_SILENT_RSSI_CALIB_CMDID     = 0x081d,
+        WMI_RF_RX_TEST_CMDID            = 0x081e,
         WMI_CFG_RX_CHAIN_CMDID          = 0x0820,
         WMI_VRING_CFG_CMDID             = 0x0821,
-        WMI_RX_ON_CMDID                 = 0x0822,
         WMI_VRING_BA_EN_CMDID           = 0x0823,
         WMI_VRING_BA_DIS_CMDID          = 0x0824,
         WMI_RCP_ADDBA_RESP_CMDID        = 0x0825,
@@ -87,7 +87,6 @@ enum wmi_command_id {
         WMI_SET_PCP_CHANNEL_CMDID       = 0x0829,
         WMI_GET_PCP_CHANNEL_CMDID       = 0x082a,
         WMI_SW_TX_REQ_CMDID             = 0x082b,
-        WMI_RX_OFF_CMDID                = 0x082c,
         WMI_READ_MAC_RXQ_CMDID          = 0x0830,
         WMI_READ_MAC_TXQ_CMDID          = 0x0831,
         WMI_WRITE_MAC_RXQ_CMDID         = 0x0832,
@@ -112,6 +111,18 @@ enum wmi_command_id {
         WMI_FLASH_READ_CMDID            = 0x0902,
         WMI_FLASH_WRITE_CMDID           = 0x0903,
         WMI_SECURITY_UNIT_TEST_CMDID    = 0x0904,
+        /*P2P*/
+        WMI_P2P_CFG_CMDID               = 0x0910,
+        WMI_PORT_ALLOCATE_CMDID         = 0x0911,
+        WMI_PORT_DELETE_CMDID           = 0x0912,
+        WMI_POWER_MGMT_CFG_CMDID        = 0x0913,
+        WMI_START_LISTEN_CMDID          = 0x0914,
+        WMI_START_SEARCH_CMDID          = 0x0915,
+        WMI_DISCOVERY_START_CMDID       = 0x0916,
+        WMI_DISCOVERY_STOP_CMDID        = 0x0917,
+        WMI_PCP_START_CMDID             = 0x0918,
+        WMI_PCP_STOP_CMDID              = 0x0919,
+        WMI_GET_PCP_FACTOR_CMDID        = 0x091b,
 
         WMI_SET_MAC_ADDRESS_CMDID       = 0xf003,
         WMI_ABORT_SCAN_CMDID            = 0xf007,
@@ -132,18 +143,6 @@ enum wmi_command_id {
  */
 
 /*
- * Frame Types
- */
-enum wmi_mgmt_frame_type {
-        WMI_FRAME_BEACON        = 0,
-        WMI_FRAME_PROBE_REQ     = 1,
-        WMI_FRAME_PROBE_RESP    = 2,
-        WMI_FRAME_ASSOC_REQ     = 3,
-        WMI_FRAME_ASSOC_RESP    = 4,
-        WMI_NUM_MGMT_FRAME,
-};
-
-/*
  * WMI_CONNECT_CMDID
  */
 enum wmi_network_type {
@@ -184,7 +183,7 @@ enum wmi_crypto_type {
 enum wmi_connect_ctrl_flag_bits {
         WMI_CONNECT_ASSOC_POLICY_USER           = 0x0001,
         WMI_CONNECT_SEND_REASSOC                = 0x0002,
-        WMI_CONNECT_IGNORE_WPAx_GROUP_CIPHER    = 0x0004,
+        WMI_CONNECT_IGNORE_WPA_GROUP_CIPHER     = 0x0004,
         WMI_CONNECT_PROFILE_MATCH_DONE          = 0x0008,
         WMI_CONNECT_IGNORE_AAC_BEACON           = 0x0010,
         WMI_CONNECT_CSA_FOLLOW_BSS              = 0x0020,
@@ -212,6 +211,13 @@ struct wmi_connect_cmd {
         u8 reserved1[2];
 } __packed;
 
+/*
+ * WMI_DISCONNECT_STA_CMDID
+ */
+struct wmi_disconnect_sta_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 disconnect_reason;
+} __packed;
 
 /*
  * WMI_RECONNECT_CMDID
@@ -289,10 +295,12 @@ struct wmi_delete_cipher_key_cmd {
 enum wmi_scan_type {
         WMI_LONG_SCAN           = 0,
         WMI_SHORT_SCAN          = 1,
+        WMI_PBC_SCAN            = 2,
 };
 
 struct wmi_start_scan_cmd {
         u8 reserved[8];
+
         __le32 home_dwell_time; /* Max duration in the home channel(ms) */
         __le32 force_scan_interval;     /* Time interval between scans (ms)*/
         u8 scan_type;           /* wmi_scan_type */
@@ -309,7 +317,7 @@ struct wmi_start_scan_cmd {
 /*
  * WMI_SET_PROBED_SSID_CMDID
  */
-#define MAX_PROBED_SSID_INDEX   (15)
+#define MAX_PROBED_SSID_INDEX   (3)
 
 enum wmi_ssid_flag {
         WMI_SSID_FLAG_DISABLE   = 0,    /* disables entry */
@@ -328,6 +336,20 @@ struct wmi_probed_ssid_cmd {
  * WMI_SET_APPIE_CMDID
  * Add Application specified IE to a management frame
  */
+#define WMI_MAX_IE_LEN          (1024)
+
+/*
+ * Frame Types
+ */
+enum wmi_mgmt_frame_type {
+        WMI_FRAME_BEACON        = 0,
+        WMI_FRAME_PROBE_REQ     = 1,
+        WMI_FRAME_PROBE_RESP    = 2,
+        WMI_FRAME_ASSOC_REQ     = 3,
+        WMI_FRAME_ASSOC_RESP    = 4,
+        WMI_NUM_MGMT_FRAME,
+};
+
 struct wmi_set_appie_cmd {
         u8 mgmt_frm_type;       /* enum wmi_mgmt_frame_type */
         u8 reserved;
@@ -335,13 +357,18 @@ struct wmi_set_appie_cmd {
         u8 ie_info[0];
 } __packed;
 
-#define WMI_MAX_IE_LEN (1024)
 
+/*
+ * WMI_PXMT_RANGE_CFG_CMDID
+ */
 struct wmi_pxmt_range_cfg_cmd {
         u8 dst_mac[WMI_MAC_LEN];
         __le16 range;
 } __packed;
 
+/*
+ * WMI_PXMT_SNR2_RANGE_CFG_CMDID
+ */
 struct wmi_pxmt_snr2_range_cfg_cmd {
         s8 snr2range_arr[WMI_PROX_RANGE_NUM-1];
 } __packed;
@@ -359,6 +386,23 @@ struct wmi_rf_mgmt_cmd {
         __le32 rf_mgmt_type;
 } __packed;
 
+
+/*
+ * WMI_RF_RX_TEST_CMDID
+ */
+struct wmi_rf_rx_test_cmd {
+        __le32 sector;
+} __packed;
+
+/*
+ * WMI_CORR_MEASURE_CMDID
+ */
+struct wmi_corr_measure_cmd {
+        s32 freq_mhz;
+        __le32 length_samples;
+        __le32 iterations;
+} __packed;
+
 /*
  * WMI_SET_SSID_CMDID
  */
@@ -388,6 +432,74 @@ struct wmi_bcon_ctrl_cmd {
         u8 disable_sec;
 } __packed;
 
+
+/******* P2P ***********/
+
+/*
+ * WMI_PORT_ALLOCATE_CMDID
+ */
+enum wmi_port_role {
+        WMI_PORT_STA            = 0,
+        WMI_PORT_PCP            = 1,
+        WMI_PORT_AP             = 2,
+        WMI_PORT_P2P_DEV        = 3,
+        WMI_PORT_P2P_CLIENT     = 4,
+        WMI_PORT_P2P_GO         = 5,
+};
+
+struct wmi_port_allocate_cmd {
+        u8 mac[WMI_MAC_LEN];
+        u8 port_role;
+        u8 midid;
+} __packed;
+
+/*
+ * WMI_PORT_DELETE_CMDID
+ */
+struct wmi_delete_port_cmd {
+        u8 mid;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_P2P_CFG_CMDID
+ */
+enum wmi_discovery_mode {
+        WMI_DISCOVERY_MODE_NON_OFFLOAD  = 0,
+        WMI_DISCOVERY_MODE_OFFLOAD      = 1,
+};
+
+struct wmi_p2p_cfg_cmd {
+        u8 discovery_mode;      /* wmi_discovery_mode */
+        u8 channel;
+        __le16 bcon_interval; /* base to listen/search duration calculation */
+} __packed;
+
+/*
+ * WMI_POWER_MGMT_CFG_CMDID
+ */
+enum wmi_power_source_type {
+        WMI_POWER_SOURCE_BATTERY        = 0,
+        WMI_POWER_SOURCE_OTHER          = 1,
+};
+
+struct wmi_power_mgmt_cfg_cmd {
+        u8 power_source;        /* wmi_power_source_type */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_PCP_START_CMDID
+ */
+struct wmi_pcp_start_cmd {
+        __le16 bcon_interval;
+        u8 reserved0[10];
+        u8 network_type;
+        u8 channel;
+        u8 disable_sec_offload;
+        u8 disable_sec;
+} __packed;
+
 /*
  * WMI_SW_TX_REQ_CMDID
  */
@@ -435,16 +547,17 @@ enum wmi_vring_cfg_schd_params_priority {
         WMI_SCH_PRIO_HIGH                       = 1,
 };
 
+#define CIDXTID_CID_POS (0)
+#define CIDXTID_CID_LEN (4)
+#define CIDXTID_CID_MSK (0xF)
+#define CIDXTID_TID_POS (4)
+#define CIDXTID_TID_LEN (4)
+#define CIDXTID_TID_MSK (0xF0)
+
 struct wmi_vring_cfg {
         struct wmi_sw_ring_cfg tx_sw_ring;
         u8 ringid;                              /* 0-23 vrings */
 
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
 
         u8 encap_trans_type;
@@ -501,8 +614,14 @@ struct wmi_vring_ba_dis_cmd {
  */
 struct wmi_notify_req_cmd {
         u8 cid;
-        u8 reserved[3];
+        u8 year;
+        u8 month;
+        u8 day;
         __le32 interval_usec;
+        u8 hour;
+        u8 minute;
+        u8 second;
+        u8 miliseconds;
 } __packed;
 
 /*
@@ -548,6 +667,11 @@ enum wmi_cfg_rx_chain_cmd_nwifi_ds_trans_type {
         WMI_NWIFI_RX_TRANS_MODE_PBSS2STA        = 2,
 };
 
+enum wmi_cfg_rx_chain_cmd_reorder_type {
+        WMI_RX_HW_REORDER = 0,
+        WMI_RX_SW_REORDER = 1,
+};
+
 struct wmi_cfg_rx_chain_cmd {
         __le32 action;
         struct wmi_sw_ring_cfg rx_sw_ring;
@@ -596,7 +720,8 @@ struct wmi_cfg_rx_chain_cmd {
         __le16 wb_thrsh;
         __le32 itr_value;
         __le16 host_thrsh;
-        u8 reserved[2];
+        u8 reorder_type;
+        u8 reserved;
         struct wmi_sniffer_cfg sniffer_cfg;
 } __packed;
 
@@ -604,15 +729,7 @@ struct wmi_cfg_rx_chain_cmd {
  * WMI_RCP_ADDBA_RESP_CMDID
  */
 struct wmi_rcp_addba_resp_cmd {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 dialog_token;
         __le16 status_code;
         __le16 ba_param_set;    /* ieee80211_ba_parameterset field to send */
@@ -623,15 +740,7 @@ struct wmi_rcp_addba_resp_cmd {
  * WMI_RCP_DELBA_CMDID
  */
 struct wmi_rcp_delba_cmd {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 reserved;
         __le16 reason;
 } __packed;
@@ -640,15 +749,7 @@ struct wmi_rcp_delba_cmd {
  * WMI_RCP_ADDBA_REQ_CMDID
  */
 struct wmi_rcp_addba_req_cmd {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 dialog_token;
         /* ieee80211_ba_parameterset field as it received */
         __le16 ba_param_set;
@@ -665,7 +766,6 @@ struct wmi_set_mac_address_cmd {
         u8 reserved[2];
 } __packed;
 
-
 /*
 * WMI_EAPOL_TX_CMDID
 */
@@ -692,6 +792,17 @@ struct wmi_echo_cmd {
 } __packed;
 
 /*
+ * WMI_TEMP_SENSE_CMDID
+ *
+ * Measure MAC and radio temperatures
+ */
+struct wmi_temp_sense_cmd {
+        __le32 measure_marlon_m_en;
+        __le32 measure_marlon_r_en;
+} __packed;
+
+
+/*
  * WMI Events
  */
 
@@ -699,7 +810,6 @@ struct wmi_echo_cmd {
  * List of Events (target to host)
  */
 enum wmi_event_id {
-        WMI_IMM_RSP_EVENTID                     = 0x0000,
         WMI_READY_EVENTID                       = 0x1001,
         WMI_CONNECT_EVENTID                     = 0x1002,
         WMI_DISCONNECT_EVENTID                  = 0x1003,
@@ -709,13 +819,9 @@ enum wmi_event_id {
         WMI_FW_READY_EVENTID                    = 0x1801,
         WMI_EXIT_FAST_MEM_ACC_MODE_EVENTID      = 0x0200,
         WMI_ECHO_RSP_EVENTID                    = 0x1803,
-        WMI_CONFIG_MAC_DONE_EVENTID             = 0x1805,
-        WMI_CONFIG_PHY_DEBUG_DONE_EVENTID       = 0x1806,
-        WMI_ADD_STATION_DONE_EVENTID            = 0x1807,
-        WMI_ADD_DEBUG_TX_PCKT_DONE_EVENTID      = 0x1808,
-        WMI_PHY_GET_STATISTICS_EVENTID          = 0x1809,
         WMI_FS_TUNE_DONE_EVENTID                = 0x180a,
-        WMI_CORR_MEASURE_DONE_EVENTID           = 0x180b,
+        WMI_CORR_MEASURE_EVENTID                = 0x180b,
+        WMI_READ_RSSI_EVENTID                   = 0x180c,
         WMI_TEMP_SENSE_DONE_EVENTID             = 0x180e,
         WMI_DC_CALIB_DONE_EVENTID               = 0x180f,
         WMI_IQ_TX_CALIB_DONE_EVENTID            = 0x1811,
@@ -727,10 +833,9 @@ enum wmi_event_id {
         WMI_MARLON_R_WRITE_DONE_EVENTID         = 0x1819,
         WMI_MARLON_R_TXRX_SEL_DONE_EVENTID      = 0x181a,
         WMI_SILENT_RSSI_CALIB_DONE_EVENTID      = 0x181d,
-
+        WMI_RF_RX_TEST_DONE_EVENTID             = 0x181e,
         WMI_CFG_RX_CHAIN_DONE_EVENTID           = 0x1820,
         WMI_VRING_CFG_DONE_EVENTID              = 0x1821,
-        WMI_RX_ON_DONE_EVENTID                  = 0x1822,
         WMI_BA_STATUS_EVENTID                   = 0x1823,
         WMI_RCP_ADDBA_REQ_EVENTID               = 0x1824,
         WMI_ADDBA_RESP_SENT_EVENTID             = 0x1825,
@@ -738,7 +843,6 @@ enum wmi_event_id {
         WMI_GET_SSID_EVENTID                    = 0x1828,
         WMI_GET_PCP_CHANNEL_EVENTID             = 0x182a,
         WMI_SW_TX_COMPLETE_EVENTID              = 0x182b,
-        WMI_RX_OFF_DONE_EVENTID                 = 0x182c,
 
         WMI_READ_MAC_RXQ_EVENTID                = 0x1830,
         WMI_READ_MAC_TXQ_EVENTID                = 0x1831,
@@ -765,7 +869,16 @@ enum wmi_event_id {
         WMI_UNIT_TEST_EVENTID                   = 0x1900,
         WMI_FLASH_READ_DONE_EVENTID             = 0x1902,
         WMI_FLASH_WRITE_DONE_EVENTID            = 0x1903,
-
+        /*P2P*/
+        WMI_PORT_ALLOCATED_EVENTID              = 0x1911,
+        WMI_PORT_DELETED_EVENTID                = 0x1912,
+        WMI_LISTEN_STARTED_EVENTID              = 0x1914,
+        WMI_SEARCH_STARTED_EVENTID              = 0x1915,
+        WMI_DISCOVERY_STARTED_EVENTID           = 0x1916,
+        WMI_DISCOVERY_STOPPED_EVENTID           = 0x1917,
+        WMI_PCP_STARTED_EVENTID                 = 0x1918,
+        WMI_PCP_STOPPED_EVENTID                 = 0x1919,
+        WMI_PCP_FACTOR_EVENTID                  = 0x191a,
         WMI_SET_CHANNEL_EVENTID                 = 0x9000,
         WMI_ASSOC_REQ_EVENTID                   = 0x9001,
         WMI_EAPOL_RX_EVENTID                    = 0x9002,
@@ -777,6 +890,12 @@ enum wmi_event_id {
  * Events data structures
  */
 
+
+enum wmi_fw_status {
+        WMI_FW_STATUS_SUCCESS,
+        WMI_FW_STATUS_FAILURE,
+};
+
 /*
  * WMI_RF_MGMT_STATUS_EVENTID
  */
@@ -857,7 +976,7 @@ struct wmi_ready_event {
         __le32 abi_version;
         u8 mac[WMI_MAC_LEN];
         u8 phy_capability;              /* enum wmi_phy_capability */
-        u8 reserved;
+        u8 numof_additional_mids;
 } __packed;
 
 /*
@@ -876,6 +995,8 @@ struct wmi_notify_req_done_event {
         __le16 other_rx_sector;
         __le16 other_tx_sector;
         __le16 range;
+        u8 sqi;
+        u8 reserved[3];
 } __packed;
 
 /*
@@ -951,27 +1072,15 @@ struct wmi_vring_ba_status_event {
  * WMI_DELBA_EVENTID
  */
 struct wmi_delba_event {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 from_initiator;
         __le16 reason;
 } __packed;
 
+
 /*
  * WMI_VRING_CFG_DONE_EVENTID
  */
-enum wmi_vring_cfg_done_event_status {
-        WMI_VRING_CFG_SUCCESS           = 0,
-        WMI_VRING_CFG_FAILURE           = 1,
-};
-
 struct wmi_vring_cfg_done_event {
         u8 ringid;
         u8 status;
@@ -982,21 +1091,8 @@ struct wmi_vring_cfg_done_event {
 /*
  * WMI_ADDBA_RESP_SENT_EVENTID
  */
-enum wmi_rcp_addba_resp_sent_event_status {
-        WMI_ADDBA_SUCCESS               = 0,
-        WMI_ADDBA_FAIL                  = 1,
-};
-
 struct wmi_rcp_addba_resp_sent_event {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 reserved;
         __le16 status;
 } __packed;
@@ -1005,15 +1101,7 @@ struct wmi_rcp_addba_resp_sent_event {
  * WMI_RCP_ADDBA_REQ_EVENTID
  */
 struct wmi_rcp_addba_req_event {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 dialog_token;
         __le16 ba_param_set;    /* ieee80211_ba_parameterset as it received */
         __le16 ba_timeout;
@@ -1055,6 +1143,7 @@ struct wmi_data_port_open_event {
         u8 reserved[3];
 } __packed;
 
+
 /*
  * WMI_GET_PCP_CHANNEL_EVENTID
  */
@@ -1063,6 +1152,54 @@ struct wmi_get_pcp_channel_event {
         u8 reserved[3];
 } __packed;
 
+
+/*
+* WMI_PORT_ALLOCATED_EVENTID
+*/
+struct wmi_port_allocated_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+* WMI_PORT_DELETED_EVENTID
+*/
+struct wmi_port_deleted_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_LISTEN_STARTED_EVENTID
+ */
+struct wmi_listen_started_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_SEARCH_STARTED_EVENTID
+ */
+struct wmi_search_started_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_PCP_STARTED_EVENTID
+ */
+struct wmi_pcp_started_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_PCP_FACTOR_EVENTID
+ */
+struct wmi_pcp_factor_event {
+        __le32 pcp_factor;
+} __packed;
+
 /*
  * WMI_SW_TX_COMPLETE_EVENTID
  */
@@ -1078,6 +1215,23 @@ struct wmi_sw_tx_complete_event {
 } __packed;
 
 /*
+ * WMI_CORR_MEASURE_EVENTID
+ */
+struct wmi_corr_measure_event {
+        s32 i;
+        s32 q;
+        s32 image_i;
+        s32 image_q;
+} __packed;
+
+/*
+ * WMI_READ_RSSI_EVENTID
+ */
+struct wmi_read_rssi_event {
+        __le32 ina_rssi_adc_dbm;
+} __packed;
+
+/*
  * WMI_GET_SSID_EVENTID
  */
 struct wmi_get_ssid_event {
@@ -1091,7 +1245,8 @@ struct wmi_get_ssid_event {
 struct wmi_rx_mgmt_info {
         u8 mcs;
         s8 snr;
-        __le16 range;
+        u8 range;
+        u8 sqi;
         __le16 stype;
         __le16 status;
         __le32 len;
@@ -1113,4 +1268,14 @@ struct wmi_echo_event {
         __le32 echoed_value;
 } __packed;
 
+/*
+ * WMI_TEMP_SENSE_DONE_EVENTID
+ *
+ * Measure MAC and radio temperatures
+ */
+struct wmi_temp_sense_done_event {
+        __le32 marlon_m_t1000;
+        __le32 marlon_r_t1000;
+} __packed;
+
 #endif /* __WILOCITY_WMI_H__ */
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 287c6b670a36..078e6f3477a9 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -131,7 +131,7 @@ config B43_PHY_LP
 
 config B43_PHY_HT
         bool "Support for HT-PHY (high throughput) devices"
-        depends on B43
+        depends on B43 && B43_BCMA
         ---help---
           Support for the HT-PHY.
 
@@ -166,8 +166,8 @@ config B43_DEBUG
           Broadcom 43xx debugging.
 
           This adds additional runtime sanity checks and statistics to the driver.
-          These checks and statistics might me expensive and hurt runtime performance
-          of your system.
+          These checks and statistics might be expensive and hurt the runtime
+          performance of your system.
           This also adds the b43 debugfs interface.
 
           Do not enable this, unless you are debugging the driver.
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 6a4bd8c433b4..7f3d461f7e8d 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -285,7 +285,9 @@ enum {
 #define B43_SHM_SH_DTIMPER              0x0012  /* DTIM period */
 #define B43_SHM_SH_NOSLPZNATDTIM        0x004C  /* NOSLPZNAT DTIM */
 /* SHM_SHARED beacon/AP variables */
+#define B43_SHM_SH_BT_BASE0             0x0068  /* Beacon template base 0 */
 #define B43_SHM_SH_BTL0                 0x0018  /* Beacon template length 0 */
+#define B43_SHM_SH_BT_BASE1             0x0468  /* Beacon template base 1 */
 #define B43_SHM_SH_BTL1                 0x001A  /* Beacon template length 1 */
 #define B43_SHM_SH_BTSFOFF              0x001C  /* Beacon TSF offset */
 #define B43_SHM_SH_TIMBPOS              0x001E  /* TIM B position in beacon */
@@ -473,6 +475,12 @@ enum {
 #define B43_MACCMD_CCA                  0x00000008      /* Clear channel assessment */
 #define B43_MACCMD_BGNOISE              0x00000010      /* Background noise */
 
+/* See BCMA_CLKCTLST_EXTRESREQ and BCMA_CLKCTLST_EXTRESST */
+#define B43_BCMA_CLKCTLST_80211_PLL_REQ 0x00000100
+#define B43_BCMA_CLKCTLST_PHY_PLL_REQ   0x00000200
+#define B43_BCMA_CLKCTLST_80211_PLL_ST  0x01000000
+#define B43_BCMA_CLKCTLST_PHY_PLL_ST    0x02000000
+
 /* BCMA 802.11 core specific IO Control (BCMA_IOCTL) flags */
 #define B43_BCMA_IOCTL_PHY_CLKEN        0x00000004      /* PHY Clock Enable */
 #define B43_BCMA_IOCTL_PHY_RESET        0x00000008      /* PHY Reset */
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 38bc5a7997ff..122146943bf2 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1487,8 +1487,12 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         const struct b43_dma_ops *ops;
         struct b43_dmaring *ring;
         struct b43_dmadesc_meta *meta;
+        static const struct b43_txstatus fake; /* filled with 0 */
+        const struct b43_txstatus *txstat;
         int slot, firstused;
         bool frame_succeed;
+        int skip;
+        static u8 err_out1, err_out2;
 
         ring = parse_cookie(dev, status->cookie, &slot);
         if (unlikely(!ring))
@@ -1501,13 +1505,36 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         firstused = ring->current_slot - ring->used_slots + 1;
         if (firstused < 0)
                 firstused = ring->nr_slots + firstused;
+
+        skip = 0;
         if (unlikely(slot != firstused)) {
                 /* This possibly is a firmware bug and will result in
-                 * malfunction, memory leaks and/or stall of DMA functionality. */
-                b43dbg(dev->wl, "Out of order TX status report on DMA ring %d. "
-                       "Expected %d, but got %d\n",
-                       ring->index, firstused, slot);
-                return;
+                 * malfunction, memory leaks and/or stall of DMA functionality.
+                 */
+                if (slot == next_slot(ring, next_slot(ring, firstused))) {
+                        /* If a single header/data pair was missed, skip over
+                         * the first two slots in an attempt to recover.
+                         */
+                        slot = firstused;
+                        skip = 2;
+                        if (!err_out1) {
+                                /* Report the error once. */
+                                b43dbg(dev->wl,
+                                       "Skip on DMA ring %d slot %d.\n",
+                                       ring->index, slot);
+                                err_out1 = 1;
+                        }
+                } else {
+                        /* More than a single header/data pair were missed.
+                         * Report this error once.
+                         */
+                        if (!err_out2)
+                                b43dbg(dev->wl,
+                                       "Out of order TX status report on DMA ring %d. Expected %d, but got %d\n",
+                                       ring->index, firstused, slot);
+                        err_out2 = 1;
+                        return;
+                }
         }
 
         ops = ring->ops;
@@ -1522,11 +1549,13 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                                slot, firstused, ring->index);
                         break;
                 }
+
                 if (meta->skb) {
                         struct b43_private_tx_info *priv_info =
-                                b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
+                             b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
 
-                        unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len, 1);
+                        unmap_descbuffer(ring, meta->dmaaddr,
+                                         meta->skb->len, 1);
                         kfree(priv_info->bouncebuffer);
                         priv_info->bouncebuffer = NULL;
                 } else {
@@ -1538,8 +1567,9 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                         struct ieee80211_tx_info *info;
 
                         if (unlikely(!meta->skb)) {
-                                /* This is a scatter-gather fragment of a frame, so
-                                 * the skb pointer must not be NULL. */
+                                /* This is a scatter-gather fragment of a frame,
+                                 * so the skb pointer must not be NULL.
+                                 */
                                 b43dbg(dev->wl, "TX status unexpected NULL skb "
                                        "at slot %d (first=%d) on ring %d\n",
                                        slot, firstused, ring->index);
@@ -1550,9 +1580,18 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
 
                         /*
                          * Call back to inform the ieee80211 subsystem about
-                         * the status of the transmission.
+                         * the status of the transmission. When skipping over
+                         * a missed TX status report, use a status structure
+                         * filled with zeros to indicate that the frame was not
+                         * sent (frame_count 0) and not acknowledged
                          */
-                        frame_succeed = b43_fill_txstatus_report(dev, info, status);
+                        if (unlikely(skip))
+                                txstat = &fake;
+                        else
+                                txstat = status;
+
+                        frame_succeed = b43_fill_txstatus_report(dev, info,
+                                                                 txstat);
 #ifdef CONFIG_B43_DEBUG
                         if (frame_succeed)
                                 ring->nr_succeed_tx_packets++;
@@ -1580,12 +1619,14 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                 /* Everything unmapped and free'd. So it's not used anymore. */
                 ring->used_slots--;
 
-                if (meta->is_last_fragment) {
+                if (meta->is_last_fragment && !skip) {
                         /* This is the last scatter-gather
                          * fragment of the frame. We are done. */
                         break;
                 }
                 slot = next_slot(ring, slot);
+                if (skip > 0)
+                        --skip;
         }
         if (ring->stopped) {
                 B43_WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index d135e8975f52..d377f77d30b5 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1189,10 +1189,15 @@ static void b43_bcma_phy_reset(struct b43_wldev *dev)
 
 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
 {
+        u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
+                  B43_BCMA_CLKCTLST_PHY_PLL_REQ;
+        u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
+                     B43_BCMA_CLKCTLST_PHY_PLL_ST;
+
         b43_device_enable(dev, B43_BCMA_IOCTL_PHY_CLKEN);
         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
         b43_bcma_phy_reset(dev);
-        bcma_core_pll_ctl(dev->dev->bdev, 0x300, 0x3000000, true);
+        bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
 }
 #endif
 
@@ -1305,17 +1310,19 @@ static u32 b43_jssi_read(struct b43_wldev *dev)
 {
         u32 val = 0;
 
-        val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
+        val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
         val <<= 16;
-        val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
+        val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
 
         return val;
 }
 
 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
 {
-        b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
-        b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
+                        (jssi & 0x0000FFFF));
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
+                        (jssi & 0xFFFF0000) >> 16);
 }
 
 static void b43_generate_noise_sample(struct b43_wldev *dev)
@@ -1618,7 +1625,7 @@ static void b43_upload_beacon0(struct b43_wldev *dev)
 
         if (wl->beacon0_uploaded)
                 return;
-        b43_write_beacon_template(dev, 0x68, 0x18);
+        b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
         wl->beacon0_uploaded = true;
 }
 
@@ -1628,7 +1635,7 @@ static void b43_upload_beacon1(struct b43_wldev *dev)
 
         if (wl->beacon1_uploaded)
                 return;
-        b43_write_beacon_template(dev, 0x468, 0x1A);
+        b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
         wl->beacon1_uploaded = true;
 }
 
@@ -2775,9 +2782,7 @@ static int b43_gpio_init(struct b43_wldev *dev)
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
         case B43_BUS_BCMA:
-                bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
-                                (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
-                                        BCMA_CC_GPIOCTL) & ~mask) | set);
+                bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
                 break;
 #endif
 #ifdef CONFIG_B43_SSB
@@ -2802,8 +2807,7 @@ static void b43_gpio_cleanup(struct b43_wldev *dev)
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
         case B43_BUS_BCMA:
-                bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
-                                0);
+                bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
                 break;
 #endif
 #ifdef CONFIG_B43_SSB
@@ -3111,7 +3115,7 @@ static int b43_chip_init(struct b43_wldev *dev)
 
         /* Probe Response Timeout value */
         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
-        b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
 
         /* Initially set the wireless operation mode. */
         b43_adjust_opmode(dev);
diff --git a/drivers/net/wireless/b43/phy_ht.c b/drivers/net/wireless/b43/phy_ht.c
index 016682ea7445..83239fd87040 100644
--- a/drivers/net/wireless/b43/phy_ht.c
+++ b/drivers/net/wireless/b43/phy_ht.c
@@ -154,9 +154,84 @@ static void b43_radio_2059_init(struct b43_wldev *dev)
 }
 
 /**************************************************
+ * RF
+ **************************************************/
+
+static void b43_phy_ht_force_rf_sequence(struct b43_wldev *dev, u16 rf_seq)
+{
+        u8 i;
+
+        u16 save_seq_mode = b43_phy_read(dev, B43_PHY_HT_RF_SEQ_MODE);
+        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_MODE, 0x3);
+
+        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_TRIG, rf_seq);
+        for (i = 0; i < 200; i++) {
+                if (!(b43_phy_read(dev, B43_PHY_HT_RF_SEQ_STATUS) & rf_seq)) {
+                        i = 0;
+                        break;
+                }
+                msleep(1);
+        }
+        if (i)
+                b43err(dev->wl, "Forcing RF sequence timeout\n");
+
+        b43_phy_write(dev, B43_PHY_HT_RF_SEQ_MODE, save_seq_mode);
+}
+
+static void b43_phy_ht_pa_override(struct b43_wldev *dev, bool enable)
+{
+        struct b43_phy_ht *htphy = dev->phy.ht;
+        static const u16 regs[3] = { B43_PHY_HT_RF_CTL_INT_C1,
+                                     B43_PHY_HT_RF_CTL_INT_C2,
+                                     B43_PHY_HT_RF_CTL_INT_C3 };
+        int i;
+
+        if (enable) {
+                for (i = 0; i < 3; i++)
+                        b43_phy_write(dev, regs[i], htphy->rf_ctl_int_save[i]);
+        } else {
+                for (i = 0; i < 3; i++)
+                        htphy->rf_ctl_int_save[i] = b43_phy_read(dev, regs[i]);
+                /* TODO: Does 5GHz band use different value (not 0x0400)? */
+                for (i = 0; i < 3; i++)
+                        b43_phy_write(dev, regs[i], 0x0400);
+        }
+}
+
+/**************************************************
  * Various PHY ops
  **************************************************/
 
+static u16 b43_phy_ht_classifier(struct b43_wldev *dev, u16 mask, u16 val)
+{
+        u16 tmp;
+        u16 allowed = B43_PHY_HT_CLASS_CTL_CCK_EN |
+                      B43_PHY_HT_CLASS_CTL_OFDM_EN |
+                      B43_PHY_HT_CLASS_CTL_WAITED_EN;
+
+        tmp = b43_phy_read(dev, B43_PHY_HT_CLASS_CTL);
+        tmp &= allowed;
+        tmp &= ~mask;
+        tmp |= (val & mask);
+        b43_phy_maskset(dev, B43_PHY_HT_CLASS_CTL, ~allowed, tmp);
+
+        return tmp;
+}
+
+static void b43_phy_ht_reset_cca(struct b43_wldev *dev)
+{
+        u16 bbcfg;
+
+        b43_phy_force_clock(dev, true);
+        bbcfg = b43_phy_read(dev, B43_PHY_HT_BBCFG);
+        b43_phy_write(dev, B43_PHY_HT_BBCFG, bbcfg | B43_PHY_HT_BBCFG_RSTCCA);
+        udelay(1);
+        b43_phy_write(dev, B43_PHY_HT_BBCFG, bbcfg & ~B43_PHY_HT_BBCFG_RSTCCA);
+        b43_phy_force_clock(dev, false);
+
+        b43_phy_ht_force_rf_sequence(dev, B43_PHY_HT_RF_SEQ_TRIG_RST2RX);
+}
+
 static void b43_phy_ht_zero_extg(struct b43_wldev *dev)
 {
         u8 i, j;
@@ -176,10 +251,10 @@ static void b43_phy_ht_afe_unk1(struct b43_wldev *dev)
 {
         u8 i;
 
-        const u16 ctl_regs[3][2] = {
-                { B43_PHY_HT_AFE_CTL1, B43_PHY_HT_AFE_CTL2 },
-                { B43_PHY_HT_AFE_CTL3, B43_PHY_HT_AFE_CTL4 },
-                { B43_PHY_HT_AFE_CTL5, B43_PHY_HT_AFE_CTL6},
+        static const u16 ctl_regs[3][2] = {
+                { B43_PHY_HT_AFE_C1_OVER, B43_PHY_HT_AFE_C1 },
+                { B43_PHY_HT_AFE_C2_OVER, B43_PHY_HT_AFE_C2 },
+                { B43_PHY_HT_AFE_C3_OVER, B43_PHY_HT_AFE_C3},
         };
 
         for (i = 0; i < 3; i++) {
@@ -193,27 +268,6 @@ static void b43_phy_ht_afe_unk1(struct b43_wldev *dev)
         }
 }
 
-static void b43_phy_ht_force_rf_sequence(struct b43_wldev *dev, u16 rf_seq)
-{
-        u8 i;
-
-        u16 save_seq_mode = b43_phy_read(dev, B43_PHY_HT_RF_SEQ_MODE);
-        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_MODE, 0x3);
-
-        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_TRIG, rf_seq);
-        for (i = 0; i < 200; i++) {
-                if (!(b43_phy_read(dev, B43_PHY_HT_RF_SEQ_STATUS) & rf_seq)) {
-                        i = 0;
-                        break;
-                }
-                msleep(1);
-        }
-        if (i)
-                b43err(dev->wl, "Forcing RF sequence timeout\n");
-
-        b43_phy_write(dev, B43_PHY_HT_RF_SEQ_MODE, save_seq_mode);
-}
-
 static void b43_phy_ht_read_clip_detection(struct b43_wldev *dev, u16 *clip_st)
 {
         clip_st[0] = b43_phy_read(dev, B43_PHY_HT_C1_CLIP1THRES);
@@ -240,15 +294,426 @@ static void b43_phy_ht_bphy_init(struct b43_wldev *dev)
 }
 
 /**************************************************
+ * Samples
+ **************************************************/
+
+static void b43_phy_ht_stop_playback(struct b43_wldev *dev)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        u16 tmp;
+        int i;
+
+        tmp = b43_phy_read(dev, B43_PHY_HT_SAMP_STAT);
+        if (tmp & 0x1)
+                b43_phy_set(dev, B43_PHY_HT_SAMP_CMD, B43_PHY_HT_SAMP_CMD_STOP);
+        else if (tmp & 0x2)
+                b43_phy_mask(dev, B43_PHY_HT_IQLOCAL_CMDGCTL, 0x7FFF);
+
+        b43_phy_mask(dev, B43_PHY_HT_SAMP_CMD, ~0x0004);
+
+        for (i = 0; i < 3; i++) {
+                if (phy_ht->bb_mult_save[i] >= 0) {
+                        b43_httab_write(dev, B43_HTTAB16(13, 0x63 + i * 4),
+                                        phy_ht->bb_mult_save[i]);
+                        b43_httab_write(dev, B43_HTTAB16(13, 0x67 + i * 4),
+                                        phy_ht->bb_mult_save[i]);
+                }
+        }
+}
+
+static u16 b43_phy_ht_load_samples(struct b43_wldev *dev)
+{
+        int i;
+        u16 len = 20 << 3;
+
+        b43_phy_write(dev, B43_PHY_HT_TABLE_ADDR, 0x4400);
+
+        for (i = 0; i < len; i++) {
+                b43_phy_write(dev, B43_PHY_HT_TABLE_DATAHI, 0);
+                b43_phy_write(dev, B43_PHY_HT_TABLE_DATALO, 0);
+        }
+
+        return len;
+}
+
+static void b43_phy_ht_run_samples(struct b43_wldev *dev, u16 samps, u16 loops,
+                                   u16 wait)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        u16 save_seq_mode;
+        int i;
+
+        for (i = 0; i < 3; i++) {
+                if (phy_ht->bb_mult_save[i] < 0)
+                        phy_ht->bb_mult_save[i] = b43_httab_read(dev, B43_HTTAB16(13, 0x63 + i * 4));
+        }
+
+        b43_phy_write(dev, B43_PHY_HT_SAMP_DEP_CNT, samps - 1);
+        if (loops != 0xFFFF)
+                loops--;
+        b43_phy_write(dev, B43_PHY_HT_SAMP_LOOP_CNT, loops);
+        b43_phy_write(dev, B43_PHY_HT_SAMP_WAIT_CNT, wait);
+
+        save_seq_mode = b43_phy_read(dev, B43_PHY_HT_RF_SEQ_MODE);
+        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_MODE,
+                    B43_PHY_HT_RF_SEQ_MODE_CA_OVER);
+
+        /* TODO: find out mask bits! Do we need more function arguments? */
+        b43_phy_mask(dev, B43_PHY_HT_SAMP_CMD, ~0);
+        b43_phy_mask(dev, B43_PHY_HT_SAMP_CMD, ~0);
+        b43_phy_mask(dev, B43_PHY_HT_IQLOCAL_CMDGCTL, ~0);
+        b43_phy_set(dev, B43_PHY_HT_SAMP_CMD, 0x1);
+
+        for (i = 0; i < 100; i++) {
+                if (!(b43_phy_read(dev, B43_PHY_HT_RF_SEQ_STATUS) & 1)) {
+                        i = 0;
+                        break;
+                }
+                udelay(10);
+        }
+        if (i)
+                b43err(dev->wl, "run samples timeout\n");
+
+        b43_phy_write(dev, B43_PHY_HT_RF_SEQ_MODE, save_seq_mode);
+}
+
+static void b43_phy_ht_tx_tone(struct b43_wldev *dev)
+{
+        u16 samp;
+
+        samp = b43_phy_ht_load_samples(dev);
+        b43_phy_ht_run_samples(dev, samp, 0xFFFF, 0);
+}
+
+/**************************************************
+ * RSSI
+ **************************************************/
+
+static void b43_phy_ht_rssi_select(struct b43_wldev *dev, u8 core_sel,
+                                   u8 rssi_type)
+{
+        static const u16 ctl_regs[3][2] = {
+                { B43_PHY_HT_AFE_C1, B43_PHY_HT_AFE_C1_OVER, },
+                { B43_PHY_HT_AFE_C2, B43_PHY_HT_AFE_C2_OVER, },
+                { B43_PHY_HT_AFE_C3, B43_PHY_HT_AFE_C3_OVER, },
+        };
+        static const u16 radio_r[] = { R2059_SYN, R2059_TXRX0, R2059_RXRX1, };
+        int core;
+
+        if (core_sel == 0) {
+                b43err(dev->wl, "RSSI selection for core off not implemented yet\n");
+        } else {
+                for (core = 0; core < 3; core++) {
+                        /* Check if caller requested a one specific core */
+                        if ((core_sel == 1 && core != 0) ||
+                            (core_sel == 2 && core != 1) ||
+                            (core_sel == 3 && core != 2))
+                                continue;
+
+                        switch (rssi_type) {
+                        case 4:
+                                b43_phy_set(dev, ctl_regs[core][0], 0x3 << 8);
+                                b43_phy_set(dev, ctl_regs[core][0], 0x3 << 10);
+                                b43_phy_set(dev, ctl_regs[core][1], 0x1 << 9);
+                                b43_phy_set(dev, ctl_regs[core][1], 0x1 << 10);
+
+                                b43_radio_set(dev, R2059_RXRX1 | 0xbf, 0x1);
+                                b43_radio_write(dev, radio_r[core] | 0x159,
+                                                0x11);
+                                break;
+                        default:
+                                b43err(dev->wl, "RSSI selection for type %d not implemented yet\n",
+                                       rssi_type);
+                        }
+                }
+        }
+}
+
+static void b43_phy_ht_poll_rssi(struct b43_wldev *dev, u8 type, s32 *buf,
+                                 u8 nsamp)
+{
+        u16 phy_regs_values[12];
+        static const u16 phy_regs_to_save[] = {
+                B43_PHY_HT_AFE_C1, B43_PHY_HT_AFE_C1_OVER,
+                0x848, 0x841,
+                B43_PHY_HT_AFE_C2, B43_PHY_HT_AFE_C2_OVER,
+                0x868, 0x861,
+                B43_PHY_HT_AFE_C3, B43_PHY_HT_AFE_C3_OVER,
+                0x888, 0x881,
+        };
+        u16 tmp[3];
+        int i;
+
+        for (i = 0; i < 12; i++)
+                phy_regs_values[i] = b43_phy_read(dev, phy_regs_to_save[i]);
+
+        b43_phy_ht_rssi_select(dev, 5, type);
+
+        for (i = 0; i < 6; i++)
+                buf[i] = 0;
+
+        for (i = 0; i < nsamp; i++) {
+                tmp[0] = b43_phy_read(dev, B43_PHY_HT_RSSI_C1);
+                tmp[1] = b43_phy_read(dev, B43_PHY_HT_RSSI_C2);
+                tmp[2] = b43_phy_read(dev, B43_PHY_HT_RSSI_C3);
+
+                buf[0] += ((s8)((tmp[0] & 0x3F) << 2)) >> 2;
+                buf[1] += ((s8)(((tmp[0] >> 8) & 0x3F) << 2)) >> 2;
+                buf[2] += ((s8)((tmp[1] & 0x3F) << 2)) >> 2;
+                buf[3] += ((s8)(((tmp[1] >> 8) & 0x3F) << 2)) >> 2;
+                buf[4] += ((s8)((tmp[2] & 0x3F) << 2)) >> 2;
+                buf[5] += ((s8)(((tmp[2] >> 8) & 0x3F) << 2)) >> 2;
+        }
+
+        for (i = 0; i < 12; i++)
+                b43_phy_write(dev, phy_regs_to_save[i], phy_regs_values[i]);
+}
+
+/**************************************************
+ * Tx/Rx
+ **************************************************/
+
+static void b43_phy_ht_tx_power_fix(struct b43_wldev *dev)
+{
+        int i;
+
+        for (i = 0; i < 3; i++) {
+                u16 mask;
+                u32 tmp = b43_httab_read(dev, B43_HTTAB32(26, 0xE8));
+
+                if (0) /* FIXME */
+                        mask = 0x2 << (i * 4);
+                else
+                        mask = 0;
+                b43_phy_mask(dev, B43_PHY_EXTG(0x108), mask);
+
+                b43_httab_write(dev, B43_HTTAB16(7, 0x110 + i), tmp >> 16);
+                b43_httab_write(dev, B43_HTTAB8(13, 0x63 + (i * 4)),
+                                tmp & 0xFF);
+                b43_httab_write(dev, B43_HTTAB8(13, 0x73 + (i * 4)),
+                                tmp & 0xFF);
+        }
+}
+
+static void b43_phy_ht_tx_power_ctl(struct b43_wldev *dev, bool enable)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        u16 en_bits = B43_PHY_HT_TXPCTL_CMD_C1_COEFF |
+                      B43_PHY_HT_TXPCTL_CMD_C1_HWPCTLEN |
+                      B43_PHY_HT_TXPCTL_CMD_C1_PCTLEN;
+        static const u16 cmd_regs[3] = { B43_PHY_HT_TXPCTL_CMD_C1,
+                                         B43_PHY_HT_TXPCTL_CMD_C2,
+                                         B43_PHY_HT_TXPCTL_CMD_C3 };
+        int i;
+
+        if (!enable) {
+                if (b43_phy_read(dev, B43_PHY_HT_TXPCTL_CMD_C1) & en_bits) {
+                        /* We disable enabled TX pwr ctl, save it's state */
+                        /*
+                         * TODO: find the registers. On N-PHY they were 0x1ed
+                         * and 0x1ee, we need 3 such a registers for HT-PHY
+                         */
+                }
+                b43_phy_mask(dev, B43_PHY_HT_TXPCTL_CMD_C1, ~en_bits);
+        } else {
+                b43_phy_set(dev, B43_PHY_HT_TXPCTL_CMD_C1, en_bits);
+
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                        for (i = 0; i < 3; i++)
+                                b43_phy_write(dev, cmd_regs[i], 0x32);
+                }
+
+                for (i = 0; i < 3; i++)
+                        if (phy_ht->tx_pwr_idx[i] <=
+                            B43_PHY_HT_TXPCTL_CMD_C1_INIT)
+                                b43_phy_write(dev, cmd_regs[i],
+                                              phy_ht->tx_pwr_idx[i]);
+        }
+
+        phy_ht->tx_pwr_ctl = enable;
+}
+
+static void b43_phy_ht_tx_power_ctl_idle_tssi(struct b43_wldev *dev)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        s32 rssi_buf[6];
+
+        /* TODO */
+
+        b43_phy_ht_tx_tone(dev);
+        udelay(20);
+        b43_phy_ht_poll_rssi(dev, 4, rssi_buf, 1);
+        b43_phy_ht_stop_playback(dev);
+        b43_phy_ht_reset_cca(dev);
+
+        phy_ht->idle_tssi[0] = rssi_buf[0] & 0xff;
+        phy_ht->idle_tssi[1] = rssi_buf[2] & 0xff;
+        phy_ht->idle_tssi[2] = rssi_buf[4] & 0xff;
+
+        /* TODO */
+}
+
+static void b43_phy_ht_tx_power_ctl_setup(struct b43_wldev *dev)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        struct ssb_sprom *sprom = dev->dev->bus_sprom;
+
+        u8 *idle = phy_ht->idle_tssi;
+        u8 target[3];
+        s16 a1[3], b0[3], b1[3];
+
+        u16 freq = dev->phy.channel_freq;
+        int i, c;
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                for (c = 0; c < 3; c++) {
+                        target[c] = sprom->core_pwr_info[c].maxpwr_2g;
+                        a1[c] = sprom->core_pwr_info[c].pa_2g[0];
+                        b0[c] = sprom->core_pwr_info[c].pa_2g[1];
+                        b1[c] = sprom->core_pwr_info[c].pa_2g[2];
+                }
+        } else if (freq >= 4900 && freq < 5100) {
+                for (c = 0; c < 3; c++) {
+                        target[c] = sprom->core_pwr_info[c].maxpwr_5gl;
+                        a1[c] = sprom->core_pwr_info[c].pa_5gl[0];
+                        b0[c] = sprom->core_pwr_info[c].pa_5gl[1];
+                        b1[c] = sprom->core_pwr_info[c].pa_5gl[2];
+                }
+        } else if (freq >= 5100 && freq < 5500) {
+                for (c = 0; c < 3; c++) {
+                        target[c] = sprom->core_pwr_info[c].maxpwr_5g;
+                        a1[c] = sprom->core_pwr_info[c].pa_5g[0];
+                        b0[c] = sprom->core_pwr_info[c].pa_5g[1];
+                        b1[c] = sprom->core_pwr_info[c].pa_5g[2];
+                }
+        } else if (freq >= 5500) {
+                for (c = 0; c < 3; c++) {
+                        target[c] = sprom->core_pwr_info[c].maxpwr_5gh;
+                        a1[c] = sprom->core_pwr_info[c].pa_5gh[0];
+                        b0[c] = sprom->core_pwr_info[c].pa_5gh[1];
+                        b1[c] = sprom->core_pwr_info[c].pa_5gh[2];
+                }
+        } else {
+                target[0] = target[1] = target[2] = 52;
+                a1[0] = a1[1] = a1[2] = -424;
+                b0[0] = b0[1] = b0[2] = 5612;
+                b1[0] = b1[1] = b1[2] = -1393;
+        }
+
+        b43_phy_set(dev, B43_PHY_HT_TSSIMODE, B43_PHY_HT_TSSIMODE_EN);
+        b43_phy_mask(dev, B43_PHY_HT_TXPCTL_CMD_C1,
+                     ~B43_PHY_HT_TXPCTL_CMD_C1_PCTLEN & 0xFFFF);
+
+        /* TODO: Does it depend on sprom->fem.ghz2.tssipos? */
+        b43_phy_set(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI, 0x4000);
+
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C1,
+                        ~B43_PHY_HT_TXPCTL_CMD_C1_INIT, 0x19);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C2,
+                        ~B43_PHY_HT_TXPCTL_CMD_C2_INIT, 0x19);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C3,
+                        ~B43_PHY_HT_TXPCTL_CMD_C3_INIT, 0x19);
+
+        b43_phy_set(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI,
+                    B43_PHY_HT_TXPCTL_IDLE_TSSI_BINF);
+
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI,
+                        ~B43_PHY_HT_TXPCTL_IDLE_TSSI_C1,
+                        idle[0] << B43_PHY_HT_TXPCTL_IDLE_TSSI_C1_SHIFT);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI,
+                        ~B43_PHY_HT_TXPCTL_IDLE_TSSI_C2,
+                        idle[1] << B43_PHY_HT_TXPCTL_IDLE_TSSI_C2_SHIFT);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI2,
+                        ~B43_PHY_HT_TXPCTL_IDLE_TSSI2_C3,
+                        idle[2] << B43_PHY_HT_TXPCTL_IDLE_TSSI2_C3_SHIFT);
+
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_N, ~B43_PHY_HT_TXPCTL_N_TSSID,
+                        0xf0);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_N, ~B43_PHY_HT_TXPCTL_N_NPTIL2,
+                        0x3 << B43_PHY_HT_TXPCTL_N_NPTIL2_SHIFT);
+#if 0
+        /* TODO: what to mask/set? */
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C1, 0x800, 0)
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C1, 0x400, 0)
+#endif
+
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_TARG_PWR,
+                        ~B43_PHY_HT_TXPCTL_TARG_PWR_C1,
+                        target[0] << B43_PHY_HT_TXPCTL_TARG_PWR_C1_SHIFT);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_TARG_PWR,
+                        ~B43_PHY_HT_TXPCTL_TARG_PWR_C2 & 0xFFFF,
+                        target[1] << B43_PHY_HT_TXPCTL_TARG_PWR_C2_SHIFT);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_TARG_PWR2,
+                        ~B43_PHY_HT_TXPCTL_TARG_PWR2_C3,
+                        target[2] << B43_PHY_HT_TXPCTL_TARG_PWR2_C3_SHIFT);
+
+        for (c = 0; c < 3; c++) {
+                s32 num, den, pwr;
+                u32 regval[64];
+
+                for (i = 0; i < 64; i++) {
+                        num = 8 * (16 * b0[c] + b1[c] * i);
+                        den = 32768 + a1[c] * i;
+                        pwr = max((4 * num + den / 2) / den, -8);
+                        regval[i] = pwr;
+                }
+                b43_httab_write_bulk(dev, B43_HTTAB16(26 + c, 0), 64, regval);
+        }
+}
+
+/**************************************************
  * Channel switching ops.
  **************************************************/
 
+static void b43_phy_ht_spur_avoid(struct b43_wldev *dev,
+                                  struct ieee80211_channel *new_channel)
+{
+        struct bcma_device *core = dev->dev->bdev;
+        int spuravoid = 0;
+        u16 tmp;
+
+        /* Check for 13 and 14 is just a guess, we don't have enough logs. */
+        if (new_channel->hw_value == 13 || new_channel->hw_value == 14)
+                spuravoid = 1;
+        bcma_core_pll_ctl(core, B43_BCMA_CLKCTLST_PHY_PLL_REQ, 0, false);
+        bcma_pmu_spuravoid_pllupdate(&core->bus->drv_cc, spuravoid);
+        bcma_core_pll_ctl(core,
+                          B43_BCMA_CLKCTLST_80211_PLL_REQ |
+                          B43_BCMA_CLKCTLST_PHY_PLL_REQ,
+                          B43_BCMA_CLKCTLST_80211_PLL_ST |
+                          B43_BCMA_CLKCTLST_PHY_PLL_ST, false);
+
+        /* Values has been taken from wlc_bmac_switch_macfreq comments */
+        switch (spuravoid) {
+        case 2: /* 126MHz */
+                tmp = 0x2082;
+                break;
+        case 1: /* 123MHz */
+                tmp = 0x5341;
+                break;
+        default: /* 120MHz */
+                tmp = 0x8889;
+        }
+
+        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, tmp);
+        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
+
+        /* TODO: reset PLL */
+
+        if (spuravoid)
+                b43_phy_set(dev, B43_PHY_HT_BBCFG, B43_PHY_HT_BBCFG_RSTRX);
+        else
+                b43_phy_mask(dev, B43_PHY_HT_BBCFG,
+                                ~B43_PHY_HT_BBCFG_RSTRX & 0xFFFF);
+
+        b43_phy_ht_reset_cca(dev);
+}
+
 static void b43_phy_ht_channel_setup(struct b43_wldev *dev,
                                 const struct b43_phy_ht_channeltab_e_phy *e,
                                 struct ieee80211_channel *new_channel)
 {
         bool old_band_5ghz;
-        u8 i;
 
         old_band_5ghz = b43_phy_read(dev, B43_PHY_HT_BANDCTL) & 0; /* FIXME */
         if (new_channel->band == IEEE80211_BAND_5GHZ && !old_band_5ghz) {
@@ -264,25 +729,20 @@ static void b43_phy_ht_channel_setup(struct b43_wldev *dev,
         b43_phy_write(dev, B43_PHY_HT_BW5, e->bw5);
         b43_phy_write(dev, B43_PHY_HT_BW6, e->bw6);
 
-        /* TODO: some ops on PHY regs 0x0B0 and 0xC0A */
+        if (new_channel->hw_value == 14) {
+                b43_phy_ht_classifier(dev, B43_PHY_HT_CLASS_CTL_OFDM_EN, 0);
+                b43_phy_set(dev, B43_PHY_HT_TEST, 0x0800);
+        } else {
+                b43_phy_ht_classifier(dev, B43_PHY_HT_CLASS_CTL_OFDM_EN,
+                                      B43_PHY_HT_CLASS_CTL_OFDM_EN);
+                if (new_channel->band == IEEE80211_BAND_2GHZ)
+                        b43_phy_mask(dev, B43_PHY_HT_TEST, ~0x840);
+        }
 
-        /* TODO: separated function? */
-        for (i = 0; i < 3; i++) {
-                u16 mask;
-                u32 tmp = b43_httab_read(dev, B43_HTTAB32(26, 0xE8));
+        if (1) /* TODO: On N it's for early devices only, what about HT? */
+                b43_phy_ht_tx_power_fix(dev);
 
-                if (0) /* FIXME */
-                        mask = 0x2 << (i * 4);
-                else
-                        mask = 0;
-                b43_phy_mask(dev, B43_PHY_EXTG(0x108), mask);
-
-                b43_httab_write(dev, B43_HTTAB16(7, 0x110 + i), tmp >> 16);
-                b43_httab_write(dev, B43_HTTAB8(13, 0x63 + (i * 4)),
-                                tmp & 0xFF);
-                b43_httab_write(dev, B43_HTTAB8(13, 0x73 + (i * 4)),
-                                tmp & 0xFF);
-        }
+        b43_phy_ht_spur_avoid(dev, new_channel);
 
         b43_phy_write(dev, 0x017e, 0x3830);
 }
@@ -337,14 +797,29 @@ static void b43_phy_ht_op_prepare_structs(struct b43_wldev *dev)
 {
         struct b43_phy *phy = &dev->phy;
         struct b43_phy_ht *phy_ht = phy->ht;
+        int i;
 
         memset(phy_ht, 0, sizeof(*phy_ht));
+
+        phy_ht->tx_pwr_ctl = true;
+        for (i = 0; i < 3; i++)
+                phy_ht->tx_pwr_idx[i] = B43_PHY_HT_TXPCTL_CMD_C1_INIT + 1;
+
+        for (i = 0; i < 3; i++)
+                phy_ht->bb_mult_save[i] = -1;
 }
 
 static int b43_phy_ht_op_init(struct b43_wldev *dev)
 {
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
         u16 tmp;
         u16 clip_state[3];
+        bool saved_tx_pwr_ctl;
+
+        if (dev->dev->bus_type != B43_BUS_BCMA) {
+                b43err(dev->wl, "HT-PHY is supported only on BCMA bus!\n");
+                return -EOPNOTSUPP;
+        }
 
         b43_phy_ht_tables_init(dev);
 
@@ -357,9 +832,9 @@ static int b43_phy_ht_op_init(struct b43_wldev *dev)
 
         b43_phy_mask(dev, B43_PHY_EXTG(0), ~0x3);
 
-        b43_phy_write(dev, B43_PHY_HT_AFE_CTL1, 0);
-        b43_phy_write(dev, B43_PHY_HT_AFE_CTL3, 0);
-        b43_phy_write(dev, B43_PHY_HT_AFE_CTL5, 0);
+        b43_phy_write(dev, B43_PHY_HT_AFE_C1_OVER, 0);
+        b43_phy_write(dev, B43_PHY_HT_AFE_C2_OVER, 0);
+        b43_phy_write(dev, B43_PHY_HT_AFE_C3_OVER, 0);
 
         b43_phy_write(dev, B43_PHY_EXTG(0x103), 0x20);
         b43_phy_write(dev, B43_PHY_EXTG(0x101), 0x20);
@@ -371,8 +846,11 @@ static int b43_phy_ht_op_init(struct b43_wldev *dev)
         if (0) /* TODO: condition */
                 ; /* TODO: PHY op on reg 0x217 */
 
-        b43_phy_read(dev, 0xb0); /* TODO: what for? */
-        b43_phy_set(dev, 0xb0, 0x1);
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
+                b43_phy_ht_classifier(dev, B43_PHY_HT_CLASS_CTL_CCK_EN, 0);
+        else
+                b43_phy_ht_classifier(dev, B43_PHY_HT_CLASS_CTL_CCK_EN,
+                                      B43_PHY_HT_CLASS_CTL_CCK_EN);
 
         b43_phy_set(dev, 0xb1, 0x91);
         b43_phy_write(dev, 0x32f, 0x0003);
@@ -448,12 +926,13 @@ static int b43_phy_ht_op_init(struct b43_wldev *dev)
 
         b43_mac_phy_clock_set(dev, true);
 
+        b43_phy_ht_pa_override(dev, false);
         b43_phy_ht_force_rf_sequence(dev, B43_PHY_HT_RF_SEQ_TRIG_RX2TX);
         b43_phy_ht_force_rf_sequence(dev, B43_PHY_HT_RF_SEQ_TRIG_RST2RX);
-
-        /* TODO: PHY op on reg 0xb0 */
+        b43_phy_ht_pa_override(dev, true);
 
         /* TODO: Should we restore it? Or store it in global PHY info? */
+        b43_phy_ht_classifier(dev, 0, 0);
         b43_phy_ht_read_clip_detection(dev, clip_state);
 
         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
@@ -462,6 +941,13 @@ static int b43_phy_ht_op_init(struct b43_wldev *dev)
         b43_httab_write_bulk(dev, B43_HTTAB32(0x1a, 0xc0),
                         B43_HTTAB_1A_C0_LATE_SIZE, b43_httab_0x1a_0xc0_late);
 
+        saved_tx_pwr_ctl = phy_ht->tx_pwr_ctl;
+        b43_phy_ht_tx_power_fix(dev);
+        b43_phy_ht_tx_power_ctl(dev, false);
+        b43_phy_ht_tx_power_ctl_idle_tssi(dev);
+        b43_phy_ht_tx_power_ctl_setup(dev);
+        b43_phy_ht_tx_power_ctl(dev, saved_tx_pwr_ctl);
+
         return 0;
 }
 
@@ -506,19 +992,19 @@ static void b43_phy_ht_op_software_rfkill(struct b43_wldev *dev,
 static void b43_phy_ht_op_switch_analog(struct b43_wldev *dev, bool on)
 {
         if (on) {
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL2, 0x00cd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL1, 0x0000);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL4, 0x00cd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL3, 0x0000);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL6, 0x00cd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL5, 0x0000);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C1, 0x00cd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C1_OVER, 0x0000);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C2, 0x00cd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C2_OVER, 0x0000);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C3, 0x00cd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C3_OVER, 0x0000);
         } else {
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL1, 0x07ff);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL2, 0x00fd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL3, 0x07ff);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL4, 0x00fd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL5, 0x07ff);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL6, 0x00fd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C1_OVER, 0x07ff);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C1, 0x00fd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C2_OVER, 0x07ff);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C2, 0x00fd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C3_OVER, 0x07ff);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C3, 0x00fd);
         }
 }
 
diff --git a/drivers/net/wireless/b43/phy_ht.h b/drivers/net/wireless/b43/phy_ht.h
index 6544c4293b34..9b2408efb224 100644
--- a/drivers/net/wireless/b43/phy_ht.h
+++ b/drivers/net/wireless/b43/phy_ht.h
@@ -12,18 +12,60 @@
 #define B43_PHY_HT_TABLE_ADDR                   0x072 /* Table address */
 #define B43_PHY_HT_TABLE_DATALO                 0x073 /* Table data low */
 #define B43_PHY_HT_TABLE_DATAHI                 0x074 /* Table data high */
+#define B43_PHY_HT_CLASS_CTL                    0x0B0 /* Classifier control */
+#define  B43_PHY_HT_CLASS_CTL_CCK_EN            0x0001 /* CCK enable */
+#define  B43_PHY_HT_CLASS_CTL_OFDM_EN           0x0002 /* OFDM enable */
+#define  B43_PHY_HT_CLASS_CTL_WAITED_EN         0x0004 /* Waited enable */
+#define B43_PHY_HT_IQLOCAL_CMDGCTL              0x0C2   /* I/Q LO cal command G control */
+#define B43_PHY_HT_SAMP_CMD                     0x0C3   /* Sample command */
+#define  B43_PHY_HT_SAMP_CMD_STOP               0x0002  /* Stop */
+#define B43_PHY_HT_SAMP_LOOP_CNT                0x0C4   /* Sample loop count */
+#define B43_PHY_HT_SAMP_WAIT_CNT                0x0C5   /* Sample wait count */
+#define B43_PHY_HT_SAMP_DEP_CNT                 0x0C6   /* Sample depth count */
+#define B43_PHY_HT_SAMP_STAT                    0x0C7   /* Sample status */
+#define B43_PHY_HT_TSSIMODE                     0x122   /* TSSI mode */
+#define  B43_PHY_HT_TSSIMODE_EN                 0x0001  /* TSSI enable */
+#define  B43_PHY_HT_TSSIMODE_PDEN               0x0002  /* Power det enable */
 #define B43_PHY_HT_BW1                          0x1CE
 #define B43_PHY_HT_BW2                          0x1CF
 #define B43_PHY_HT_BW3                          0x1D0
 #define B43_PHY_HT_BW4                          0x1D1
 #define B43_PHY_HT_BW5                          0x1D2
 #define B43_PHY_HT_BW6                          0x1D3
+#define B43_PHY_HT_TXPCTL_CMD_C1                0x1E7   /* TX power control command */
+#define  B43_PHY_HT_TXPCTL_CMD_C1_INIT          0x007F  /* Init */
+#define  B43_PHY_HT_TXPCTL_CMD_C1_COEFF         0x2000  /* Power control coefficients */
+#define  B43_PHY_HT_TXPCTL_CMD_C1_HWPCTLEN      0x4000  /* Hardware TX power control enable */
+#define  B43_PHY_HT_TXPCTL_CMD_C1_PCTLEN        0x8000  /* TX power control enable */
+#define B43_PHY_HT_TXPCTL_N                     0x1E8   /* TX power control N num */
+#define  B43_PHY_HT_TXPCTL_N_TSSID              0x00FF  /* N TSSI delay */
+#define  B43_PHY_HT_TXPCTL_N_TSSID_SHIFT        0
+#define  B43_PHY_HT_TXPCTL_N_NPTIL2             0x0700  /* N PT integer log2 */
+#define  B43_PHY_HT_TXPCTL_N_NPTIL2_SHIFT       8
+#define B43_PHY_HT_TXPCTL_IDLE_TSSI             0x1E9   /* TX power control idle TSSI */
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_C1         0x003F
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_C1_SHIFT   0
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_C2         0x3F00
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_C2_SHIFT   8
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_BINF       0x8000  /* Raw TSSI offset bin format */
+#define B43_PHY_HT_TXPCTL_TARG_PWR              0x1EA   /* TX power control target power */
+#define  B43_PHY_HT_TXPCTL_TARG_PWR_C1          0x00FF  /* Power 0 */
+#define  B43_PHY_HT_TXPCTL_TARG_PWR_C1_SHIFT    0
+#define  B43_PHY_HT_TXPCTL_TARG_PWR_C2          0xFF00  /* Power 1 */
+#define  B43_PHY_HT_TXPCTL_TARG_PWR_C2_SHIFT    8
+#define B43_PHY_HT_TXPCTL_CMD_C2                0x222
+#define  B43_PHY_HT_TXPCTL_CMD_C2_INIT          0x007F
+#define B43_PHY_HT_RSSI_C1                      0x219
+#define B43_PHY_HT_RSSI_C2                      0x21A
+#define B43_PHY_HT_RSSI_C3                      0x21B
 
 #define B43_PHY_HT_C1_CLIP1THRES                B43_PHY_OFDM(0x00E)
 #define B43_PHY_HT_C2_CLIP1THRES                B43_PHY_OFDM(0x04E)
 #define B43_PHY_HT_C3_CLIP1THRES                B43_PHY_OFDM(0x08E)
 
 #define B43_PHY_HT_RF_SEQ_MODE                  B43_PHY_EXTG(0x000)
+#define  B43_PHY_HT_RF_SEQ_MODE_CA_OVER         0x0001  /* Core active override */
+#define  B43_PHY_HT_RF_SEQ_MODE_TR_OVER         0x0002  /* Trigger override */
 #define B43_PHY_HT_RF_SEQ_TRIG                  B43_PHY_EXTG(0x003)
 #define  B43_PHY_HT_RF_SEQ_TRIG_RX2TX           0x0001 /* RX2TX */
 #define  B43_PHY_HT_RF_SEQ_TRIG_TX2RX           0x0002 /* TX2RX */
@@ -36,12 +78,27 @@
 
 #define B43_PHY_HT_RF_CTL1                      B43_PHY_EXTG(0x010)
 
-#define B43_PHY_HT_AFE_CTL1                     B43_PHY_EXTG(0x110)
-#define B43_PHY_HT_AFE_CTL2                     B43_PHY_EXTG(0x111)
-#define B43_PHY_HT_AFE_CTL3                     B43_PHY_EXTG(0x114)
-#define B43_PHY_HT_AFE_CTL4                     B43_PHY_EXTG(0x115)
-#define B43_PHY_HT_AFE_CTL5                     B43_PHY_EXTG(0x118)
-#define B43_PHY_HT_AFE_CTL6                     B43_PHY_EXTG(0x119)
+#define B43_PHY_HT_RF_CTL_INT_C1                B43_PHY_EXTG(0x04c)
+#define B43_PHY_HT_RF_CTL_INT_C2                B43_PHY_EXTG(0x06c)
+#define B43_PHY_HT_RF_CTL_INT_C3                B43_PHY_EXTG(0x08c)
+
+#define B43_PHY_HT_AFE_C1_OVER                  B43_PHY_EXTG(0x110)
+#define B43_PHY_HT_AFE_C1                       B43_PHY_EXTG(0x111)
+#define B43_PHY_HT_AFE_C2_OVER                  B43_PHY_EXTG(0x114)
+#define B43_PHY_HT_AFE_C2                       B43_PHY_EXTG(0x115)
+#define B43_PHY_HT_AFE_C3_OVER                  B43_PHY_EXTG(0x118)
+#define B43_PHY_HT_AFE_C3                       B43_PHY_EXTG(0x119)
+
+#define B43_PHY_HT_TXPCTL_CMD_C3                B43_PHY_EXTG(0x164)
+#define  B43_PHY_HT_TXPCTL_CMD_C3_INIT          0x007F
+#define B43_PHY_HT_TXPCTL_IDLE_TSSI2            B43_PHY_EXTG(0x165)     /* TX power control idle TSSI */
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI2_C3        0x003F
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI2_C3_SHIFT  0
+#define B43_PHY_HT_TXPCTL_TARG_PWR2             B43_PHY_EXTG(0x166)     /* TX power control target power */
+#define  B43_PHY_HT_TXPCTL_TARG_PWR2_C3         0x00FF
+#define  B43_PHY_HT_TXPCTL_TARG_PWR2_C3_SHIFT   0
+
+#define B43_PHY_HT_TEST                         B43_PHY_N_BMODE(0x00A)
 
 
 /* Values for PHY registers used on channel switching */
@@ -56,6 +113,14 @@ struct b43_phy_ht_channeltab_e_phy {
 
 
 struct b43_phy_ht {
+        u16 rf_ctl_int_save[3];
+
+        bool tx_pwr_ctl;
+        u8 tx_pwr_idx[3];
+
+        s32 bb_mult_save[3];
+
+        u8 idle_tssi[3];
 };
 
 
diff --git a/drivers/net/wireless/b43/phy_lp.c b/drivers/net/wireless/b43/phy_lp.c
index 3ae28561f7a4..5ed352ddae9e 100644
--- a/drivers/net/wireless/b43/phy_lp.c
+++ b/drivers/net/wireless/b43/phy_lp.c
@@ -104,14 +104,8 @@ static void lpphy_read_band_sprom(struct b43_wldev *dev)
                 maxpwr = sprom->maxpwr_bg;
                 lpphy->max_tx_pwr_med_band = maxpwr;
                 cckpo = sprom->cck2gpo;
-                /*
-                 * We don't read SPROM's opo as specs say. On rev8 SPROMs
-                 * opo == ofdm2gpo and we don't know any SSB with LP-PHY
-                 * and SPROM rev below 8.
-                 */
-                B43_WARN_ON(sprom->revision < 8);
-                ofdmpo = sprom->ofdm2gpo;
                 if (cckpo) {
+                        ofdmpo = sprom->ofdm2gpo;
                         for (i = 0; i < 4; i++) {
                                 lpphy->tx_max_rate[i] =
                                         maxpwr - (ofdmpo & 0xF) * 2;
@@ -124,11 +118,11 @@ static void lpphy_read_band_sprom(struct b43_wldev *dev)
                                 ofdmpo >>= 4;
                         }
                 } else {
-                        ofdmpo &= 0xFF;
+                        u8 opo = sprom->opo;
                         for (i = 0; i < 4; i++)
                                 lpphy->tx_max_rate[i] = maxpwr;
                         for (i = 4; i < 15; i++)
-                                lpphy->tx_max_rate[i] = maxpwr - ofdmpo;
+                                lpphy->tx_max_rate[i] = maxpwr - opo;
                 }
         } else { /* 5GHz */
                 lpphy->tx_isolation_low_band = sprom->tri5gl;
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 949a3bdeede9..e05dd117f215 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -1564,7 +1564,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
         u16 clip_off[2] = { 0xFFFF, 0xFFFF };
 
         u8 vcm_final = 0;
-        s8 offset[4];
+        s32 offset[4];
         s32 results[8][4] = { };
         s32 results_min[4] = { };
         s32 poll_results[4] = { };
@@ -1615,7 +1615,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
                 }
                 for (i = 0; i < 4; i += 2) {
                         s32 curr;
-                        s32 mind = 40;
+                        s32 mind = 0x100000;
                         s32 minpoll = 249;
                         u8 minvcm = 0;
                         if (2 * core != i)
@@ -1732,7 +1732,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
         u8 regs_save_radio[2];
         u16 regs_save_phy[2];
 
-        s8 offset[4];
+        s32 offset[4];
         u8 core;
         u8 rail;
 
@@ -1799,7 +1799,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
         }
 
         for (i = 0; i < 4; i++) {
-                s32 mind = 40;
+                s32 mind = 0x100000;
                 u8 minvcm = 0;
                 s32 minpoll = 249;
                 s32 curr;
@@ -2789,10 +2789,6 @@ static void b43_nphy_iq_cal_gain_params(struct b43_wldev *dev, u16 core,
  * Tx and Rx
  **************************************************/
 
-void b43_nphy_set_rxantenna(struct b43_wldev *dev, int antenna)
-{//TODO
-}
-
 static void b43_nphy_op_adjust_txpower(struct b43_wldev *dev)
 {//TODO
 }
@@ -4892,7 +4888,7 @@ static void b43_nphy_superswitch_init(struct b43_wldev *dev, bool init)
 }
 
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/Init/N */
-int b43_phy_initn(struct b43_wldev *dev)
+static int b43_phy_initn(struct b43_wldev *dev)
 {
         struct ssb_sprom *sprom = dev->dev->bus_sprom;
         struct b43_phy *phy = &dev->phy;
@@ -5104,63 +5100,11 @@ static void b43_chantab_phy_upload(struct b43_wldev *dev,
 /* http://bcm-v4.sipsolutions.net/802.11/PmuSpurAvoid */
 static void b43_nphy_pmu_spur_avoid(struct b43_wldev *dev, bool avoid)
 {
-        struct bcma_drv_cc __maybe_unused *cc;
-        u32 __maybe_unused pmu_ctl;
-
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
         case B43_BUS_BCMA:
-                cc = &dev->dev->bdev->bus->drv_cc;
-                if (dev->dev->chip_id == 43224 || dev->dev->chip_id == 43225) {
-                        if (avoid) {
-                                bcma_chipco_pll_write(cc, 0x0, 0x11500010);
-                                bcma_chipco_pll_write(cc, 0x1, 0x000C0C06);
-                                bcma_chipco_pll_write(cc, 0x2, 0x0F600a08);
-                                bcma_chipco_pll_write(cc, 0x3, 0x00000000);
-                                bcma_chipco_pll_write(cc, 0x4, 0x2001E920);
-                                bcma_chipco_pll_write(cc, 0x5, 0x88888815);
-                        } else {
-                                bcma_chipco_pll_write(cc, 0x0, 0x11100010);
-                                bcma_chipco_pll_write(cc, 0x1, 0x000c0c06);
-                                bcma_chipco_pll_write(cc, 0x2, 0x03000a08);
-                                bcma_chipco_pll_write(cc, 0x3, 0x00000000);
-                                bcma_chipco_pll_write(cc, 0x4, 0x200005c0);
-                                bcma_chipco_pll_write(cc, 0x5, 0x88888815);
-                        }
-                        pmu_ctl = BCMA_CC_PMU_CTL_PLL_UPD;
-                } else if (dev->dev->chip_id == 0x4716) {
-                        if (avoid) {
-                                bcma_chipco_pll_write(cc, 0x0, 0x11500060);
-                                bcma_chipco_pll_write(cc, 0x1, 0x080C0C06);
-                                bcma_chipco_pll_write(cc, 0x2, 0x0F600000);
-                                bcma_chipco_pll_write(cc, 0x3, 0x00000000);
-                                bcma_chipco_pll_write(cc, 0x4, 0x2001E924);
-                                bcma_chipco_pll_write(cc, 0x5, 0x88888815);
-                        } else {
-                                bcma_chipco_pll_write(cc, 0x0, 0x11100060);
-                                bcma_chipco_pll_write(cc, 0x1, 0x080c0c06);
-                                bcma_chipco_pll_write(cc, 0x2, 0x03000000);
-                                bcma_chipco_pll_write(cc, 0x3, 0x00000000);
-                                bcma_chipco_pll_write(cc, 0x4, 0x200005c0);
-                                bcma_chipco_pll_write(cc, 0x5, 0x88888815);
-                        }
-                        pmu_ctl = BCMA_CC_PMU_CTL_PLL_UPD |
-                                  BCMA_CC_PMU_CTL_NOILPONW;
-                } else if (dev->dev->chip_id == 0x4322 ||
-                           dev->dev->chip_id == 0x4340 ||
-                           dev->dev->chip_id == 0x4341) {
-                        bcma_chipco_pll_write(cc, 0x0, 0x11100070);
-                        bcma_chipco_pll_write(cc, 0x1, 0x1014140a);
-                        bcma_chipco_pll_write(cc, 0x5, 0x88888854);
-                        if (avoid)
-                                bcma_chipco_pll_write(cc, 0x2, 0x05201828);
-                        else
-                                bcma_chipco_pll_write(cc, 0x2, 0x05001828);
-                        pmu_ctl = BCMA_CC_PMU_CTL_PLL_UPD;
-                } else {
-                        return;
-                }
-                bcma_cc_set32(cc, BCMA_CC_PMU_CTL, pmu_ctl);
+                bcma_pmu_spuravoid_pllupdate(&dev->dev->bdev->bus->drv_cc,
+                                             avoid);
                 break;
 #endif
 #ifdef CONFIG_B43_SSB
diff --git a/drivers/net/wireless/b43/radio_2056.c b/drivers/net/wireless/b43/radio_2056.c
index ce037fb6789a..b4fd9345d673 100644
--- a/drivers/net/wireless/b43/radio_2056.c
+++ b/drivers/net/wireless/b43/radio_2056.c
@@ -2980,7 +2980,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev8_rx[] = {
         .rx             = prefix##_rx,                  \
         .rx_length      = ARRAY_SIZE(prefix##_rx)
 
-struct b2056_inittabs_pts b2056_inittabs[] = {
+static const struct b2056_inittabs_pts b2056_inittabs[] = {
         [3] = { INITTABSPTS(b2056_inittab_rev3) },
         [4] = { INITTABSPTS(b2056_inittab_rev4) },
         [5] = { INITTABSPTS(b2056_inittab_rev5) },
@@ -9035,7 +9035,7 @@ static void b2056_upload_inittab(struct b43_wldev *dev, bool ghz5,
 void b2056_upload_inittabs(struct b43_wldev *dev,
                            bool ghz5, bool ignore_uploadflag)
 {
-        struct b2056_inittabs_pts *pts;
+        const struct b2056_inittabs_pts *pts;
 
         if (dev->phy.rev >= ARRAY_SIZE(b2056_inittabs)) {
                 B43_WARN_ON(1);
@@ -9057,7 +9057,7 @@ void b2056_upload_inittabs(struct b43_wldev *dev,
 
 void b2056_upload_syn_pll_cp2(struct b43_wldev *dev, bool ghz5)
 {
-        struct b2056_inittabs_pts *pts;
+        const struct b2056_inittabs_pts *pts;
         const struct b2056_inittab_entry *e;
 
         if (dev->phy.rev >= ARRAY_SIZE(b2056_inittabs)) {
diff --git a/drivers/net/wireless/b43/sdio.h b/drivers/net/wireless/b43/sdio.h
index fb633094403a..1e93926f388f 100644
--- a/drivers/net/wireless/b43/sdio.h
+++ b/drivers/net/wireless/b43/sdio.h
@@ -25,12 +25,12 @@ void b43_sdio_exit(void);
 #else /* CONFIG_B43_SDIO */
 
 
-int b43_sdio_request_irq(struct b43_wldev *dev,
+static inline int b43_sdio_request_irq(struct b43_wldev *dev,
                          void (*handler)(struct b43_wldev *dev))
 {
         return -ENODEV;
 }
-void b43_sdio_free_irq(struct b43_wldev *dev)
+static inline void b43_sdio_free_irq(struct b43_wldev *dev)
 {
 }
 static inline int b43_sdio_init(void)
diff --git a/drivers/net/wireless/b43/tables_nphy.c b/drivers/net/wireless/b43/tables_nphy.c
index aaca60c6f575..110510d53958 100644
--- a/drivers/net/wireless/b43/tables_nphy.c
+++ b/drivers/net/wireless/b43/tables_nphy.c
@@ -2800,7 +2800,7 @@ static const struct nphy_rf_control_override_rev7
         { 0x0010, 0x344, 0x345, 0x0010, 4 },
 };
 
-struct nphy_gain_ctl_workaround_entry nphy_gain_ctl_wa_phy6_radio11_ghz2 = {
+static struct nphy_gain_ctl_workaround_entry nphy_gain_ctl_wa_phy6_radio11_ghz2 = {
         { 10, 14, 19, 27 },
         { -5, 6, 10, 15 },
         { 0xA, 0xA, 0xA, 0xA, 0xA, 0xA, 0xA, 0xA, 0xA, 0xA },
@@ -2811,7 +2811,7 @@ struct nphy_gain_ctl_workaround_entry nphy_gain_ctl_wa_phy6_radio11_ghz2 = {
         0x18, 0x18, 0x18,
         0x01D0, 0x5,
 };
-struct nphy_gain_ctl_workaround_entry nphy_gain_ctl_workaround[2][4] = {
+static struct nphy_gain_ctl_workaround_entry nphy_gain_ctl_workaround[2][4] = {
         { /* 2GHz */
                 { /* PHY rev 3 */
                         { 7, 11, 16, 23 },
diff --git a/drivers/net/wireless/b43/tables_phy_lcn.c b/drivers/net/wireless/b43/tables_phy_lcn.c
index 5176363cadf2..e347b8d80ea4 100644
--- a/drivers/net/wireless/b43/tables_phy_lcn.c
+++ b/drivers/net/wireless/b43/tables_phy_lcn.c
@@ -313,7 +313,7 @@ static const u32 b43_lcntab_0x18[] = {
  * TX gain.
  **************************************************/
 
-const struct b43_lcntab_tx_gain_tbl_entry
+static const struct b43_lcntab_tx_gain_tbl_entry
         b43_lcntab_tx_gain_tbl_2ghz_ext_pa_rev0[B43_LCNTAB_TX_GAIN_SIZE] = {
         { 0x03, 0x00, 0x1f, 0x0, 0x48 },
         { 0x03, 0x00, 0x1f, 0x0, 0x46 },
@@ -449,7 +449,7 @@ const struct b43_lcntab_tx_gain_tbl_entry
  * SW control.
  **************************************************/
 
-const u16 b43_lcntab_sw_ctl_4313_epa_rev0[] = {
+static const u16 b43_lcntab_sw_ctl_4313_epa_rev0[] = {
         0x0002, 0x0008, 0x0004, 0x0001, 0x0002, 0x0008,
         0x0004, 0x0001, 0x0002, 0x0008, 0x0004, 0x0001,
         0x0002, 0x0008, 0x0004, 0x0001, 0x0002, 0x0008,
@@ -631,7 +631,7 @@ static void b43_phy_lcn_upload_static_tables(struct b43_wldev *dev)
         lcntab_upload(dev, B43_LCNTAB32(0x18, 0), b43_lcntab_0x18);
 }
 
-void b43_phy_lcn_load_tx_gain_tab(struct b43_wldev *dev,
+static void b43_phy_lcn_load_tx_gain_tab(struct b43_wldev *dev,
                         const struct b43_lcntab_tx_gain_tbl_entry *gain_table)
 {
         u32 i;
diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
index 1d92d874ebb6..fc8a0fa6d3b2 100644
--- a/drivers/net/wireless/brcm80211/Kconfig
+++ b/drivers/net/wireless/brcm80211/Kconfig
@@ -12,8 +12,9 @@ config BRCMSMAC
         select CORDIC
         ---help---
           This module adds support for PCIe wireless adapters based on Broadcom
-          IEEE802.11n SoftMAC chipsets.  If you choose to build a module, it'll
-          be called brcmsmac.ko.
+          IEEE802.11n SoftMAC chipsets. It also has WLAN led support, which will
+          be available if you select BCMA_DRIVER_GPIO. If you choose to build a
+          module, the driver will be called brcmsmac.ko.
 
 config BRCMFMAC
         tristate "Broadcom IEEE802.11n embedded FullMAC WLAN driver"
@@ -36,15 +37,6 @@ config BRCMFMAC_SDIO
           IEEE802.11n embedded FullMAC WLAN driver. Say Y if you want to
           use the driver for a SDIO wireless card.
 
-config BRCMFMAC_SDIO_OOB
-        bool "Out of band interrupt support for SDIO interface chipset"
-        depends on BRCMFMAC_SDIO
-        ---help---
-          This option enables out-of-band interrupt support for Broadcom
-          SDIO Wifi chipset using fullmac in order to gain better
-          performance and deep sleep wake up capability on certain
-          platforms. Say N if you are unsure.
-
 config BRCMFMAC_USB
         bool "USB bus interface support for FullMAC driver"
         depends on USB
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
index 756e19fc2795..598c8e2f8d2b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
@@ -26,6 +26,7 @@ brcmfmac-objs += \
                 wl_cfg80211.o \
                 fwil.o \
                 fweh.o \
+                fwsignal.o \
                 p2p.o \
                 dhd_cdc.o \
                 dhd_common.o \
@@ -39,3 +40,5 @@ brcmfmac-$(CONFIG_BRCMFMAC_USB) += \
                 usb.o
 brcmfmac-$(CONFIG_BRCMDBG) += \
                 dhd_dbg.o
+brcmfmac-$(CONFIG_BRCM_TRACING) += \
+                tracepoint.o
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 11fd1c735589..4891e3df2058 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -25,6 +25,7 @@
 #include <linux/mmc/sdio.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/card.h>
+#include <linux/platform_data/brcmfmac-sdio.h>
 
 #include <defs.h>
 #include <brcm_hw_ids.h>
@@ -37,16 +38,15 @@
 
 #define SDIOH_API_ACCESS_RETRY_LIMIT    2
 
-#ifdef CONFIG_BRCMFMAC_SDIO_OOB
-static irqreturn_t brcmf_sdio_irqhandler(int irq, void *dev_id)
+
+static irqreturn_t brcmf_sdio_oob_irqhandler(int irq, void *dev_id)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev_id);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
 
-        brcmf_dbg(INTR, "oob intr triggered\n");
+        brcmf_dbg(INTR, "OOB intr triggered\n");
 
-        /*
-         * out-of-band interrupt is level-triggered which won't
+        /* out-of-band interrupt is level-triggered which won't
          * be cleared until dpc
          */
         if (sdiodev->irq_en) {
@@ -59,72 +59,12 @@ static irqreturn_t brcmf_sdio_irqhandler(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
-{
-        int ret = 0;
-        u8 data;
-        unsigned long flags;
-
-        brcmf_dbg(TRACE, "Entering: irq %d\n", sdiodev->irq);
-
-        ret = request_irq(sdiodev->irq, brcmf_sdio_irqhandler,
-                          sdiodev->irq_flags, "brcmf_oob_intr",
-                          &sdiodev->func[1]->dev);
-        if (ret != 0)
-                return ret;
-        spin_lock_init(&sdiodev->irq_en_lock);
-        spin_lock_irqsave(&sdiodev->irq_en_lock, flags);
-        sdiodev->irq_en = true;
-        spin_unlock_irqrestore(&sdiodev->irq_en_lock, flags);
-
-        ret = enable_irq_wake(sdiodev->irq);
-        if (ret != 0)
-                return ret;
-        sdiodev->irq_wake = true;
-
-        sdio_claim_host(sdiodev->func[1]);
-
-        /* must configure SDIO_CCCR_IENx to enable irq */
-        data = brcmf_sdio_regrb(sdiodev, SDIO_CCCR_IENx, &ret);
-        data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
-        brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
-
-        /* redirect, configure and enable io for interrupt signal */
-        data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
-        if (sdiodev->irq_flags & IRQF_TRIGGER_HIGH)
-                data |= SDIO_SEPINT_ACT_HI;
-        brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
-
-        sdio_release_host(sdiodev->func[1]);
-
-        return 0;
-}
-
-int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev)
-{
-        brcmf_dbg(TRACE, "Entering\n");
-
-        sdio_claim_host(sdiodev->func[1]);
-        brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
-        brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
-        sdio_release_host(sdiodev->func[1]);
-
-        if (sdiodev->irq_wake) {
-                disable_irq_wake(sdiodev->irq);
-                sdiodev->irq_wake = false;
-        }
-        free_irq(sdiodev->irq, &sdiodev->func[1]->dev);
-        sdiodev->irq_en = false;
-
-        return 0;
-}
-#else           /* CONFIG_BRCMFMAC_SDIO_OOB */
-static void brcmf_sdio_irqhandler(struct sdio_func *func)
+static void brcmf_sdio_ib_irqhandler(struct sdio_func *func)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(&func->dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
 
-        brcmf_dbg(INTR, "ib intr triggered\n");
+        brcmf_dbg(INTR, "IB intr triggered\n");
 
         brcmf_sdbrcm_isr(sdiodev->bus);
 }
@@ -136,28 +76,89 @@ static void brcmf_sdio_dummy_irqhandler(struct sdio_func *func)
 
 int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
 {
-        brcmf_dbg(TRACE, "Entering\n");
+        int ret = 0;
+        u8 data;
+        unsigned long flags;
 
-        sdio_claim_host(sdiodev->func[1]);
-        sdio_claim_irq(sdiodev->func[1], brcmf_sdio_irqhandler);
-        sdio_claim_irq(sdiodev->func[2], brcmf_sdio_dummy_irqhandler);
-        sdio_release_host(sdiodev->func[1]);
+        if ((sdiodev->pdata) && (sdiodev->pdata->oob_irq_supported)) {
+                brcmf_dbg(SDIO, "Enter, register OOB IRQ %d\n",
+                          sdiodev->pdata->oob_irq_nr);
+                ret = request_irq(sdiodev->pdata->oob_irq_nr,
+                                  brcmf_sdio_oob_irqhandler,
+                                  sdiodev->pdata->oob_irq_flags,
+                                  "brcmf_oob_intr",
+                                  &sdiodev->func[1]->dev);
+                if (ret != 0) {
+                        brcmf_err("request_irq failed %d\n", ret);
+                        return ret;
+                }
+                sdiodev->oob_irq_requested = true;
+                spin_lock_init(&sdiodev->irq_en_lock);
+                spin_lock_irqsave(&sdiodev->irq_en_lock, flags);
+                sdiodev->irq_en = true;
+                spin_unlock_irqrestore(&sdiodev->irq_en_lock, flags);
+
+                ret = enable_irq_wake(sdiodev->pdata->oob_irq_nr);
+                if (ret != 0) {
+                        brcmf_err("enable_irq_wake failed %d\n", ret);
+                        return ret;
+                }
+                sdiodev->irq_wake = true;
+
+                sdio_claim_host(sdiodev->func[1]);
+
+                /* must configure SDIO_CCCR_IENx to enable irq */
+                data = brcmf_sdio_regrb(sdiodev, SDIO_CCCR_IENx, &ret);
+                data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
+                brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
+
+                /* redirect, configure and enable io for interrupt signal */
+                data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
+                if (sdiodev->pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
+                        data |= SDIO_SEPINT_ACT_HI;
+                brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
+
+                sdio_release_host(sdiodev->func[1]);
+        } else {
+                brcmf_dbg(SDIO, "Entering\n");
+                sdio_claim_host(sdiodev->func[1]);
+                sdio_claim_irq(sdiodev->func[1], brcmf_sdio_ib_irqhandler);
+                sdio_claim_irq(sdiodev->func[2], brcmf_sdio_dummy_irqhandler);
+                sdio_release_host(sdiodev->func[1]);
+        }
 
         return 0;
 }
 
 int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev)
 {
-        brcmf_dbg(TRACE, "Entering\n");
-
-        sdio_claim_host(sdiodev->func[1]);
-        sdio_release_irq(sdiodev->func[2]);
-        sdio_release_irq(sdiodev->func[1]);
-        sdio_release_host(sdiodev->func[1]);
+        brcmf_dbg(SDIO, "Entering\n");
+
+        if ((sdiodev->pdata) && (sdiodev->pdata->oob_irq_supported)) {
+                sdio_claim_host(sdiodev->func[1]);
+                brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
+                brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
+                sdio_release_host(sdiodev->func[1]);
+
+                if (sdiodev->oob_irq_requested) {
+                        sdiodev->oob_irq_requested = false;
+                        if (sdiodev->irq_wake) {
+                                disable_irq_wake(sdiodev->pdata->oob_irq_nr);
+                                sdiodev->irq_wake = false;
+                        }
+                        free_irq(sdiodev->pdata->oob_irq_nr,
+                                 &sdiodev->func[1]->dev);
+                        sdiodev->irq_en = false;
+                }
+        } else {
+                sdio_claim_host(sdiodev->func[1]);
+                sdio_release_irq(sdiodev->func[2]);
+                sdio_release_irq(sdiodev->func[1]);
+                sdio_release_host(sdiodev->func[1]);
+        }
 
         return 0;
 }
-#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
 
 int
 brcmf_sdcard_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
@@ -253,9 +254,9 @@ u8 brcmf_sdio_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
         u8 data;
         int retval;
 
-        brcmf_dbg(INFO, "addr:0x%08x\n", addr);
+        brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
         retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, false);
-        brcmf_dbg(INFO, "data:0x%02x\n", data);
+        brcmf_dbg(SDIO, "data:0x%02x\n", data);
 
         if (ret)
                 *ret = retval;
@@ -268,9 +269,9 @@ u32 brcmf_sdio_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
         u32 data;
         int retval;
 
-        brcmf_dbg(INFO, "addr:0x%08x\n", addr);
+        brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
         retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, false);
-        brcmf_dbg(INFO, "data:0x%08x\n", data);
+        brcmf_dbg(SDIO, "data:0x%08x\n", data);
 
         if (ret)
                 *ret = retval;
@@ -283,7 +284,7 @@ void brcmf_sdio_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
 {
         int retval;
 
-        brcmf_dbg(INFO, "addr:0x%08x, data:0x%02x\n", addr, data);
+        brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
         retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, true);
 
         if (ret)
@@ -295,7 +296,7 @@ void brcmf_sdio_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
 {
         int retval;
 
-        brcmf_dbg(INFO, "addr:0x%08x, data:0x%08x\n", addr, data);
+        brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
         retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, true);
 
         if (ret)
@@ -358,7 +359,7 @@ brcmf_sdcard_recv_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
         uint width;
         int err = 0;
 
-        brcmf_dbg(INFO, "fun = %d, addr = 0x%x, size = %d\n",
+        brcmf_dbg(SDIO, "fun = %d, addr = 0x%x, size = %d\n",
                   fn, addr, pkt->len);
 
         width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
@@ -381,7 +382,7 @@ int brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
         uint width;
         int err = 0;
 
-        brcmf_dbg(INFO, "fun = %d, addr = 0x%x, size = %d\n",
+        brcmf_dbg(SDIO, "fun = %d, addr = 0x%x, size = %d\n",
                   fn, addr, pktq->qlen);
 
         width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
@@ -428,7 +429,7 @@ brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
         uint bar0 = addr & ~SBSDIO_SB_OFT_ADDR_MASK;
         int err = 0;
 
-        brcmf_dbg(INFO, "fun = %d, addr = 0x%x, size = %d\n",
+        brcmf_dbg(SDIO, "fun = %d, addr = 0x%x, size = %d\n",
                   fn, addr, pkt->len);
 
         /* Async not implemented yet */
@@ -457,48 +458,92 @@ done:
         return err;
 }
 
-int brcmf_sdcard_rwdata(struct brcmf_sdio_dev *sdiodev, uint rw, u32 addr,
-                        u8 *buf, uint nbytes)
+int
+brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
+                 u8 *data, uint size)
 {
-        struct sk_buff *mypkt;
-        bool write = rw ? SDIOH_WRITE : SDIOH_READ;
-        int err;
+        int bcmerror = 0;
+        struct sk_buff *pkt;
+        u32 sdaddr;
+        uint dsize;
+
+        dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
+        pkt = dev_alloc_skb(dsize);
+        if (!pkt) {
+                brcmf_err("dev_alloc_skb failed: len %d\n", dsize);
+                return -EIO;
+        }
+        pkt->priority = 0;
 
-        addr &= SBSDIO_SB_OFT_ADDR_MASK;
-        addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+        /* Determine initial transfer parameters */
+        sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
+        if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
+                dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
+        else
+                dsize = size;
 
-        mypkt = brcmu_pkt_buf_get_skb(nbytes);
-        if (!mypkt) {
-                brcmf_err("brcmu_pkt_buf_get_skb failed: len %d\n",
-                          nbytes);
-                return -EIO;
+        sdio_claim_host(sdiodev->func[1]);
+
+        /* Do the transfer(s) */
+        while (size) {
+                /* Set the backplane window to include the start address */
+                bcmerror = brcmf_sdcard_set_sbaddr_window(sdiodev, address);
+                if (bcmerror)
+                        break;
+
+                brcmf_dbg(SDIO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
+                          write ? "write" : "read", dsize,
+                          sdaddr, address & SBSDIO_SBWINDOW_MASK);
+
+                sdaddr &= SBSDIO_SB_OFT_ADDR_MASK;
+                sdaddr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+                skb_put(pkt, dsize);
+                if (write)
+                        memcpy(pkt->data, data, dsize);
+                bcmerror = brcmf_sdioh_request_buffer(sdiodev, SDIOH_DATA_INC,
+                                                      write, SDIO_FUNC_1,
+                                                      sdaddr, pkt);
+                if (bcmerror) {
+                        brcmf_err("membytes transfer failed\n");
+                        break;
+                }
+                if (!write)
+                        memcpy(data, pkt->data, dsize);
+                skb_trim(pkt, dsize);
+
+                /* Adjust for next transfer (if any) */
+                size -= dsize;
+                if (size) {
+                        data += dsize;
+                        address += dsize;
+                        sdaddr = 0;
+                        dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
+                }
         }
 
-        /* For a write, copy the buffer data into the packet. */
-        if (write)
-                memcpy(mypkt->data, buf, nbytes);
+        dev_kfree_skb(pkt);
 
-        err = brcmf_sdioh_request_buffer(sdiodev, SDIOH_DATA_INC, write,
-                                         SDIO_FUNC_1, addr, mypkt);
+        /* Return the window to backplane enumeration space for core access */
+        if (brcmf_sdcard_set_sbaddr_window(sdiodev, sdiodev->sbwad))
+                brcmf_err("FAILED to set window back to 0x%x\n",
+                          sdiodev->sbwad);
 
-        /* For a read, copy the packet data back to the buffer. */
-        if (!err && !write)
-                memcpy(buf, mypkt->data, nbytes);
+        sdio_release_host(sdiodev->func[1]);
 
-        brcmu_pkt_buf_free_skb(mypkt);
-        return err;
+        return bcmerror;
 }
 
 int brcmf_sdcard_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
 {
         char t_func = (char)fn;
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
 
         /* issue abort cmd52 command through F0 */
         brcmf_sdioh_request_byte(sdiodev, SDIOH_WRITE, SDIO_FUNC_0,
                                  SDIO_CCCR_ABORT, &t_func);
 
-        brcmf_dbg(TRACE, "Exit\n");
+        brcmf_dbg(SDIO, "Exit\n");
         return 0;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index d92d373733d7..44fa0cdbf97b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -26,6 +26,7 @@
 #include <linux/sched.h>        /* request_irq() */
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/platform_data/brcmfmac-sdio.h>
 #include <net/cfg80211.h>
 
 #include <defs.h>
@@ -40,32 +41,30 @@
 
 #define DMA_ALIGN_MASK  0x03
 
+#define SDIO_DEVICE_ID_BROADCOM_43143   43143
 #define SDIO_DEVICE_ID_BROADCOM_43241   0x4324
 #define SDIO_DEVICE_ID_BROADCOM_4329    0x4329
 #define SDIO_DEVICE_ID_BROADCOM_4330    0x4330
 #define SDIO_DEVICE_ID_BROADCOM_4334    0x4334
+#define SDIO_DEVICE_ID_BROADCOM_4335    0x4335
 
 #define SDIO_FUNC1_BLOCKSIZE            64
 #define SDIO_FUNC2_BLOCKSIZE            512
 
 /* devices we support, null terminated */
 static const struct sdio_device_id brcmf_sdmmc_ids[] = {
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43143)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43241)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4334)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4335)},
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
 
-#ifdef CONFIG_BRCMFMAC_SDIO_OOB
-static struct list_head oobirq_lh;
-struct brcmf_sdio_oobirq {
-        unsigned int irq;
-        unsigned long flags;
-        struct list_head list;
-};
-#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
+static struct brcmfmac_sdio_platform_data *brcmfmac_sdio_pdata;
+
 
 static bool
 brcmf_pm_resume_error(struct brcmf_sdio_dev *sdiodev)
@@ -139,7 +138,7 @@ int brcmf_sdioh_request_byte(struct brcmf_sdio_dev *sdiodev, uint rw, uint func,
 {
         int err_ret;
 
-        brcmf_dbg(INFO, "rw=%d, func=%d, addr=0x%05x\n", rw, func, regaddr);
+        brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x\n", rw, func, regaddr);
 
         brcmf_pm_resume_wait(sdiodev, &sdiodev->request_byte_wait);
         if (brcmf_pm_resume_error(sdiodev))
@@ -179,7 +178,7 @@ int brcmf_sdioh_request_word(struct brcmf_sdio_dev *sdiodev,
                 return -EINVAL;
         }
 
-        brcmf_dbg(INFO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+        brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
                   rw, func, addr, nbytes);
 
         brcmf_pm_resume_wait(sdiodev, &sdiodev->request_word_wait);
@@ -252,7 +251,7 @@ brcmf_sdioh_request_chain(struct brcmf_sdio_dev *sdiodev, uint fix_inc,
 
         struct sk_buff *pkt;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
 
         brcmf_pm_resume_wait(sdiodev, &sdiodev->request_chain_wait);
         if (brcmf_pm_resume_error(sdiodev))
@@ -270,7 +269,7 @@ brcmf_sdioh_request_chain(struct brcmf_sdio_dev *sdiodev, uint fix_inc,
                                   write ? "TX" : "RX", pkt, SGCount, addr,
                                   pkt_len, err_ret);
                 } else {
-                        brcmf_dbg(TRACE, "%s xfr'd %p[%d], addr=0x%05x, len=%d\n",
+                        brcmf_dbg(SDIO, "%s xfr'd %p[%d], addr=0x%05x, len=%d\n",
                                   write ? "TX" : "RX", pkt, SGCount, addr,
                                   pkt_len);
                 }
@@ -280,7 +279,7 @@ brcmf_sdioh_request_chain(struct brcmf_sdio_dev *sdiodev, uint fix_inc,
                 SGCount++;
         }
 
-        brcmf_dbg(TRACE, "Exit\n");
+        brcmf_dbg(SDIO, "Exit\n");
         return err_ret;
 }
 
@@ -295,7 +294,7 @@ int brcmf_sdioh_request_buffer(struct brcmf_sdio_dev *sdiodev,
         uint pkt_len;
         bool fifo = (fix_inc == SDIOH_DATA_FIX);
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
 
         if (pkt == NULL)
                 return -EINVAL;
@@ -314,7 +313,7 @@ int brcmf_sdioh_request_buffer(struct brcmf_sdio_dev *sdiodev,
                 brcmf_err("%s FAILED %p, addr=0x%05x, pkt_len=%d, ERR=0x%08x\n",
                           write ? "TX" : "RX", pkt, addr, pkt_len, status);
         } else {
-                brcmf_dbg(TRACE, "%s xfr'd %p, addr=0x%05x, len=%d\n",
+                brcmf_dbg(SDIO, "%s xfr'd %p, addr=0x%05x, len=%d\n",
                           write ? "TX" : "RX", pkt, addr, pkt_len);
         }
 
@@ -350,12 +349,12 @@ static int brcmf_sdioh_enablefuncs(struct brcmf_sdio_dev *sdiodev)
         u32 fbraddr;
         u8 func;
 
-        brcmf_dbg(TRACE, "\n");
+        brcmf_dbg(SDIO, "\n");
 
         /* Get the Card's common CIS address */
         sdiodev->func_cis_ptr[0] = brcmf_sdioh_get_cisaddr(sdiodev,
                                                            SDIO_CCCR_CIS);
-        brcmf_dbg(INFO, "Card's Common CIS Ptr = 0x%x\n",
+        brcmf_dbg(SDIO, "Card's Common CIS Ptr = 0x%x\n",
                   sdiodev->func_cis_ptr[0]);
 
         /* Get the Card's function CIS (for each function) */
@@ -363,7 +362,7 @@ static int brcmf_sdioh_enablefuncs(struct brcmf_sdio_dev *sdiodev)
              func <= sdiodev->num_funcs; func++, fbraddr += SDIOD_FBR_SIZE) {
                 sdiodev->func_cis_ptr[func] =
                     brcmf_sdioh_get_cisaddr(sdiodev, SDIO_FBR_CIS + fbraddr);
-                brcmf_dbg(INFO, "Function %d CIS Ptr = 0x%x\n",
+                brcmf_dbg(SDIO, "Function %d CIS Ptr = 0x%x\n",
                           func, sdiodev->func_cis_ptr[func]);
         }
 
@@ -382,7 +381,7 @@ int brcmf_sdioh_attach(struct brcmf_sdio_dev *sdiodev)
 {
         int err_ret = 0;
 
-        brcmf_dbg(TRACE, "\n");
+        brcmf_dbg(SDIO, "\n");
 
         sdiodev->num_funcs = 2;
 
@@ -404,13 +403,13 @@ int brcmf_sdioh_attach(struct brcmf_sdio_dev *sdiodev)
 
 out:
         sdio_release_host(sdiodev->func[1]);
-        brcmf_dbg(TRACE, "Done\n");
+        brcmf_dbg(SDIO, "Done\n");
         return err_ret;
 }
 
 void brcmf_sdioh_detach(struct brcmf_sdio_dev *sdiodev)
 {
-        brcmf_dbg(TRACE, "\n");
+        brcmf_dbg(SDIO, "\n");
 
         /* Disable Function 2 */
         sdio_claim_host(sdiodev->func[2]);
@@ -424,33 +423,6 @@ void brcmf_sdioh_detach(struct brcmf_sdio_dev *sdiodev)
 
 }
 
-#ifdef CONFIG_BRCMFMAC_SDIO_OOB
-static int brcmf_sdio_getintrcfg(struct brcmf_sdio_dev *sdiodev)
-{
-        struct brcmf_sdio_oobirq *oobirq_entry;
-
-        if (list_empty(&oobirq_lh)) {
-                brcmf_err("no valid oob irq resource\n");
-                return -ENXIO;
-        }
-
-        oobirq_entry = list_first_entry(&oobirq_lh, struct brcmf_sdio_oobirq,
-                                        list);
-
-        sdiodev->irq = oobirq_entry->irq;
-        sdiodev->irq_flags = oobirq_entry->flags;
-        list_del(&oobirq_entry->list);
-        kfree(oobirq_entry);
-
-        return 0;
-}
-#else
-static inline int brcmf_sdio_getintrcfg(struct brcmf_sdio_dev *sdiodev)
-{
-        return 0;
-}
-#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
-
 static int brcmf_ops_sdio_probe(struct sdio_func *func,
                                 const struct sdio_device_id *id)
 {
@@ -458,11 +430,11 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
         struct brcmf_sdio_dev *sdiodev;
         struct brcmf_bus *bus_if;
 
-        brcmf_dbg(TRACE, "Enter\n");
-        brcmf_dbg(TRACE, "Class=%x\n", func->class);
-        brcmf_dbg(TRACE, "sdio vendor ID: 0x%04x\n", func->vendor);
-        brcmf_dbg(TRACE, "sdio device ID: 0x%04x\n", func->device);
-        brcmf_dbg(TRACE, "Function#: %d\n", func->num);
+        brcmf_dbg(SDIO, "Enter\n");
+        brcmf_dbg(SDIO, "Class=%x\n", func->class);
+        brcmf_dbg(SDIO, "sdio vendor ID: 0x%04x\n", func->vendor);
+        brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
+        brcmf_dbg(SDIO, "Function#: %d\n", func->num);
 
         /* Consume func num 1 but dont do anything with it. */
         if (func->num == 1)
@@ -491,23 +463,21 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
         dev_set_drvdata(&func->dev, bus_if);
         dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
         sdiodev->dev = &sdiodev->func[1]->dev;
+        sdiodev->pdata = brcmfmac_sdio_pdata;
 
         atomic_set(&sdiodev->suspend, false);
         init_waitqueue_head(&sdiodev->request_byte_wait);
         init_waitqueue_head(&sdiodev->request_word_wait);
         init_waitqueue_head(&sdiodev->request_chain_wait);
         init_waitqueue_head(&sdiodev->request_buffer_wait);
-        err = brcmf_sdio_getintrcfg(sdiodev);
-        if (err)
-                goto fail;
 
-        brcmf_dbg(TRACE, "F2 found, calling brcmf_sdio_probe...\n");
+        brcmf_dbg(SDIO, "F2 found, calling brcmf_sdio_probe...\n");
         err = brcmf_sdio_probe(sdiodev);
         if (err) {
                 brcmf_err("F2 error, probe failed %d...\n", err);
                 goto fail;
         }
-        brcmf_dbg(TRACE, "F2 init completed...\n");
+        brcmf_dbg(SDIO, "F2 init completed...\n");
         return 0;
 
 fail:
@@ -523,10 +493,10 @@ static void brcmf_ops_sdio_remove(struct sdio_func *func)
         struct brcmf_bus *bus_if;
         struct brcmf_sdio_dev *sdiodev;
 
-        brcmf_dbg(TRACE, "Enter\n");
-        brcmf_dbg(TRACE, "sdio vendor ID: 0x%04x\n", func->vendor);
-        brcmf_dbg(TRACE, "sdio device ID: 0x%04x\n", func->device);
-        brcmf_dbg(TRACE, "Function: %d\n", func->num);
+        brcmf_dbg(SDIO, "Enter\n");
+        brcmf_dbg(SDIO, "sdio vendor ID: 0x%04x\n", func->vendor);
+        brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
+        brcmf_dbg(SDIO, "Function: %d\n", func->num);
 
         if (func->num != 1 && func->num != 2)
                 return;
@@ -543,7 +513,7 @@ static void brcmf_ops_sdio_remove(struct sdio_func *func)
                 kfree(sdiodev);
         }
 
-        brcmf_dbg(TRACE, "Exit\n");
+        brcmf_dbg(SDIO, "Exit\n");
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -554,7 +524,7 @@ static int brcmf_sdio_suspend(struct device *dev)
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
         int ret = 0;
 
-        brcmf_dbg(TRACE, "\n");
+        brcmf_dbg(SDIO, "\n");
 
         atomic_set(&sdiodev->suspend, true);
 
@@ -594,7 +564,7 @@ static const struct dev_pm_ops brcmf_sdio_pm_ops = {
 static struct sdio_driver brcmf_sdmmc_driver = {
         .probe = brcmf_ops_sdio_probe,
         .remove = brcmf_ops_sdio_remove,
-        .name = "brcmfmac",
+        .name = BRCMFMAC_SDIO_PDATA_NAME,
         .id_table = brcmf_sdmmc_ids,
 #ifdef CONFIG_PM_SLEEP
         .drv = {
@@ -603,83 +573,65 @@ static struct sdio_driver brcmf_sdmmc_driver = {
 #endif  /* CONFIG_PM_SLEEP */
 };
 
-#ifdef CONFIG_BRCMFMAC_SDIO_OOB
 static int brcmf_sdio_pd_probe(struct platform_device *pdev)
 {
-        struct resource *res;
-        struct brcmf_sdio_oobirq *oobirq_entry;
-        int i, ret;
+        int ret;
 
-        INIT_LIST_HEAD(&oobirq_lh);
+        brcmf_dbg(SDIO, "Enter\n");
 
-        for (i = 0; ; i++) {
-                res = platform_get_resource(pdev, IORESOURCE_IRQ, i);
-                if (!res)
-                        break;
+        brcmfmac_sdio_pdata = pdev->dev.platform_data;
 
-                oobirq_entry = kzalloc(sizeof(struct brcmf_sdio_oobirq),
-                                       GFP_KERNEL);
-                if (!oobirq_entry)
-                        return -ENOMEM;
-                oobirq_entry->irq = res->start;
-                oobirq_entry->flags = res->flags & IRQF_TRIGGER_MASK;
-                list_add_tail(&oobirq_entry->list, &oobirq_lh);
-        }
-        if (i == 0)
-                return -ENXIO;
+        if (brcmfmac_sdio_pdata->power_on)
+                brcmfmac_sdio_pdata->power_on();
 
         ret = sdio_register_driver(&brcmf_sdmmc_driver);
-
         if (ret)
                 brcmf_err("sdio_register_driver failed: %d\n", ret);
 
         return ret;
 }
 
-static struct platform_driver brcmf_sdio_pd = {
-        .probe          = brcmf_sdio_pd_probe,
-        .driver         = {
-                .name   = "brcmf_sdio_pd"
-        }
-};
-
-void brcmf_sdio_exit(void)
+static int brcmf_sdio_pd_remove(struct platform_device *pdev)
 {
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
+
+        if (brcmfmac_sdio_pdata->power_off)
+                brcmfmac_sdio_pdata->power_off();
 
         sdio_unregister_driver(&brcmf_sdmmc_driver);
 
-        platform_driver_unregister(&brcmf_sdio_pd);
+        return 0;
 }
 
-void brcmf_sdio_init(void)
-{
-        int ret;
-
-        brcmf_dbg(TRACE, "Enter\n");
-
-        ret = platform_driver_register(&brcmf_sdio_pd);
+static struct platform_driver brcmf_sdio_pd = {
+        .remove         = brcmf_sdio_pd_remove,
+        .driver         = {
+                .name   = BRCMFMAC_SDIO_PDATA_NAME
+        }
+};
 
-        if (ret)
-                brcmf_err("platform_driver_register failed: %d\n", ret);
-}
-#else
 void brcmf_sdio_exit(void)
 {
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
 
-        sdio_unregister_driver(&brcmf_sdmmc_driver);
+        if (brcmfmac_sdio_pdata)
+                platform_driver_unregister(&brcmf_sdio_pd);
+        else
+                sdio_unregister_driver(&brcmf_sdmmc_driver);
 }
 
 void brcmf_sdio_init(void)
 {
         int ret;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
 
-        ret = sdio_register_driver(&brcmf_sdmmc_driver);
+        ret = platform_driver_probe(&brcmf_sdio_pd, brcmf_sdio_pd_probe);
+        if (ret == -ENODEV) {
+                brcmf_dbg(SDIO, "No platform data available, registering without.\n");
+                ret = sdio_register_driver(&brcmf_sdmmc_driver);
+        }
 
         if (ret)
-                brcmf_err("sdio_register_driver failed: %d\n", ret);
+                brcmf_err("driver registration failed: %d\n", ret);
 }
-#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index ef6f23be6d32..28db9cf39672 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -28,6 +28,7 @@
 /*******************************************************************************
  * IO codes that are interpreted by dongle firmware
  ******************************************************************************/
+#define BRCMF_C_GET_VERSION                     1
 #define BRCMF_C_UP                              2
 #define BRCMF_C_DOWN                            3
 #define BRCMF_C_SET_PROMISC                     10
@@ -72,6 +73,7 @@
 #define BRCMF_C_SET_WSEC                        134
 #define BRCMF_C_GET_PHY_NOISE                   135
 #define BRCMF_C_GET_BSS_INFO                    136
+#define BRCMF_C_GET_BANDLIST                    140
 #define BRCMF_C_SET_SCB_TIMEOUT                 158
 #define BRCMF_C_GET_PHYLIST                     180
 #define BRCMF_C_SET_SCAN_CHANNEL_TIME           185
@@ -475,6 +477,11 @@ struct brcmf_sta_info_le {
         __le32  rx_decrypt_failures;    /* # of packet decrypted failed */
 };
 
+struct brcmf_chanspec_list {
+        __le32  count;          /* # of entries */
+        __le32  element[1];     /* variable length uint32 list */
+};
+
 /*
  * WLC_E_PROBRESP_MSG
  * WLC_E_P2P_PROBREQ_MSG
@@ -501,6 +508,7 @@ struct brcmf_dcmd {
 /* Forward decls for struct brcmf_pub (see below) */
 struct brcmf_proto;     /* device communication protocol info */
 struct brcmf_cfg80211_dev; /* cfg80211 device info */
+struct brcmf_fws_info; /* firmware signalling info */
 
 /* Common structure for module and instance linkage */
 struct brcmf_pub {
@@ -527,6 +535,10 @@ struct brcmf_pub {
         unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
 
         struct brcmf_fweh_info fweh;
+
+        bool fw_signals;
+        struct brcmf_fws_info *fws;
+        spinlock_t fws_spinlock;
 #ifdef DEBUG
         struct dentry *dbgfs_dir;
 #endif
@@ -537,10 +549,25 @@ struct brcmf_if_event {
         u8 action;
         u8 flags;
         u8 bssidx;
+        u8 role;
 };
 
-/* forward declaration */
+/* forward declarations */
 struct brcmf_cfg80211_vif;
+struct brcmf_fws_mac_descriptor;
+
+/**
+ * enum brcmf_netif_stop_reason - reason for stopping netif queue.
+ *
+ * @BRCMF_NETIF_STOP_REASON_FWS_FC:
+ *      netif stopped due to firmware signalling flow control.
+ * @BRCMF_NETIF_STOP_REASON_BLOCK_BUS:
+ *      netif stopped due to bus blocking.
+ */
+enum brcmf_netif_stop_reason {
+        BRCMF_NETIF_STOP_REASON_FWS_FC = 1,
+        BRCMF_NETIF_STOP_REASON_BLOCK_BUS = 2
+};
 
 /**
  * struct brcmf_if - interface control information.
@@ -549,9 +576,13 @@ struct brcmf_cfg80211_vif;
  * @vif: points to cfg80211 specific interface information.
  * @ndev: associated network device.
  * @stats: interface specific network statistics.
+ * @setmacaddr_work: worker object for setting mac address.
+ * @multicast_work: worker object for multicast provisioning.
+ * @fws_desc: interface specific firmware-signalling descriptor.
  * @ifidx: interface index in device firmware.
  * @bssidx: index of bss associated with this interface.
  * @mac_addr: assigned mac address.
+ * @netif_stop: bitmap indicates reason why netif queues are stopped.
  * @pend_8021x_cnt: tracks outstanding number of 802.1x frames.
  * @pend_8021x_wait: used for signalling change in count.
  */
@@ -562,9 +593,11 @@ struct brcmf_if {
         struct net_device_stats stats;
         struct work_struct setmacaddr_work;
         struct work_struct multicast_work;
+        struct brcmf_fws_mac_descriptor *fws_desc;
         int ifidx;
         s32 bssidx;
         u8 mac_addr[ETH_ALEN];
+        u8 netif_stop;
         atomic_t pend_8021x_cnt;
         wait_queue_head_t pend_8021x_wait;
 };
@@ -582,13 +615,17 @@ extern int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
                                     void *buf, uint len);
 
 /* Remove any protocol-specific data header. */
-extern int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
+extern int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
                                struct sk_buff *rxp);
 
 extern int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
 extern struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx,
                                      s32 ifidx, char *name, u8 *mac_addr);
 extern void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx);
+void brcmf_txflowblock_if(struct brcmf_if *ifp,
+                          enum brcmf_netif_stop_reason reason, bool state);
 extern u32 brcmf_get_chip_info(struct brcmf_if *ifp);
+extern void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
+                             bool success);
 
 #endif                          /* _BRCMF_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index ad25c3408b59..080395f49fa5 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -39,10 +39,12 @@ struct brcmf_bus_dcmd {
  * @txdata: send a data frame to the dongle (callee disposes skb).
  * @txctl: transmit a control request message to dongle.
  * @rxctl: receive a control response message from dongle.
+ * @gettxq: obtain a reference of bus transmit queue (optional).
  *
  * This structure provides an abstract interface towards the
  * bus specific driver. For control messages to common driver
- * will assure there is only one active transaction.
+ * will assure there is only one active transaction. Unless
+ * indicated otherwise these callbacks are mandatory.
  */
 struct brcmf_bus_ops {
         int (*init)(struct device *dev);
@@ -50,6 +52,7 @@ struct brcmf_bus_ops {
         int (*txdata)(struct device *dev, struct sk_buff *skb);
         int (*txctl)(struct device *dev, unsigned char *msg, uint len);
         int (*rxctl)(struct device *dev, unsigned char *msg, uint len);
+        struct pktq * (*gettxq)(struct device *dev);
 };
 
 /**
@@ -115,6 +118,14 @@ int brcmf_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint len)
         return bus->ops->rxctl(bus->dev, msg, len);
 }
 
+static inline
+struct pktq *brcmf_bus_gettxq(struct brcmf_bus *bus)
+{
+        if (!bus->ops->gettxq)
+                return ERR_PTR(-ENOENT);
+
+        return bus->ops->gettxq(bus->dev);
+}
 /*
  * interface functions from common layer
  */
@@ -134,7 +145,7 @@ extern void brcmf_dev_reset(struct device *dev);
 /* Indication from bus module to change flow-control state */
 extern void brcmf_txflowblock(struct device *dev, bool state);
 
-/* Notify tx completion */
+/* Notify the bus has transferred the tx packet to firmware */
 extern void brcmf_txcomplete(struct device *dev, struct sk_buff *txp,
                              bool success);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
index a2354d951dd7..59c77aa3b959 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
@@ -28,6 +28,7 @@
 #include "dhd.h"
 #include "dhd_proto.h"
 #include "dhd_bus.h"
+#include "fwsignal.h"
 #include "dhd_dbg.h"
 
 struct brcmf_proto_cdc_dcmd {
@@ -71,13 +72,26 @@ struct brcmf_proto_cdc_dcmd {
         ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | \
         ((idx) << BDC_FLAG2_IF_SHIFT)))
 
+/**
+ * struct brcmf_proto_bdc_header - BDC header format
+ *
+ * @flags: flags contain protocol and checksum info.
+ * @priority: 802.1d priority and USB flow control info (bit 4:7).
+ * @flags2: additional flags containing dongle interface index.
+ * @data_offset: start of packet data. header is following by firmware signals.
+ */
 struct brcmf_proto_bdc_header {
         u8 flags;
-        u8 priority;    /* 802.1d Priority, 4:7 flow control info for usb */
+        u8 priority;
         u8 flags2;
         u8 data_offset;
 };
 
+/*
+ * maximum length of firmware signal data between
+ * the BDC header and packet data in the tx path.
+ */
+#define BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES        12
 
 #define RETRIES 2 /* # of retries to retrieve matching dcmd response */
 #define BUS_HEADER_LEN  (16+64)         /* Must be atleast SDPCM_RESERVE
@@ -258,7 +272,7 @@ static void pkt_set_sum_good(struct sk_buff *skb, bool x)
         skb->ip_summed = (x ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE);
 }
 
-void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
+void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx, u8 offset,
                          struct sk_buff *pktbuf)
 {
         struct brcmf_proto_bdc_header *h;
@@ -266,7 +280,6 @@ void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
         brcmf_dbg(CDC, "Enter\n");
 
         /* Push BDC header used to convey priority for buses that don't */
-
         skb_push(pktbuf, BDC_HEADER_LEN);
 
         h = (struct brcmf_proto_bdc_header *)(pktbuf->data);
@@ -277,11 +290,11 @@ void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
 
         h->priority = (pktbuf->priority & BDC_PRIORITY_MASK);
         h->flags2 = 0;
-        h->data_offset = 0;
+        h->data_offset = offset;
         BDC_SET_IF_IDX(h, ifidx);
 }
 
-int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
+int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
                         struct sk_buff *pktbuf)
 {
         struct brcmf_proto_bdc_header *h;
@@ -290,8 +303,8 @@ int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
 
         /* Pop BDC header used to convey priority for buses that don't */
 
-        if (pktbuf->len < BDC_HEADER_LEN) {
-                brcmf_err("rx data too short (%d < %d)\n",
+        if (pktbuf->len <= BDC_HEADER_LEN) {
+                brcmf_dbg(INFO, "rx data too short (%d <= %d)\n",
                           pktbuf->len, BDC_HEADER_LEN);
                 return -EBADE;
         }
@@ -328,7 +341,10 @@ int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
         pktbuf->priority = h->priority & BDC_PRIORITY_MASK;
 
         skb_pull(pktbuf, BDC_HEADER_LEN);
-        skb_pull(pktbuf, h->data_offset << 2);
+        if (do_fws)
+                brcmf_fws_hdrpull(drvr, *ifidx, h->data_offset << 2, pktbuf);
+        else
+                skb_pull(pktbuf, h->data_offset << 2);
 
         if (pktbuf->len == 0)
                 return -ENODATA;
@@ -350,7 +366,7 @@ int brcmf_proto_attach(struct brcmf_pub *drvr)
         }
 
         drvr->prot = cdc;
-        drvr->hdrlen += BDC_HEADER_LEN;
+        drvr->hdrlen += BDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
         drvr->bus_if->maxctl = BRCMF_DCMD_MAXLEN +
                         sizeof(struct brcmf_proto_cdc_dcmd) + ROUND_UP_MARGIN;
         return 0;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 4544342a0428..be0787cab24f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -24,6 +24,7 @@
 #include "dhd_proto.h"
 #include "dhd_dbg.h"
 #include "fwil.h"
+#include "tracepoint.h"
 
 #define PKTFILTER_BUF_SIZE              128
 #define BRCMF_ARPOL_MODE                0xb     /* agent|snoop|peer_autoreply */
@@ -373,3 +374,35 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
 done:
         return err;
 }
+
+#ifdef CONFIG_BRCM_TRACING
+void __brcmf_err(const char *func, const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        pr_err("%s: %pV", func, &vaf);
+        trace_brcmf_err(func, &vaf);
+        va_end(args);
+}
+#endif
+#if defined(CONFIG_BRCM_TRACING) || defined(CONFIG_BRCMDBG)
+void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        if (brcmf_msg_level & level)
+                pr_debug("%s %pV", func, &vaf);
+        trace_brcmf_dbg(level, func, &vaf);
+        va_end(args);
+}
+#endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
index 57671eddf79d..202869cd0932 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
@@ -22,6 +22,7 @@
 #include "dhd.h"
 #include "dhd_bus.h"
 #include "dhd_dbg.h"
+#include "tracepoint.h"
 
 static struct dentry *root_folder;
 
@@ -123,3 +124,82 @@ void brcmf_debugfs_create_sdio_count(struct brcmf_pub *drvr,
                 debugfs_create_file("counters", S_IRUGO, dentry,
                                     sdcnt, &brcmf_debugfs_sdio_counter_ops);
 }
+
+static
+ssize_t brcmf_debugfs_fws_stats_read(struct file *f, char __user *data,
+                                     size_t count, loff_t *ppos)
+{
+        struct brcmf_fws_stats *fwstats = f->private_data;
+        char buf[650];
+        int res;
+
+        /* only allow read from start */
+        if (*ppos > 0)
+                return 0;
+
+        res = scnprintf(buf, sizeof(buf),
+                        "header_pulls:      %u\n"
+                        "header_only_pkt:   %u\n"
+                        "tlv_parse_failed:  %u\n"
+                        "tlv_invalid_type:  %u\n"
+                        "mac_update_fails:  %u\n"
+                        "ps_update_fails:   %u\n"
+                        "if_update_fails:   %u\n"
+                        "pkt2bus:           %u\n"
+                        "generic_error:     %u\n"
+                        "rollback_success:  %u\n"
+                        "rollback_failed:   %u\n"
+                        "delayq_full:       %u\n"
+                        "supprq_full:       %u\n"
+                        "txs_indicate:      %u\n"
+                        "txs_discard:       %u\n"
+                        "txs_suppr_core:    %u\n"
+                        "txs_suppr_ps:      %u\n"
+                        "txs_tossed:        %u\n"
+                        "send_pkts:         BK:%u BE:%u VO:%u VI:%u BCMC:%u\n"
+                        "fifo_credits_sent: BK:%u BE:%u VO:%u VI:%u BCMC:%u\n",
+                        fwstats->header_pulls,
+                        fwstats->header_only_pkt,
+                        fwstats->tlv_parse_failed,
+                        fwstats->tlv_invalid_type,
+                        fwstats->mac_update_failed,
+                        fwstats->mac_ps_update_failed,
+                        fwstats->if_update_failed,
+                        fwstats->pkt2bus,
+                        fwstats->generic_error,
+                        fwstats->rollback_success,
+                        fwstats->rollback_failed,
+                        fwstats->delayq_full_error,
+                        fwstats->supprq_full_error,
+                        fwstats->txs_indicate,
+                        fwstats->txs_discard,
+                        fwstats->txs_supp_core,
+                        fwstats->txs_supp_ps,
+                        fwstats->txs_tossed,
+                        fwstats->send_pkts[0], fwstats->send_pkts[1],
+                        fwstats->send_pkts[2], fwstats->send_pkts[3],
+                        fwstats->send_pkts[4],
+                        fwstats->fifo_credits_sent[0],
+                        fwstats->fifo_credits_sent[1],
+                        fwstats->fifo_credits_sent[2],
+                        fwstats->fifo_credits_sent[3],
+                        fwstats->fifo_credits_sent[4]);
+
+        return simple_read_from_buffer(data, count, ppos, buf, res);
+}
+
+static const struct file_operations brcmf_debugfs_fws_stats_ops = {
+        .owner = THIS_MODULE,
+        .open = simple_open,
+        .read = brcmf_debugfs_fws_stats_read
+};
+
+void brcmf_debugfs_create_fws_stats(struct brcmf_pub *drvr,
+                                    struct brcmf_fws_stats *stats)
+{
+        struct dentry *dentry =  drvr->dbgfs_dir;
+
+        if (!IS_ERR_OR_NULL(dentry))
+                debugfs_create_file("fws_stats", S_IRUGO, dentry,
+                                    stats, &brcmf_debugfs_fws_stats_ops);
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
index bc013cbe06f6..009c87bfd9ae 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
@@ -34,6 +34,7 @@
 #define BRCMF_SCAN_VAL  0x00004000
 #define BRCMF_CONN_VAL  0x00008000
 #define BRCMF_CDC_VAL   0x00010000
+#define BRCMF_SDIO_VAL  0x00020000
 
 /* set default print format */
 #undef pr_fmt
@@ -43,6 +44,7 @@
  * debugging is not selected. When debugging the driver error
  * messages are as important as other tracing or even more so.
  */
+#ifndef CONFIG_BRCM_TRACING
 #ifdef CONFIG_BRCMDBG
 #define brcmf_err(fmt, ...)     pr_err("%s: " fmt, __func__, ##__VA_ARGS__)
 #else
@@ -52,15 +54,21 @@
                         pr_err("%s: " fmt, __func__, ##__VA_ARGS__);    \
         } while (0)
 #endif
+#else
+__printf(2, 3)
+void __brcmf_err(const char *func, const char *fmt, ...);
+#define brcmf_err(fmt, ...) \
+        __brcmf_err(__func__, fmt, ##__VA_ARGS__)
+#endif
 
-#if defined(DEBUG)
-
+#if defined(DEBUG) || defined(CONFIG_BRCM_TRACING)
+__printf(3, 4)
+void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...);
 #define brcmf_dbg(level, fmt, ...)                              \
 do {                                                            \
-        if (brcmf_msg_level & BRCMF_##level##_VAL)              \
-                pr_debug("%s: " fmt, __func__, ##__VA_ARGS__);  \
+        __brcmf_dbg(BRCMF_##level##_VAL, __func__,              \
+                    fmt, ##__VA_ARGS__);                        \
 } while (0)
-
 #define BRCMF_DATA_ON()         (brcmf_msg_level & BRCMF_DATA_VAL)
 #define BRCMF_CTL_ON()          (brcmf_msg_level & BRCMF_CTL_VAL)
 #define BRCMF_HDRS_ON()         (brcmf_msg_level & BRCMF_HDRS_VAL)
@@ -69,7 +77,7 @@ do {								\
 #define BRCMF_EVENT_ON()        (brcmf_msg_level & BRCMF_EVENT_VAL)
 #define BRCMF_FIL_ON()          (brcmf_msg_level & BRCMF_FIL_VAL)
 
-#else   /* (defined DEBUG) || (defined DEBUG) */
+#else /* defined(DEBUG) || defined(CONFIG_BRCM_TRACING) */
 
 #define brcmf_dbg(level, fmt, ...) no_printk(fmt, ##__VA_ARGS__)
 
@@ -81,10 +89,11 @@ do {								\
 #define BRCMF_EVENT_ON()        0
 #define BRCMF_FIL_ON()          0
 
-#endif                          /* defined(DEBUG) */
+#endif /* defined(DEBUG) || defined(CONFIG_BRCM_TRACING) */
 
 #define brcmf_dbg_hex_dump(test, data, len, fmt, ...)                   \
 do {                                                                    \
+        trace_brcmf_hexdump((void *)data, len);                         \
         if (test)                                                       \
                 brcmu_dbg_hex_dump(data, len, fmt, ##__VA_ARGS__);      \
 } while (0)
@@ -125,6 +134,32 @@ struct brcmf_sdio_count {
         ulong rx_readahead_cnt; /* packets where header read-ahead was used */
 };
 
+struct brcmf_fws_stats {
+        u32 tlv_parse_failed;
+        u32 tlv_invalid_type;
+        u32 header_only_pkt;
+        u32 header_pulls;
+        u32 pkt2bus;
+        u32 send_pkts[5];
+        u32 fifo_credits_sent[5];
+        u32 fifo_credits_back[6];
+        u32 generic_error;
+        u32 mac_update_failed;
+        u32 mac_ps_update_failed;
+        u32 if_update_failed;
+        u32 packet_request_failed;
+        u32 credit_request_failed;
+        u32 rollback_success;
+        u32 rollback_failed;
+        u32 delayq_full_error;
+        u32 supprq_full_error;
+        u32 txs_indicate;
+        u32 txs_discard;
+        u32 txs_supp_core;
+        u32 txs_supp_ps;
+        u32 txs_tossed;
+};
+
 struct brcmf_pub;
 #ifdef DEBUG
 void brcmf_debugfs_init(void);
@@ -134,6 +169,8 @@ void brcmf_debugfs_detach(struct brcmf_pub *drvr);
 struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr);
 void brcmf_debugfs_create_sdio_count(struct brcmf_pub *drvr,
                                      struct brcmf_sdio_count *sdcnt);
+void brcmf_debugfs_create_fws_stats(struct brcmf_pub *drvr,
+                                    struct brcmf_fws_stats *stats);
 #else
 static inline void brcmf_debugfs_init(void)
 {
@@ -148,6 +185,10 @@ static inline int brcmf_debugfs_attach(struct brcmf_pub *drvr)
 static inline void brcmf_debugfs_detach(struct brcmf_pub *drvr)
 {
 }
+static inline void brcmf_debugfs_create_fws_stats(struct brcmf_pub *drvr,
+                                                  struct brcmf_fws_stats *stats)
+{
+}
 #endif
 
 #endif                          /* _BRCMF_DBG_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index c06cea88df0d..763a84eba216 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -30,17 +30,18 @@
 #include "p2p.h"
 #include "wl_cfg80211.h"
 #include "fwil.h"
+#include "fwsignal.h"
 
 MODULE_AUTHOR("Broadcom Corporation");
 MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
-MODULE_SUPPORTED_DEVICE("Broadcom 802.11 WLAN fullmac cards");
 MODULE_LICENSE("Dual BSD/GPL");
 
 #define MAX_WAIT_FOR_8021X_TX           50      /* msecs */
 
 /* Error bits */
 int brcmf_msg_level;
-module_param(brcmf_msg_level, int, 0);
+module_param_named(debug, brcmf_msg_level, int, S_IRUSR | S_IWUSR);
+MODULE_PARM_DESC(debug, "level of debug output");
 
 /* P2P0 enable */
 static int brcmf_p2p_enable;
@@ -222,18 +223,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
                 goto done;
         }
 
-        /* handle ethernet header */
-        eh = (struct ethhdr *)(skb->data);
-        if (is_multicast_ether_addr(eh->h_dest))
-                drvr->tx_multicast++;
-        if (ntohs(eh->h_proto) == ETH_P_PAE)
-                atomic_inc(&ifp->pend_8021x_cnt);
-
-        /* If the protocol uses a data header, apply it */
-        brcmf_proto_hdrpush(drvr, ifp->ifidx, skb);
-
-        /* Use bus module to send data frame */
-        ret =  brcmf_bus_txdata(drvr->bus_if, skb);
+        ret = brcmf_fws_process_skb(ifp, skb);
 
 done:
         if (ret) {
@@ -247,9 +237,27 @@ done:
         return NETDEV_TX_OK;
 }
 
+void brcmf_txflowblock_if(struct brcmf_if *ifp,
+                          enum brcmf_netif_stop_reason reason, bool state)
+{
+        if (!ifp)
+                return;
+
+        brcmf_dbg(TRACE, "enter: idx=%d stop=0x%X reason=%d state=%d\n",
+                  ifp->bssidx, ifp->netif_stop, reason, state);
+        if (state) {
+                if (!ifp->netif_stop)
+                        netif_stop_queue(ifp->ndev);
+                ifp->netif_stop |= reason;
+        } else {
+                ifp->netif_stop &= ~reason;
+                if (!ifp->netif_stop)
+                        netif_wake_queue(ifp->ndev);
+        }
+}
+
 void brcmf_txflowblock(struct device *dev, bool state)
 {
-        struct net_device *ndev;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
         int i;
@@ -257,13 +265,8 @@ void brcmf_txflowblock(struct device *dev, bool state)
         brcmf_dbg(TRACE, "Enter\n");
 
         for (i = 0; i < BRCMF_MAX_IFS; i++)
-                if (drvr->iflist[i]) {
-                        ndev = drvr->iflist[i]->ndev;
-                        if (state)
-                                netif_stop_queue(ndev);
-                        else
-                                netif_wake_queue(ndev);
-                }
+                brcmf_txflowblock_if(drvr->iflist[i],
+                                     BRCMF_NETIF_STOP_REASON_BLOCK_BUS, state);
 }
 
 void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
@@ -283,7 +286,7 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
                 skb_unlink(skb, skb_list);
 
                 /* process and remove protocol-specific header */
-                ret = brcmf_proto_hdrpull(drvr, &ifidx, skb);
+                ret = brcmf_proto_hdrpull(drvr, drvr->fw_signals, &ifidx, skb);
                 ifp = drvr->iflist[ifidx];
 
                 if (ret || !ifp || !ifp->ndev) {
@@ -320,13 +323,8 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
                 /* Strip header, count, deliver upward */
                 skb_pull(skb, ETH_HLEN);
 
-                /* Process special event packets and then discard them */
-                brcmf_fweh_process_skb(drvr, skb, &ifidx);
-
-                if (drvr->iflist[ifidx]) {
-                        ifp = drvr->iflist[ifidx];
-                        ifp->ndev->last_rx = jiffies;
-                }
+                /* Process special event packets */
+                brcmf_fweh_process_skb(drvr, skb);
 
                 if (!(ifp->ndev->flags & IFF_UP)) {
                         brcmu_pkt_buf_free_skb(skb);
@@ -349,31 +347,49 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
         }
 }
 
-void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
+void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
+                      bool success)
 {
-        u8 ifidx;
+        struct brcmf_if *ifp;
         struct ethhdr *eh;
+        u8 ifidx;
         u16 type;
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_pub *drvr = bus_if->drvr;
-        struct brcmf_if *ifp;
+        int res;
 
-        brcmf_proto_hdrpull(drvr, &ifidx, txp);
+        res = brcmf_proto_hdrpull(drvr, false, &ifidx, txp);
 
         ifp = drvr->iflist[ifidx];
         if (!ifp)
-                return;
+                goto done;
 
-        eh = (struct ethhdr *)(txp->data);
-        type = ntohs(eh->h_proto);
+        if (res == 0) {
+                eh = (struct ethhdr *)(txp->data);
+                type = ntohs(eh->h_proto);
 
-        if (type == ETH_P_PAE) {
-                atomic_dec(&ifp->pend_8021x_cnt);
-                if (waitqueue_active(&ifp->pend_8021x_wait))
-                        wake_up(&ifp->pend_8021x_wait);
+                if (type == ETH_P_PAE) {
+                        atomic_dec(&ifp->pend_8021x_cnt);
+                        if (waitqueue_active(&ifp->pend_8021x_wait))
+                                wake_up(&ifp->pend_8021x_wait);
+                }
         }
         if (!success)
                 ifp->stats.tx_errors++;
+done:
+        brcmu_pkt_buf_free_skb(txp);
+}
+
+void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_pub *drvr = bus_if->drvr;
+
+        /* await txstatus signal for firmware if active */
+        if (brcmf_fws_fc_active(drvr->fws)) {
+                if (!success)
+                        brcmf_fws_bustxfail(drvr->fws, txp);
+        } else {
+                brcmf_txfinalize(drvr, txp, success);
+        }
 }
 
 static struct net_device_stats *brcmf_netdev_get_stats(struct net_device *ndev)
@@ -734,28 +750,35 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
                 }
         }
 
-        /* Allocate netdev, including space for private structure */
-        ndev = alloc_netdev(sizeof(struct brcmf_if), name, ether_setup);
-        if (!ndev) {
-                brcmf_err("OOM - alloc_netdev\n");
-                return ERR_PTR(-ENOMEM);
+        if (!brcmf_p2p_enable && bssidx == 1) {
+                /* this is P2P_DEVICE interface */
+                brcmf_dbg(INFO, "allocate non-netdev interface\n");
+                ifp = kzalloc(sizeof(*ifp), GFP_KERNEL);
+        } else {
+                brcmf_dbg(INFO, "allocate netdev interface\n");
+                /* Allocate netdev, including space for private structure */
+                ndev = alloc_netdev(sizeof(*ifp), name, ether_setup);
+                if (!ndev) {
+                        brcmf_err("OOM - alloc_netdev\n");
+                        return ERR_PTR(-ENOMEM);
+                }
+
+                ifp = netdev_priv(ndev);
+                ifp->ndev = ndev;
         }
 
-        ifp = netdev_priv(ndev);
-        ifp->ndev = ndev;
         ifp->drvr = drvr;
         drvr->iflist[bssidx] = ifp;
         ifp->ifidx = ifidx;
         ifp->bssidx = bssidx;
 
-
         init_waitqueue_head(&ifp->pend_8021x_wait);
 
         if (mac_addr != NULL)
                 memcpy(ifp->mac_addr, mac_addr, ETH_ALEN);
 
         brcmf_dbg(TRACE, " ==== pid:%x, if:%s (%pM) created ===\n",
-                  current->pid, ifp->ndev->name, ifp->mac_addr);
+                  current->pid, name, ifp->mac_addr);
 
         return ifp;
 }
@@ -787,11 +810,13 @@ void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx)
                 }
 
                 unregister_netdev(ifp->ndev);
-                drvr->iflist[bssidx] = NULL;
                 if (bssidx == 0)
                         brcmf_cfg80211_detach(drvr->config);
                 free_netdev(ifp->ndev);
+        } else {
+                kfree(ifp);
         }
+        drvr->iflist[bssidx] = NULL;
 }
 
 int brcmf_attach(uint bus_hdrlen, struct device *dev)
@@ -873,6 +898,10 @@ int brcmf_bus_start(struct device *dev)
         if (ret < 0)
                 goto fail;
 
+        drvr->fw_signals = true;
+        (void)brcmf_fws_init(drvr);
+        brcmf_fws_add_interface(ifp);
+
         drvr->config = brcmf_cfg80211_attach(drvr, bus_if->dev);
         if (drvr->config == NULL) {
                 ret = -ENOMEM;
@@ -889,6 +918,10 @@ fail:
                 brcmf_err("failed: %d\n", ret);
                 if (drvr->config)
                         brcmf_cfg80211_detach(drvr->config);
+                if (drvr->fws) {
+                        brcmf_fws_del_interface(ifp);
+                        brcmf_fws_deinit(drvr);
+                }
                 free_netdev(ifp->ndev);
                 drvr->iflist[0] = NULL;
                 if (p2p_ifp) {
@@ -944,14 +977,18 @@ void brcmf_detach(struct device *dev)
 
         /* make sure primary interface removed last */
         for (i = BRCMF_MAX_IFS-1; i > -1; i--)
-                if (drvr->iflist[i])
+                if (drvr->iflist[i]) {
+                        brcmf_fws_del_interface(drvr->iflist[i]);
                         brcmf_del_if(drvr, i);
+                }
 
         brcmf_bus_detach(drvr);
 
         if (drvr->prot)
                 brcmf_proto_detach(drvr);
 
+        brcmf_fws_deinit(drvr);
+
         brcmf_debugfs_detach(drvr);
         bus_if->drvr = NULL;
         kfree(drvr);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
index 48fa70302192..ef9179883748 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
@@ -33,7 +33,7 @@ extern void brcmf_proto_stop(struct brcmf_pub *drvr);
 /* Add any protocol-specific data header.
  * Caller must reserve prot_hdrlen prepend space.
  */
-extern void brcmf_proto_hdrpush(struct brcmf_pub *, int ifidx,
+extern void brcmf_proto_hdrpush(struct brcmf_pub *, int ifidx, u8 offset,
                                 struct sk_buff *txp);
 
 /* Sets dongle media info (drv_version, mac address). */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 4469321c0eb3..d2487518bd2a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -31,6 +31,7 @@
 #include <linux/bcma/bcma.h>
 #include <linux/debugfs.h>
 #include <linux/vmalloc.h>
+#include <linux/platform_data/brcmfmac-sdio.h>
 #include <asm/unaligned.h>
 #include <defs.h>
 #include <brcmu_wifi.h>
@@ -94,6 +95,7 @@ struct rte_console {
 
 #include "dhd_bus.h"
 #include "dhd_dbg.h"
+#include "tracepoint.h"
 
 #define TXQLEN          2048    /* bulk tx queue length */
 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
@@ -323,6 +325,9 @@ MODULE_FIRMWARE(BRCMF_SDIO_NV_NAME);
                                          */
 #define BRCMF_IDLE_INTERVAL     1
 
+#define KSO_WAIT_US 50
+#define MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
+
 /*
  * Conversion of 802.1D priority to precedence level
  */
@@ -332,95 +337,6 @@ static uint prio2prec(u32 prio)
                (prio^2) : prio;
 }
 
-/* core registers */
-struct sdpcmd_regs {
-        u32 corecontrol;                /* 0x00, rev8 */
-        u32 corestatus;                 /* rev8 */
-        u32 PAD[1];
-        u32 biststatus;                 /* rev8 */
-
-        /* PCMCIA access */
-        u16 pcmciamesportaladdr;        /* 0x010, rev8 */
-        u16 PAD[1];
-        u16 pcmciamesportalmask;        /* rev8 */
-        u16 PAD[1];
-        u16 pcmciawrframebc;            /* rev8 */
-        u16 PAD[1];
-        u16 pcmciaunderflowtimer;       /* rev8 */
-        u16 PAD[1];
-
-        /* interrupt */
-        u32 intstatus;                  /* 0x020, rev8 */
-        u32 hostintmask;                /* rev8 */
-        u32 intmask;                    /* rev8 */
-        u32 sbintstatus;                /* rev8 */
-        u32 sbintmask;                  /* rev8 */
-        u32 funcintmask;                /* rev4 */
-        u32 PAD[2];
-        u32 tosbmailbox;                /* 0x040, rev8 */
-        u32 tohostmailbox;              /* rev8 */
-        u32 tosbmailboxdata;            /* rev8 */
-        u32 tohostmailboxdata;          /* rev8 */
-
-        /* synchronized access to registers in SDIO clock domain */
-        u32 sdioaccess;                 /* 0x050, rev8 */
-        u32 PAD[3];
-
-        /* PCMCIA frame control */
-        u8 pcmciaframectrl;             /* 0x060, rev8 */
-        u8 PAD[3];
-        u8 pcmciawatermark;             /* rev8 */
-        u8 PAD[155];
-
-        /* interrupt batching control */
-        u32 intrcvlazy;                 /* 0x100, rev8 */
-        u32 PAD[3];
-
-        /* counters */
-        u32 cmd52rd;                    /* 0x110, rev8 */
-        u32 cmd52wr;                    /* rev8 */
-        u32 cmd53rd;                    /* rev8 */
-        u32 cmd53wr;                    /* rev8 */
-        u32 abort;                      /* rev8 */
-        u32 datacrcerror;               /* rev8 */
-        u32 rdoutofsync;                /* rev8 */
-        u32 wroutofsync;                /* rev8 */
-        u32 writebusy;                  /* rev8 */
-        u32 readwait;                   /* rev8 */
-        u32 readterm;                   /* rev8 */
-        u32 writeterm;                  /* rev8 */
-        u32 PAD[40];
-        u32 clockctlstatus;             /* rev8 */
-        u32 PAD[7];
-
-        u32 PAD[128];                   /* DMA engines */
-
-        /* SDIO/PCMCIA CIS region */
-        char cis[512];                  /* 0x400-0x5ff, rev6 */
-
-        /* PCMCIA function control registers */
-        char pcmciafcr[256];            /* 0x600-6ff, rev6 */
-        u16 PAD[55];
-
-        /* PCMCIA backplane access */
-        u16 backplanecsr;               /* 0x76E, rev6 */
-        u16 backplaneaddr0;             /* rev6 */
-        u16 backplaneaddr1;             /* rev6 */
-        u16 backplaneaddr2;             /* rev6 */
-        u16 backplaneaddr3;             /* rev6 */
-        u16 backplanedata0;             /* rev6 */
-        u16 backplanedata1;             /* rev6 */
-        u16 backplanedata2;             /* rev6 */
-        u16 backplanedata3;             /* rev6 */
-        u16 PAD[31];
-
-        /* sprom "size" & "blank" info */
-        u16 spromstatus;                /* 0x7BE, rev2 */
-        u32 PAD[464];
-
-        u16 PAD[0x80];
-};
-
 #ifdef DEBUG
 /* Device console log buffer state */
 struct brcmf_console {
@@ -587,12 +503,14 @@ struct brcmf_sdio {
 
         bool txoff;             /* Transmit flow-controlled */
         struct brcmf_sdio_count sdcnt;
+        bool sr_enabled; /* SaveRestore enabled */
+        bool sleeping; /* SDIO bus sleeping */
 };
 
 /* clkstate */
 #define CLK_NONE        0
 #define CLK_SDONLY      1
-#define CLK_PENDING     2       /* Not used yet */
+#define CLK_PENDING     2
 #define CLK_AVAIL       3
 
 #ifdef DEBUG
@@ -600,7 +518,7 @@ static int qcount[NUMPRIO];
 static int tx_packets[NUMPRIO];
 #endif                          /* DEBUG */
 
-#define SDIO_DRIVE_STRENGTH     6       /* in milliamps */
+#define DEFAULT_SDIO_DRIVE_STRENGTH     6       /* in milliamps */
 
 #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
 
@@ -664,6 +582,62 @@ w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
         return ret;
 }
 
+static int
+brcmf_sdbrcm_kso_control(struct brcmf_sdio *bus, bool on)
+{
+        u8 wr_val = 0, rd_val, cmp_val, bmask;
+        int err = 0;
+        int try_cnt = 0;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+        /* 1st KSO write goes to AOS wake up core if device is asleep  */
+        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+                         wr_val, &err);
+        if (err) {
+                brcmf_err("SDIO_AOS KSO write error: %d\n", err);
+                return err;
+        }
+
+        if (on) {
+                /* device WAKEUP through KSO:
+                 * write bit 0 & read back until
+                 * both bits 0 (kso bit) & 1 (dev on status) are set
+                 */
+                cmp_val = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK |
+                          SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK;
+                bmask = cmp_val;
+                usleep_range(2000, 3000);
+        } else {
+                /* Put device to sleep, turn off KSO */
+                cmp_val = 0;
+                /* only check for bit0, bit1(dev on status) may not
+                 * get cleared right away
+                 */
+                bmask = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK;
+        }
+
+        do {
+                /* reliable KSO bit set/clr:
+                 * the sdiod sleep write access is synced to PMU 32khz clk
+                 * just one write attempt may fail,
+                 * read it back until it matches written value
+                 */
+                rd_val = brcmf_sdio_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+                                          &err);
+                if (((rd_val & bmask) == cmp_val) && !err)
+                        break;
+                brcmf_dbg(SDIO, "KSO wr/rd retry:%d (max: %d) ERR:%x\n",
+                          try_cnt, MAX_KSO_ATTEMPTS, err);
+                udelay(KSO_WAIT_US);
+                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+                                 wr_val, &err);
+        } while (try_cnt++ < MAX_KSO_ATTEMPTS);
+
+        return err;
+}
+
 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 
 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
@@ -675,10 +649,15 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
         u8 clkctl, clkreq, devctl;
         unsigned long timeout;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
 
         clkctl = 0;
 
+        if (bus->sr_enabled) {
+                bus->clkstate = (on ? CLK_AVAIL : CLK_SDONLY);
+                return 0;
+        }
+
         if (on) {
                 /* Request HT Avail */
                 clkreq =
@@ -713,7 +692,7 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
                                          devctl, &err);
-                        brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
+                        brcmf_dbg(SDIO, "CLKCTL: set PENDING\n");
                         bus->clkstate = CLK_PENDING;
 
                         return 0;
@@ -750,7 +729,7 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 
                 /* Mark clock available */
                 bus->clkstate = CLK_AVAIL;
-                brcmf_dbg(INFO, "CLKCTL: turned ON\n");
+                brcmf_dbg(SDIO, "CLKCTL: turned ON\n");
 
 #if defined(DEBUG)
                 if (!bus->alp_only) {
@@ -775,7 +754,7 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
                 bus->clkstate = CLK_SDONLY;
                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
                                  clkreq, &err);
-                brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
+                brcmf_dbg(SDIO, "CLKCTL: turned OFF\n");
                 if (err) {
                         brcmf_err("Failed access turning clock off: %d\n",
                                   err);
@@ -788,7 +767,7 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 /* Change idle/active SD state */
 static int brcmf_sdbrcm_sdclk(struct brcmf_sdio *bus, bool on)
 {
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
 
         if (on)
                 bus->clkstate = CLK_SDONLY;
@@ -805,7 +784,7 @@ static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
         uint oldstate = bus->clkstate;
 #endif                          /* DEBUG */
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
 
         /* Early exit if we're already there */
         if (bus->clkstate == target) {
@@ -849,12 +828,69 @@ static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
                 break;
         }
 #ifdef DEBUG
-        brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
+        brcmf_dbg(SDIO, "%d -> %d\n", oldstate, bus->clkstate);
 #endif                          /* DEBUG */
 
         return 0;
 }
 
+static int
+brcmf_sdbrcm_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
+{
+        int err = 0;
+        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "request %s currently %s\n",
+                  (sleep ? "SLEEP" : "WAKE"),
+                  (bus->sleeping ? "SLEEP" : "WAKE"));
+
+        /* If SR is enabled control bus state with KSO */
+        if (bus->sr_enabled) {
+                /* Done if we're already in the requested state */
+                if (sleep == bus->sleeping)
+                        goto end;
+
+                /* Going to sleep */
+                if (sleep) {
+                        /* Don't sleep if something is pending */
+                        if (atomic_read(&bus->intstatus) ||
+                            atomic_read(&bus->ipend) > 0 ||
+                            (!atomic_read(&bus->fcstate) &&
+                            brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
+                            data_ok(bus)))
+                                 return -EBUSY;
+                        err = brcmf_sdbrcm_kso_control(bus, false);
+                        /* disable watchdog */
+                        if (!err)
+                                brcmf_sdbrcm_wd_timer(bus, 0);
+                } else {
+                        bus->idlecount = 0;
+                        err = brcmf_sdbrcm_kso_control(bus, true);
+                }
+                if (!err) {
+                        /* Change state */
+                        bus->sleeping = sleep;
+                        brcmf_dbg(SDIO, "new state %s\n",
+                                  (sleep ? "SLEEP" : "WAKE"));
+                } else {
+                        brcmf_err("error while changing bus sleep state %d\n",
+                                  err);
+                        return err;
+                }
+        }
+
+end:
+        /* control clocks */
+        if (sleep) {
+                if (!bus->sr_enabled)
+                        brcmf_sdbrcm_clkctl(bus, CLK_NONE, pendok);
+        } else {
+                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, pendok);
+        }
+
+        return err;
+
+}
+
 static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
 {
         u32 intstatus = 0;
@@ -862,7 +898,7 @@ static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
         u8 fcbits;
         int ret;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(SDIO, "Enter\n");
 
         /* Read mailbox data and ack that we did so */
         ret = r_sdreg32(bus, &hmb_data,
@@ -875,7 +911,7 @@ static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
 
         /* Dongle recomposed rx frames, accept them again */
         if (hmb_data & HMB_DATA_NAKHANDLED) {
-                brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
+                brcmf_dbg(SDIO, "Dongle reports NAK handled, expect rtx of %d\n",
                           bus->rx_seq);
                 if (!bus->rxskip)
                         brcmf_err("unexpected NAKHANDLED!\n");
@@ -896,7 +932,7 @@ static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
                                   "expecting %d\n",
                                   bus->sdpcm_ver, SDPCM_PROT_VERSION);
                 else
-                        brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
+                        brcmf_dbg(SDIO, "Dongle ready, protocol version %d\n",
                                   bus->sdpcm_ver);
         }
 
@@ -970,7 +1006,7 @@ static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
         if (!retries)
                 brcmf_err("count never zeroed: last 0x%04x\n", lastrbc);
         else
-                brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
+                brcmf_dbg(SDIO, "flush took %d iterations\n", 0xffff - retries);
 
         if (rtx) {
                 bus->sdcnt.rxrtx++;
@@ -1173,7 +1209,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
         /* If packets, issue read(s) and send up packet chain */
         /* Return sequence numbers consumed? */
 
-        brcmf_dbg(TRACE, "start: glomd %p glom %p\n",
+        brcmf_dbg(SDIO, "start: glomd %p glom %p\n",
                   bus->glomd, skb_peek(&bus->glom));
 
         /* If there's a descriptor, generate the packet chain */
@@ -1546,7 +1582,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
         struct sk_buff_head pktlist;    /* needed for bus interface */
         u16 pad;                /* Number of pad bytes to read */
         uint rxleft = 0;        /* Remaining number of frames allowed */
-        int sdret;              /* Return code from calls */
+        int ret;                /* Return code from calls */
         uint rxcount = 0;       /* Total frames read */
         struct brcmf_sdio_read *rd = &bus->cur_read, rd_new;
         u8 head_read = 0;
@@ -1577,15 +1613,15 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                 /* read header first for unknow frame length */
                 sdio_claim_host(bus->sdiodev->func[1]);
                 if (!rd->len) {
-                        sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
+                        ret = brcmf_sdcard_recv_buf(bus->sdiodev,
                                                       bus->sdiodev->sbwad,
                                                       SDIO_FUNC_2, F2SYNC,
                                                       bus->rxhdr,
                                                       BRCMF_FIRSTREAD);
                         bus->sdcnt.f2rxhdrs++;
-                        if (sdret < 0) {
+                        if (ret < 0) {
                                 brcmf_err("RXHEADER FAILED: %d\n",
-                                          sdret);
+                                          ret);
                                 bus->sdcnt.rx_hdrfail++;
                                 brcmf_sdbrcm_rxfail(bus, true, true);
                                 sdio_release_host(bus->sdiodev->func[1]);
@@ -1637,14 +1673,14 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                 skb_pull(pkt, head_read);
                 pkt_align(pkt, rd->len_left, BRCMF_SDALIGN);
 
-                sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
+                ret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
                                               SDIO_FUNC_2, F2SYNC, pkt);
                 bus->sdcnt.f2rxdata++;
                 sdio_release_host(bus->sdiodev->func[1]);
 
-                if (sdret < 0) {
+                if (ret < 0) {
                         brcmf_err("read %d bytes from channel %d failed: %d\n",
-                                  rd->len, rd->channel, sdret);
+                                  rd->len, rd->channel, ret);
                         brcmu_pkt_buf_free_skb(pkt);
                         sdio_claim_host(bus->sdiodev->func[1]);
                         brcmf_sdbrcm_rxfail(bus, true,
@@ -1775,13 +1811,12 @@ brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
 /* Writes a HW/SW header into the packet and sends it. */
 /* Assumes: (a) header space already there, (b) caller holds lock */
 static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
-                              uint chan, bool free_pkt)
+                              uint chan)
 {
         int ret;
         u8 *frame;
         u16 len, pad = 0;
         u32 swheader;
-        struct sk_buff *new;
         int i;
 
         brcmf_dbg(TRACE, "Enter\n");
@@ -1795,30 +1830,14 @@ static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
                         brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
                                   skb_headroom(pkt), pad);
                         bus->sdiodev->bus_if->tx_realloc++;
-                        new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
-                        if (!new) {
-                                brcmf_err("couldn't allocate new %d-byte packet\n",
-                                          pkt->len + BRCMF_SDALIGN);
-                                ret = -ENOMEM;
+                        ret = skb_cow(pkt, BRCMF_SDALIGN);
+                        if (ret)
                                 goto done;
-                        }
-
-                        pkt_align(new, pkt->len, BRCMF_SDALIGN);
-                        memcpy(new->data, pkt->data, pkt->len);
-                        if (free_pkt)
-                                brcmu_pkt_buf_free_skb(pkt);
-                        /* free the pkt if canned one is not used */
-                        free_pkt = true;
-                        pkt = new;
-                        frame = (u8 *) (pkt->data);
-                        /* precondition: (frame % BRCMF_SDALIGN) == 0) */
-                        pad = 0;
-                } else {
-                        skb_push(pkt, pad);
-                        frame = (u8 *) (pkt->data);
-                        /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
-                        memset(frame, 0, pad + SDPCM_HDRLEN);
+                        pad = ((unsigned long)frame % BRCMF_SDALIGN);
                 }
+                skb_push(pkt, pad);
+                frame = (u8 *) (pkt->data);
+                memset(frame, 0, pad + SDPCM_HDRLEN);
         }
         /* precondition: pad < BRCMF_SDALIGN */
 
@@ -1833,8 +1852,8 @@ static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
             (((pad +
                SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
 
-        put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
-        put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
+        *(((__le32 *) frame) + 1) = cpu_to_le32(swheader);
+        *(((__le32 *) frame) + 2) = 0;
 
 #ifdef DEBUG
         tx_packets[pkt->priority]++;
@@ -1900,11 +1919,7 @@ static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
 done:
         /* restore pkt buffer pointer before calling tx complete routine */
         skb_pull(pkt, SDPCM_HDRLEN + pad);
-        brcmf_txcomplete(bus->sdiodev->dev, pkt, ret != 0);
-
-        if (free_pkt)
-                brcmu_pkt_buf_free_skb(pkt);
-
+        brcmf_txcomplete(bus->sdiodev->dev, pkt, ret == 0);
         return ret;
 }
 
@@ -1932,7 +1947,7 @@ static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
                 spin_unlock_bh(&bus->txqlock);
                 datalen = pkt->len - SDPCM_HDRLEN;
 
-                ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
+                ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL);
 
                 /* In poll mode, need to check for other events */
                 if (!bus->intr && cnt) {
@@ -1980,7 +1995,7 @@ static void brcmf_sdbrcm_bus_stop(struct device *dev)
         sdio_claim_host(bus->sdiodev->func[1]);
 
         /* Enable clock for device interrupts */
-        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+        brcmf_sdbrcm_bus_sleep(bus, false, false);
 
         /* Disable and clear interrupts at the chip level also */
         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
@@ -2032,23 +2047,19 @@ static void brcmf_sdbrcm_bus_stop(struct device *dev)
         bus->tx_seq = bus->rx_seq = 0;
 }
 
-#ifdef CONFIG_BRCMFMAC_SDIO_OOB
 static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
-        if (!bus->sdiodev->irq_en && !atomic_read(&bus->ipend)) {
-                enable_irq(bus->sdiodev->irq);
-                bus->sdiodev->irq_en = true;
+        if (bus->sdiodev->oob_irq_requested) {
+                spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
+                if (!bus->sdiodev->irq_en && !atomic_read(&bus->ipend)) {
+                        enable_irq(bus->sdiodev->pdata->oob_irq_nr);
+                        bus->sdiodev->irq_en = true;
+                }
+                spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
         }
-        spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
-}
-#else
-static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
-{
 }
-#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
 
 static inline void brcmf_sdbrcm_adddpctsk(struct brcmf_sdio *bus)
 {
@@ -2116,7 +2127,7 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
         sdio_claim_host(bus->sdiodev->func[1]);
 
         /* If waiting for HTAVAIL, check status */
-        if (bus->clkstate == CLK_PENDING) {
+        if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
                 u8 clkctl, devctl = 0;
 
 #ifdef DEBUG
@@ -2138,7 +2149,7 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
                 }
 
-                brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
+                brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
                           devctl, clkctl);
 
                 if (SBSDIO_HTAV(clkctl)) {
@@ -2162,7 +2173,7 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
         }
 
         /* Make sure backplane clock is on */
-        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
+        brcmf_sdbrcm_bus_sleep(bus, false, true);
 
         /* Pending interrupt indicates new device status */
         if (atomic_read(&bus->ipend) > 0) {
@@ -2308,12 +2319,22 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
         if ((bus->clkstate != CLK_PENDING)
             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
                 bus->activity = false;
+                brcmf_dbg(SDIO, "idle state\n");
                 sdio_claim_host(bus->sdiodev->func[1]);
-                brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
+                brcmf_sdbrcm_bus_sleep(bus, true, false);
                 sdio_release_host(bus->sdiodev->func[1]);
         }
 }
 
+static struct pktq *brcmf_sdbrcm_bus_gettxq(struct device *dev)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+        struct brcmf_sdio *bus = sdiodev->bus;
+
+        return &bus->txq;
+}
+
 static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
 {
         int ret = -EBADE;
@@ -2343,7 +2364,6 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
         if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
                 skb_pull(pkt, SDPCM_HDRLEN);
                 brcmf_txcomplete(bus->sdiodev->dev, pkt, false);
-                brcmu_pkt_buf_free_skb(pkt);
                 brcmf_err("out of bus->txq !!!\n");
                 ret = -ENOSR;
         } else {
@@ -2374,69 +2394,6 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
         return ret;
 }
 
-static int
-brcmf_sdbrcm_membytes(struct brcmf_sdio *bus, bool write, u32 address, u8 *data,
-                 uint size)
-{
-        int bcmerror = 0;
-        u32 sdaddr;
-        uint dsize;
-
-        /* Determine initial transfer parameters */
-        sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
-        if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
-                dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
-        else
-                dsize = size;
-
-        sdio_claim_host(bus->sdiodev->func[1]);
-
-        /* Set the backplane window to include the start address */
-        bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
-        if (bcmerror) {
-                brcmf_err("window change failed\n");
-                goto xfer_done;
-        }
-
-        /* Do the transfer(s) */
-        while (size) {
-                brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
-                          write ? "write" : "read", dsize,
-                          sdaddr, address & SBSDIO_SBWINDOW_MASK);
-                bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
-                                               sdaddr, data, dsize);
-                if (bcmerror) {
-                        brcmf_err("membytes transfer failed\n");
-                        break;
-                }
-
-                /* Adjust for next transfer (if any) */
-                size -= dsize;
-                if (size) {
-                        data += dsize;
-                        address += dsize;
-                        bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
-                                                                  address);
-                        if (bcmerror) {
-                                brcmf_err("window change failed\n");
-                                break;
-                        }
-                        sdaddr = 0;
-                        dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
-                }
-        }
-
-xfer_done:
-        /* Return the window to backplane enumeration space for core access */
-        if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
-                brcmf_err("FAILED to set window back to 0x%x\n",
-                          bus->sdiodev->sbwad);
-
-        sdio_release_host(bus->sdiodev->func[1]);
-
-        return bcmerror;
-}
-
 #ifdef DEBUG
 #define CONSOLE_LINE_MAX        192
 
@@ -2453,8 +2410,8 @@ static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
 
         /* Read console log struct */
         addr = bus->console_addr + offsetof(struct rte_console, log_le);
-        rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log_le,
-                                   sizeof(c->log_le));
+        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr, (u8 *)&c->log_le,
+                              sizeof(c->log_le));
         if (rv < 0)
                 return rv;
 
@@ -2479,7 +2436,7 @@ static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
 
         /* Read the console buffer */
         addr = le32_to_cpu(c->log_le.buf);
-        rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
+        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr, c->buf, c->bufsize);
         if (rv < 0)
                 return rv;
 
@@ -2604,7 +2561,7 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
 
         /* Make sure backplane clock is on */
         sdio_claim_host(bus->sdiodev->func[1]);
-        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+        brcmf_sdbrcm_bus_sleep(bus, false, false);
         sdio_release_host(bus->sdiodev->func[1]);
 
         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
@@ -2633,10 +2590,10 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
                                                  msecs_to_jiffies(2000));
 
                 if (!bus->ctrl_frame_stat) {
-                        brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
+                        brcmf_dbg(SDIO, "ctrl_frame_stat == false\n");
                         ret = 0;
                 } else {
-                        brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
+                        brcmf_dbg(SDIO, "ctrl_frame_stat == true\n");
                         ret = -1;
                 }
         }
@@ -2662,6 +2619,7 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
 
                 bus->activity = false;
                 sdio_claim_host(bus->sdiodev->func[1]);
+                brcmf_dbg(INFO, "idle\n");
                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
                 sdio_release_host(bus->sdiodev->func[1]);
         } else {
@@ -2691,23 +2649,22 @@ static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
         struct sdpcm_shared_le sh_le;
         __le32 addr_le;
 
-        shaddr = bus->ramsize - 4;
+        shaddr = bus->ci->rambase + bus->ramsize - 4;
 
         /*
          * Read last word in socram to determine
          * address of sdpcm_shared structure
          */
         sdio_claim_host(bus->sdiodev->func[1]);
-        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
-        rv = brcmf_sdbrcm_membytes(bus, false, shaddr,
-                                   (u8 *)&addr_le, 4);
+        brcmf_sdbrcm_bus_sleep(bus, false, false);
+        rv = brcmf_sdio_ramrw(bus->sdiodev, false, shaddr, (u8 *)&addr_le, 4);
         sdio_release_host(bus->sdiodev->func[1]);
         if (rv < 0)
                 return rv;
 
         addr = le32_to_cpu(addr_le);
 
-        brcmf_dbg(INFO, "sdpcm_shared address 0x%08X\n", addr);
+        brcmf_dbg(SDIO, "sdpcm_shared address 0x%08X\n", addr);
 
         /*
          * Check if addr is valid.
@@ -2720,8 +2677,8 @@ static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
         }
 
         /* Read hndrte_shared structure */
-        rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&sh_le,
-                                   sizeof(struct sdpcm_shared_le));
+        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr, (u8 *)&sh_le,
+                              sizeof(struct sdpcm_shared_le));
         if (rv < 0)
                 return rv;
 
@@ -2734,8 +2691,8 @@ static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
         sh->console_addr = le32_to_cpu(sh_le.console_addr);
         sh->msgtrace_addr = le32_to_cpu(sh_le.msgtrace_addr);
 
-        if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
-                brcmf_err("sdpcm_shared version mismatch: dhd %d dongle %d\n",
+        if ((sh->flags & SDPCM_SHARED_VERSION_MASK) > SDPCM_SHARED_VERSION) {
+                brcmf_err("sdpcm shared version unsupported: dhd %d dongle %d\n",
                           SDPCM_SHARED_VERSION,
                           sh->flags & SDPCM_SHARED_VERSION_MASK);
                 return -EPROTO;
@@ -2757,22 +2714,22 @@ static int brcmf_sdio_dump_console(struct brcmf_sdio *bus,
 
         /* obtain console information from device memory */
         addr = sh->console_addr + offsetof(struct rte_console, log_le);
-        rv = brcmf_sdbrcm_membytes(bus, false, addr,
-                        (u8 *)&sh_val, sizeof(u32));
+        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr,
+                              (u8 *)&sh_val, sizeof(u32));
         if (rv < 0)
                 return rv;
         console_ptr = le32_to_cpu(sh_val);
 
         addr = sh->console_addr + offsetof(struct rte_console, log_le.buf_size);
-        rv = brcmf_sdbrcm_membytes(bus, false, addr,
-                        (u8 *)&sh_val, sizeof(u32));
+        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr,
+                              (u8 *)&sh_val, sizeof(u32));
         if (rv < 0)
                 return rv;
         console_size = le32_to_cpu(sh_val);
 
         addr = sh->console_addr + offsetof(struct rte_console, log_le.idx);
-        rv = brcmf_sdbrcm_membytes(bus, false, addr,
-                        (u8 *)&sh_val, sizeof(u32));
+        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr,
+                              (u8 *)&sh_val, sizeof(u32));
         if (rv < 0)
                 return rv;
         console_index = le32_to_cpu(sh_val);
@@ -2786,8 +2743,8 @@ static int brcmf_sdio_dump_console(struct brcmf_sdio *bus,
 
         /* obtain the console data from device */
         conbuf[console_size] = '\0';
-        rv = brcmf_sdbrcm_membytes(bus, false, console_ptr, (u8 *)conbuf,
-                                   console_size);
+        rv = brcmf_sdio_ramrw(bus->sdiodev, false, console_ptr, (u8 *)conbuf,
+                              console_size);
         if (rv < 0)
                 goto done;
 
@@ -2817,21 +2774,18 @@ static int brcmf_sdio_trap_info(struct brcmf_sdio *bus, struct sdpcm_shared *sh,
         int error, res;
         char buf[350];
         struct brcmf_trap_info tr;
-        int nbytes;
         loff_t pos = 0;
 
-        if ((sh->flags & SDPCM_SHARED_TRAP) == 0)
+        if ((sh->flags & SDPCM_SHARED_TRAP) == 0) {
+                brcmf_dbg(INFO, "no trap in firmware\n");
                 return 0;
+        }
 
-        error = brcmf_sdbrcm_membytes(bus, false, sh->trap_addr, (u8 *)&tr,
-                                      sizeof(struct brcmf_trap_info));
+        error = brcmf_sdio_ramrw(bus->sdiodev, false, sh->trap_addr, (u8 *)&tr,
+                                 sizeof(struct brcmf_trap_info));
         if (error < 0)
                 return error;
 
-        nbytes = brcmf_sdio_dump_console(bus, sh, data, count);
-        if (nbytes < 0)
-                return nbytes;
-
         res = scnprintf(buf, sizeof(buf),
                         "dongle trap info: type 0x%x @ epc 0x%08x\n"
                         "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
@@ -2847,12 +2801,7 @@ static int brcmf_sdio_trap_info(struct brcmf_sdio *bus, struct sdpcm_shared *sh,
                         le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
                         le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
 
-        error = simple_read_from_buffer(data+nbytes, count, &pos, buf, res);
-        if (error < 0)
-                return error;
-
-        nbytes += error;
-        return nbytes;
+        return simple_read_from_buffer(data, count, &pos, buf, res);
 }
 
 static int brcmf_sdio_assert_info(struct brcmf_sdio *bus,
@@ -2876,14 +2825,14 @@ static int brcmf_sdio_assert_info(struct brcmf_sdio *bus,
 
         sdio_claim_host(bus->sdiodev->func[1]);
         if (sh->assert_file_addr != 0) {
-                error = brcmf_sdbrcm_membytes(bus, false, sh->assert_file_addr,
-                                              (u8 *)file, 80);
+                error = brcmf_sdio_ramrw(bus->sdiodev, false,
+                                         sh->assert_file_addr, (u8 *)file, 80);
                 if (error < 0)
                         return error;
         }
         if (sh->assert_exp_addr != 0) {
-                error = brcmf_sdbrcm_membytes(bus, false, sh->assert_exp_addr,
-                                              (u8 *)expr, 80);
+                error = brcmf_sdio_ramrw(bus->sdiodev, false,
+                                         sh->assert_exp_addr, (u8 *)expr, 80);
                 if (error < 0)
                         return error;
         }
@@ -2934,14 +2883,20 @@ static int brcmf_sdbrcm_died_dump(struct brcmf_sdio *bus, char __user *data,
         error = brcmf_sdio_assert_info(bus, &sh, data, count);
         if (error < 0)
                 goto done;
-
         nbytes = error;
-        error = brcmf_sdio_trap_info(bus, &sh, data, count);
+
+        error = brcmf_sdio_trap_info(bus, &sh, data+nbytes, count);
         if (error < 0)
                 goto done;
+        nbytes += error;
+
+        error = brcmf_sdio_dump_console(bus, &sh, data+nbytes, count);
+        if (error < 0)
+                goto done;
+        nbytes += error;
 
-        error += nbytes;
-        *ppos += error;
+        error = nbytes;
+        *ppos += nbytes;
 done:
         return error;
 }
@@ -3035,84 +2990,8 @@ brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
         return rxlen ? (int)rxlen : -ETIMEDOUT;
 }
 
-static int brcmf_sdbrcm_write_vars(struct brcmf_sdio *bus)
+static bool brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
 {
-        int bcmerror = 0;
-        u32 varaddr;
-        u32 varsizew;
-        __le32 varsizew_le;
-#ifdef DEBUG
-        char *nvram_ularray;
-#endif                          /* DEBUG */
-
-        /* Even if there are no vars are to be written, we still
-                 need to set the ramsize. */
-        varaddr = (bus->ramsize - 4) - bus->varsz;
-
-        if (bus->vars) {
-                /* Write the vars list */
-                bcmerror = brcmf_sdbrcm_membytes(bus, true, varaddr,
-                                                 bus->vars, bus->varsz);
-#ifdef DEBUG
-                /* Verify NVRAM bytes */
-                brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n",
-                          bus->varsz);
-                nvram_ularray = kmalloc(bus->varsz, GFP_ATOMIC);
-                if (!nvram_ularray)
-                        return -ENOMEM;
-
-                /* Upload image to verify downloaded contents. */
-                memset(nvram_ularray, 0xaa, bus->varsz);
-
-                /* Read the vars list to temp buffer for comparison */
-                bcmerror = brcmf_sdbrcm_membytes(bus, false, varaddr,
-                                                 nvram_ularray, bus->varsz);
-                if (bcmerror) {
-                        brcmf_err("error %d on reading %d nvram bytes at 0x%08x\n",
-                                  bcmerror, bus->varsz, varaddr);
-                }
-                /* Compare the org NVRAM with the one read from RAM */
-                if (memcmp(bus->vars, nvram_ularray, bus->varsz))
-                        brcmf_err("Downloaded NVRAM image is corrupted\n");
-                else
-                        brcmf_err("Download/Upload/Compare of NVRAM ok\n");
-
-                kfree(nvram_ularray);
-#endif                          /* DEBUG */
-        }
-
-        /* adjust to the user specified RAM */
-        brcmf_dbg(INFO, "Physical memory size: %d\n", bus->ramsize);
-        brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
-                  varaddr, bus->varsz);
-
-        /*
-         * Determine the length token:
-         * Varsize, converted to words, in lower 16-bits, checksum
-         * in upper 16-bits.
-         */
-        if (bcmerror) {
-                varsizew = 0;
-                varsizew_le = cpu_to_le32(0);
-        } else {
-                varsizew = bus->varsz / 4;
-                varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
-                varsizew_le = cpu_to_le32(varsizew);
-        }
-
-        brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
-                  bus->varsz, varsizew);
-
-        /* Write the length token to the last word */
-        bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->ramsize - 4),
-                                         (u8 *)&varsizew_le, 4);
-
-        return bcmerror;
-}
-
-static int brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
-{
-        int bcmerror = 0;
         struct chip_info *ci = bus->ci;
 
         /* To enter download state, disable ARM and reset SOCRAM.
@@ -3121,41 +3000,19 @@ static int brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
         if (enter) {
                 bus->alp_only = true;
 
-                ci->coredisable(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
-
-                ci->resetcore(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM);
-
-                /* Clear the top bit of memory */
-                if (bus->ramsize) {
-                        u32 zeros = 0;
-                        brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
-                                         (u8 *)&zeros, 4);
-                }
+                brcmf_sdio_chip_enter_download(bus->sdiodev, ci);
         } else {
-                if (!ci->iscoreup(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM)) {
-                        brcmf_err("SOCRAM core is down after reset?\n");
-                        bcmerror = -EBADE;
-                        goto fail;
-                }
-
-                bcmerror = brcmf_sdbrcm_write_vars(bus);
-                if (bcmerror) {
-                        brcmf_err("no vars written to RAM\n");
-                        bcmerror = 0;
-                }
-
-                w_sdreg32(bus, 0xFFFFFFFF,
-                          offsetof(struct sdpcmd_regs, intstatus));
-
-                ci->resetcore(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
+                if (!brcmf_sdio_chip_exit_download(bus->sdiodev, ci, bus->vars,
+                                                   bus->varsz))
+                        return false;
 
                 /* Allow HT Clock now that the ARM is running. */
                 bus->alp_only = false;
 
                 bus->sdiodev->bus_if->state = BRCMF_BUS_LOAD;
         }
-fail:
-        return bcmerror;
+
+        return true;
 }
 
 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
@@ -3170,10 +3027,11 @@ static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
 
 static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
 {
-        int offset = 0;
+        int offset;
         uint len;
         u8 *memblock = NULL, *memptr;
         int ret;
+        u8 idx;
 
         brcmf_dbg(INFO, "Enter\n");
 
@@ -3194,10 +3052,15 @@ static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
                 memptr += (BRCMF_SDALIGN -
                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
 
+        offset = bus->ci->rambase;
+
         /* Download image */
-        while ((len =
-                brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
-                ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
+        len = brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus);
+        idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_ARM_CR4);
+        if (BRCMF_MAX_CORENUM != idx)
+                memcpy(&bus->ci->rst_vec, memptr, sizeof(bus->ci->rst_vec));
+        while (len) {
+                ret = brcmf_sdio_ramrw(bus->sdiodev, true, offset, memptr, len);
                 if (ret) {
                         brcmf_err("error %d on writing %d membytes at 0x%08x\n",
                                   ret, MEMBLOCK, offset);
@@ -3205,6 +3068,7 @@ static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
                 }
 
                 offset += MEMBLOCK;
+                len = brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus);
         }
 
 err:
@@ -3312,23 +3176,23 @@ static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
         int bcmerror = -1;
 
         /* Keep arm in reset */
-        if (brcmf_sdbrcm_download_state(bus, true)) {
+        if (!brcmf_sdbrcm_download_state(bus, true)) {
                 brcmf_err("error placing ARM core in reset\n");
                 goto err;
         }
 
-        /* External image takes precedence if specified */
         if (brcmf_sdbrcm_download_code_file(bus)) {
                 brcmf_err("dongle image file download failed\n");
                 goto err;
         }
 
-        /* External nvram takes precedence if specified */
-        if (brcmf_sdbrcm_download_nvram(bus))
+        if (brcmf_sdbrcm_download_nvram(bus)) {
                 brcmf_err("dongle nvram file download failed\n");
+                goto err;
+        }
 
         /* Take arm out of reset */
-        if (brcmf_sdbrcm_download_state(bus, false)) {
+        if (!brcmf_sdbrcm_download_state(bus, false)) {
                 brcmf_err("error getting out of ARM core reset\n");
                 goto err;
         }
@@ -3339,6 +3203,103 @@ err:
         return bcmerror;
 }
 
+static bool brcmf_sdbrcm_sr_capable(struct brcmf_sdio *bus)
+{
+        u32 addr, reg;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        /* old chips with PMU version less than 17 don't support save restore */
+        if (bus->ci->pmurev < 17)
+                return false;
+
+        /* read PMU chipcontrol register 3*/
+        addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_addr);
+        brcmf_sdio_regwl(bus->sdiodev, addr, 3, NULL);
+        addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_data);
+        reg = brcmf_sdio_regrl(bus->sdiodev, addr, NULL);
+
+        return (bool)reg;
+}
+
+static void brcmf_sdbrcm_sr_init(struct brcmf_sdio *bus)
+{
+        int err = 0;
+        u8 val;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        val = brcmf_sdio_regrb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL,
+                               &err);
+        if (err) {
+                brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
+                return;
+        }
+
+        val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
+        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL,
+                         val, &err);
+        if (err) {
+                brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
+                return;
+        }
+
+        /* Add CMD14 Support */
+        brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
+                         (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
+                          SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
+                         &err);
+        if (err) {
+                brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
+                return;
+        }
+
+        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                         SBSDIO_FORCE_HT, &err);
+        if (err) {
+                brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
+                return;
+        }
+
+        /* set flag */
+        bus->sr_enabled = true;
+        brcmf_dbg(INFO, "SR enabled\n");
+}
+
+/* enable KSO bit */
+static int brcmf_sdbrcm_kso_init(struct brcmf_sdio *bus)
+{
+        u8 val;
+        int err = 0;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        /* KSO bit added in SDIO core rev 12 */
+        if (bus->ci->c_inf[1].rev < 12)
+                return 0;
+
+        val = brcmf_sdio_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+                               &err);
+        if (err) {
+                brcmf_err("error reading SBSDIO_FUNC1_SLEEPCSR\n");
+                return err;
+        }
+
+        if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
+                val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN <<
+                        SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+                                 val, &err);
+                if (err) {
+                        brcmf_err("error writing SBSDIO_FUNC1_SLEEPCSR\n");
+                        return err;
+                }
+        }
+
+        return 0;
+}
+
+
 static bool
 brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
 {
@@ -3437,8 +3398,13 @@ static int brcmf_sdbrcm_bus_init(struct device *dev)
                 ret = -ENODEV;
         }
 
-        /* Restore previous clock setting */
-        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
+        if (brcmf_sdbrcm_sr_capable(bus)) {
+                brcmf_sdbrcm_sr_init(bus);
+        } else {
+                /* Restore previous clock setting */
+                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                 saveclk, &err);
+        }
 
         if (ret == 0) {
                 ret = brcmf_sdio_intr_register(bus->sdiodev);
@@ -3499,7 +3465,8 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
         brcmf_dbg(TIMER, "Enter\n");
 
         /* Poll period: check device if appropriate. */
-        if (bus->poll && (++bus->polltick >= bus->pollrate)) {
+        if (!bus->sr_enabled &&
+            bus->poll && (++bus->polltick >= bus->pollrate)) {
                 u32 intstatus = 0;
 
                 /* Reset poll tick */
@@ -3550,7 +3517,7 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                         bus->console.count -= bus->console_interval;
                         sdio_claim_host(bus->sdiodev->func[1]);
                         /* Make sure backplane clock is on */
-                        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+                        brcmf_sdbrcm_bus_sleep(bus, false, false);
                         if (brcmf_sdbrcm_readconsole(bus) < 0)
                                 /* stop on error */
                                 bus->console_interval = 0;
@@ -3567,8 +3534,9 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                                 bus->activity = false;
                                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
                         } else {
+                                brcmf_dbg(SDIO, "idle\n");
                                 sdio_claim_host(bus->sdiodev->func[1]);
-                                brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
+                                brcmf_sdbrcm_bus_sleep(bus, true, false);
                                 sdio_release_host(bus->sdiodev->func[1]);
                         }
                 }
@@ -3579,6 +3547,8 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
 
 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
 {
+        if (chipid == BCM43143_CHIP_ID)
+                return true;
         if (chipid == BCM43241_CHIP_ID)
                 return true;
         if (chipid == BCM4329_CHIP_ID)
@@ -3587,6 +3557,8 @@ static bool brcmf_sdbrcm_chipmatch(u16 chipid)
                 return true;
         if (chipid == BCM4334_CHIP_ID)
                 return true;
+        if (chipid == BCM4335_CHIP_ID)
+                return true;
         return false;
 }
 
@@ -3664,7 +3636,7 @@ brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
         int err = 0;
         int reg_addr;
         u32 reg_val;
-        u8 idx;
+        u32 drivestrength;
 
         bus->alp_only = true;
 
@@ -3700,8 +3672,16 @@ brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
                 goto fail;
         }
 
-        brcmf_sdio_chip_drivestrengthinit(bus->sdiodev, bus->ci,
-                                          SDIO_DRIVE_STRENGTH);
+        if (brcmf_sdbrcm_kso_init(bus)) {
+                brcmf_err("error enabling KSO\n");
+                goto fail;
+        }
+
+        if ((bus->sdiodev->pdata) && (bus->sdiodev->pdata->drive_strength))
+                drivestrength = bus->sdiodev->pdata->drive_strength;
+        else
+                drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
+        brcmf_sdio_chip_drivestrengthinit(bus->sdiodev, bus->ci, drivestrength);
 
         /* Get info on the SOCRAM cores... */
         bus->ramsize = bus->ci->ramsize;
@@ -3710,12 +3690,37 @@ brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
                 goto fail;
         }
 
-        /* Set core control so an SDIO reset does a backplane reset */
-        idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
-        reg_addr = bus->ci->c_inf[idx].base +
-                   offsetof(struct sdpcmd_regs, corecontrol);
-        reg_val = brcmf_sdio_regrl(bus->sdiodev, reg_addr, NULL);
-        brcmf_sdio_regwl(bus->sdiodev, reg_addr, reg_val | CC_BPRESEN, NULL);
+        /* Set card control so an SDIO card reset does a WLAN backplane reset */
+        reg_val = brcmf_sdio_regrb(bus->sdiodev,
+                                   SDIO_CCCR_BRCM_CARDCTRL, &err);
+        if (err)
+                goto fail;
+
+        reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
+
+        brcmf_sdio_regwb(bus->sdiodev,
+                         SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
+        if (err)
+                goto fail;
+
+        /* set PMUControl so a backplane reset does PMU state reload */
+        reg_addr = CORE_CC_REG(bus->ci->c_inf[0].base,
+                               pmucontrol);
+        reg_val = brcmf_sdio_regrl(bus->sdiodev,
+                                   reg_addr,
+                                   &err);
+        if (err)
+                goto fail;
+
+        reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
+
+        brcmf_sdio_regwl(bus->sdiodev,
+                         reg_addr,
+                         reg_val,
+                         &err);
+        if (err)
+                goto fail;
+
 
         sdio_release_host(bus->sdiodev->func[1]);
 
@@ -3769,6 +3774,10 @@ static bool brcmf_sdbrcm_probe_init(struct brcmf_sdio *bus)
         bus->use_rxchain = false;
         bus->sd_rxchain = false;
 
+        /* SR state */
+        bus->sleeping = false;
+        bus->sr_enabled = false;
+
         return true;
 }
 
@@ -3856,6 +3865,7 @@ static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
         .txdata = brcmf_sdbrcm_bus_txdata,
         .txctl = brcmf_sdbrcm_bus_txctl,
         .rxctl = brcmf_sdbrcm_bus_rxctl,
+        .gettxq = brcmf_sdbrcm_bus_gettxq,
 };
 
 void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
index e9d6f91a1f2b..5a64280e6485 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
@@ -20,6 +20,8 @@
 
 #include "dhd.h"
 #include "dhd_dbg.h"
+#include "tracepoint.h"
+#include "fwsignal.h"
 #include "fweh.h"
 #include "fwil.h"
 
@@ -154,7 +156,7 @@ static int brcmf_fweh_call_event_handler(struct brcmf_if *ifp,
                 fweh = &ifp->drvr->fweh;
 
                 /* handle the event if valid interface and handler */
-                if (ifp->ndev && fweh->evt_handler[code])
+                if (fweh->evt_handler[code])
                         err = fweh->evt_handler[code](ifp, emsg, data);
                 else
                         brcmf_err("unhandled event %d ignored\n", code);
@@ -179,9 +181,9 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr,
         struct brcmf_if *ifp;
         int err = 0;
 
-        brcmf_dbg(EVENT, "action: %u idx: %u bsscfg: %u flags: %u\n",
-                  ifevent->action, ifevent->ifidx,
-                  ifevent->bssidx, ifevent->flags);
+        brcmf_dbg(EVENT, "action: %u idx: %u bsscfg: %u flags: %u role: %u\n",
+                  ifevent->action, ifevent->ifidx, ifevent->bssidx,
+                  ifevent->flags, ifevent->role);
 
         if (ifevent->ifidx >= BRCMF_MAX_IFS) {
                 brcmf_err("invalid interface index: %u\n",
@@ -198,15 +200,20 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr,
                                    emsg->ifname, emsg->addr);
                 if (IS_ERR(ifp))
                         return;
-
+                brcmf_fws_add_interface(ifp);
                 if (!drvr->fweh.evt_handler[BRCMF_E_IF])
                         err = brcmf_net_attach(ifp, false);
         }
 
+        if (ifevent->action == BRCMF_E_IF_CHANGE)
+                brcmf_fws_reset_interface(ifp);
+
         err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data);
 
-        if (ifevent->action == BRCMF_E_IF_DEL)
+        if (ifevent->action == BRCMF_E_IF_DEL) {
+                brcmf_fws_del_interface(ifp);
                 brcmf_del_if(drvr, ifevent->bssidx);
+        }
 }
 
 /**
@@ -400,13 +407,12 @@ int brcmf_fweh_activate_events(struct brcmf_if *ifp)
  *
  * @drvr: driver information object.
  * @event_packet: event packet to process.
- * @ifidx: index of the firmware interface (may change).
  *
  * If the packet buffer contains a firmware event message it will
  * dispatch the event to a registered handler (using worker).
  */
 void brcmf_fweh_process_event(struct brcmf_pub *drvr,
-                              struct brcmf_event *event_packet, u8 *ifidx)
+                              struct brcmf_event *event_packet)
 {
         enum brcmf_fweh_event_code code;
         struct brcmf_fweh_info *fweh = &drvr->fweh;
@@ -418,7 +424,6 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr,
         /* get event info */
         code = get_unaligned_be32(&event_packet->msg.event_type);
         datalen = get_unaligned_be32(&event_packet->msg.datalen);
-        *ifidx = event_packet->msg.ifidx;
         data = &event_packet[1];
 
         if (code >= BRCMF_E_LAST)
@@ -435,7 +440,7 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr,
                 return;
 
         event->code = code;
-        event->ifidx = *ifidx;
+        event->ifidx = event_packet->msg.ifidx;
 
         /* use memcpy to get aligned event message */
         memcpy(&event->emsg, &event_packet->msg, sizeof(event->emsg));
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
index 8c39b51dcccf..6ec5db9c60a5 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
@@ -187,10 +187,10 @@ void brcmf_fweh_unregister(struct brcmf_pub *drvr,
                            enum brcmf_fweh_event_code code);
 int brcmf_fweh_activate_events(struct brcmf_if *ifp);
 void brcmf_fweh_process_event(struct brcmf_pub *drvr,
-                              struct brcmf_event *event_packet, u8 *ifidx);
+                              struct brcmf_event *event_packet);
 
 static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr,
-                                          struct sk_buff *skb, u8 *ifidx)
+                                          struct sk_buff *skb)
 {
         struct brcmf_event *event_packet;
         u8 *data;
@@ -213,7 +213,7 @@ static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr,
         if (usr_stype != BCMILCP_BCM_SUBTYPE_EVENT)
                 return;
 
-        brcmf_fweh_process_event(drvr, event_packet, ifidx);
+        brcmf_fweh_process_event(drvr, event_packet);
 }
 
 #endif /* FWEH_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
index 8d1def935b8d..04f395930d86 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
@@ -25,6 +25,7 @@
 #include "dhd.h"
 #include "dhd_bus.h"
 #include "dhd_dbg.h"
+#include "tracepoint.h"
 #include "fwil.h"
 
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
new file mode 100644
index 000000000000..1bcd58ce4a2f
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -0,0 +1,1948 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/if_ether.h>
+#include <linux/spinlock.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/err.h>
+#include <uapi/linux/nl80211.h>
+#include <net/cfg80211.h>
+
+#include <brcmu_utils.h>
+#include <brcmu_wifi.h>
+#include "dhd.h"
+#include "dhd_proto.h"
+#include "dhd_dbg.h"
+#include "dhd_bus.h"
+#include "fwil.h"
+#include "fwil_types.h"
+#include "fweh.h"
+#include "fwsignal.h"
+#include "p2p.h"
+#include "wl_cfg80211.h"
+
+/**
+ * DOC: Firmware Signalling
+ *
+ * Firmware can send signals to host and vice versa, which are passed in the
+ * data packets using TLV based header. This signalling layer is on top of the
+ * BDC bus protocol layer.
+ */
+
+/*
+ * single definition for firmware-driver flow control tlv's.
+ *
+ * each tlv is specified by BRCMF_FWS_TLV_DEF(name, ID, length).
+ * A length value 0 indicates variable length tlv.
+ */
+#define BRCMF_FWS_TLV_DEFLIST \
+        BRCMF_FWS_TLV_DEF(MAC_OPEN, 1, 1) \
+        BRCMF_FWS_TLV_DEF(MAC_CLOSE, 2, 1) \
+        BRCMF_FWS_TLV_DEF(MAC_REQUEST_CREDIT, 3, 2) \
+        BRCMF_FWS_TLV_DEF(TXSTATUS, 4, 4) \
+        BRCMF_FWS_TLV_DEF(PKTTAG, 5, 4) \
+        BRCMF_FWS_TLV_DEF(MACDESC_ADD,  6, 8) \
+        BRCMF_FWS_TLV_DEF(MACDESC_DEL, 7, 8) \
+        BRCMF_FWS_TLV_DEF(RSSI, 8, 1) \
+        BRCMF_FWS_TLV_DEF(INTERFACE_OPEN, 9, 1) \
+        BRCMF_FWS_TLV_DEF(INTERFACE_CLOSE, 10, 1) \
+        BRCMF_FWS_TLV_DEF(FIFO_CREDITBACK, 11, 6) \
+        BRCMF_FWS_TLV_DEF(PENDING_TRAFFIC_BMP, 12, 2) \
+        BRCMF_FWS_TLV_DEF(MAC_REQUEST_PACKET, 13, 3) \
+        BRCMF_FWS_TLV_DEF(HOST_REORDER_RXPKTS, 14, 10) \
+        BRCMF_FWS_TLV_DEF(TRANS_ID, 18, 6) \
+        BRCMF_FWS_TLV_DEF(COMP_TXSTATUS, 19, 1) \
+        BRCMF_FWS_TLV_DEF(FILLER, 255, 0)
+
+/*
+ * enum brcmf_fws_tlv_type - definition of tlv identifiers.
+ */
+#define BRCMF_FWS_TLV_DEF(name, id, len) \
+        BRCMF_FWS_TYPE_ ## name =  id,
+enum brcmf_fws_tlv_type {
+        BRCMF_FWS_TLV_DEFLIST
+        BRCMF_FWS_TYPE_INVALID
+};
+#undef BRCMF_FWS_TLV_DEF
+
+/*
+ * enum brcmf_fws_tlv_len - definition of tlv lengths.
+ */
+#define BRCMF_FWS_TLV_DEF(name, id, len) \
+        BRCMF_FWS_TYPE_ ## name ## _LEN = (len),
+enum brcmf_fws_tlv_len {
+        BRCMF_FWS_TLV_DEFLIST
+};
+#undef BRCMF_FWS_TLV_DEF
+
+#ifdef DEBUG
+/*
+ * brcmf_fws_tlv_names - array of tlv names.
+ */
+#define BRCMF_FWS_TLV_DEF(name, id, len) \
+        { id, #name },
+static struct {
+        enum brcmf_fws_tlv_type id;
+        const char *name;
+} brcmf_fws_tlv_names[] = {
+        BRCMF_FWS_TLV_DEFLIST
+};
+#undef BRCMF_FWS_TLV_DEF
+
+static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(brcmf_fws_tlv_names); i++)
+                if (brcmf_fws_tlv_names[i].id == id)
+                        return brcmf_fws_tlv_names[i].name;
+
+        return "INVALID";
+}
+#else
+static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
+{
+        return "NODEBUG";
+}
+#endif /* DEBUG */
+
+/*
+ * flags used to enable tlv signalling from firmware.
+ */
+#define BRCMF_FWS_FLAGS_RSSI_SIGNALS                    0x0001
+#define BRCMF_FWS_FLAGS_XONXOFF_SIGNALS                 0x0002
+#define BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS           0x0004
+#define BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE        0x0008
+#define BRCMF_FWS_FLAGS_PSQ_GENERATIONFSM_ENABLE        0x0010
+#define BRCMF_FWS_FLAGS_PSQ_ZERO_BUFFER_ENABLE          0x0020
+#define BRCMF_FWS_FLAGS_HOST_RXREORDER_ACTIVE           0x0040
+
+#define BRCMF_FWS_MAC_DESC_TABLE_SIZE                   32
+#define BRCMF_FWS_MAC_DESC_ID_INVALID                   0xff
+
+#define BRCMF_FWS_HOSTIF_FLOWSTATE_OFF                  0
+#define BRCMF_FWS_HOSTIF_FLOWSTATE_ON                   1
+#define BRCMF_FWS_FLOWCONTROL_HIWATER                   128
+#define BRCMF_FWS_FLOWCONTROL_LOWATER                   64
+
+#define BRCMF_FWS_PSQ_PREC_COUNT                ((NL80211_NUM_ACS + 1) * 2)
+#define BRCMF_FWS_PSQ_LEN                               256
+
+#define BRCMF_FWS_HTOD_FLAG_PKTFROMHOST                 0x01
+#define BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED               0x02
+
+/**
+ * enum brcmf_fws_skb_state - indicates processing state of skb.
+ *
+ * @BRCMF_FWS_SKBSTATE_NEW: sk_buff is newly arrived in the driver.
+ * @BRCMF_FWS_SKBSTATE_DELAYED: sk_buff had to wait on queue.
+ * @BRCMF_FWS_SKBSTATE_SUPPRESSED: sk_buff has been suppressed by firmware.
+ */
+enum brcmf_fws_skb_state {
+        BRCMF_FWS_SKBSTATE_NEW,
+        BRCMF_FWS_SKBSTATE_DELAYED,
+        BRCMF_FWS_SKBSTATE_SUPPRESSED
+};
+
+/**
+ * struct brcmf_skbuff_cb - control buffer associated with skbuff.
+ *
+ * @if_flags: holds interface index and packet related flags.
+ * @htod: host to device packet identifier (used in PKTTAG tlv).
+ * @state: transmit state of the packet.
+ * @mac: descriptor related to destination for this packet.
+ *
+ * This information is stored in control buffer struct sk_buff::cb, which
+ * provides 48 bytes of storage so this structure should not exceed that.
+ */
+struct brcmf_skbuff_cb {
+        u16 if_flags;
+        u32 htod;
+        enum brcmf_fws_skb_state state;
+        struct brcmf_fws_mac_descriptor *mac;
+};
+
+/*
+ * macro casting skbuff control buffer to struct brcmf_skbuff_cb.
+ */
+#define brcmf_skbcb(skb)        ((struct brcmf_skbuff_cb *)((skb)->cb))
+
+/*
+ * sk_buff control if flags
+ *
+ *      b[11]  - packet sent upon firmware request.
+ *      b[10]  - packet only contains signalling data.
+ *      b[9]   - packet is a tx packet.
+ *      b[8]   - packet uses FIFO credit (non-pspoll).
+ *      b[7]   - interface in AP mode.
+ *      b[6:4] - AC FIFO number.
+ *      b[3:0] - interface index.
+ */
+#define BRCMF_SKB_IF_FLAGS_REQUESTED_MASK       0x0800
+#define BRCMF_SKB_IF_FLAGS_REQUESTED_SHIFT      11
+#define BRCMF_SKB_IF_FLAGS_SIGNAL_ONLY_MASK     0x0400
+#define BRCMF_SKB_IF_FLAGS_SIGNAL_ONLY_SHIFT    10
+#define BRCMF_SKB_IF_FLAGS_TRANSMIT_MASK        0x0200
+#define BRCMF_SKB_IF_FLAGS_TRANSMIT_SHIFT       9
+#define BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK     0x0100
+#define BRCMF_SKB_IF_FLAGS_CREDITCHECK_SHIFT    8
+#define BRCMF_SKB_IF_FLAGS_IF_AP_MASK           0x0080
+#define BRCMF_SKB_IF_FLAGS_IF_AP_SHIFT          7
+#define BRCMF_SKB_IF_FLAGS_FIFO_MASK            0x0070
+#define BRCMF_SKB_IF_FLAGS_FIFO_SHIFT           4
+#define BRCMF_SKB_IF_FLAGS_INDEX_MASK           0x000f
+#define BRCMF_SKB_IF_FLAGS_INDEX_SHIFT          0
+
+#define brcmf_skb_if_flags_set_field(skb, field, value) \
+        brcmu_maskset16(&(brcmf_skbcb(skb)->if_flags), \
+                        BRCMF_SKB_IF_FLAGS_ ## field ## _MASK, \
+                        BRCMF_SKB_IF_FLAGS_ ## field ## _SHIFT, (value))
+#define brcmf_skb_if_flags_get_field(skb, field) \
+        brcmu_maskget16(brcmf_skbcb(skb)->if_flags, \
+                        BRCMF_SKB_IF_FLAGS_ ## field ## _MASK, \
+                        BRCMF_SKB_IF_FLAGS_ ## field ## _SHIFT)
+
+/*
+ * sk_buff control packet identifier
+ *
+ * 32-bit packet identifier used in PKTTAG tlv from host to dongle.
+ *
+ * - Generated at the host (e.g. dhd)
+ * - Seen as a generic sequence number by firmware except for the flags field.
+ *
+ * Generation   : b[31] => generation number for this packet [host->fw]
+ *                         OR, current generation number [fw->host]
+ * Flags        : b[30:27] => command, status flags
+ * FIFO-AC      : b[26:24] => AC-FIFO id
+ * h-slot       : b[23:8] => hanger-slot
+ * freerun      : b[7:0] => A free running counter
+ */
+#define BRCMF_SKB_HTOD_TAG_GENERATION_MASK              0x80000000
+#define BRCMF_SKB_HTOD_TAG_GENERATION_SHIFT             31
+#define BRCMF_SKB_HTOD_TAG_FLAGS_MASK                   0x78000000
+#define BRCMF_SKB_HTOD_TAG_FLAGS_SHIFT                  27
+#define BRCMF_SKB_HTOD_TAG_FIFO_MASK                    0x07000000
+#define BRCMF_SKB_HTOD_TAG_FIFO_SHIFT                   24
+#define BRCMF_SKB_HTOD_TAG_HSLOT_MASK                   0x00ffff00
+#define BRCMF_SKB_HTOD_TAG_HSLOT_SHIFT                  8
+#define BRCMF_SKB_HTOD_TAG_FREERUN_MASK                 0x000000ff
+#define BRCMF_SKB_HTOD_TAG_FREERUN_SHIFT                        0
+
+#define brcmf_skb_htod_tag_set_field(skb, field, value) \
+        brcmu_maskset32(&(brcmf_skbcb(skb)->htod), \
+                        BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
+                        BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT, (value))
+#define brcmf_skb_htod_tag_get_field(skb, field) \
+        brcmu_maskget32(brcmf_skbcb(skb)->htod, \
+                        BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
+                        BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT)
+
+#define BRCMF_FWS_TXSTAT_GENERATION_MASK        0x80000000
+#define BRCMF_FWS_TXSTAT_GENERATION_SHIFT       31
+#define BRCMF_FWS_TXSTAT_FLAGS_MASK             0x78000000
+#define BRCMF_FWS_TXSTAT_FLAGS_SHIFT            27
+#define BRCMF_FWS_TXSTAT_FIFO_MASK              0x07000000
+#define BRCMF_FWS_TXSTAT_FIFO_SHIFT             24
+#define BRCMF_FWS_TXSTAT_HSLOT_MASK             0x00FFFF00
+#define BRCMF_FWS_TXSTAT_HSLOT_SHIFT            8
+#define BRCMF_FWS_TXSTAT_PKTID_MASK             0x00FFFFFF
+#define BRCMF_FWS_TXSTAT_PKTID_SHIFT            0
+
+#define brcmf_txstatus_get_field(txs, field) \
+        brcmu_maskget32(txs, BRCMF_FWS_TXSTAT_ ## field ## _MASK, \
+                        BRCMF_FWS_TXSTAT_ ## field ## _SHIFT)
+
+/**
+ * enum brcmf_fws_fifo - fifo indices used by dongle firmware.
+ *
+ * @BRCMF_FWS_FIFO_AC_BK: fifo for background traffic.
+ * @BRCMF_FWS_FIFO_AC_BE: fifo for best-effort traffic.
+ * @BRCMF_FWS_FIFO_AC_VI: fifo for video traffic.
+ * @BRCMF_FWS_FIFO_AC_VO: fifo for voice traffic.
+ * @BRCMF_FWS_FIFO_BCMC: fifo for broadcast/multicast (AP only).
+ * @BRCMF_FWS_FIFO_ATIM: fifo for ATIM (AP only).
+ * @BRCMF_FWS_FIFO_COUNT: number of fifos.
+ */
+enum brcmf_fws_fifo {
+        BRCMF_FWS_FIFO_AC_BK,
+        BRCMF_FWS_FIFO_AC_BE,
+        BRCMF_FWS_FIFO_AC_VI,
+        BRCMF_FWS_FIFO_AC_VO,
+        BRCMF_FWS_FIFO_BCMC,
+        BRCMF_FWS_FIFO_ATIM,
+        BRCMF_FWS_FIFO_COUNT
+};
+
+/**
+ * enum brcmf_fws_txstatus - txstatus flag values.
+ *
+ * @BRCMF_FWS_TXSTATUS_DISCARD:
+ *      host is free to discard the packet.
+ * @BRCMF_FWS_TXSTATUS_CORE_SUPPRESS:
+ *      802.11 core suppressed the packet.
+ * @BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS:
+ *      firmware suppress the packet as device is already in PS mode.
+ * @BRCMF_FWS_TXSTATUS_FW_TOSSED:
+ *      firmware tossed the packet.
+ */
+enum brcmf_fws_txstatus {
+        BRCMF_FWS_TXSTATUS_DISCARD,
+        BRCMF_FWS_TXSTATUS_CORE_SUPPRESS,
+        BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS,
+        BRCMF_FWS_TXSTATUS_FW_TOSSED
+};
+
+enum brcmf_fws_fcmode {
+        BRCMF_FWS_FCMODE_NONE,
+        BRCMF_FWS_FCMODE_IMPLIED_CREDIT,
+        BRCMF_FWS_FCMODE_EXPLICIT_CREDIT
+};
+
+enum brcmf_fws_mac_desc_state {
+        BRCMF_FWS_STATE_OPEN = 1,
+        BRCMF_FWS_STATE_CLOSE
+};
+
+/**
+ * struct brcmf_fws_mac_descriptor - firmware signalling data per node/interface
+ *
+ * @occupied: slot is in use.
+ * @mac_handle: handle for mac entry determined by firmware.
+ * @interface_id: interface index.
+ * @state: current state.
+ * @suppressed: mac entry is suppressed.
+ * @generation: generation bit.
+ * @ac_bitmap: ac queue bitmap.
+ * @requested_credit: credits requested by firmware.
+ * @ea: ethernet address.
+ * @seq: per-node free-running sequence.
+ * @psq: power-save queue.
+ * @transit_count: packet in transit to firmware.
+ */
+struct brcmf_fws_mac_descriptor {
+        u8 occupied;
+        u8 mac_handle;
+        u8 interface_id;
+        u8 state;
+        bool suppressed;
+        u8 generation;
+        u8 ac_bitmap;
+        u8 requested_credit;
+        u8 requested_packet;
+        u8 ea[ETH_ALEN];
+        u8 seq[BRCMF_FWS_FIFO_COUNT];
+        struct pktq psq;
+        int transit_count;
+        int suppress_count;
+        int suppr_transit_count;
+        bool send_tim_signal;
+        u8 traffic_pending_bmp;
+        u8 traffic_lastreported_bmp;
+};
+
+#define BRCMF_FWS_HANGER_MAXITEMS       1024
+
+/**
+ * enum brcmf_fws_hanger_item_state - state of hanger item.
+ *
+ * @BRCMF_FWS_HANGER_ITEM_STATE_FREE: item is free for use.
+ * @BRCMF_FWS_HANGER_ITEM_STATE_INUSE: item is in use.
+ * @BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED: item was suppressed.
+ */
+enum brcmf_fws_hanger_item_state {
+        BRCMF_FWS_HANGER_ITEM_STATE_FREE = 1,
+        BRCMF_FWS_HANGER_ITEM_STATE_INUSE,
+        BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED
+};
+
+
+/**
+ * struct brcmf_fws_hanger_item - single entry for tx pending packet.
+ *
+ * @state: entry is either free or occupied.
+ * @gen: generation.
+ * @pkt: packet itself.
+ */
+struct brcmf_fws_hanger_item {
+        enum brcmf_fws_hanger_item_state state;
+        u8 gen;
+        struct sk_buff *pkt;
+};
+
+/**
+ * struct brcmf_fws_hanger - holds packets awaiting firmware txstatus.
+ *
+ * @pushed: packets pushed to await txstatus.
+ * @popped: packets popped upon handling txstatus.
+ * @failed_to_push: packets that could not be pushed.
+ * @failed_to_pop: packets that could not be popped.
+ * @failed_slotfind: packets for which failed to find an entry.
+ * @slot_pos: last returned item index for a free entry.
+ * @items: array of hanger items.
+ */
+struct brcmf_fws_hanger {
+        u32 pushed;
+        u32 popped;
+        u32 failed_to_push;
+        u32 failed_to_pop;
+        u32 failed_slotfind;
+        u32 slot_pos;
+        struct brcmf_fws_hanger_item items[BRCMF_FWS_HANGER_MAXITEMS];
+};
+
+struct brcmf_fws_macdesc_table {
+        struct brcmf_fws_mac_descriptor nodes[BRCMF_FWS_MAC_DESC_TABLE_SIZE];
+        struct brcmf_fws_mac_descriptor iface[BRCMF_MAX_IFS];
+        struct brcmf_fws_mac_descriptor other;
+};
+
+struct brcmf_fws_info {
+        struct brcmf_pub *drvr;
+        struct brcmf_fws_stats stats;
+        struct brcmf_fws_hanger hanger;
+        enum brcmf_fws_fcmode fcmode;
+        struct brcmf_fws_macdesc_table desc;
+        struct workqueue_struct *fws_wq;
+        struct work_struct fws_dequeue_work;
+        u32 fifo_enqpkt[BRCMF_FWS_FIFO_COUNT];
+        int fifo_credit[BRCMF_FWS_FIFO_COUNT];
+        int deq_node_pos[BRCMF_FWS_FIFO_COUNT];
+        u32 fifo_credit_map;
+        u32 fifo_delay_map;
+};
+
+/*
+ * brcmf_fws_prio2fifo - mapping from 802.1d priority to firmware fifo index.
+ */
+static const int brcmf_fws_prio2fifo[] = {
+        BRCMF_FWS_FIFO_AC_BE,
+        BRCMF_FWS_FIFO_AC_BK,
+        BRCMF_FWS_FIFO_AC_BK,
+        BRCMF_FWS_FIFO_AC_BE,
+        BRCMF_FWS_FIFO_AC_VI,
+        BRCMF_FWS_FIFO_AC_VI,
+        BRCMF_FWS_FIFO_AC_VO,
+        BRCMF_FWS_FIFO_AC_VO
+};
+
+static int fcmode;
+module_param(fcmode, int, S_IRUSR);
+MODULE_PARM_DESC(fcmode, "mode of firmware signalled flow control");
+
+#define BRCMF_FWS_TLV_DEF(name, id, len) \
+        case BRCMF_FWS_TYPE_ ## name: \
+                return len;
+
+/**
+ * brcmf_fws_get_tlv_len() - returns defined length for given tlv id.
+ *
+ * @fws: firmware-signalling information.
+ * @id: identifier of the TLV.
+ *
+ * Return: the specified length for the given TLV; Otherwise -EINVAL.
+ */
+static int brcmf_fws_get_tlv_len(struct brcmf_fws_info *fws,
+                                 enum brcmf_fws_tlv_type id)
+{
+        switch (id) {
+        BRCMF_FWS_TLV_DEFLIST
+        default:
+                fws->stats.tlv_invalid_type++;
+                break;
+        }
+        return -EINVAL;
+}
+#undef BRCMF_FWS_TLV_DEF
+
+static bool brcmf_fws_ifidx_match(struct sk_buff *skb, void *arg)
+{
+        u32 ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
+        return ifidx == *(int *)arg;
+}
+
+static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
+                                int ifidx)
+{
+        bool (*matchfn)(struct sk_buff *, void *) = NULL;
+        struct sk_buff *skb;
+        int prec;
+
+        if (ifidx != -1)
+                matchfn = brcmf_fws_ifidx_match;
+        for (prec = 0; prec < q->num_prec; prec++) {
+                skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+                while (skb) {
+                        brcmu_pkt_buf_free_skb(skb);
+                        skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+                }
+        }
+}
+
+static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
+{
+        int i;
+
+        brcmf_dbg(TRACE, "enter\n");
+        memset(hanger, 0, sizeof(*hanger));
+        for (i = 0; i < ARRAY_SIZE(hanger->items); i++)
+                hanger->items[i].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
+}
+
+static u32 brcmf_fws_hanger_get_free_slot(struct brcmf_fws_hanger *h)
+{
+        u32 i;
+
+        brcmf_dbg(TRACE, "enter\n");
+        i = (h->slot_pos + 1) % BRCMF_FWS_HANGER_MAXITEMS;
+
+        while (i != h->slot_pos) {
+                if (h->items[i].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
+                        h->slot_pos = i;
+                        goto done;
+                }
+                i++;
+                if (i == BRCMF_FWS_HANGER_MAXITEMS)
+                        i = 0;
+        }
+        brcmf_err("all slots occupied\n");
+        h->failed_slotfind++;
+        i = BRCMF_FWS_HANGER_MAXITEMS;
+done:
+        brcmf_dbg(TRACE, "exit: %d\n", i);
+        return i;
+}
+
+static int brcmf_fws_hanger_pushpkt(struct brcmf_fws_hanger *h,
+                                           struct sk_buff *pkt, u32 slot_id)
+{
+        brcmf_dbg(TRACE, "enter\n");
+        if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
+                return -ENOENT;
+
+        if (h->items[slot_id].state != BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
+                brcmf_err("slot is not free\n");
+                h->failed_to_push++;
+                return -EINVAL;
+        }
+
+        h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE;
+        h->items[slot_id].pkt = pkt;
+        h->pushed++;
+        return 0;
+}
+
+static int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
+                                          u32 slot_id, struct sk_buff **pktout,
+                                          bool remove_item)
+{
+        brcmf_dbg(TRACE, "enter\n");
+        if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
+                return -ENOENT;
+
+        if (h->items[slot_id].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
+                brcmf_err("entry not in use\n");
+                h->failed_to_pop++;
+                return -EINVAL;
+        }
+
+        *pktout = h->items[slot_id].pkt;
+        if (remove_item) {
+                h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
+                h->items[slot_id].pkt = NULL;
+                h->items[slot_id].gen = 0xff;
+                h->popped++;
+        }
+        return 0;
+}
+
+static int brcmf_fws_hanger_mark_suppressed(struct brcmf_fws_hanger *h,
+                                                   u32 slot_id, u8 gen)
+{
+        brcmf_dbg(TRACE, "enter\n");
+
+        if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
+                return -ENOENT;
+
+        h->items[slot_id].gen = gen;
+
+        if (h->items[slot_id].state != BRCMF_FWS_HANGER_ITEM_STATE_INUSE) {
+                brcmf_err("entry not in use\n");
+                return -EINVAL;
+        }
+
+        h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED;
+        return 0;
+}
+
+static int brcmf_fws_hanger_get_genbit(struct brcmf_fws_hanger *hanger,
+                                              struct sk_buff *pkt, u32 slot_id,
+                                              int *gen)
+{
+        brcmf_dbg(TRACE, "enter\n");
+        *gen = 0xff;
+
+        if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
+                return -ENOENT;
+
+        if (hanger->items[slot_id].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
+                brcmf_err("slot not in use\n");
+                return -EINVAL;
+        }
+
+        *gen = hanger->items[slot_id].gen;
+        return 0;
+}
+
+static void brcmf_fws_hanger_cleanup(struct brcmf_fws_info *fws,
+                                     bool (*fn)(struct sk_buff *, void *),
+                                     int ifidx)
+{
+        struct brcmf_fws_hanger *h = &fws->hanger;
+        struct sk_buff *skb;
+        int i;
+        enum brcmf_fws_hanger_item_state s;
+
+        brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
+        for (i = 0; i < ARRAY_SIZE(h->items); i++) {
+                s = h->items[i].state;
+                if (s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE ||
+                    s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED) {
+                        skb = h->items[i].pkt;
+                        if (fn == NULL || fn(skb, &ifidx)) {
+                                /* suppress packets freed from psq */
+                                if (s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE)
+                                        brcmu_pkt_buf_free_skb(skb);
+                                h->items[i].state =
+                                        BRCMF_FWS_HANGER_ITEM_STATE_FREE;
+                        }
+                }
+        }
+}
+
+static void brcmf_fws_init_mac_descriptor(struct brcmf_fws_mac_descriptor *desc,
+                                          u8 *addr, u8 ifidx)
+{
+        brcmf_dbg(TRACE,
+                  "enter: desc %p ea=%pM, ifidx=%u\n", desc, addr, ifidx);
+        desc->occupied = 1;
+        desc->state = BRCMF_FWS_STATE_OPEN;
+        desc->requested_credit = 0;
+        /* depending on use may need ifp->bssidx instead */
+        desc->interface_id = ifidx;
+        desc->ac_bitmap = 0xff; /* update this when handling APSD */
+        if (addr)
+                memcpy(&desc->ea[0], addr, ETH_ALEN);
+}
+
+static
+void brcmf_fws_clear_mac_descriptor(struct brcmf_fws_mac_descriptor *desc)
+{
+        brcmf_dbg(TRACE,
+                  "enter: ea=%pM, ifidx=%u\n", desc->ea, desc->interface_id);
+        desc->occupied = 0;
+        desc->state = BRCMF_FWS_STATE_CLOSE;
+        desc->requested_credit = 0;
+}
+
+static struct brcmf_fws_mac_descriptor *
+brcmf_fws_mac_descriptor_lookup(struct brcmf_fws_info *fws, u8 *ea)
+{
+        struct brcmf_fws_mac_descriptor *entry;
+        int i;
+
+        brcmf_dbg(TRACE, "enter: ea=%pM\n", ea);
+        if (ea == NULL)
+                return ERR_PTR(-EINVAL);
+
+        entry = &fws->desc.nodes[0];
+        for (i = 0; i < ARRAY_SIZE(fws->desc.nodes); i++) {
+                if (entry->occupied && !memcmp(entry->ea, ea, ETH_ALEN))
+                        return entry;
+                entry++;
+        }
+
+        return ERR_PTR(-ENOENT);
+}
+
+static struct brcmf_fws_mac_descriptor*
+brcmf_fws_find_mac_desc(struct brcmf_fws_info *fws, struct brcmf_if *ifp,
+                        u8 *da)
+{
+        struct brcmf_fws_mac_descriptor *entry = &fws->desc.other;
+        bool multicast;
+        enum nl80211_iftype iftype;
+
+        brcmf_dbg(TRACE, "enter: idx=%d\n", ifp->bssidx);
+
+        multicast = is_multicast_ether_addr(da);
+        iftype = brcmf_cfg80211_get_iftype(ifp);
+
+        /* Multicast destination and P2P clients get the interface entry.
+         * STA gets the interface entry if there is no exact match. For
+         * example, TDLS destinations have their own entry.
+         */
+        entry = NULL;
+        if ((multicast || iftype == NL80211_IFTYPE_STATION ||
+             iftype == NL80211_IFTYPE_P2P_CLIENT) && ifp->fws_desc)
+                entry = ifp->fws_desc;
+
+        if (entry != NULL && iftype != NL80211_IFTYPE_STATION)
+                goto done;
+
+        entry = brcmf_fws_mac_descriptor_lookup(fws, da);
+        if (IS_ERR(entry))
+                entry = &fws->desc.other;
+
+done:
+        brcmf_dbg(TRACE, "exit: entry=%p\n", entry);
+        return entry;
+}
+
+static bool brcmf_fws_mac_desc_closed(struct brcmf_fws_mac_descriptor *entry,
+                                      int fifo)
+{
+        bool closed;
+
+        /* an entry is closed when the state is closed and
+         * the firmware did not request anything.
+         */
+        closed = entry->state == BRCMF_FWS_STATE_CLOSE &&
+                 !entry->requested_credit && !entry->requested_packet;
+
+        /* Or firmware does not allow traffic for given fifo */
+        return closed || !(entry->ac_bitmap & BIT(fifo));
+}
+
+static void brcmf_fws_mac_desc_cleanup(struct brcmf_fws_info *fws,
+                                       struct brcmf_fws_mac_descriptor *entry,
+                                       int ifidx)
+{
+        brcmf_dbg(TRACE, "enter: entry=(ea=%pM, ifid=%d), ifidx=%d\n",
+                  entry->ea, entry->interface_id, ifidx);
+        if (entry->occupied && (ifidx == -1 || ifidx == entry->interface_id)) {
+                brcmf_dbg(TRACE, "flush psq: ifidx=%d, qlen=%d\n",
+                          ifidx, entry->psq.len);
+                brcmf_fws_psq_flush(fws, &entry->psq, ifidx);
+                entry->occupied = !!(entry->psq.len);
+        }
+}
+
+static void brcmf_fws_bus_txq_cleanup(struct brcmf_fws_info *fws,
+                                      bool (*fn)(struct sk_buff *, void *),
+                                      int ifidx)
+{
+        struct brcmf_fws_hanger_item *hi;
+        struct pktq *txq;
+        struct sk_buff *skb;
+        int prec;
+        u32 hslot;
+
+        brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
+        txq = brcmf_bus_gettxq(fws->drvr->bus_if);
+        if (IS_ERR(txq)) {
+                brcmf_dbg(TRACE, "no txq to clean up\n");
+                return;
+        }
+
+        for (prec = 0; prec < txq->num_prec; prec++) {
+                skb = brcmu_pktq_pdeq_match(txq, prec, fn, &ifidx);
+                while (skb) {
+                        hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
+                        hi = &fws->hanger.items[hslot];
+                        WARN_ON(skb != hi->pkt);
+                        hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
+                        brcmu_pkt_buf_free_skb(skb);
+                        skb = brcmu_pktq_pdeq_match(txq, prec, fn, &ifidx);
+                }
+        }
+}
+
+static void brcmf_fws_cleanup(struct brcmf_fws_info *fws, int ifidx)
+{
+        int i;
+        struct brcmf_fws_mac_descriptor *table;
+        bool (*matchfn)(struct sk_buff *, void *) = NULL;
+
+        brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
+        if (fws == NULL)
+                return;
+
+        if (ifidx != -1)
+                matchfn = brcmf_fws_ifidx_match;
+
+        /* cleanup individual nodes */
+        table = &fws->desc.nodes[0];
+        for (i = 0; i < ARRAY_SIZE(fws->desc.nodes); i++)
+                brcmf_fws_mac_desc_cleanup(fws, &table[i], ifidx);
+
+        brcmf_fws_mac_desc_cleanup(fws, &fws->desc.other, ifidx);
+        brcmf_fws_bus_txq_cleanup(fws, matchfn, ifidx);
+        brcmf_fws_hanger_cleanup(fws, matchfn, ifidx);
+}
+
+static void brcmf_fws_tim_update(struct brcmf_fws_info *ctx,
+                                 struct brcmf_fws_mac_descriptor *entry,
+                                 int prec)
+{
+        brcmf_dbg(TRACE, "enter: ea=%pM\n", entry->ea);
+        if (entry->state == BRCMF_FWS_STATE_CLOSE) {
+                /* check delayedQ and suppressQ in one call using bitmap */
+                if (brcmu_pktq_mlen(&entry->psq, 3 << (prec * 2)) == 0)
+                        entry->traffic_pending_bmp =
+                                entry->traffic_pending_bmp & ~NBITVAL(prec);
+                else
+                        entry->traffic_pending_bmp =
+                                entry->traffic_pending_bmp | NBITVAL(prec);
+        }
+        /* request a TIM update to firmware at the next piggyback opportunity */
+        if (entry->traffic_lastreported_bmp != entry->traffic_pending_bmp)
+                entry->send_tim_signal = true;
+}
+
+static void
+brcmf_fws_flow_control_check(struct brcmf_fws_info *fws, struct pktq *pq,
+                             u8 if_id)
+{
+        struct brcmf_if *ifp = fws->drvr->iflist[if_id];
+
+        brcmf_dbg(TRACE,
+                  "enter: bssidx=%d, ifidx=%d\n", ifp->bssidx, ifp->ifidx);
+        if (WARN_ON(!ifp))
+                return;
+
+        if ((ifp->netif_stop & BRCMF_NETIF_STOP_REASON_FWS_FC) &&
+            pq->len <= BRCMF_FWS_FLOWCONTROL_LOWATER)
+                brcmf_txflowblock_if(ifp,
+                                     BRCMF_NETIF_STOP_REASON_FWS_FC, false);
+        if (!(ifp->netif_stop & BRCMF_NETIF_STOP_REASON_FWS_FC) &&
+            pq->len >= BRCMF_FWS_FLOWCONTROL_HIWATER)
+                brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FWS_FC, true);
+        return;
+}
+
+static int brcmf_fws_rssi_indicate(struct brcmf_fws_info *fws, s8 rssi)
+{
+        brcmf_dbg(CTL, "rssi %d\n", rssi);
+        return 0;
+}
+
+static
+int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
+{
+        struct brcmf_fws_mac_descriptor *entry, *existing;
+        u8 mac_handle;
+        u8 ifidx;
+        u8 *addr;
+
+        mac_handle = *data++;
+        ifidx = *data++;
+        addr = data;
+
+        entry = &fws->desc.nodes[mac_handle & 0x1F];
+        if (type == BRCMF_FWS_TYPE_MACDESC_DEL) {
+                brcmf_dbg(TRACE, "deleting mac %pM idx %d\n", addr, ifidx);
+                if (entry->occupied)
+                        brcmf_fws_clear_mac_descriptor(entry);
+                else
+                        fws->stats.mac_update_failed++;
+                return 0;
+        }
+
+        brcmf_dbg(TRACE,
+                  "add mac %pM handle %u idx %d\n", addr, mac_handle, ifidx);
+        existing = brcmf_fws_mac_descriptor_lookup(fws, addr);
+        if (IS_ERR(existing)) {
+                if (!entry->occupied) {
+                        entry->mac_handle = mac_handle;
+                        brcmf_fws_init_mac_descriptor(entry, addr, ifidx);
+                        brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
+                                        BRCMF_FWS_PSQ_LEN);
+                } else {
+                        fws->stats.mac_update_failed++;
+                }
+        } else {
+                if (entry != existing) {
+                        brcmf_dbg(TRACE, "relocate mac\n");
+                        memcpy(entry, existing,
+                               offsetof(struct brcmf_fws_mac_descriptor, psq));
+                        entry->mac_handle = mac_handle;
+                        brcmf_fws_clear_mac_descriptor(existing);
+                } else {
+                        brcmf_dbg(TRACE, "use existing\n");
+                        WARN_ON(entry->mac_handle != mac_handle);
+                        /* TODO: what should we do here: continue, reinit, .. */
+                }
+        }
+        return 0;
+}
+
+static int brcmf_fws_macdesc_state_indicate(struct brcmf_fws_info *fws,
+                                            u8 type, u8 *data)
+{
+        struct brcmf_fws_mac_descriptor *entry;
+        u8 mac_handle;
+        int i;
+
+        mac_handle = data[0];
+        entry = &fws->desc.nodes[mac_handle & 0x1F];
+        if (!entry->occupied) {
+                fws->stats.mac_ps_update_failed++;
+                return -ESRCH;
+        }
+
+        /* a state update should wipe old credits? */
+        entry->requested_credit = 0;
+        if (type == BRCMF_FWS_TYPE_MAC_OPEN) {
+                entry->state = BRCMF_FWS_STATE_OPEN;
+        } else {
+                entry->state = BRCMF_FWS_STATE_CLOSE;
+                for (i = BRCMF_FWS_FIFO_AC_BE; i < NL80211_NUM_ACS; i++)
+                        brcmf_fws_tim_update(fws, entry, i);
+        }
+        return 0;
+}
+
+static int brcmf_fws_interface_state_indicate(struct brcmf_fws_info *fws,
+                                              u8 type, u8 *data)
+{
+        struct brcmf_fws_mac_descriptor *entry;
+        u8 ifidx;
+        int ret;
+
+        ifidx = data[0];
+
+        brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
+        if (ifidx >= BRCMF_MAX_IFS) {
+                ret = -ERANGE;
+                goto fail;
+        }
+
+        entry = &fws->desc.iface[ifidx];
+        if (!entry->occupied) {
+                ret = -ESRCH;
+                goto fail;
+        }
+
+        switch (type) {
+        case BRCMF_FWS_TYPE_INTERFACE_OPEN:
+                entry->state = BRCMF_FWS_STATE_OPEN;
+                return 0;
+        case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
+                entry->state = BRCMF_FWS_STATE_CLOSE;
+                return 0;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+fail:
+        fws->stats.if_update_failed++;
+        return ret;
+}
+
+static int brcmf_fws_request_indicate(struct brcmf_fws_info *fws, u8 type,
+                                      u8 *data)
+{
+        struct brcmf_fws_mac_descriptor *entry;
+
+        entry = &fws->desc.nodes[data[1] & 0x1F];
+        if (!entry->occupied) {
+                if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
+                        fws->stats.credit_request_failed++;
+                else
+                        fws->stats.packet_request_failed++;
+                return -ESRCH;
+        }
+
+        if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
+                entry->requested_credit = data[0];
+        else
+                entry->requested_packet = data[0];
+
+        entry->ac_bitmap = data[2];
+        return 0;
+}
+
+static void brcmf_fws_return_credits(struct brcmf_fws_info *fws,
+                                     u8 fifo, u8 credits)
+{
+        if (!credits)
+                return;
+
+        fws->fifo_credit_map |= 1 << fifo;
+        fws->fifo_credit[fifo] += credits;
+}
+
+static void brcmf_fws_schedule_deq(struct brcmf_fws_info *fws)
+{
+        /* only schedule dequeue when there are credits for delayed traffic */
+        if (fws->fifo_credit_map & fws->fifo_delay_map)
+                queue_work(fws->fws_wq, &fws->fws_dequeue_work);
+}
+
+static void brcmf_skb_pick_up_credit(struct brcmf_fws_info *fws, int fifo,
+                                     struct sk_buff *p)
+{
+        struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(p)->mac;
+
+        if (brcmf_skbcb(p)->if_flags & BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK) {
+                if (fws->fcmode != BRCMF_FWS_FCMODE_IMPLIED_CREDIT)
+                        return;
+                brcmf_fws_return_credits(fws, fifo, 1);
+        } else {
+                /*
+                 * if this packet did not count against FIFO credit, it
+                 * must have taken a requested_credit from the destination
+                 * entry (for pspoll etc.)
+                 */
+                if (!brcmf_skb_if_flags_get_field(p, REQUESTED))
+                        entry->requested_credit++;
+        }
+        brcmf_fws_schedule_deq(fws);
+}
+
+static int brcmf_fws_enq(struct brcmf_fws_info *fws,
+                         enum brcmf_fws_skb_state state, int fifo,
+                         struct sk_buff *p)
+{
+        int prec = 2 * fifo;
+        u32 *qfull_stat = &fws->stats.delayq_full_error;
+
+        struct brcmf_fws_mac_descriptor *entry;
+
+        entry = brcmf_skbcb(p)->mac;
+        if (entry == NULL) {
+                brcmf_err("no mac descriptor found for skb %p\n", p);
+                return -ENOENT;
+        }
+
+        brcmf_dbg(TRACE, "enter: ea=%pM, qlen=%d\n", entry->ea, entry->psq.len);
+        if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED) {
+                prec += 1;
+                qfull_stat = &fws->stats.supprq_full_error;
+        }
+
+        if (brcmu_pktq_penq(&entry->psq, prec, p) == NULL) {
+                *qfull_stat += 1;
+                return -ENFILE;
+        }
+
+        /* increment total enqueued packet count */
+        fws->fifo_delay_map |= 1 << fifo;
+        fws->fifo_enqpkt[fifo]++;
+
+        /* update the sk_buff state */
+        brcmf_skbcb(p)->state = state;
+        if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED)
+                entry->suppress_count++;
+
+        /*
+         * A packet has been pushed so update traffic
+         * availability bitmap, if applicable
+         */
+        brcmf_fws_tim_update(fws, entry, fifo);
+        brcmf_fws_flow_control_check(fws, &entry->psq,
+                                     brcmf_skb_if_flags_get_field(p, INDEX));
+        return 0;
+}
+
+static struct sk_buff *brcmf_fws_deq(struct brcmf_fws_info *fws, int fifo)
+{
+        struct brcmf_fws_mac_descriptor *table;
+        struct brcmf_fws_mac_descriptor *entry;
+        struct sk_buff *p;
+        int use_credit = 1;
+        int num_nodes;
+        int node_pos;
+        int prec_out;
+        int pmsk = 3;
+        int i;
+
+        table = (struct brcmf_fws_mac_descriptor *)&fws->desc;
+        num_nodes = sizeof(fws->desc) / sizeof(struct brcmf_fws_mac_descriptor);
+        node_pos = fws->deq_node_pos[fifo];
+
+        for (i = 0; i < num_nodes; i++) {
+                entry = &table[(node_pos + i) % num_nodes];
+                if (!entry->occupied || brcmf_fws_mac_desc_closed(entry, fifo))
+                        continue;
+
+                if (entry->suppressed)
+                        pmsk = 2;
+                p = brcmu_pktq_mdeq(&entry->psq, pmsk << (fifo * 2), &prec_out);
+                if (p == NULL) {
+                        if (entry->suppressed) {
+                                if (entry->suppr_transit_count >
+                                    entry->suppress_count)
+                                        return NULL;
+                                entry->suppressed = false;
+                                p = brcmu_pktq_mdeq(&entry->psq,
+                                                    1 << (fifo * 2), &prec_out);
+                        }
+                }
+                if  (p == NULL)
+                        continue;
+
+                /* did the packet come from suppress sub-queue? */
+                if (entry->requested_credit > 0) {
+                        entry->requested_credit--;
+                        /*
+                         * if the packet was pulled out while destination is in
+                         * closed state but had a non-zero packets requested,
+                         * then this should not count against the FIFO credit.
+                         * That is due to the fact that the firmware will
+                         * most likely hold onto this packet until a suitable
+                         * time later to push it to the appropriate AC FIFO.
+                         */
+                        if (entry->state == BRCMF_FWS_STATE_CLOSE)
+                                use_credit = 0;
+                } else if (entry->requested_packet > 0) {
+                        entry->requested_packet--;
+                        brcmf_skb_if_flags_set_field(p, REQUESTED, 1);
+                        if (entry->state == BRCMF_FWS_STATE_CLOSE)
+                                use_credit = 0;
+                }
+                brcmf_skb_if_flags_set_field(p, CREDITCHECK, use_credit);
+
+                /* move dequeue position to ensure fair round-robin */
+                fws->deq_node_pos[fifo] = (node_pos + i + 1) % num_nodes;
+                brcmf_fws_flow_control_check(fws, &entry->psq,
+                                             brcmf_skb_if_flags_get_field(p,
+                                                                          INDEX)
+                                             );
+                /*
+                 * A packet has been picked up, update traffic
+                 * availability bitmap, if applicable
+                 */
+                brcmf_fws_tim_update(fws, entry, fifo);
+
+                /*
+                 * decrement total enqueued fifo packets and
+                 * clear delay bitmap if done.
+                 */
+                fws->fifo_enqpkt[fifo]--;
+                if (fws->fifo_enqpkt[fifo] == 0)
+                        fws->fifo_delay_map &= ~(1 << fifo);
+                goto done;
+        }
+        p = NULL;
+done:
+        brcmf_dbg(TRACE, "exit: fifo %d skb %p\n", fifo, p);
+        return p;
+}
+
+static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
+                                         struct sk_buff *skb, u32 genbit)
+{
+        struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
+        u32 hslot;
+        int ret;
+
+        hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
+
+        /* this packet was suppressed */
+        if (!entry->suppressed || entry->generation != genbit) {
+                entry->suppressed = true;
+                entry->suppress_count = brcmu_pktq_mlen(&entry->psq,
+                                                        1 << (fifo * 2 + 1));
+                entry->suppr_transit_count = entry->transit_count;
+        }
+
+        entry->generation = genbit;
+
+        ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo, skb);
+        if (ret != 0) {
+                /* suppress q is full, drop this packet */
+                brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
+                                        true);
+        } else {
+                /*
+                 * Mark suppressed to avoid a double free during
+                 * wlfc cleanup
+                 */
+                brcmf_fws_hanger_mark_suppressed(&fws->hanger, hslot,
+                                                 genbit);
+                entry->suppress_count++;
+        }
+
+        return ret;
+}
+
+static int
+brcmf_fws_txstatus_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
+                           u32 genbit)
+{
+        u32 fifo;
+        int ret;
+        bool remove_from_hanger = true;
+        struct sk_buff *skb;
+        struct brcmf_fws_mac_descriptor *entry = NULL;
+
+        brcmf_dbg(TRACE, "status: flags=0x%X, hslot=%d\n",
+                  flags, hslot);
+
+        if (flags == BRCMF_FWS_TXSTATUS_DISCARD)
+                fws->stats.txs_discard++;
+        else if (flags == BRCMF_FWS_TXSTATUS_CORE_SUPPRESS) {
+                fws->stats.txs_supp_core++;
+                remove_from_hanger = false;
+        } else if (flags == BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS) {
+                fws->stats.txs_supp_ps++;
+                remove_from_hanger = false;
+        } else if (flags == BRCMF_FWS_TXSTATUS_FW_TOSSED)
+                fws->stats.txs_tossed++;
+        else
+                brcmf_err("unexpected txstatus\n");
+
+        ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
+                                      remove_from_hanger);
+        if (ret != 0) {
+                brcmf_err("no packet in hanger slot: hslot=%d\n", hslot);
+                return ret;
+        }
+
+        entry = brcmf_skbcb(skb)->mac;
+        if (WARN_ON(!entry)) {
+                brcmu_pkt_buf_free_skb(skb);
+                return -EINVAL;
+        }
+
+        /* pick up the implicit credit from this packet */
+        fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
+        brcmf_skb_pick_up_credit(fws, fifo, skb);
+
+        if (!remove_from_hanger)
+                ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, genbit);
+
+        if (remove_from_hanger || ret) {
+                entry->transit_count--;
+                if (entry->suppressed)
+                        entry->suppr_transit_count--;
+
+                brcmf_txfinalize(fws->drvr, skb, true);
+        }
+        return 0;
+}
+
+static int brcmf_fws_fifocreditback_indicate(struct brcmf_fws_info *fws,
+                                             u8 *data)
+{
+        int i;
+
+        if (fws->fcmode != BRCMF_FWS_FCMODE_EXPLICIT_CREDIT) {
+                brcmf_dbg(INFO, "ignored\n");
+                return 0;
+        }
+
+        brcmf_dbg(TRACE, "enter: data %pM\n", data);
+        for (i = 0; i < BRCMF_FWS_FIFO_COUNT; i++)
+                brcmf_fws_return_credits(fws, i, data[i]);
+
+        brcmf_dbg(INFO, "map: credit %x delay %x\n", fws->fifo_credit_map,
+                  fws->fifo_delay_map);
+        brcmf_fws_schedule_deq(fws);
+        return 0;
+}
+
+static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
+{
+        __le32 status_le;
+        u32 status;
+        u32 hslot;
+        u32 genbit;
+        u8 flags;
+
+        fws->stats.txs_indicate++;
+        memcpy(&status_le, data, sizeof(status_le));
+        status = le32_to_cpu(status_le);
+        flags = brcmf_txstatus_get_field(status, FLAGS);
+        hslot = brcmf_txstatus_get_field(status, HSLOT);
+        genbit = brcmf_txstatus_get_field(status, GENERATION);
+
+        return brcmf_fws_txstatus_process(fws, flags, hslot, genbit);
+}
+
+static int brcmf_fws_dbg_seqnum_check(struct brcmf_fws_info *fws, u8 *data)
+{
+        __le32 timestamp;
+
+        memcpy(&timestamp, &data[2], sizeof(timestamp));
+        brcmf_dbg(INFO, "received: seq %d, timestamp %d\n", data[1],
+                  le32_to_cpu(timestamp));
+        return 0;
+}
+
+/* using macro so sparse checking does not complain
+ * about locking imbalance.
+ */
+#define brcmf_fws_lock(drvr, flags)                             \
+do {                                                            \
+        flags = 0;                                              \
+        spin_lock_irqsave(&((drvr)->fws_spinlock), (flags));    \
+} while (0)
+
+/* using macro so sparse checking does not complain
+ * about locking imbalance.
+ */
+#define brcmf_fws_unlock(drvr, flags) \
+        spin_unlock_irqrestore(&((drvr)->fws_spinlock), (flags))
+
+static int brcmf_fws_notify_credit_map(struct brcmf_if *ifp,
+                                       const struct brcmf_event_msg *e,
+                                       void *data)
+{
+        struct brcmf_fws_info *fws = ifp->drvr->fws;
+        int i;
+        ulong flags;
+        u8 *credits = data;
+
+        if (e->datalen < BRCMF_FWS_FIFO_COUNT) {
+                brcmf_err("event payload too small (%d)\n", e->datalen);
+                return -EINVAL;
+        }
+
+        brcmf_dbg(TRACE, "enter: credits %pM\n", credits);
+        brcmf_fws_lock(ifp->drvr, flags);
+        for (i = 0; i < ARRAY_SIZE(fws->fifo_credit); i++) {
+                if (*credits)
+                        fws->fifo_credit_map |= 1 << i;
+                else
+                        fws->fifo_credit_map &= ~(1 << i);
+                fws->fifo_credit[i] = *credits++;
+        }
+        brcmf_fws_schedule_deq(fws);
+        brcmf_fws_unlock(ifp->drvr, flags);
+        return 0;
+}
+
+int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
+                      struct sk_buff *skb)
+{
+        struct brcmf_fws_info *fws = drvr->fws;
+        ulong flags;
+        u8 *signal_data;
+        s16 data_len;
+        u8 type;
+        u8 len;
+        u8 *data;
+
+        brcmf_dbg(TRACE, "enter: ifidx %d, skblen %u, sig %d\n",
+                  ifidx, skb->len, signal_len);
+
+        WARN_ON(signal_len > skb->len);
+
+        /* if flow control disabled, skip to packet data and leave */
+        if (!signal_len || !drvr->fw_signals) {
+                skb_pull(skb, signal_len);
+                return 0;
+        }
+
+        /* lock during tlv parsing */
+        brcmf_fws_lock(drvr, flags);
+
+        fws->stats.header_pulls++;
+        data_len = signal_len;
+        signal_data = skb->data;
+
+        while (data_len > 0) {
+                /* extract tlv info */
+                type = signal_data[0];
+
+                /* FILLER type is actually not a TLV, but
+                 * a single byte that can be skipped.
+                 */
+                if (type == BRCMF_FWS_TYPE_FILLER) {
+                        signal_data += 1;
+                        data_len -= 1;
+                        continue;
+                }
+                len = signal_data[1];
+                data = signal_data + 2;
+
+                brcmf_dbg(INFO, "tlv type=%d (%s), len=%d, data[0]=%d\n", type,
+                          brcmf_fws_get_tlv_name(type), len, *data);
+
+                /* abort parsing when length invalid */
+                if (data_len < len + 2)
+                        break;
+
+                if (len != brcmf_fws_get_tlv_len(fws, type))
+                        break;
+
+                switch (type) {
+                case BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS:
+                case BRCMF_FWS_TYPE_COMP_TXSTATUS:
+                        break;
+                case BRCMF_FWS_TYPE_MACDESC_ADD:
+                case BRCMF_FWS_TYPE_MACDESC_DEL:
+                        brcmf_fws_macdesc_indicate(fws, type, data);
+                        break;
+                case BRCMF_FWS_TYPE_MAC_OPEN:
+                case BRCMF_FWS_TYPE_MAC_CLOSE:
+                        brcmf_fws_macdesc_state_indicate(fws, type, data);
+                        break;
+                case BRCMF_FWS_TYPE_INTERFACE_OPEN:
+                case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
+                        brcmf_fws_interface_state_indicate(fws, type, data);
+                        break;
+                case BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT:
+                case BRCMF_FWS_TYPE_MAC_REQUEST_PACKET:
+                        brcmf_fws_request_indicate(fws, type, data);
+                        break;
+                case BRCMF_FWS_TYPE_TXSTATUS:
+                        brcmf_fws_txstatus_indicate(fws, data);
+                        break;
+                case BRCMF_FWS_TYPE_FIFO_CREDITBACK:
+                        brcmf_fws_fifocreditback_indicate(fws, data);
+                        break;
+                case BRCMF_FWS_TYPE_RSSI:
+                        brcmf_fws_rssi_indicate(fws, *data);
+                        break;
+                case BRCMF_FWS_TYPE_TRANS_ID:
+                        brcmf_fws_dbg_seqnum_check(fws, data);
+                        break;
+                case BRCMF_FWS_TYPE_PKTTAG:
+                case BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP:
+                default:
+                        fws->stats.tlv_invalid_type++;
+                        break;
+                }
+
+                signal_data += len + 2;
+                data_len -= len + 2;
+        }
+
+        if (data_len != 0)
+                fws->stats.tlv_parse_failed++;
+
+        /* signalling processing result does
+         * not affect the actual ethernet packet.
+         */
+        skb_pull(skb, signal_len);
+
+        /* this may be a signal-only packet
+         */
+        if (skb->len == 0)
+                fws->stats.header_only_pkt++;
+
+        brcmf_fws_unlock(drvr, flags);
+        return 0;
+}
+
+static int brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
+{
+        struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
+        u8 *wlh;
+        u16 data_offset = 0;
+        u8 fillers;
+        __le32 pkttag = cpu_to_le32(brcmf_skbcb(skb)->htod);
+
+        brcmf_dbg(TRACE, "enter: ea=%pM, ifidx=%u, pkttag=0x%08X\n",
+                  entry->ea, entry->interface_id, le32_to_cpu(pkttag));
+        if (entry->send_tim_signal)
+                data_offset += 2 + BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
+
+        /* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
+        data_offset += 2 + BRCMF_FWS_TYPE_PKTTAG_LEN;
+        fillers = round_up(data_offset, 4) - data_offset;
+        data_offset += fillers;
+
+        skb_push(skb, data_offset);
+        wlh = skb->data;
+
+        wlh[0] = BRCMF_FWS_TYPE_PKTTAG;
+        wlh[1] = BRCMF_FWS_TYPE_PKTTAG_LEN;
+        memcpy(&wlh[2], &pkttag, sizeof(pkttag));
+        wlh += BRCMF_FWS_TYPE_PKTTAG_LEN + 2;
+
+        if (entry->send_tim_signal) {
+                entry->send_tim_signal = 0;
+                wlh[0] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP;
+                wlh[1] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
+                wlh[2] = entry->mac_handle;
+                wlh[3] = entry->traffic_pending_bmp;
+                wlh += BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2;
+                entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
+        }
+        if (fillers)
+                memset(wlh, BRCMF_FWS_TYPE_FILLER, fillers);
+
+        brcmf_proto_hdrpush(fws->drvr, brcmf_skb_if_flags_get_field(skb, INDEX),
+                            data_offset >> 2, skb);
+        return 0;
+}
+
+static int brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
+                                   struct sk_buff *p)
+{
+        struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
+        struct brcmf_fws_mac_descriptor *entry = skcb->mac;
+        int rc = 0;
+        bool header_needed;
+        int hslot = BRCMF_FWS_HANGER_MAXITEMS;
+        u8 free_ctr;
+        u8 ifidx;
+        u8 flags;
+
+        header_needed = skcb->state != BRCMF_FWS_SKBSTATE_SUPPRESSED;
+
+        if (header_needed) {
+                /* obtaining free slot may fail, but that will be caught
+                 * by the hanger push. This assures the packet has a BDC
+                 * header upon return.
+                 */
+                hslot = brcmf_fws_hanger_get_free_slot(&fws->hanger);
+                free_ctr = entry->seq[fifo];
+                brcmf_skb_htod_tag_set_field(p, HSLOT, hslot);
+                brcmf_skb_htod_tag_set_field(p, FREERUN, free_ctr);
+                brcmf_skb_htod_tag_set_field(p, GENERATION, 1);
+                entry->transit_count++;
+        }
+        brcmf_skb_if_flags_set_field(p, TRANSMIT, 1);
+        brcmf_skb_htod_tag_set_field(p, FIFO, fifo);
+
+        flags = BRCMF_FWS_HTOD_FLAG_PKTFROMHOST;
+        if (!(skcb->if_flags & BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK)) {
+                /*
+                Indicate that this packet is being sent in response to an
+                explicit request from the firmware side.
+                */
+                flags |= BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED;
+        }
+        brcmf_skb_htod_tag_set_field(p, FLAGS, flags);
+        if (header_needed) {
+                brcmf_fws_hdrpush(fws, p);
+                rc = brcmf_fws_hanger_pushpkt(&fws->hanger, p, hslot);
+                if (rc)
+                        brcmf_err("hanger push failed: rc=%d\n", rc);
+        } else {
+                int gen;
+
+                /* remove old header */
+                rc = brcmf_proto_hdrpull(fws->drvr, false, &ifidx, p);
+                if (rc == 0) {
+                        hslot = brcmf_skb_htod_tag_get_field(p, HSLOT);
+                        brcmf_fws_hanger_get_genbit(&fws->hanger, p,
+                                                    hslot, &gen);
+                        brcmf_skb_htod_tag_set_field(p, GENERATION, gen);
+
+                        /* push new header */
+                        brcmf_fws_hdrpush(fws, p);
+                }
+        }
+
+        return rc;
+}
+
+static int
+brcmf_fws_rollback_toq(struct brcmf_fws_info *fws, struct sk_buff *skb)
+{
+        /*
+        put the packet back to the head of queue
+
+        - suppressed packet goes back to suppress sub-queue
+        - pull out the header, if new or delayed packet
+
+        Note: hslot is used only when header removal is done.
+        */
+        struct brcmf_fws_mac_descriptor *entry;
+        enum brcmf_fws_skb_state state;
+        struct sk_buff *pktout;
+        int rc = 0;
+        int fifo;
+        int hslot;
+        u8 ifidx;
+
+        fifo = brcmf_skb_if_flags_get_field(skb, FIFO);
+        state = brcmf_skbcb(skb)->state;
+        entry = brcmf_skbcb(skb)->mac;
+
+        if (entry != NULL) {
+                if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED) {
+                        /* wl-header is saved for suppressed packets */
+                        pktout = brcmu_pktq_penq_head(&entry->psq, 2 * fifo + 1,
+                                                      skb);
+                        if (pktout == NULL) {
+                                brcmf_err("suppress queue full\n");
+                                rc = -ENOSPC;
+                        }
+                } else {
+                        hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
+
+                        /* remove header first */
+                        rc = brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
+                        if (rc) {
+                                brcmf_err("header removal failed\n");
+                                /* free the hanger slot */
+                                brcmf_fws_hanger_poppkt(&fws->hanger, hslot,
+                                                        &pktout, true);
+                                brcmf_txfinalize(fws->drvr, skb, false);
+                                rc = -EINVAL;
+                                goto fail;
+                        }
+
+                        /* delay-q packets are going to delay-q */
+                        pktout = brcmu_pktq_penq_head(&entry->psq,
+                                                      2 * fifo, skb);
+                        if (pktout == NULL) {
+                                brcmf_err("delay queue full\n");
+                                rc = -ENOSPC;
+                        }
+
+                        /* free the hanger slot */
+                        brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &pktout,
+                                                true);
+
+                        /* decrement sequence count */
+                        entry->seq[fifo]--;
+                }
+                /*
+                if this packet did not count against FIFO credit, it must have
+                taken a requested_credit from the firmware (for pspoll etc.)
+                */
+                if (!(brcmf_skbcb(skb)->if_flags &
+                      BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK))
+                        entry->requested_credit++;
+        } else {
+                brcmf_err("no mac entry linked\n");
+                rc = -ENOENT;
+        }
+
+
+fail:
+        if (rc)
+                fws->stats.rollback_failed++;
+        else
+                fws->stats.rollback_success++;
+        return rc;
+}
+
+static int brcmf_fws_consume_credit(struct brcmf_fws_info *fws, int fifo,
+                                    struct sk_buff *skb)
+{
+        struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
+        int *credit = &fws->fifo_credit[fifo];
+        int use_credit = 1;
+
+        brcmf_dbg(TRACE, "enter: ac=%d, credits=%d\n", fifo, *credit);
+
+        if (entry->requested_credit > 0) {
+                /*
+                 * if the packet was pulled out while destination is in
+                 * closed state but had a non-zero packets requested,
+                 * then this should not count against the FIFO credit.
+                 * That is due to the fact that the firmware will
+                 * most likely hold onto this packet until a suitable
+                 * time later to push it to the appropriate AC FIFO.
+                 */
+                entry->requested_credit--;
+                if (entry->state == BRCMF_FWS_STATE_CLOSE)
+                        use_credit = 0;
+        } else if (entry->requested_packet > 0) {
+                entry->requested_packet--;
+                brcmf_skb_if_flags_set_field(skb, REQUESTED, 1);
+                if (entry->state == BRCMF_FWS_STATE_CLOSE)
+                        use_credit = 0;
+        }
+        brcmf_skb_if_flags_set_field(skb, CREDITCHECK, use_credit);
+        if (!use_credit) {
+                brcmf_dbg(TRACE, "exit: no creditcheck set\n");
+                return 0;
+        }
+
+        if (!(*credit)) {
+                brcmf_dbg(TRACE, "exit: credits depleted\n");
+                return -ENAVAIL;
+        }
+        (*credit)--;
+        if (!(*credit))
+                fws->fifo_credit_map &= ~(1 << fifo);
+        brcmf_dbg(TRACE, "exit: ac=%d, credits=%d\n", fifo, *credit);
+        return 0;
+}
+
+static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
+                                struct sk_buff *skb)
+{
+        struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
+        struct brcmf_fws_mac_descriptor *entry;
+        struct brcmf_bus *bus = fws->drvr->bus_if;
+        int rc;
+
+        entry = skcb->mac;
+        if (IS_ERR(entry))
+                return PTR_ERR(entry);
+
+        rc = brcmf_fws_precommit_skb(fws, fifo, skb);
+        if (rc < 0) {
+                fws->stats.generic_error++;
+                goto rollback;
+        }
+
+        rc = brcmf_bus_txdata(bus, skb);
+        if (rc < 0)
+                goto rollback;
+
+        entry->seq[fifo]++;
+        fws->stats.pkt2bus++;
+        if (brcmf_skbcb(skb)->if_flags & BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK) {
+                fws->stats.send_pkts[fifo]++;
+                fws->stats.fifo_credits_sent[fifo]++;
+        }
+
+        return rc;
+
+rollback:
+        rc = brcmf_fws_rollback_toq(fws, skb);
+        return rc;
+}
+
+int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
+{
+        struct brcmf_pub *drvr = ifp->drvr;
+        struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
+        struct ethhdr *eh = (struct ethhdr *)(skb->data);
+        ulong flags;
+        int fifo = BRCMF_FWS_FIFO_BCMC;
+        bool multicast = is_multicast_ether_addr(eh->h_dest);
+
+        /* determine the priority */
+        if (!skb->priority)
+                skb->priority = cfg80211_classify8021d(skb);
+
+        drvr->tx_multicast += !!multicast;
+        if (ntohs(eh->h_proto) == ETH_P_PAE)
+                atomic_inc(&ifp->pend_8021x_cnt);
+
+        if (!brcmf_fws_fc_active(drvr->fws)) {
+                /* If the protocol uses a data header, apply it */
+                brcmf_proto_hdrpush(drvr, ifp->ifidx, 0, skb);
+
+                /* Use bus module to send data frame */
+                return brcmf_bus_txdata(drvr->bus_if, skb);
+        }
+
+        /* set control buffer information */
+        skcb->if_flags = 0;
+        skcb->mac = brcmf_fws_find_mac_desc(drvr->fws, ifp, eh->h_dest);
+        skcb->state = BRCMF_FWS_SKBSTATE_NEW;
+        brcmf_skb_if_flags_set_field(skb, INDEX, ifp->ifidx);
+        if (!multicast)
+                fifo = brcmf_fws_prio2fifo[skb->priority];
+        brcmf_skb_if_flags_set_field(skb, FIFO, fifo);
+
+        brcmf_dbg(TRACE, "ea=%pM, multi=%d, fifo=%d\n", eh->h_dest,
+                  multicast, fifo);
+
+        brcmf_fws_lock(drvr, flags);
+        if (skcb->mac->suppressed ||
+            brcmf_fws_mac_desc_closed(skcb->mac, fifo) ||
+            brcmu_pktq_mlen(&skcb->mac->psq, 3 << (fifo * 2)) ||
+            (!multicast &&
+             brcmf_fws_consume_credit(drvr->fws, fifo, skb) < 0)) {
+                /* enqueue the packet in delayQ */
+                drvr->fws->fifo_delay_map |= 1 << fifo;
+                brcmf_fws_enq(drvr->fws, BRCMF_FWS_SKBSTATE_DELAYED, fifo, skb);
+        } else {
+                brcmf_fws_commit_skb(drvr->fws, fifo, skb);
+        }
+        brcmf_fws_unlock(drvr, flags);
+        return 0;
+}
+
+void brcmf_fws_reset_interface(struct brcmf_if *ifp)
+{
+        struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
+
+        brcmf_dbg(TRACE, "enter: idx=%d\n", ifp->bssidx);
+        if (!entry)
+                return;
+
+        brcmf_fws_init_mac_descriptor(entry, ifp->mac_addr, ifp->ifidx);
+}
+
+void brcmf_fws_add_interface(struct brcmf_if *ifp)
+{
+        struct brcmf_fws_info *fws = ifp->drvr->fws;
+        struct brcmf_fws_mac_descriptor *entry;
+
+        brcmf_dbg(TRACE, "enter: idx=%d, mac=%pM\n",
+                  ifp->bssidx, ifp->mac_addr);
+        if (!ifp->ndev || !ifp->drvr->fw_signals)
+                return;
+
+        entry = &fws->desc.iface[ifp->ifidx];
+        ifp->fws_desc = entry;
+        brcmf_fws_init_mac_descriptor(entry, ifp->mac_addr, ifp->ifidx);
+        brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
+                        BRCMF_FWS_PSQ_LEN);
+}
+
+void brcmf_fws_del_interface(struct brcmf_if *ifp)
+{
+        struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
+
+        brcmf_dbg(TRACE, "enter: idx=%d\n", ifp->bssidx);
+        if (!entry)
+                return;
+
+        ifp->fws_desc = NULL;
+        brcmf_fws_clear_mac_descriptor(entry);
+        brcmf_fws_cleanup(ifp->drvr->fws, ifp->ifidx);
+}
+
+static void brcmf_fws_dequeue_worker(struct work_struct *worker)
+{
+        struct brcmf_fws_info *fws;
+        struct sk_buff *skb;
+        ulong flags;
+        int fifo;
+        int credit;
+
+        fws = container_of(worker, struct brcmf_fws_info, fws_dequeue_work);
+
+        brcmf_dbg(TRACE, "enter: fws=%p\n", fws);
+        brcmf_fws_lock(fws->drvr, flags);
+        for (fifo = NL80211_NUM_ACS; fifo >= 0; fifo--) {
+                brcmf_dbg(TRACE, "fifo %d credit %d\n", fifo,
+                          fws->fifo_credit[fifo]);
+                for (credit = 0; credit < fws->fifo_credit[fifo]; /* nop */) {
+                        skb = brcmf_fws_deq(fws, fifo);
+                        if (!skb)
+                                break;
+                        if (!brcmf_fws_commit_skb(fws, fifo, skb) &&
+                            brcmf_skbcb(skb)->if_flags &
+                            BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK)
+                                credit++;
+                }
+                fws->fifo_credit[fifo] -= credit;
+        }
+        brcmf_fws_unlock(fws->drvr, flags);
+}
+
+int brcmf_fws_init(struct brcmf_pub *drvr)
+{
+        u32 tlv = BRCMF_FWS_FLAGS_RSSI_SIGNALS;
+        int rc;
+
+        if (!drvr->fw_signals)
+                return 0;
+
+        spin_lock_init(&drvr->fws_spinlock);
+
+        drvr->fws = kzalloc(sizeof(*(drvr->fws)), GFP_KERNEL);
+        if (!drvr->fws) {
+                rc = -ENOMEM;
+                goto fail;
+        }
+
+        /* set linkage back */
+        drvr->fws->drvr = drvr;
+        drvr->fws->fcmode = fcmode;
+
+        drvr->fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
+        if (drvr->fws->fws_wq == NULL) {
+                brcmf_err("workqueue creation failed\n");
+                rc = -EBADF;
+                goto fail;
+        }
+        INIT_WORK(&drvr->fws->fws_dequeue_work, brcmf_fws_dequeue_worker);
+
+        /* enable firmware signalling if fcmode active */
+        if (drvr->fws->fcmode != BRCMF_FWS_FCMODE_NONE)
+                tlv |= BRCMF_FWS_FLAGS_XONXOFF_SIGNALS |
+                       BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS |
+                       BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE;
+
+        rc = brcmf_fil_iovar_int_set(drvr->iflist[0], "tlv", tlv);
+        if (rc < 0) {
+                brcmf_err("failed to set bdcv2 tlv signaling\n");
+                goto fail;
+        }
+
+        if (brcmf_fweh_register(drvr, BRCMF_E_FIFO_CREDIT_MAP,
+                                brcmf_fws_notify_credit_map)) {
+                brcmf_err("register credit map handler failed\n");
+                goto fail;
+        }
+
+        brcmf_fws_hanger_init(&drvr->fws->hanger);
+        brcmf_fws_init_mac_descriptor(&drvr->fws->desc.other, NULL, 0);
+        brcmu_pktq_init(&drvr->fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
+                        BRCMF_FWS_PSQ_LEN);
+
+        /* create debugfs file for statistics */
+        brcmf_debugfs_create_fws_stats(drvr, &drvr->fws->stats);
+
+        /* TODO: remove upon feature delivery */
+        brcmf_err("%s bdcv2 tlv signaling [%x]\n",
+                  drvr->fw_signals ? "enabled" : "disabled", tlv);
+        return 0;
+
+fail:
+        /* disable flow control entirely */
+        drvr->fw_signals = false;
+        brcmf_fws_deinit(drvr);
+        return rc;
+}
+
+void brcmf_fws_deinit(struct brcmf_pub *drvr)
+{
+        struct brcmf_fws_info *fws = drvr->fws;
+        ulong flags;
+
+        if (!fws)
+                return;
+
+        /* cleanup */
+        brcmf_fws_lock(drvr, flags);
+        brcmf_fws_cleanup(fws, -1);
+        drvr->fws = NULL;
+        brcmf_fws_unlock(drvr, flags);
+
+        /* free top structure */
+        kfree(fws);
+}
+
+bool brcmf_fws_fc_active(struct brcmf_fws_info *fws)
+{
+        if (!fws)
+                return false;
+
+        brcmf_dbg(TRACE, "enter: mode=%d\n", fws->fcmode);
+        return fws->fcmode != BRCMF_FWS_FCMODE_NONE;
+}
+
+void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
+{
+        ulong flags;
+
+        brcmf_fws_lock(fws->drvr, flags);
+        brcmf_fws_txstatus_process(fws, BRCMF_FWS_TXSTATUS_FW_TOSSED,
+                                   brcmf_skb_htod_tag_get_field(skb, HSLOT), 0);
+        /* the packet never reached firmware so reclaim credit */
+        if (fws->fcmode == BRCMF_FWS_FCMODE_EXPLICIT_CREDIT &&
+            brcmf_skbcb(skb)->if_flags & BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK) {
+                brcmf_fws_return_credits(fws,
+                                         brcmf_skb_htod_tag_get_field(skb,
+                                                                      FIFO),
+                                         1);
+                brcmf_fws_schedule_deq(fws);
+        }
+        brcmf_fws_unlock(fws->drvr, flags);
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h
new file mode 100644
index 000000000000..fbe483d23752
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#ifndef FWSIGNAL_H_
+#define FWSIGNAL_H_
+
+int brcmf_fws_init(struct brcmf_pub *drvr);
+void brcmf_fws_deinit(struct brcmf_pub *drvr);
+bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
+int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
+                      struct sk_buff *skb);
+int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb);
+
+void brcmf_fws_reset_interface(struct brcmf_if *ifp);
+void brcmf_fws_add_interface(struct brcmf_if *ifp);
+void brcmf_fws_del_interface(struct brcmf_if *ifp);
+void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb);
+
+#endif /* FWSIGNAL_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index 4166e642068b..2b90da0d85f3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -15,6 +15,7 @@
  */
 #include <linux/slab.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <net/cfg80211.h>
 
 #include <brcmu_wifi.h>
@@ -423,29 +424,6 @@ static void brcmf_p2p_print_actframe(bool tx, void *frame, u32 frame_len)
 
 
 /**
- * brcmf_p2p_chnr_to_chspec() - convert channel number to chanspec.
- *
- * @channel: channel number
- */
-static u16 brcmf_p2p_chnr_to_chspec(u16 channel)
-{
-        u16 chanspec;
-
-        chanspec = channel & WL_CHANSPEC_CHAN_MASK;
-
-        if (channel <= CH_MAX_2G_CHANNEL)
-                chanspec |= WL_CHANSPEC_BAND_2G;
-        else
-                chanspec |= WL_CHANSPEC_BAND_5G;
-
-        chanspec |= WL_CHANSPEC_BW_20;
-        chanspec |= WL_CHANSPEC_CTL_SB_NONE;
-
-        return chanspec;
-}
-
-
-/**
  * brcmf_p2p_set_firmware() - prepare firmware for peer-to-peer operation.
  *
  * @ifp: ifp to use for iovars (primary).
@@ -455,7 +433,9 @@ static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac)
 {
         s32 ret = 0;
 
+        brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
         brcmf_fil_iovar_int_set(ifp, "apsta", 1);
+        brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
 
         /* In case of COB type, firmware has default mac address
          * After Initializing firmware, we have to set current mac address to
@@ -473,28 +453,35 @@ static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac)
  * brcmf_p2p_generate_bss_mac() - derive mac addresses for P2P.
  *
  * @p2p: P2P specific data.
+ * @dev_addr: optional device address.
  *
- * P2P needs mac addresses for P2P device and interface. These are
- * derived from the primary net device, ie. the permanent ethernet
- * address of the device.
+ * P2P needs mac addresses for P2P device and interface. If no device
+ * address it specified, these are derived from the primary net device, ie.
+ * the permanent ethernet address of the device.
  */
-static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p)
+static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr)
 {
         struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
-        struct brcmf_if *p2p_ifp = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif->ifp;
+        bool local_admin = false;
+
+        if (!dev_addr || is_zero_ether_addr(dev_addr)) {
+                dev_addr = pri_ifp->mac_addr;
+                local_admin = true;
+        }
 
         /* Generate the P2P Device Address.  This consists of the device's
          * primary MAC address with the locally administered bit set.
          */
-        memcpy(p2p->dev_addr, pri_ifp->mac_addr, ETH_ALEN);
-        p2p->dev_addr[0] |= 0x02;
-        memcpy(p2p_ifp->mac_addr, p2p->dev_addr, ETH_ALEN);
+        memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
+        if (local_admin)
+                p2p->dev_addr[0] |= 0x02;
 
         /* Generate the P2P Interface Address.  If the discovery and connection
          * BSSCFGs need to simultaneously co-exist, then this address must be
          * different from the P2P Device Address, but also locally administered.
          */
         memcpy(p2p->int_addr, p2p->dev_addr, ETH_ALEN);
+        p2p->int_addr[0] |= 0x02;
         p2p->int_addr[4] ^= 0x80;
 }
 
@@ -773,7 +760,7 @@ exit:
  * validates the channels in the request.
  */
 static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg,
-                               struct net_device *ndev,
+                               struct brcmf_if *ifp,
                                struct cfg80211_scan_request *request,
                                u16 action)
 {
@@ -827,7 +814,8 @@ static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg,
                                            IEEE80211_CHAN_PASSIVE_SCAN))
                                 continue;
 
-                        chanspecs[i] = channel_to_chanspec(chan);
+                        chanspecs[i] = channel_to_chanspec(&p2p->cfg->d11inf,
+                                                           chan);
                         brcmf_dbg(INFO, "%d: chan=%d, channel spec=%x\n",
                                   num_nodfs, chan->hw_value, chanspecs[i]);
                         num_nodfs++;
@@ -935,8 +923,8 @@ static s32
 brcmf_p2p_discover_listen(struct brcmf_p2p_info *p2p, u16 channel, u32 duration)
 {
         struct brcmf_cfg80211_vif *vif;
+        struct brcmu_chan ch;
         s32 err = 0;
-        u16 chanspec;
 
         vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
         if (!vif) {
@@ -951,9 +939,11 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info *p2p, u16 channel, u32 duration)
                 goto exit;
         }
 
-        chanspec = brcmf_p2p_chnr_to_chspec(channel);
+        ch.chnum = channel;
+        ch.bw = BRCMU_CHAN_BW_20;
+        p2p->cfg->d11inf.encchspec(&ch);
         err = brcmf_p2p_set_discover_state(vif->ifp, WL_P2P_DISC_ST_LISTEN,
-                                           chanspec, (u16)duration);
+                                           ch.chspec, (u16)duration);
         if (!err) {
                 set_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status);
                 p2p->remain_on_channel_cookie++;
@@ -1065,6 +1055,7 @@ static s32 brcmf_p2p_act_frm_search(struct brcmf_p2p_info *p2p, u16 channel)
         u32 channel_cnt;
         u16 *default_chan_list;
         u32 i;
+        struct brcmu_chan ch;
 
         brcmf_dbg(TRACE, "Enter\n");
 
@@ -1079,15 +1070,23 @@ static s32 brcmf_p2p_act_frm_search(struct brcmf_p2p_info *p2p, u16 channel)
                 err = -ENOMEM;
                 goto exit;
         }
+        ch.bw = BRCMU_CHAN_BW_20;
         if (channel) {
+                ch.chnum = channel;
+                p2p->cfg->d11inf.encchspec(&ch);
                 /* insert same channel to the chan_list */
                 for (i = 0; i < channel_cnt; i++)
-                        default_chan_list[i] =
-                                        brcmf_p2p_chnr_to_chspec(channel);
+                        default_chan_list[i] = ch.chspec;
         } else {
-                default_chan_list[0] = brcmf_p2p_chnr_to_chspec(SOCIAL_CHAN_1);
-                default_chan_list[1] = brcmf_p2p_chnr_to_chspec(SOCIAL_CHAN_2);
-                default_chan_list[2] = brcmf_p2p_chnr_to_chspec(SOCIAL_CHAN_3);
+                ch.chnum = SOCIAL_CHAN_1;
+                p2p->cfg->d11inf.encchspec(&ch);
+                default_chan_list[0] = ch.chspec;
+                ch.chnum = SOCIAL_CHAN_2;
+                p2p->cfg->d11inf.encchspec(&ch);
+                default_chan_list[1] = ch.chspec;
+                ch.chnum = SOCIAL_CHAN_3;
+                p2p->cfg->d11inf.encchspec(&ch);
+                default_chan_list[2] = ch.chspec;
         }
         err = brcmf_p2p_escan(p2p, channel_cnt, default_chan_list,
                               WL_P2P_DISC_ST_SEARCH, WL_ESCAN_ACTION_START,
@@ -1217,6 +1216,7 @@ bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
 {
         struct brcmf_p2p_info *p2p = &cfg->p2p;
         struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+        struct brcmu_chan ch;
         u8 *ie;
         s32 err;
         u8 p2p_dev_addr[ETH_ALEN];
@@ -1242,8 +1242,12 @@ bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
                                             p2p_dev_addr, sizeof(p2p_dev_addr));
         if ((err >= 0) &&
             (!memcmp(p2p_dev_addr, afx_hdl->tx_dst_addr, ETH_ALEN))) {
-                afx_hdl->peer_chan = bi->ctl_ch ? bi->ctl_ch :
-                                      CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
+                if (!bi->ctl_ch) {
+                        ch.chspec = le16_to_cpu(bi->chanspec);
+                        cfg->d11inf.decchspec(&ch);
+                        bi->ctl_ch = ch.chnum;
+                }
+                afx_hdl->peer_chan = bi->ctl_ch;
                 brcmf_dbg(TRACE, "ACTION FRAME SCAN : Peer %pM found, channel : %d\n",
                           afx_hdl->tx_dst_addr, afx_hdl->peer_chan);
                 complete(&afx_hdl->act_frm_scan);
@@ -1261,7 +1265,7 @@ static void
 brcmf_p2p_stop_wait_next_action_frame(struct brcmf_cfg80211_info *cfg)
 {
         struct brcmf_p2p_info *p2p = &cfg->p2p;
-        struct net_device *ndev = cfg->escan_info.ndev;
+        struct brcmf_if *ifp = cfg->escan_info.ifp;
 
         if (test_bit(BRCMF_P2P_STATUS_SENDING_ACT_FRAME, &p2p->status) &&
             (test_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status) ||
@@ -1271,12 +1275,12 @@ brcmf_p2p_stop_wait_next_action_frame(struct brcmf_cfg80211_info *cfg)
                  * So abort scan for off channel completion.
                  */
                 if (p2p->af_sent_channel)
-                        brcmf_notify_escan_complete(cfg, ndev, true, true);
+                        brcmf_notify_escan_complete(cfg, ifp, true, true);
         } else if (test_bit(BRCMF_P2P_STATUS_WAITING_NEXT_AF_LISTEN,
                             &p2p->status)) {
                 brcmf_dbg(TRACE, "*** Wake UP ** abort listen for next af frame\n");
                 /* So abort scan to cancel listen */
-                brcmf_notify_escan_complete(cfg, ndev, true, true);
+                brcmf_notify_escan_complete(cfg, ifp, true, true);
         }
 }
 
@@ -1350,12 +1354,14 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
         u8 *frame = (u8 *)(rxframe + 1);
         struct brcmf_p2p_pub_act_frame *act_frm;
         struct brcmf_p2psd_gas_pub_act_frame *sd_act_frm;
-        u16 chanspec = be16_to_cpu(rxframe->chanspec);
+        struct brcmu_chan ch;
         struct ieee80211_mgmt *mgmt_frame;
         s32 freq;
         u16 mgmt_type;
         u8 action;
 
+        ch.chspec = be16_to_cpu(rxframe->chanspec);
+        cfg->d11inf.decchspec(&ch);
         /* Check if wpa_supplicant has registered for this frame */
         brcmf_dbg(INFO, "ifp->vif->mgmt_rx_reg %04x\n", ifp->vif->mgmt_rx_reg);
         mgmt_type = (IEEE80211_STYPE_ACTION & IEEE80211_FCTL_STYPE) >> 4;
@@ -1374,7 +1380,7 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
                                      &p2p->status) &&
                             (memcmp(afx_hdl->tx_dst_addr, e->addr,
                                     ETH_ALEN) == 0)) {
-                                afx_hdl->peer_chan = CHSPEC_CHANNEL(chanspec);
+                                afx_hdl->peer_chan = ch.chnum;
                                 brcmf_dbg(INFO, "GON request: Peer found, channel=%d\n",
                                           afx_hdl->peer_chan);
                                 complete(&afx_hdl->act_frm_scan);
@@ -1384,7 +1390,7 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
                 /* After complete GO Negotiation, roll back to mpc mode */
                 if ((action == P2P_PAF_GON_CONF) ||
                     (action == P2P_PAF_PROVDIS_RSP))
-                        brcmf_set_mpc(ifp->ndev, 1);
+                        brcmf_set_mpc(ifp, 1);
                 if (action == P2P_PAF_GON_CONF) {
                         brcmf_dbg(TRACE, "P2P: GO_NEG_PHASE status cleared\n");
                         clear_bit(BRCMF_P2P_STATUS_GO_NEG_PHASE, &p2p->status);
@@ -1417,11 +1423,12 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
         memcpy(&mgmt_frame->u, frame, mgmt_frame_len);
         mgmt_frame_len += offsetof(struct ieee80211_mgmt, u);
 
-        freq = ieee80211_channel_to_frequency(CHSPEC_CHANNEL(chanspec),
-                                              CHSPEC_IS2G(chanspec) ?
+        freq = ieee80211_channel_to_frequency(ch.chnum,
+                                              ch.band == BRCMU_CHAN_BAND_2G ?
                                               IEEE80211_BAND_2GHZ :
                                               IEEE80211_BAND_5GHZ);
-        wdev = ifp->ndev->ieee80211_ptr;
+
+        wdev = &ifp->vif->wdev;
         cfg80211_rx_mgmt(wdev, freq, 0, (u8 *)mgmt_frame, mgmt_frame_len,
                          GFP_ATOMIC);
 
@@ -1637,6 +1644,7 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
                                  struct brcmf_fil_af_params_le *af_params)
 {
         struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_fil_action_frame_le *action_frame;
         struct brcmf_config_af_params config_af_params;
         struct afx_hdl *afx_hdl = &p2p->afx_hdl;
@@ -1725,7 +1733,7 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
 
         /* To make sure to send successfully action frame, turn off mpc */
         if (config_af_params.mpc_onoff == 0)
-                brcmf_set_mpc(ndev, 0);
+                brcmf_set_mpc(ifp, 0);
 
         /* set status and destination address before sending af */
         if (p2p->next_af_subtype != P2P_PAF_SUBTYPE_INVALID) {
@@ -1753,7 +1761,7 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
                  * care of current piggback algo, lets abort the scan here
                  * itself.
                  */
-                brcmf_notify_escan_complete(cfg, ndev, true, true);
+                brcmf_notify_escan_complete(cfg, ifp, true, true);
 
                 /* update channel */
                 af_params->channel = cpu_to_le32(afx_hdl->peer_chan);
@@ -1820,7 +1828,7 @@ exit:
         clear_bit(BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME, &p2p->status);
         /* if all done, turn mpc on again */
         if (config_af_params.mpc_onoff == 1)
-                brcmf_set_mpc(ndev, 1);
+                brcmf_set_mpc(ifp, 1);
 
         return ack;
 }
@@ -1839,10 +1847,10 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
         struct brcmf_p2p_info *p2p = &cfg->p2p;
         struct afx_hdl *afx_hdl = &p2p->afx_hdl;
-        struct wireless_dev *wdev;
         struct brcmf_cfg80211_vif *vif = ifp->vif;
         struct brcmf_rx_mgmt_data *rxframe = (struct brcmf_rx_mgmt_data *)data;
         u16 chanspec = be16_to_cpu(rxframe->chanspec);
+        struct brcmu_chan ch;
         u8 *mgmt_frame;
         u32 mgmt_frame_len;
         s32 freq;
@@ -1851,9 +1859,12 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
         brcmf_dbg(INFO, "Enter: event %d reason %d\n", e->event_code,
                   e->reason);
 
+        ch.chspec = be16_to_cpu(rxframe->chanspec);
+        cfg->d11inf.decchspec(&ch);
+
         if (test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL, &p2p->status) &&
             (memcmp(afx_hdl->tx_dst_addr, e->addr, ETH_ALEN) == 0)) {
-                afx_hdl->peer_chan = CHSPEC_CHANNEL(chanspec);
+                afx_hdl->peer_chan = ch.chnum;
                 brcmf_dbg(INFO, "PROBE REQUEST: Peer found, channel=%d\n",
                           afx_hdl->peer_chan);
                 complete(&afx_hdl->act_frm_scan);
@@ -1878,12 +1889,13 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
 
         mgmt_frame = (u8 *)(rxframe + 1);
         mgmt_frame_len = e->datalen - sizeof(*rxframe);
-        freq = ieee80211_channel_to_frequency(CHSPEC_CHANNEL(chanspec),
-                                              CHSPEC_IS2G(chanspec) ?
+        freq = ieee80211_channel_to_frequency(ch.chnum,
+                                              ch.band == BRCMU_CHAN_BAND_2G ?
                                               IEEE80211_BAND_2GHZ :
                                               IEEE80211_BAND_5GHZ);
-        wdev = ifp->ndev->ieee80211_ptr;
-        cfg80211_rx_mgmt(wdev, freq, 0, mgmt_frame, mgmt_frame_len, GFP_ATOMIC);
+
+        cfg80211_rx_mgmt(&vif->wdev, freq, 0, mgmt_frame, mgmt_frame_len,
+                         GFP_ATOMIC);
 
         brcmf_dbg(INFO, "mgmt_frame_len (%d) , e->datalen (%d), chanspec (%04x), freq (%d)\n",
                   mgmt_frame_len, e->datalen, chanspec, freq);
@@ -1934,7 +1946,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg)
 
                 p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = p2p_vif;
 
-                brcmf_p2p_generate_bss_mac(p2p);
+                brcmf_p2p_generate_bss_mac(p2p, NULL);
+                memcpy(p2p_ifp->mac_addr, p2p->dev_addr, ETH_ALEN);
                 brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
 
                 /* Initialize P2P Discovery in the firmware */
@@ -2001,21 +2014,19 @@ static void brcmf_p2p_get_current_chanspec(struct brcmf_p2p_info *p2p,
 {
         struct brcmf_if *ifp;
         struct brcmf_fil_chan_info_le ci;
+        struct brcmu_chan ch;
         s32 err;
 
         ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
 
-        *chanspec = 11 & WL_CHANSPEC_CHAN_MASK;
+        ch.chnum = 11;
 
         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_CHANNEL, &ci, sizeof(ci));
-        if (!err) {
-                *chanspec = le32_to_cpu(ci.hw_channel) & WL_CHANSPEC_CHAN_MASK;
-                if (*chanspec < CH_MAX_2G_CHANNEL)
-                        *chanspec |= WL_CHANSPEC_BAND_2G;
-                else
-                        *chanspec |= WL_CHANSPEC_BAND_5G;
-        }
-        *chanspec |= WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE;
+        if (!err)
+                ch.chnum = le32_to_cpu(ci.hw_channel);
+        ch.bw = BRCMU_CHAN_BW_20;
+        p2p->cfg->d11inf.encchspec(&ch);
+        *chanspec = ch.chspec;
 }
 
 /**
@@ -2040,13 +2051,13 @@ int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
                 brcmf_err("vif for P2PAPI_BSSCFG_PRIMARY does not exist\n");
                 return -EPERM;
         }
-        brcmf_notify_escan_complete(cfg, vif->ifp->ndev, true, true);
+        brcmf_notify_escan_complete(cfg, vif->ifp, true, true);
         vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
         if (!vif) {
                 brcmf_err("vif for P2PAPI_BSSCFG_CONNECTION does not exist\n");
                 return -EPERM;
         }
-        brcmf_set_mpc(vif->ifp->ndev, 0);
+        brcmf_set_mpc(vif->ifp, 0);
 
         /* In concurrency case, STA may be already associated in a particular */
         /* channel. so retrieve the current channel of primary interface and  */
@@ -2124,13 +2135,105 @@ static int brcmf_p2p_release_p2p_if(struct brcmf_cfg80211_vif *vif)
 }
 
 /**
+ * brcmf_p2p_create_p2pdev() - create a P2P_DEVICE virtual interface.
+ *
+ * @p2p: P2P specific data.
+ * @wiphy: wiphy device of new interface.
+ * @addr: mac address for this new interface.
+ */
+static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p,
+                                                    struct wiphy *wiphy,
+                                                    u8 *addr)
+{
+        struct brcmf_cfg80211_vif *p2p_vif;
+        struct brcmf_if *p2p_ifp;
+        struct brcmf_if *pri_ifp;
+        int err;
+        u32 bssidx;
+
+        if (p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
+                return ERR_PTR(-ENOSPC);
+
+        p2p_vif = brcmf_alloc_vif(p2p->cfg, NL80211_IFTYPE_P2P_DEVICE,
+                                  false);
+        if (IS_ERR(p2p_vif)) {
+                brcmf_err("could not create discovery vif\n");
+                return (struct wireless_dev *)p2p_vif;
+        }
+
+        pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
+        brcmf_p2p_generate_bss_mac(p2p, addr);
+        brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
+
+        brcmf_cfg80211_arm_vif_event(p2p->cfg, p2p_vif);
+
+        /* Initialize P2P Discovery in the firmware */
+        err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
+        if (err < 0) {
+                brcmf_err("set p2p_disc error\n");
+                brcmf_cfg80211_arm_vif_event(p2p->cfg, NULL);
+                goto fail;
+        }
+
+        /* wait for firmware event */
+        err = brcmf_cfg80211_wait_vif_event_timeout(p2p->cfg, BRCMF_E_IF_ADD,
+                                                    msecs_to_jiffies(1500));
+        brcmf_cfg80211_arm_vif_event(p2p->cfg, NULL);
+        if (!err) {
+                brcmf_err("timeout occurred\n");
+                err = -EIO;
+                goto fail;
+        }
+
+        /* discovery interface created */
+        p2p_ifp = p2p_vif->ifp;
+        p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = p2p_vif;
+        memcpy(p2p_ifp->mac_addr, p2p->dev_addr, ETH_ALEN);
+        memcpy(&p2p_vif->wdev.address, p2p->dev_addr, sizeof(p2p->dev_addr));
+
+        /* verify bsscfg index for P2P discovery */
+        err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bssidx);
+        if (err < 0) {
+                brcmf_err("retrieving discover bsscfg index failed\n");
+                goto fail;
+        }
+
+        WARN_ON(p2p_ifp->bssidx != bssidx);
+
+        init_completion(&p2p->send_af_done);
+        INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
+        init_completion(&p2p->afx_hdl.act_frm_scan);
+        init_completion(&p2p->wait_next_af);
+
+        return &p2p_vif->wdev;
+
+fail:
+        brcmf_free_vif(p2p_vif);
+        return ERR_PTR(err);
+}
+
+/**
+ * brcmf_p2p_delete_p2pdev() - delete P2P_DEVICE virtual interface.
+ *
+ * @vif: virtual interface object to delete.
+ */
+static void brcmf_p2p_delete_p2pdev(struct brcmf_cfg80211_vif *vif)
+{
+        struct brcmf_p2p_info *p2p = &vif->ifp->drvr->config->p2p;
+
+        cfg80211_unregister_wdev(&vif->wdev);
+        p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
+        brcmf_free_vif(vif);
+}
+
+/**
  * brcmf_p2p_add_vif() - create a new P2P virtual interface.
  *
  * @wiphy: wiphy device of new interface.
  * @name: name of the new interface.
  * @type: nl80211 interface type.
- * @flags: TBD
- * @params: TBD
+ * @flags: not used.
+ * @params: contains mac address for P2P device.
  */
 struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
                                        enum nl80211_iftype type, u32 *flags,
@@ -2157,6 +2260,9 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
                 iftype = BRCMF_FIL_P2P_IF_GO;
                 mode = WL_MODE_AP;
                 break;
+        case NL80211_IFTYPE_P2P_DEVICE:
+                return brcmf_p2p_create_p2pdev(&cfg->p2p, wiphy,
+                                               params->macaddr);
         default:
                 return ERR_PTR(-EOPNOTSUPP);
         }
@@ -2244,6 +2350,8 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
                 break;
 
         case NL80211_IFTYPE_P2P_DEVICE:
+                brcmf_p2p_delete_p2pdev(vif);
+                return 0;
         default:
                 return -ENOTSUPP;
                 break;
@@ -2275,3 +2383,33 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
 
         return err;
 }
+
+int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct brcmf_cfg80211_vif *vif;
+        int err;
+
+        vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
+        mutex_lock(&cfg->usr_sync);
+        err = brcmf_p2p_enable_discovery(p2p);
+        if (!err)
+                set_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state);
+        mutex_unlock(&cfg->usr_sync);
+        return err;
+}
+
+void brcmf_p2p_stop_device(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct brcmf_cfg80211_vif *vif;
+
+        vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
+        mutex_lock(&cfg->usr_sync);
+        (void)brcmf_p2p_deinit_discovery(p2p);
+        brcmf_abort_scanning(cfg);
+        clear_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state);
+        mutex_unlock(&cfg->usr_sync);
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
index 14be2d5530ce..ca72177388b9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
@@ -40,6 +40,15 @@
 #define BCM4329_CORE_ARM_BASE           0x18002000
 #define BCM4329_RAMSIZE                 0x48000
 
+/* bcm43143 */
+/* SDIO device core */
+#define BCM43143_CORE_BUS_BASE          0x18002000
+/* internal memory core */
+#define BCM43143_CORE_SOCRAM_BASE       0x18004000
+/* ARM Cortex M3 core, ID 0x82a */
+#define BCM43143_CORE_ARM_BASE          0x18003000
+#define BCM43143_RAMSIZE                0x70000
+
 #define SBCOREREV(sbidh) \
         ((((sbidh) & SSB_IDHIGH_RCHI) >> SSB_IDHIGH_RCHI_SHIFT) | \
           ((sbidh) & SSB_IDHIGH_RCLO))
@@ -52,6 +61,9 @@
 #define CIB_REV_MASK            0xff000000
 #define CIB_REV_SHIFT           24
 
+/* ARM CR4 core specific control flag bits */
+#define ARMCR4_BCMA_IOCTL_CPUHALT       0x0020
+
 #define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
 /* SDIO Pad drive strength to select value mappings */
 struct sdiod_drive_str {
@@ -70,6 +82,14 @@ static const struct sdiod_drive_str sdiod_drvstr_tab1_1v8[] = {
         {0, 0x1}
 };
 
+/* SDIO Drive Strength to sel value table for 43143 PMU Rev 17 (3.3V) */
+static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
+        {16, 0x7},
+        {12, 0x5},
+        {8,  0x3},
+        {4,  0x1}
+};
+
 u8
 brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid)
 {
@@ -149,7 +169,7 @@ brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
 
 static void
 brcmf_sdio_sb_coredisable(struct brcmf_sdio_dev *sdiodev,
-                          struct chip_info *ci, u16 coreid)
+                          struct chip_info *ci, u16 coreid, u32 core_bits)
 {
         u32 regdata, base;
         u8 idx;
@@ -235,7 +255,7 @@ brcmf_sdio_sb_coredisable(struct brcmf_sdio_dev *sdiodev,
 
 static void
 brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
-                          struct chip_info *ci, u16 coreid)
+                          struct chip_info *ci, u16 coreid, u32 core_bits)
 {
         u8 idx;
         u32 regdata;
@@ -249,19 +269,36 @@ brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
         if ((regdata & BCMA_RESET_CTL_RESET) != 0)
                 return;
 
-        brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL, 0, NULL);
-        regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
+        /* ensure no pending backplane operation
+         * 300uc should be sufficient for backplane ops to be finish
+         * extra 10ms is taken into account for firmware load stage
+         * after 10300us carry on disabling the core anyway
+         */
+        SPINWAIT(brcmf_sdio_regrl(sdiodev,
+                                  ci->c_inf[idx].wrapbase+BCMA_RESET_ST,
+                                  NULL), 10300);
+        regdata = brcmf_sdio_regrl(sdiodev,
+                                   ci->c_inf[idx].wrapbase+BCMA_RESET_ST,
                                    NULL);
-        udelay(10);
+        if (regdata)
+                brcmf_err("disabling core 0x%x with reset status %x\n",
+                          coreid, regdata);
 
         brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
                          BCMA_RESET_CTL_RESET, NULL);
         udelay(1);
+
+        brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
+                         core_bits, NULL);
+        regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
+                                   NULL);
+        usleep_range(10, 20);
+
 }
 
 static void
 brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid)
+                        struct chip_info *ci, u16 coreid, u32 core_bits)
 {
         u32 regdata;
         u8 idx;
@@ -272,7 +309,7 @@ brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
          * Must do the disable sequence first to work for
          * arbitrary current core state.
          */
-        brcmf_sdio_sb_coredisable(sdiodev, ci, coreid);
+        brcmf_sdio_sb_coredisable(sdiodev, ci, coreid, 0);
 
         /*
          * Now do the initialization sequence.
@@ -325,7 +362,7 @@ brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
 
 static void
 brcmf_sdio_ai_resetcore(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid)
+                        struct chip_info *ci, u16 coreid, u32 core_bits)
 {
         u8 idx;
         u32 regdata;
@@ -333,31 +370,69 @@ brcmf_sdio_ai_resetcore(struct brcmf_sdio_dev *sdiodev,
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
 
         /* must disable first to work for arbitrary current core state */
-        brcmf_sdio_ai_coredisable(sdiodev, ci, coreid);
+        brcmf_sdio_ai_coredisable(sdiodev, ci, coreid, core_bits);
 
         /* now do initialization sequence */
         brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                         BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
+                         core_bits | BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
         regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
                                    NULL);
         brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
                          0, NULL);
+        regdata = brcmf_sdio_regrl(sdiodev,
+                                   ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
+                                   NULL);
         udelay(1);
 
         brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                         BCMA_IOCTL_CLK, NULL);
+                         core_bits | BCMA_IOCTL_CLK, NULL);
         regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
                                    NULL);
         udelay(1);
 }
 
+#ifdef DEBUG
+/* safety check for chipinfo */
+static int brcmf_sdio_chip_cichk(struct chip_info *ci)
+{
+        u8 core_idx;
+
+        /* check RAM core presence for ARM CM3 core */
+        core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_ARM_CM3);
+        if (BRCMF_MAX_CORENUM != core_idx) {
+                core_idx = brcmf_sdio_chip_getinfidx(ci,
+                                                     BCMA_CORE_INTERNAL_MEM);
+                if (BRCMF_MAX_CORENUM == core_idx) {
+                        brcmf_err("RAM core not provided with ARM CM3 core\n");
+                        return -ENODEV;
+                }
+        }
+
+        /* check RAM base for ARM CR4 core */
+        core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_ARM_CR4);
+        if (BRCMF_MAX_CORENUM != core_idx) {
+                if (ci->rambase == 0) {
+                        brcmf_err("RAM base not provided with ARM CR4 core\n");
+                        return -ENOMEM;
+                }
+        }
+
+        return 0;
+}
+#else   /* DEBUG */
+static inline int brcmf_sdio_chip_cichk(struct chip_info *ci)
+{
+        return 0;
+}
+#endif
+
 static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
                                        struct chip_info *ci, u32 regs)
 {
         u32 regdata;
+        int ret;
 
-        /*
-         * Get CC core rev
+        /* Get CC core rev
          * Chipid is assume to be at offset 0 from regs arg
          * For different chiptypes or old sdio hosts w/o chipcommon,
          * other ways of recognition should be added here.
@@ -375,6 +450,23 @@ static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
 
         /* Address of cores for new chips should be added here */
         switch (ci->chip) {
+        case BCM43143_CHIP_ID:
+                ci->c_inf[0].wrapbase = ci->c_inf[0].base + 0x00100000;
+                ci->c_inf[0].cib = 0x2b000000;
+                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                ci->c_inf[1].base = BCM43143_CORE_BUS_BASE;
+                ci->c_inf[1].wrapbase = ci->c_inf[1].base + 0x00100000;
+                ci->c_inf[1].cib = 0x18000000;
+                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                ci->c_inf[2].base = BCM43143_CORE_SOCRAM_BASE;
+                ci->c_inf[2].wrapbase = ci->c_inf[2].base + 0x00100000;
+                ci->c_inf[2].cib = 0x14000000;
+                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                ci->c_inf[3].base = BCM43143_CORE_ARM_BASE;
+                ci->c_inf[3].wrapbase = ci->c_inf[3].base + 0x00100000;
+                ci->c_inf[3].cib = 0x07000000;
+                ci->ramsize = BCM43143_RAMSIZE;
+                break;
         case BCM43241_CHIP_ID:
                 ci->c_inf[0].wrapbase = 0x18100000;
                 ci->c_inf[0].cib = 0x2a084411;
@@ -435,11 +527,29 @@ static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
                 ci->c_inf[3].cib = 0x07004211;
                 ci->ramsize = 0x80000;
                 break;
+        case BCM4335_CHIP_ID:
+                ci->c_inf[0].wrapbase = 0x18100000;
+                ci->c_inf[0].cib = 0x2b084411;
+                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                ci->c_inf[1].base = 0x18005000;
+                ci->c_inf[1].wrapbase = 0x18105000;
+                ci->c_inf[1].cib = 0x0f004211;
+                ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
+                ci->c_inf[2].base = 0x18002000;
+                ci->c_inf[2].wrapbase = 0x18102000;
+                ci->c_inf[2].cib = 0x01084411;
+                ci->ramsize = 0xc0000;
+                ci->rambase = 0x180000;
+                break;
         default:
                 brcmf_err("chipid 0x%x is not supported\n", ci->chip);
                 return -ENODEV;
         }
 
+        ret = brcmf_sdio_chip_cichk(ci);
+        if (ret)
+                return ret;
+
         switch (ci->socitype) {
         case SOCI_SB:
                 ci->iscoreup = brcmf_sdio_sb_iscoreup;
@@ -539,7 +649,7 @@ brcmf_sdio_chip_buscoresetup(struct brcmf_sdio_dev *sdiodev,
          * Make sure any on-chip ARM is off (in case strapping is wrong),
          * or downloaded code was already running.
          */
-        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3);
+        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0);
 }
 
 int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
@@ -600,21 +710,37 @@ void
 brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
                                   struct chip_info *ci, u32 drivestrength)
 {
-        struct sdiod_drive_str *str_tab = NULL;
-        u32 str_mask = 0;
-        u32 str_shift = 0;
+        const struct sdiod_drive_str *str_tab = NULL;
+        u32 str_mask;
+        u32 str_shift;
         char chn[8];
         u32 base = ci->c_inf[0].base;
+        u32 i;
+        u32 drivestrength_sel = 0;
+        u32 cc_data_temp;
+        u32 addr;
 
         if (!(ci->c_inf[0].caps & CC_CAP_PMU))
                 return;
 
         switch (SDIOD_DRVSTR_KEY(ci->chip, ci->pmurev)) {
         case SDIOD_DRVSTR_KEY(BCM4330_CHIP_ID, 12):
-                str_tab = (struct sdiod_drive_str *)&sdiod_drvstr_tab1_1v8;
+                str_tab = sdiod_drvstr_tab1_1v8;
                 str_mask = 0x00003800;
                 str_shift = 11;
                 break;
+        case SDIOD_DRVSTR_KEY(BCM43143_CHIP_ID, 17):
+                /* note: 43143 does not support tristate */
+                i = ARRAY_SIZE(sdiod_drvstr_tab2_3v3) - 1;
+                if (drivestrength >= sdiod_drvstr_tab2_3v3[i].strength) {
+                        str_tab = sdiod_drvstr_tab2_3v3;
+                        str_mask = 0x00000007;
+                        str_shift = 0;
+                } else
+                        brcmf_err("Invalid SDIO Drive strength for chip %s, strength=%d\n",
+                                  brcmf_sdio_chip_name(ci->chip, chn, 8),
+                                  drivestrength);
+                break;
         default:
                 brcmf_err("No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
                           brcmf_sdio_chip_name(ci->chip, chn, 8),
@@ -623,30 +749,207 @@ brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
         }
 
         if (str_tab != NULL) {
-                u32 drivestrength_sel = 0;
-                u32 cc_data_temp;
-                int i;
-
                 for (i = 0; str_tab[i].strength != 0; i++) {
                         if (drivestrength >= str_tab[i].strength) {
                                 drivestrength_sel = str_tab[i].sel;
                                 break;
                         }
                 }
-
-                brcmf_sdio_regwl(sdiodev, CORE_CC_REG(base, chipcontrol_addr),
-                                 1, NULL);
-                cc_data_temp =
-                        brcmf_sdio_regrl(sdiodev,
-                                         CORE_CC_REG(base, chipcontrol_addr),
-                                         NULL);
+                addr = CORE_CC_REG(base, chipcontrol_addr);
+                brcmf_sdio_regwl(sdiodev, addr, 1, NULL);
+                cc_data_temp = brcmf_sdio_regrl(sdiodev, addr, NULL);
                 cc_data_temp &= ~str_mask;
                 drivestrength_sel <<= str_shift;
                 cc_data_temp |= drivestrength_sel;
-                brcmf_sdio_regwl(sdiodev, CORE_CC_REG(base, chipcontrol_addr),
-                                 cc_data_temp, NULL);
+                brcmf_sdio_regwl(sdiodev, addr, cc_data_temp, NULL);
 
-                brcmf_dbg(INFO, "SDIO: %dmA drive strength selected, set to 0x%08x\n",
-                          drivestrength, cc_data_temp);
+                brcmf_dbg(INFO, "SDIO: %d mA (req=%d mA) drive strength selected, set to 0x%08x\n",
+                          str_tab[i].strength, drivestrength, cc_data_temp);
         }
 }
+
+#ifdef DEBUG
+static bool
+brcmf_sdio_chip_verifynvram(struct brcmf_sdio_dev *sdiodev, u32 nvram_addr,
+                            char *nvram_dat, uint nvram_sz)
+{
+        char *nvram_ularray;
+        int err;
+        bool ret = true;
+
+        /* read back and verify */
+        brcmf_dbg(INFO, "Compare NVRAM dl & ul; size=%d\n", nvram_sz);
+        nvram_ularray = kmalloc(nvram_sz, GFP_KERNEL);
+        /* do not proceed while no memory but  */
+        if (!nvram_ularray)
+                return true;
+
+        /* Upload image to verify downloaded contents. */
+        memset(nvram_ularray, 0xaa, nvram_sz);
+
+        /* Read the vars list to temp buffer for comparison */
+        err = brcmf_sdio_ramrw(sdiodev, false, nvram_addr, nvram_ularray,
+                               nvram_sz);
+        if (err) {
+                brcmf_err("error %d on reading %d nvram bytes at 0x%08x\n",
+                          err, nvram_sz, nvram_addr);
+        } else if (memcmp(nvram_dat, nvram_ularray, nvram_sz)) {
+                brcmf_err("Downloaded NVRAM image is corrupted\n");
+                ret = false;
+        }
+        kfree(nvram_ularray);
+
+        return ret;
+}
+#else   /* DEBUG */
+static inline bool
+brcmf_sdio_chip_verifynvram(struct brcmf_sdio_dev *sdiodev, u32 nvram_addr,
+                            char *nvram_dat, uint nvram_sz)
+{
+        return true;
+}
+#endif  /* DEBUG */
+
+static bool brcmf_sdio_chip_writenvram(struct brcmf_sdio_dev *sdiodev,
+                                       struct chip_info *ci,
+                                       char *nvram_dat, uint nvram_sz)
+{
+        int err;
+        u32 nvram_addr;
+        u32 token;
+        __le32 token_le;
+
+        nvram_addr = (ci->ramsize - 4) - nvram_sz + ci->rambase;
+
+        /* Write the vars list */
+        err = brcmf_sdio_ramrw(sdiodev, true, nvram_addr, nvram_dat, nvram_sz);
+        if (err) {
+                brcmf_err("error %d on writing %d nvram bytes at 0x%08x\n",
+                          err, nvram_sz, nvram_addr);
+                return false;
+        }
+
+        if (!brcmf_sdio_chip_verifynvram(sdiodev, nvram_addr,
+                                         nvram_dat, nvram_sz))
+                return false;
+
+        /* generate token:
+         * nvram size, converted to words, in lower 16-bits, checksum
+         * in upper 16-bits.
+         */
+        token = nvram_sz / 4;
+        token = (~token << 16) | (token & 0x0000FFFF);
+        token_le = cpu_to_le32(token);
+
+        brcmf_dbg(INFO, "RAM size: %d\n", ci->ramsize);
+        brcmf_dbg(INFO, "nvram is placed at %d, size %d, token=0x%08x\n",
+                  nvram_addr, nvram_sz, token);
+
+        /* Write the length token to the last word */
+        if (brcmf_sdio_ramrw(sdiodev, true, (ci->ramsize - 4 + ci->rambase),
+                             (u8 *)&token_le, 4))
+                return false;
+
+        return true;
+}
+
+static void
+brcmf_sdio_chip_cm3_enterdl(struct brcmf_sdio_dev *sdiodev,
+                            struct chip_info *ci)
+{
+        u32 zeros = 0;
+
+        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_INTERNAL_MEM, 0);
+
+        /* clear length token */
+        brcmf_sdio_ramrw(sdiodev, true, ci->ramsize - 4, (u8 *)&zeros, 4);
+}
+
+static bool
+brcmf_sdio_chip_cm3_exitdl(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
+                           char *nvram_dat, uint nvram_sz)
+{
+        u8 core_idx;
+        u32 reg_addr;
+
+        if (!ci->iscoreup(sdiodev, ci, BCMA_CORE_INTERNAL_MEM)) {
+                brcmf_err("SOCRAM core is down after reset?\n");
+                return false;
+        }
+
+        if (!brcmf_sdio_chip_writenvram(sdiodev, ci, nvram_dat, nvram_sz))
+                return false;
+
+        /* clear all interrupts */
+        core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_SDIO_DEV);
+        reg_addr = ci->c_inf[core_idx].base;
+        reg_addr += offsetof(struct sdpcmd_regs, intstatus);
+        brcmf_sdio_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+
+        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CM3, 0);
+
+        return true;
+}
+
+static inline void
+brcmf_sdio_chip_cr4_enterdl(struct brcmf_sdio_dev *sdiodev,
+                            struct chip_info *ci)
+{
+        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4,
+                      ARMCR4_BCMA_IOCTL_CPUHALT);
+}
+
+static bool
+brcmf_sdio_chip_cr4_exitdl(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
+                           char *nvram_dat, uint nvram_sz)
+{
+        u8 core_idx;
+        u32 reg_addr;
+
+        if (!brcmf_sdio_chip_writenvram(sdiodev, ci, nvram_dat, nvram_sz))
+                return false;
+
+        /* clear all interrupts */
+        core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_SDIO_DEV);
+        reg_addr = ci->c_inf[core_idx].base;
+        reg_addr += offsetof(struct sdpcmd_regs, intstatus);
+        brcmf_sdio_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+
+        /* Write reset vector to address 0 */
+        brcmf_sdio_ramrw(sdiodev, true, 0, (void *)&ci->rst_vec,
+                         sizeof(ci->rst_vec));
+
+        /* restore ARM */
+        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4, 0);
+
+        return true;
+}
+
+void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
+                                    struct chip_info *ci)
+{
+        u8 arm_core_idx;
+
+        arm_core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_ARM_CM3);
+        if (BRCMF_MAX_CORENUM != arm_core_idx) {
+                brcmf_sdio_chip_cm3_enterdl(sdiodev, ci);
+                return;
+        }
+
+        brcmf_sdio_chip_cr4_enterdl(sdiodev, ci);
+}
+
+bool brcmf_sdio_chip_exit_download(struct brcmf_sdio_dev *sdiodev,
+                                   struct chip_info *ci, char *nvram_dat,
+                                   uint nvram_sz)
+{
+        u8 arm_core_idx;
+
+        arm_core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_ARM_CM3);
+        if (BRCMF_MAX_CORENUM != arm_core_idx)
+                return brcmf_sdio_chip_cm3_exitdl(sdiodev, ci, nvram_dat,
+                                                  nvram_sz);
+
+        return brcmf_sdio_chip_cr4_exitdl(sdiodev, ci, nvram_dat, nvram_sz);
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
index ce974d76bd92..83c041f1bf4a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
@@ -73,15 +73,17 @@ struct chip_info {
         u32 pmurev;
         u32 pmucaps;
         u32 ramsize;
+        u32 rambase;
+        u32 rst_vec;    /* reset vertor for ARM CR4 core */
 
         bool (*iscoreup)(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
                          u16 coreid);
         u32 (*corerev)(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
                          u16 coreid);
         void (*coredisable)(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid);
+                        struct chip_info *ci, u16 coreid, u32 core_bits);
         void (*resetcore)(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid);
+                        struct chip_info *ci, u16 coreid, u32 core_bits);
 };
 
 struct sbconfig {
@@ -124,6 +126,95 @@ struct sbconfig {
         u32 sbidhigh;   /* identification */
 };
 
+/* sdio core registers */
+struct sdpcmd_regs {
+        u32 corecontrol;                /* 0x00, rev8 */
+        u32 corestatus;                 /* rev8 */
+        u32 PAD[1];
+        u32 biststatus;                 /* rev8 */
+
+        /* PCMCIA access */
+        u16 pcmciamesportaladdr;        /* 0x010, rev8 */
+        u16 PAD[1];
+        u16 pcmciamesportalmask;        /* rev8 */
+        u16 PAD[1];
+        u16 pcmciawrframebc;            /* rev8 */
+        u16 PAD[1];
+        u16 pcmciaunderflowtimer;       /* rev8 */
+        u16 PAD[1];
+
+        /* interrupt */
+        u32 intstatus;                  /* 0x020, rev8 */
+        u32 hostintmask;                /* rev8 */
+        u32 intmask;                    /* rev8 */
+        u32 sbintstatus;                /* rev8 */
+        u32 sbintmask;                  /* rev8 */
+        u32 funcintmask;                /* rev4 */
+        u32 PAD[2];
+        u32 tosbmailbox;                /* 0x040, rev8 */
+        u32 tohostmailbox;              /* rev8 */
+        u32 tosbmailboxdata;            /* rev8 */
+        u32 tohostmailboxdata;          /* rev8 */
+
+        /* synchronized access to registers in SDIO clock domain */
+        u32 sdioaccess;                 /* 0x050, rev8 */
+        u32 PAD[3];
+
+        /* PCMCIA frame control */
+        u8 pcmciaframectrl;             /* 0x060, rev8 */
+        u8 PAD[3];
+        u8 pcmciawatermark;             /* rev8 */
+        u8 PAD[155];
+
+        /* interrupt batching control */
+        u32 intrcvlazy;                 /* 0x100, rev8 */
+        u32 PAD[3];
+
+        /* counters */
+        u32 cmd52rd;                    /* 0x110, rev8 */
+        u32 cmd52wr;                    /* rev8 */
+        u32 cmd53rd;                    /* rev8 */
+        u32 cmd53wr;                    /* rev8 */
+        u32 abort;                      /* rev8 */
+        u32 datacrcerror;               /* rev8 */
+        u32 rdoutofsync;                /* rev8 */
+        u32 wroutofsync;                /* rev8 */
+        u32 writebusy;                  /* rev8 */
+        u32 readwait;                   /* rev8 */
+        u32 readterm;                   /* rev8 */
+        u32 writeterm;                  /* rev8 */
+        u32 PAD[40];
+        u32 clockctlstatus;             /* rev8 */
+        u32 PAD[7];
+
+        u32 PAD[128];                   /* DMA engines */
+
+        /* SDIO/PCMCIA CIS region */
+        char cis[512];                  /* 0x400-0x5ff, rev6 */
+
+        /* PCMCIA function control registers */
+        char pcmciafcr[256];            /* 0x600-6ff, rev6 */
+        u16 PAD[55];
+
+        /* PCMCIA backplane access */
+        u16 backplanecsr;               /* 0x76E, rev6 */
+        u16 backplaneaddr0;             /* rev6 */
+        u16 backplaneaddr1;             /* rev6 */
+        u16 backplaneaddr2;             /* rev6 */
+        u16 backplaneaddr3;             /* rev6 */
+        u16 backplanedata0;             /* rev6 */
+        u16 backplanedata1;             /* rev6 */
+        u16 backplanedata2;             /* rev6 */
+        u16 backplanedata3;             /* rev6 */
+        u16 PAD[31];
+
+        /* sprom "size" & "blank" info */
+        u16 spromstatus;                /* 0x7BE, rev2 */
+        u32 PAD[464];
+
+        u16 PAD[0x80];
+};
+
 extern int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
                                   struct chip_info **ci_ptr, u32 regs);
 extern void brcmf_sdio_chip_detach(struct chip_info **ci_ptr);
@@ -131,6 +222,10 @@ extern void brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
                                               struct chip_info *ci,
                                               u32 drivestrength);
 extern u8 brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid);
-
+extern void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
+                                           struct chip_info *ci);
+extern bool brcmf_sdio_chip_exit_download(struct brcmf_sdio_dev *sdiodev,
+                                          struct chip_info *ci, char *nvram_dat,
+                                          uint nvram_sz);
 
 #endif          /* _BRCMFMAC_SDIO_CHIP_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
index 0d30afd8c672..7c1b6332747e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
@@ -48,7 +48,13 @@
 #define SBSDIO_NUM_FUNCTION             3
 
 /* function 0 vendor specific CCCR registers */
-#define SDIO_CCCR_BRCM_SEPINT           0xf2
+#define SDIO_CCCR_BRCM_CARDCAP                  0xf0
+#define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT    0x02
+#define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT        0x04
+#define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC        0x08
+#define SDIO_CCCR_BRCM_CARDCTRL         0xf1
+#define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET       0x02
+#define SDIO_CCCR_BRCM_SEPINT                   0xf2
 
 #define  SDIO_SEPINT_MASK               0x01
 #define  SDIO_SEPINT_OE                 0x02
@@ -97,9 +103,23 @@
 #define SBSDIO_FUNC1_RFRAMEBCLO         0x1001B
 /* Read Frame Byte Count High */
 #define SBSDIO_FUNC1_RFRAMEBCHI         0x1001C
+/* MesBusyCtl (rev 11) */
+#define SBSDIO_FUNC1_MESBUSYCTRL        0x1001D
+/* Sdio Core Rev 12 */
+#define SBSDIO_FUNC1_WAKEUPCTRL         0x1001E
+#define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK         0x1
+#define SBSDIO_FUNC1_WCTRL_ALPWAIT_SHIFT        0
+#define SBSDIO_FUNC1_WCTRL_HTWAIT_MASK          0x2
+#define SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT         1
+#define SBSDIO_FUNC1_SLEEPCSR           0x1001F
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_MASK          0x1
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT         0
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_EN            1
+#define SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK        0x2
+#define SBSDIO_FUNC1_SLEEPCSR_DEVON_SHIFT       1
 
 #define SBSDIO_FUNC1_MISC_REG_START     0x10000 /* f1 misc register start */
-#define SBSDIO_FUNC1_MISC_REG_LIMIT     0x1001C /* f1 misc register end */
+#define SBSDIO_FUNC1_MISC_REG_LIMIT     0x1001F /* f1 misc register end */
 
 /* function 1 OCP space */
 
@@ -154,13 +174,11 @@ struct brcmf_sdio_dev {
         wait_queue_head_t request_buffer_wait;
         struct device *dev;
         struct brcmf_bus *bus_if;
-#ifdef CONFIG_BRCMFMAC_SDIO_OOB
-        unsigned int irq;               /* oob interrupt number */
-        unsigned long irq_flags;        /* board specific oob flags */
+        struct brcmfmac_sdio_platform_data *pdata;
+        bool oob_irq_requested;
         bool irq_en;                    /* irq enable flags */
         spinlock_t irq_en_lock;
         bool irq_wake;                  /* irq wake enable flags */
-#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
 };
 
 /* Register/deregister interrupt handler. */
@@ -224,6 +242,8 @@ brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
  */
 extern int brcmf_sdcard_rwdata(struct brcmf_sdio_dev *sdiodev, uint rw,
                                u32 addr, u8 *buf, uint nbytes);
+extern int brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write,
+                            u32 address, u8 *data, uint size);
 
 /* Issue an abort to the specified function */
 extern int brcmf_sdcard_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
new file mode 100644
index 000000000000..b505db48c60d
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h> /* bug in tracepoint.h, it should include this */
+
+#ifndef __CHECKER__
+#define CREATE_TRACE_POINTS
+#include "tracepoint.h"
+#endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h
new file mode 100644
index 000000000000..9df1f7a681e0
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#if !defined(BRCMF_TRACEPOINT_H_) || defined(TRACE_HEADER_MULTI_READ)
+#define BRCMF_TRACEPOINT_H_
+
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+
+#ifndef CONFIG_BRCM_TRACING
+
+#undef TRACE_EVENT
+#define TRACE_EVENT(name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+
+#undef DECLARE_EVENT_CLASS
+#define DECLARE_EVENT_CLASS(...)
+
+#undef DEFINE_EVENT
+#define DEFINE_EVENT(evt_class, name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+
+#endif /* CONFIG_BRCM_TRACING */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM    brcmfmac
+
+#define MAX_MSG_LEN             100
+
+TRACE_EVENT(brcmf_err,
+        TP_PROTO(const char *func, struct va_format *vaf),
+        TP_ARGS(func, vaf),
+        TP_STRUCT__entry(
+                __string(func, func)
+                __dynamic_array(char, msg, MAX_MSG_LEN)
+        ),
+        TP_fast_assign(
+                __assign_str(func, func);
+                WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+                                       MAX_MSG_LEN, vaf->fmt,
+                                       *vaf->va) >= MAX_MSG_LEN);
+        ),
+        TP_printk("%s: %s", __get_str(func), __get_str(msg))
+);
+
+TRACE_EVENT(brcmf_dbg,
+        TP_PROTO(u32 level, const char *func, struct va_format *vaf),
+        TP_ARGS(level, func, vaf),
+        TP_STRUCT__entry(
+                __field(u32, level)
+                __string(func, func)
+                __dynamic_array(char, msg, MAX_MSG_LEN)
+        ),
+        TP_fast_assign(
+                __entry->level = level;
+                __assign_str(func, func);
+                WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+                                       MAX_MSG_LEN, vaf->fmt,
+                                       *vaf->va) >= MAX_MSG_LEN);
+        ),
+        TP_printk("%s: %s", __get_str(func), __get_str(msg))
+);
+
+TRACE_EVENT(brcmf_hexdump,
+        TP_PROTO(void *data, size_t len),
+        TP_ARGS(data, len),
+        TP_STRUCT__entry(
+                __field(unsigned long, len)
+                __dynamic_array(u8, hdata, len)
+        ),
+        TP_fast_assign(
+                __entry->len = len;
+                memcpy(__get_dynamic_array(hdata), data, len);
+        ),
+        TP_printk("hexdump [length=%lu]", __entry->len)
+);
+
+#ifdef CONFIG_BRCM_TRACING
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE tracepoint
+
+#include <trace/define_trace.h>
+
+#endif /* CONFIG_BRCM_TRACING */
+
+#endif /* BRCMF_TRACEPOINT_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 42289e9ea886..01aed7ad6bec 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -112,11 +112,6 @@ struct brcmf_usbdev_info {
 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
                                 struct brcmf_usbreq  *req);
 
-MODULE_AUTHOR("Broadcom Corporation");
-MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac usb driver.");
-MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac usb cards");
-MODULE_LICENSE("Dual BSD/GPL");
-
 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
@@ -422,8 +417,6 @@ static void brcmf_usb_tx_complete(struct urb *urb)
         brcmf_usb_del_fromq(devinfo, req);
 
         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
-
-        brcmu_pkt_buf_free_skb(req->skb);
         req->skb = NULL;
         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
         if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
@@ -577,15 +570,17 @@ static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
         int ret;
 
         brcmf_dbg(USB, "Enter, skb=%p\n", skb);
-        if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
-                return -EIO;
+        if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
+                ret = -EIO;
+                goto fail;
+        }
 
         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
                                         &devinfo->tx_freecount);
         if (!req) {
-                brcmu_pkt_buf_free_skb(skb);
                 brcmf_err("no req to send\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         req->skb = skb;
@@ -598,18 +593,21 @@ static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
         if (ret) {
                 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
                 brcmf_usb_del_fromq(devinfo, req);
-                brcmu_pkt_buf_free_skb(req->skb);
                 req->skb = NULL;
                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
-                                                &devinfo->tx_freecount);
-        } else {
-                if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
-                        !devinfo->tx_flowblock) {
-                        brcmf_txflowblock(dev, true);
-                        devinfo->tx_flowblock = true;
-                }
+                              &devinfo->tx_freecount);
+                goto fail;
         }
 
+        if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
+            !devinfo->tx_flowblock) {
+                brcmf_txflowblock(dev, true);
+                devinfo->tx_flowblock = true;
+        }
+        return 0;
+
+fail:
+        brcmf_txcomplete(dev, skb, false);
         return ret;
 }
 
@@ -1485,6 +1483,7 @@ static struct usb_device_id brcmf_usb_devid_table[] = {
         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
         { }
 };
+
 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 2af9c0f0798d..3b3eb94b5472 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -26,6 +26,7 @@
 #include <brcmu_wifi.h>
 #include "dhd.h"
 #include "dhd_dbg.h"
+#include "tracepoint.h"
 #include "fwil_types.h"
 #include "p2p.h"
 #include "wl_cfg80211.h"
@@ -182,64 +183,6 @@ static struct ieee80211_channel __wl_5ghz_a_channels[] = {
         CHAN5G(216, 0),
 };
 
-static struct ieee80211_channel __wl_5ghz_n_channels[] = {
-        CHAN5G(32, 0), CHAN5G(34, 0),
-        CHAN5G(36, 0), CHAN5G(38, 0),
-        CHAN5G(40, 0), CHAN5G(42, 0),
-        CHAN5G(44, 0), CHAN5G(46, 0),
-        CHAN5G(48, 0), CHAN5G(50, 0),
-        CHAN5G(52, 0), CHAN5G(54, 0),
-        CHAN5G(56, 0), CHAN5G(58, 0),
-        CHAN5G(60, 0), CHAN5G(62, 0),
-        CHAN5G(64, 0), CHAN5G(66, 0),
-        CHAN5G(68, 0), CHAN5G(70, 0),
-        CHAN5G(72, 0), CHAN5G(74, 0),
-        CHAN5G(76, 0), CHAN5G(78, 0),
-        CHAN5G(80, 0), CHAN5G(82, 0),
-        CHAN5G(84, 0), CHAN5G(86, 0),
-        CHAN5G(88, 0), CHAN5G(90, 0),
-        CHAN5G(92, 0), CHAN5G(94, 0),
-        CHAN5G(96, 0), CHAN5G(98, 0),
-        CHAN5G(100, 0), CHAN5G(102, 0),
-        CHAN5G(104, 0), CHAN5G(106, 0),
-        CHAN5G(108, 0), CHAN5G(110, 0),
-        CHAN5G(112, 0), CHAN5G(114, 0),
-        CHAN5G(116, 0), CHAN5G(118, 0),
-        CHAN5G(120, 0), CHAN5G(122, 0),
-        CHAN5G(124, 0), CHAN5G(126, 0),
-        CHAN5G(128, 0), CHAN5G(130, 0),
-        CHAN5G(132, 0), CHAN5G(134, 0),
-        CHAN5G(136, 0), CHAN5G(138, 0),
-        CHAN5G(140, 0), CHAN5G(142, 0),
-        CHAN5G(144, 0), CHAN5G(145, 0),
-        CHAN5G(146, 0), CHAN5G(147, 0),
-        CHAN5G(148, 0), CHAN5G(149, 0),
-        CHAN5G(150, 0), CHAN5G(151, 0),
-        CHAN5G(152, 0), CHAN5G(153, 0),
-        CHAN5G(154, 0), CHAN5G(155, 0),
-        CHAN5G(156, 0), CHAN5G(157, 0),
-        CHAN5G(158, 0), CHAN5G(159, 0),
-        CHAN5G(160, 0), CHAN5G(161, 0),
-        CHAN5G(162, 0), CHAN5G(163, 0),
-        CHAN5G(164, 0), CHAN5G(165, 0),
-        CHAN5G(166, 0), CHAN5G(168, 0),
-        CHAN5G(170, 0), CHAN5G(172, 0),
-        CHAN5G(174, 0), CHAN5G(176, 0),
-        CHAN5G(178, 0), CHAN5G(180, 0),
-        CHAN5G(182, 0), CHAN5G(184, 0),
-        CHAN5G(186, 0), CHAN5G(188, 0),
-        CHAN5G(190, 0), CHAN5G(192, 0),
-        CHAN5G(194, 0), CHAN5G(196, 0),
-        CHAN5G(198, 0), CHAN5G(200, 0),
-        CHAN5G(202, 0), CHAN5G(204, 0),
-        CHAN5G(206, 0), CHAN5G(208, 0),
-        CHAN5G(210, 0), CHAN5G(212, 0),
-        CHAN5G(214, 0), CHAN5G(216, 0),
-        CHAN5G(218, 0), CHAN5G(220, 0),
-        CHAN5G(222, 0), CHAN5G(224, 0),
-        CHAN5G(226, 0), CHAN5G(228, 0),
-};
-
 static struct ieee80211_supported_band __wl_band_2ghz = {
         .band = IEEE80211_BAND_2GHZ,
         .channels = __wl_2ghz_channels,
@@ -256,12 +199,28 @@ static struct ieee80211_supported_band __wl_band_5ghz_a = {
         .n_bitrates = wl_a_rates_size,
 };
 
-static struct ieee80211_supported_band __wl_band_5ghz_n = {
-        .band = IEEE80211_BAND_5GHZ,
-        .channels = __wl_5ghz_n_channels,
-        .n_channels = ARRAY_SIZE(__wl_5ghz_n_channels),
-        .bitrates = wl_a_rates,
-        .n_bitrates = wl_a_rates_size,
+/* This is to override regulatory domains defined in cfg80211 module (reg.c)
+ * By default world regulatory domain defined in reg.c puts the flags
+ * NL80211_RRF_PASSIVE_SCAN and NL80211_RRF_NO_IBSS for 5GHz channels (for
+ * 36..48 and 149..165). With respect to these flags, wpa_supplicant doesn't
+ * start p2p operations on 5GHz channels. All the changes in world regulatory
+ * domain are to be done here.
+ */
+static const struct ieee80211_regdomain brcmf_regdom = {
+        .n_reg_rules = 4,
+        .alpha2 =  "99",
+        .reg_rules = {
+                /* IEEE 802.11b/g, channels 1..11 */
+                REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
+                /* If any */
+                /* IEEE 802.11 channel 14 - Only JP enables
+                 * this and for 802.11b only
+                 */
+                REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
+                /* IEEE 802.11a, channel 36..64 */
+                REG_RULE(5150-10, 5350+10, 40, 6, 20, 0),
+                /* IEEE 802.11a, channel 100..165 */
+                REG_RULE(5470-10, 5850+10, 40, 6, 20, 0), }
 };
 
 static const u32 __wl_cipher_suites[] = {
@@ -375,22 +334,16 @@ static u8 brcmf_mw_to_qdbm(u16 mw)
         return qdbm;
 }
 
-u16 channel_to_chanspec(struct ieee80211_channel *ch)
+u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
+                        struct ieee80211_channel *ch)
 {
-        u16 chanspec;
+        struct brcmu_chan ch_inf;
 
-        chanspec = ieee80211_frequency_to_channel(ch->center_freq);
-        chanspec &= WL_CHANSPEC_CHAN_MASK;
+        ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
+        ch_inf.bw = BRCMU_CHAN_BW_20;
+        d11inf->encchspec(&ch_inf);
 
-        if (ch->band == IEEE80211_BAND_2GHZ)
-                chanspec |= WL_CHANSPEC_BAND_2G;
-        else
-                chanspec |= WL_CHANSPEC_BAND_5G;
-
-        chanspec |= WL_CHANSPEC_BW_20;
-        chanspec |= WL_CHANSPEC_CTL_SB_NONE;
-
-        return chanspec;
+        return ch_inf.chspec;
 }
 
 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
@@ -523,17 +476,16 @@ static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
                 return ERR_PTR(-EOPNOTSUPP);
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_P2P_DEVICE:
                 return brcmf_p2p_add_vif(wiphy, name, type, flags, params);
         case NL80211_IFTYPE_UNSPECIFIED:
-        case NL80211_IFTYPE_P2P_DEVICE:
         default:
                 return ERR_PTR(-EINVAL);
         }
 }
 
-void brcmf_set_mpc(struct net_device *ndev, int mpc)
+void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err = 0;
 
         if (check_vif_up(ifp->vif)) {
@@ -546,10 +498,9 @@ void brcmf_set_mpc(struct net_device *ndev, int mpc)
         }
 }
 
-s32
-brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
-                            struct net_device *ndev,
-                            bool aborted, bool fw_abort)
+s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
+                                struct brcmf_if *ifp, bool aborted,
+                                bool fw_abort)
 {
         struct brcmf_scan_params_le params_le;
         struct cfg80211_scan_request *scan_request;
@@ -580,7 +531,7 @@ brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
                 /* Scan is aborted by setting channel_list[0] to -1 */
                 params_le.channel_list[0] = cpu_to_le16(-1);
                 /* E-Scan (or anyother type) can be aborted by SCAN */
-                err = brcmf_fil_cmd_data_set(netdev_priv(ndev), BRCMF_C_SCAN,
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
                                              &params_le, sizeof(params_le));
                 if (err)
                         brcmf_err("Scan abort  failed\n");
@@ -594,12 +545,12 @@ brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
                 cfg->sched_escan = false;
                 if (!aborted)
                         cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
-                brcmf_set_mpc(ndev, 1);
+                brcmf_set_mpc(ifp, 1);
         } else if (scan_request) {
                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
                           aborted ? "Aborted" : "Done");
                 cfg80211_scan_done(scan_request, aborted);
-                brcmf_set_mpc(ndev, 1);
+                brcmf_set_mpc(ifp, 1);
         }
         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
@@ -619,9 +570,9 @@ int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 
         if (ndev) {
                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
-                    cfg->escan_info.ndev == ndev)
-                        brcmf_notify_escan_complete(cfg, ndev, true,
-                                                    true);
+                    cfg->escan_info.ifp == netdev_priv(ndev))
+                        brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
+                                                    true, true);
 
                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
         }
@@ -637,9 +588,9 @@ int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
                 return -EOPNOTSUPP;
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_P2P_DEVICE:
                 return brcmf_p2p_del_vif(wiphy, wdev);
         case NL80211_IFTYPE_UNSPECIFIED:
-        case NL80211_IFTYPE_P2P_DEVICE:
         default:
                 return -EINVAL;
         }
@@ -723,7 +674,8 @@ done:
         return err;
 }
 
-static void brcmf_escan_prep(struct brcmf_scan_params_le *params_le,
+static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
+                             struct brcmf_scan_params_le *params_le,
                              struct cfg80211_scan_request *request)
 {
         u32 n_ssids;
@@ -755,7 +707,8 @@ static void brcmf_escan_prep(struct brcmf_scan_params_le *params_le,
                   n_channels);
         if (n_channels > 0) {
                 for (i = 0; i < n_channels; i++) {
-                        chanspec = channel_to_chanspec(request->channels[i]);
+                        chanspec = channel_to_chanspec(&cfg->d11inf,
+                                                       request->channels[i]);
                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
                                   request->channels[i]->hw_value, chanspec);
                         params_le->channel_list[i] = cpu_to_le16(chanspec);
@@ -803,7 +756,7 @@ static void brcmf_escan_prep(struct brcmf_scan_params_le *params_le,
 }
 
 static s32
-brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct net_device *ndev,
+brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
                 struct cfg80211_scan_request *request, u16 action)
 {
         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
@@ -827,13 +780,12 @@ brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct net_device *ndev,
                 goto exit;
         }
         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
-        brcmf_escan_prep(&params->params_le, request);
+        brcmf_escan_prep(cfg, &params->params_le, request);
         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
         params->action = cpu_to_le16(action);
         params->sync_id = cpu_to_le16(0x1234);
 
-        err = brcmf_fil_iovar_data_set(netdev_priv(ndev), "escan",
-                                       params, params_size);
+        err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
         if (err) {
                 if (err == -EBUSY)
                         brcmf_dbg(INFO, "system busy : escan canceled\n");
@@ -848,7 +800,7 @@ exit:
 
 static s32
 brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
-               struct net_device *ndev, struct cfg80211_scan_request *request)
+               struct brcmf_if *ifp, struct cfg80211_scan_request *request)
 {
         s32 err;
         u32 passive_scan;
@@ -856,35 +808,35 @@ brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
         struct escan_info *escan = &cfg->escan_info;
 
         brcmf_dbg(SCAN, "Enter\n");
-        escan->ndev = ndev;
+        escan->ifp = ifp;
         escan->wiphy = wiphy;
         escan->escan_state = WL_ESCAN_STATE_SCANNING;
         passive_scan = cfg->active_scan ? 0 : 1;
-        err = brcmf_fil_cmd_int_set(netdev_priv(ndev), BRCMF_C_SET_PASSIVE_SCAN,
+        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
                                     passive_scan);
         if (err) {
                 brcmf_err("error (%d)\n", err);
                 return err;
         }
-        brcmf_set_mpc(ndev, 0);
+        brcmf_set_mpc(ifp, 0);
         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
         results->version = 0;
         results->count = 0;
         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
 
-        err = escan->run(cfg, ndev, request, WL_ESCAN_ACTION_START);
+        err = escan->run(cfg, ifp, request, WL_ESCAN_ACTION_START);
         if (err)
-                brcmf_set_mpc(ndev, 1);
+                brcmf_set_mpc(ifp, 1);
         return err;
 }
 
 static s32
-brcmf_cfg80211_escan(struct wiphy *wiphy, struct net_device *ndev,
+brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
                      struct cfg80211_scan_request *request,
                      struct cfg80211_ssid *this_ssid)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_cfg80211_info *cfg = ndev_to_cfg(ndev);
+        struct brcmf_if *ifp = vif->ifp;
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct cfg80211_ssid *ssids;
         struct brcmf_cfg80211_scan_req *sr = &cfg->scan_req_int;
         u32 passive_scan;
@@ -910,10 +862,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy, struct net_device *ndev,
         }
 
         /* If scan req comes for p2p0, send it over primary I/F */
-        if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif) {
-                ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
-                ndev = ifp->ndev;
-        }
+        if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
+                vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
 
         /* Arm scan timeout timer */
         mod_timer(&cfg->escan_timeout, jiffies +
@@ -934,11 +884,11 @@ brcmf_cfg80211_escan(struct wiphy *wiphy, struct net_device *ndev,
         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
         if (escan_req) {
                 cfg->escan_info.run = brcmf_run_escan;
-                err = brcmf_p2p_scan_prep(wiphy, request, ifp->vif);
+                err = brcmf_p2p_scan_prep(wiphy, request, vif);
                 if (err)
                         goto scan_out;
 
-                err = brcmf_do_escan(cfg, wiphy, ndev, request);
+                err = brcmf_do_escan(cfg, wiphy, vif->ifp, request);
                 if (err)
                         goto scan_out;
         } else {
@@ -962,7 +912,7 @@ brcmf_cfg80211_escan(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
                         goto scan_out;
                 }
-                brcmf_set_mpc(ndev, 0);
+                brcmf_set_mpc(ifp, 0);
                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
                                              &sr->ssid_le, sizeof(sr->ssid_le));
                 if (err) {
@@ -972,7 +922,7 @@ brcmf_cfg80211_escan(struct wiphy *wiphy, struct net_device *ndev,
                         else
                                 brcmf_err("WLC_SCAN error (%d)\n", err);
 
-                        brcmf_set_mpc(ndev, 1);
+                        brcmf_set_mpc(ifp, 1);
                         goto scan_out;
                 }
         }
@@ -990,16 +940,15 @@ scan_out:
 static s32
 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
 {
-        struct net_device *ndev = request->wdev->netdev;
+        struct brcmf_cfg80211_vif *vif;
         s32 err = 0;
 
         brcmf_dbg(TRACE, "Enter\n");
-
-        if (!check_vif_up(container_of(request->wdev,
-                                       struct brcmf_cfg80211_vif, wdev)))
+        vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
+        if (!check_vif_up(vif))
                 return -EIO;
 
-        err = brcmf_cfg80211_escan(wiphy, ndev, request, NULL);
+        err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
 
         if (err)
                 brcmf_err("scan error (%d)\n", err);
@@ -1229,7 +1178,8 @@ brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
                                 params->chandef.chan->center_freq);
                 if (params->channel_fixed) {
                         /* adding chanspec */
-                        chanspec = channel_to_chanspec(params->chandef.chan);
+                        chanspec = channel_to_chanspec(&cfg->d11inf,
+                                                       params->chandef.chan);
                         join_params.params_le.chanspec_list[0] =
                                 cpu_to_le16(chanspec);
                         join_params.params_le.chanspec_num = cpu_to_le32(1);
@@ -1619,7 +1569,7 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
         if (chan) {
                 cfg->channel =
                         ieee80211_frequency_to_channel(chan->center_freq);
-                chanspec = channel_to_chanspec(chan);
+                chanspec = channel_to_chanspec(&cfg->d11inf, chan);
                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
                           cfg->channel, chan->center_freq, chanspec);
         } else {
@@ -1891,8 +1841,10 @@ static s32
 brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
               u8 key_idx, const u8 *mac_addr, struct key_params *params)
 {
+        struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_wsec_key key;
         s32 err = 0;
+        u8 keybuf[8];
 
         memset(&key, 0, sizeof(key));
         key.index = (u32) key_idx;
@@ -1916,8 +1868,9 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
                 brcmf_dbg(CONN, "Setting the key index %d\n", key.index);
                 memcpy(key.data, params->key, key.len);
 
-                if (params->cipher == WLAN_CIPHER_SUITE_TKIP) {
-                        u8 keybuf[8];
+                if ((ifp->vif->mode != WL_MODE_AP) &&
+                    (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
+                        brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
                         memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
                         memcpy(&key.data[16], keybuf, sizeof(keybuf));
@@ -2013,7 +1966,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
                 if (ifp->vif->mode != WL_MODE_AP) {
-                        brcmf_dbg(CONN, "Swapping key\n");
+                        brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
                         memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
                         memcpy(&key.data[16], keybuf, sizeof(keybuf));
@@ -2118,8 +2071,7 @@ brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
                 err = -EAGAIN;
                 goto done;
         }
-        switch (wsec & ~SES_OW_ENABLED) {
-        case WEP_ENABLED:
+        if (wsec & WEP_ENABLED) {
                 sec = &profile->sec;
                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
@@ -2128,16 +2080,13 @@ brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
                 }
-                break;
-        case TKIP_ENABLED:
+        } else if (wsec & TKIP_ENABLED) {
                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
-                break;
-        case AES_ENABLED:
+        } else if (wsec & AES_ENABLED) {
                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
-                break;
-        default:
+        } else  {
                 brcmf_err("Invalid algo (0x%x)\n", wsec);
                 err = -EINVAL;
                 goto done;
@@ -2279,6 +2228,7 @@ static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
         struct ieee80211_channel *notify_channel;
         struct cfg80211_bss *bss;
         struct ieee80211_supported_band *band;
+        struct brcmu_chan ch;
         s32 err = 0;
         u16 channel;
         u32 freq;
@@ -2293,8 +2243,12 @@ static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
                 return 0;
         }
 
-        channel = bi->ctl_ch ? bi->ctl_ch :
-                                CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
+        if (!bi->ctl_ch) {
+                ch.chspec = le16_to_cpu(bi->chanspec);
+                cfg->d11inf.decchspec(&ch);
+                bi->ctl_ch = ch.chnum;
+        }
+        channel = bi->ctl_ch;
 
         if (channel <= CH_MAX_2G_CHANNEL)
                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
@@ -2369,9 +2323,9 @@ static s32 wl_inform_ibss(struct brcmf_cfg80211_info *cfg,
         struct brcmf_bss_info_le *bi = NULL;
         struct ieee80211_supported_band *band;
         struct cfg80211_bss *bss;
+        struct brcmu_chan ch;
         u8 *buf = NULL;
         s32 err = 0;
-        u16 channel;
         u32 freq;
         u16 notify_capability;
         u16 notify_interval;
@@ -2398,15 +2352,15 @@ static s32 wl_inform_ibss(struct brcmf_cfg80211_info *cfg,
 
         bi = (struct brcmf_bss_info_le *)(buf + 4);
 
-        channel = bi->ctl_ch ? bi->ctl_ch :
-                                CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
+        ch.chspec = le16_to_cpu(bi->chanspec);
+        cfg->d11inf.decchspec(&ch);
 
-        if (channel <= CH_MAX_2G_CHANNEL)
+        if (ch.band == BRCMU_CHAN_BAND_2G)
                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
         else
                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
 
-        freq = ieee80211_channel_to_frequency(channel, band->band);
+        freq = ieee80211_channel_to_frequency(ch.chnum, band->band);
         notify_channel = ieee80211_get_channel(wiphy, freq);
 
         notify_capability = le16_to_cpu(bi->capability);
@@ -2415,7 +2369,7 @@ static s32 wl_inform_ibss(struct brcmf_cfg80211_info *cfg,
         notify_ielen = le32_to_cpu(bi->ie_length);
         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
 
-        brcmf_dbg(CONN, "channel: %d(%d)\n", channel, freq);
+        brcmf_dbg(CONN, "channel: %d(%d)\n", ch.chnum, freq);
         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
@@ -2511,7 +2465,7 @@ void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
         if (cfg->scan_request) {
                 escan->escan_state = WL_ESCAN_STATE_IDLE;
-                brcmf_notify_escan_complete(cfg, escan->ndev, true, true);
+                brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
         }
         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
@@ -2523,7 +2477,7 @@ static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
                         container_of(work, struct brcmf_cfg80211_info,
                                      escan_timeout_work);
 
-        brcmf_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+        brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
 }
 
 static void brcmf_escan_timeout(unsigned long data)
@@ -2538,12 +2492,19 @@ static void brcmf_escan_timeout(unsigned long data)
 }
 
 static s32
-brcmf_compare_update_same_bss(struct brcmf_bss_info_le *bss,
+brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
+                              struct brcmf_bss_info_le *bss,
                               struct brcmf_bss_info_le *bss_info_le)
 {
+        struct brcmu_chan ch_bss, ch_bss_info_le;
+
+        ch_bss.chspec = le16_to_cpu(bss->chanspec);
+        cfg->d11inf.decchspec(&ch_bss);
+        ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
+        cfg->d11inf.decchspec(&ch_bss_info_le);
+
         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
-                (CHSPEC_BAND(le16_to_cpu(bss_info_le->chanspec)) ==
-                CHSPEC_BAND(le16_to_cpu(bss->chanspec))) &&
+                ch_bss.band == ch_bss_info_le.band &&
                 bss_info_le->SSID_len == bss->SSID_len &&
                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
                 if ((bss->flags & WLC_BSS_RSSI_ON_CHANNEL) ==
@@ -2574,7 +2535,6 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                              const struct brcmf_event_msg *e, void *data)
 {
         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
-        struct net_device *ndev = ifp->ndev;
         s32 status;
         s32 err = 0;
         struct brcmf_escan_result_le *escan_result_le;
@@ -2587,9 +2547,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
 
         status = e->status;
 
-        if (!ndev || !test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
-                brcmf_err("scan not ready ndev %p drv_status %x\n", ndev,
-                          !test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status));
+        if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+                brcmf_err("scan not ready, bssidx=%d\n", ifp->bssidx);
                 return -EPERM;
         }
 
@@ -2643,7 +2602,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                         bss = bss ? (struct brcmf_bss_info_le *)
                                 ((unsigned char *)bss +
                                 le32_to_cpu(bss->length)) : list->bss_info_le;
-                        if (brcmf_compare_update_same_bss(bss, bss_info_le))
+                        if (brcmf_compare_update_same_bss(cfg, bss,
+                                                          bss_info_le))
                                 goto exit;
                 }
                 memcpy(&(cfg->escan_info.escan_buf[list->buflen]),
@@ -2660,7 +2620,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                                 cfg->escan_info.escan_buf;
                         brcmf_inform_bss(cfg);
                         aborted = status != BRCMF_E_STATUS_SUCCESS;
-                        brcmf_notify_escan_complete(cfg, ndev, aborted,
+                        brcmf_notify_escan_complete(cfg, ifp, aborted,
                                                     false);
                 } else
                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
@@ -2738,7 +2698,7 @@ static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
                 brcmf_abort_scanning(cfg);
 
         /* Turn off watchdog timer */
-        brcmf_set_mpc(ndev, 1);
+        brcmf_set_mpc(netdev_priv(ndev), 1);
 
 exit:
         brcmf_dbg(TRACE, "Exit\n");
@@ -2896,7 +2856,6 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
                                 const struct brcmf_event_msg *e, void *data)
 {
         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
-        struct net_device *ndev = ifp->ndev;
         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
         struct cfg80211_scan_request *request = NULL;
         struct cfg80211_ssid *ssid = NULL;
@@ -2980,7 +2939,7 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
                 }
 
                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
-                err = brcmf_do_escan(cfg, wiphy, ndev, request);
+                err = brcmf_do_escan(cfg, wiphy, ifp, request);
                 if (err) {
                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
                         goto out_err;
@@ -3052,16 +3011,16 @@ brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
         int i;
         int ret = 0;
 
-        brcmf_dbg(SCAN, "Enter n_match_sets:%d   n_ssids:%d\n",
+        brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
                   request->n_match_sets, request->n_ssids);
         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
                 return -EAGAIN;
         }
 
-        if (!request || !request->n_ssids || !request->n_match_sets) {
+        if (!request->n_ssids || !request->n_match_sets) {
                 brcmf_err("Invalid sched scan req!! n_ssids:%d\n",
-                          request ? request->n_ssids : 0);
+                          request->n_ssids);
                 return -EINVAL;
         }
 
@@ -3137,7 +3096,7 @@ static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
         brcmf_dbg(SCAN, "enter\n");
         brcmf_dev_pno_clean(ndev);
         if (cfg->sched_escan)
-                brcmf_notify_escan_complete(cfg, ndev, true, true);
+                brcmf_notify_escan_complete(cfg, netdev_priv(ndev), true, true);
         return 0;
 }
 
@@ -3709,7 +3668,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
         }
 
-        brcmf_set_mpc(ndev, 0);
+        brcmf_set_mpc(ifp, 0);
 
         /* find the RSN_IE */
         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
@@ -3817,15 +3776,16 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
 
 exit:
         if (err)
-                brcmf_set_mpc(ndev, 1);
+                brcmf_set_mpc(ifp, 1);
         return err;
 }
 
 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
-        s32 err = -EPERM;
+        s32 err;
         struct brcmf_fil_bss_enable_le bss_enable;
+        struct brcmf_join_params join_params;
 
         brcmf_dbg(TRACE, "Enter\n");
 
@@ -3833,16 +3793,21 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                 /* Due to most likely deauths outstanding we sleep */
                 /* first to make sure they get processed by fw. */
                 msleep(400);
-                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
-                if (err < 0) {
-                        brcmf_err("setting AP mode failed %d\n", err);
-                        goto exit;
-                }
+
+                memset(&join_params, 0, sizeof(join_params));
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+                                             &join_params, sizeof(join_params));
+                if (err < 0)
+                        brcmf_err("SET SSID error (%d)\n", err);
                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
-                if (err < 0) {
+                if (err < 0)
                         brcmf_err("BRCMF_C_UP error %d\n", err);
-                        goto exit;
-                }
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
+                if (err < 0)
+                        brcmf_err("setting AP mode failed %d\n", err);
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
+                if (err < 0)
+                        brcmf_err("setting INFRA mode failed %d\n", err);
         } else {
                 bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
                 bss_enable.enable = cpu_to_le32(0);
@@ -3851,11 +3816,10 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                 if (err < 0)
                         brcmf_err("bss_enable config failed %d\n", err);
         }
-        brcmf_set_mpc(ndev, 1);
+        brcmf_set_mpc(ifp, 1);
         set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
 
-exit:
         return err;
 }
 
@@ -3909,13 +3873,13 @@ brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
                                    struct wireless_dev *wdev,
                                    u16 frame_type, bool reg)
 {
-        struct brcmf_if *ifp = netdev_priv(wdev->netdev);
-        struct brcmf_cfg80211_vif *vif = ifp->vif;
+        struct brcmf_cfg80211_vif *vif;
         u16 mgmt_type;
 
         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
 
         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
+        vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
         if (reg)
                 vif->mgmt_rx_reg |= BIT(mgmt_type);
         else
@@ -3931,7 +3895,6 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         const struct ieee80211_mgmt *mgmt;
-        struct brcmf_if *ifp;
         struct brcmf_cfg80211_vif *vif;
         s32 err = 0;
         s32 ie_offset;
@@ -3967,8 +3930,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 ie_offset =  DOT11_MGMT_HDR_LEN +
                              DOT11_BCN_PRB_FIXED_LEN;
                 ie_len = len - ie_offset;
-                ifp = netdev_priv(wdev->netdev);
-                vif = ifp->vif;
+                vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
                 err = brcmf_vif_set_mgmt_ie(vif,
@@ -4003,7 +3965,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                           *cookie, le16_to_cpu(action_frame->len),
                           chan->center_freq);
 
-                ack = brcmf_p2p_send_action_frame(cfg, wdev->netdev,
+                ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
                                                   af_params);
 
                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
@@ -4075,6 +4037,8 @@ static struct cfg80211_ops wl_cfg80211_ops = {
         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
         .remain_on_channel = brcmf_p2p_remain_on_channel,
         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
+        .start_p2p_device = brcmf_p2p_start_device,
+        .stop_p2p_device = brcmf_p2p_stop_device,
 #ifdef CONFIG_NL80211_TESTMODE
         .testmode_cmd = brcmf_cfg80211_testmode
 #endif
@@ -4162,6 +4126,11 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
                       BIT(IEEE80211_STYPE_AUTH >> 4) |
                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
                       BIT(IEEE80211_STYPE_ACTION >> 4)
+        },
+        [NL80211_IFTYPE_P2P_DEVICE] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
         }
 };
 
@@ -4188,13 +4157,6 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
         wiphy->iface_combinations = brcmf_iface_combos;
         wiphy->n_iface_combinations = ARRAY_SIZE(brcmf_iface_combos);
         wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
-        wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_a;  /* Set
-                                                * it as 11a by default.
-                                                * This will be updated with
-                                                * 11n phy tables in
-                                                * "ifconfig up"
-                                                * if phy has 11n capability
-                                                */
         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
         wiphy->cipher_suites = __wl_cipher_suites;
         wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
@@ -4204,6 +4166,9 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
         wiphy->mgmt_stypes = brcmf_txrx_stypes;
         wiphy->max_remain_on_channel_duration = 5000;
         brcmf_wiphy_pno_params(wiphy);
+        brcmf_dbg(INFO, "Registering custom regulatory\n");
+        wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+        wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
         err = wiphy_register(wiphy);
         if (err < 0) {
                 brcmf_err("Could not register wiphy device (%d)\n", err);
@@ -4387,9 +4352,9 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
         struct ieee80211_channel *notify_channel = NULL;
         struct ieee80211_supported_band *band;
         struct brcmf_bss_info_le *bi;
+        struct brcmu_chan ch;
         u32 freq;
         s32 err = 0;
-        u32 target_channel;
         u8 *buf;
 
         brcmf_dbg(TRACE, "Enter\n");
@@ -4413,15 +4378,15 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
                 goto done;
 
         bi = (struct brcmf_bss_info_le *)(buf + 4);
-        target_channel = bi->ctl_ch ? bi->ctl_ch :
-                                      CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
+        ch.chspec = le16_to_cpu(bi->chanspec);
+        cfg->d11inf.decchspec(&ch);
 
-        if (target_channel <= CH_MAX_2G_CHANNEL)
+        if (ch.band == BRCMU_CHAN_BAND_2G)
                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
         else
                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
 
-        freq = ieee80211_channel_to_frequency(target_channel, band->band);
+        freq = ieee80211_channel_to_frequency(ch.chnum, band->band);
         notify_channel = ieee80211_get_channel(wiphy, freq);
 
 done:
@@ -4622,9 +4587,11 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
 
                 ifp->vif = vif;
                 vif->ifp = ifp;
-                vif->wdev.netdev = ifp->ndev;
-                ifp->ndev->ieee80211_ptr = &vif->wdev;
-                SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
+                if (ifp->ndev) {
+                        vif->wdev.netdev = ifp->ndev;
+                        ifp->ndev->ieee80211_ptr = &vif->wdev;
+                        SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
+                }
                 mutex_unlock(&event->vif_event_lock);
                 wake_up(&event->vif_wq);
                 return 0;
@@ -4773,6 +4740,7 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
         struct brcmf_cfg80211_vif *vif;
         struct brcmf_if *ifp;
         s32 err = 0;
+        s32 io_type;
 
         if (!ndev) {
                 brcmf_err("ndev is invalid\n");
@@ -4814,6 +4782,15 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
                 goto cfg80211_p2p_attach_out;
         }
 
+        err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION,
+                                    &io_type);
+        if (err) {
+                brcmf_err("Failed to get D11 version (%d)\n", err);
+                goto cfg80211_p2p_attach_out;
+        }
+        cfg->d11inf.io_type = (u8)io_type;
+        brcmu_d11_attach(&cfg->d11inf);
+
         return cfg;
 
 cfg80211_p2p_attach_out:
@@ -4927,34 +4904,234 @@ dongle_scantime_out:
         return err;
 }
 
-static s32 wl_update_wiphybands(struct brcmf_cfg80211_info *cfg)
+
+static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
+{
+        struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
+        struct ieee80211_channel *band_chan_arr;
+        struct brcmf_chanspec_list *list;
+        struct brcmu_chan ch;
+        s32 err;
+        u8 *pbuf;
+        u32 i, j;
+        u32 total;
+        enum ieee80211_band band;
+        u32 channel;
+        u32 *n_cnt;
+        bool ht40_allowed;
+        u32 index;
+        u32 ht40_flag;
+        bool update;
+        u32 array_size;
+
+        pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
+
+        if (pbuf == NULL)
+                return -ENOMEM;
+
+        list = (struct brcmf_chanspec_list *)pbuf;
+
+        err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
+                                       BRCMF_DCMD_MEDLEN);
+        if (err) {
+                brcmf_err("get chanspecs error (%d)\n", err);
+                goto exit;
+        }
+
+        __wl_band_2ghz.n_channels = 0;
+        __wl_band_5ghz_a.n_channels = 0;
+
+        total = le32_to_cpu(list->count);
+        for (i = 0; i < total; i++) {
+                ch.chspec = (u16)le32_to_cpu(list->element[i]);
+                cfg->d11inf.decchspec(&ch);
+
+                if (ch.band == BRCMU_CHAN_BAND_2G) {
+                        band_chan_arr = __wl_2ghz_channels;
+                        array_size = ARRAY_SIZE(__wl_2ghz_channels);
+                        n_cnt = &__wl_band_2ghz.n_channels;
+                        band = IEEE80211_BAND_2GHZ;
+                        ht40_allowed = (bw_cap == WLC_N_BW_40ALL);
+                } else if (ch.band == BRCMU_CHAN_BAND_5G) {
+                        band_chan_arr = __wl_5ghz_a_channels;
+                        array_size = ARRAY_SIZE(__wl_5ghz_a_channels);
+                        n_cnt = &__wl_band_5ghz_a.n_channels;
+                        band = IEEE80211_BAND_5GHZ;
+                        ht40_allowed = !(bw_cap == WLC_N_BW_20ALL);
+                } else {
+                        brcmf_err("Invalid channel Sepc. 0x%x.\n", ch.chspec);
+                        continue;
+                }
+                if (!ht40_allowed && ch.bw == BRCMU_CHAN_BW_40)
+                        continue;
+                update = false;
+                for (j = 0; (j < *n_cnt && (*n_cnt < array_size)); j++) {
+                        if (band_chan_arr[j].hw_value == ch.chnum) {
+                                update = true;
+                                break;
+                        }
+                }
+                if (update)
+                        index = j;
+                else
+                        index = *n_cnt;
+                if (index <  array_size) {
+                        band_chan_arr[index].center_freq =
+                                ieee80211_channel_to_frequency(ch.chnum, band);
+                        band_chan_arr[index].hw_value = ch.chnum;
+
+                        if (ch.bw == BRCMU_CHAN_BW_40 && ht40_allowed) {
+                                /* assuming the order is HT20, HT40 Upper,
+                                 * HT40 lower from chanspecs
+                                 */
+                                ht40_flag = band_chan_arr[index].flags &
+                                            IEEE80211_CHAN_NO_HT40;
+                                if (ch.sb == BRCMU_CHAN_SB_U) {
+                                        if (ht40_flag == IEEE80211_CHAN_NO_HT40)
+                                                band_chan_arr[index].flags &=
+                                                        ~IEEE80211_CHAN_NO_HT40;
+                                        band_chan_arr[index].flags |=
+                                                IEEE80211_CHAN_NO_HT40PLUS;
+                                } else {
+                                        /* It should be one of
+                                         * IEEE80211_CHAN_NO_HT40 or
+                                         * IEEE80211_CHAN_NO_HT40PLUS
+                                         */
+                                        band_chan_arr[index].flags &=
+                                                        ~IEEE80211_CHAN_NO_HT40;
+                                        if (ht40_flag == IEEE80211_CHAN_NO_HT40)
+                                                band_chan_arr[index].flags |=
+                                                    IEEE80211_CHAN_NO_HT40MINUS;
+                                }
+                        } else {
+                                band_chan_arr[index].flags =
+                                                        IEEE80211_CHAN_NO_HT40;
+                                ch.bw = BRCMU_CHAN_BW_20;
+                                cfg->d11inf.encchspec(&ch);
+                                channel = ch.chspec;
+                                err = brcmf_fil_bsscfg_int_get(ifp,
+                                                               "per_chan_info",
+                                                               &channel);
+                                if (!err) {
+                                        if (channel & WL_CHAN_RADAR)
+                                                band_chan_arr[index].flags |=
+                                                        (IEEE80211_CHAN_RADAR |
+                                                        IEEE80211_CHAN_NO_IBSS);
+                                        if (channel & WL_CHAN_PASSIVE)
+                                                band_chan_arr[index].flags |=
+                                                    IEEE80211_CHAN_PASSIVE_SCAN;
+                                }
+                        }
+                        if (!update)
+                                (*n_cnt)++;
+                }
+        }
+exit:
+        kfree(pbuf);
+        return err;
+}
+
+
+static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
 {
         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
         struct wiphy *wiphy;
         s32 phy_list;
+        u32 band_list[3];
+        u32 nmode;
+        u32 bw_cap = 0;
         s8 phy;
-        s32 err = 0;
+        s32 err;
+        u32 nband;
+        s32 i;
+        struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS];
+        s32 index;
 
         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_PHYLIST,
                                      &phy_list, sizeof(phy_list));
         if (err) {
-                brcmf_err("error (%d)\n", err);
+                brcmf_err("BRCMF_C_GET_PHYLIST error (%d)\n", err);
                 return err;
         }
 
         phy = ((char *)&phy_list)[0];
-        brcmf_dbg(INFO, "%c phy\n", phy);
-        if (phy == 'n' || phy == 'a') {
-                wiphy = cfg_to_wiphy(cfg);
-                wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_n;
+        brcmf_dbg(INFO, "BRCMF_C_GET_PHYLIST reported: %c phy\n", phy);
+
+
+        err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST,
+                                     &band_list, sizeof(band_list));
+        if (err) {
+                brcmf_err("BRCMF_C_GET_BANDLIST error (%d)\n", err);
+                return err;
+        }
+        brcmf_dbg(INFO, "BRCMF_C_GET_BANDLIST reported: 0x%08x 0x%08x 0x%08x phy\n",
+                  band_list[0], band_list[1], band_list[2]);
+
+        err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
+        if (err) {
+                brcmf_err("nmode error (%d)\n", err);
+        } else {
+                err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &bw_cap);
+                if (err)
+                        brcmf_err("mimo_bw_cap error (%d)\n", err);
         }
+        brcmf_dbg(INFO, "nmode=%d, mimo_bw_cap=%d\n", nmode, bw_cap);
+
+        err = brcmf_construct_reginfo(cfg, bw_cap);
+        if (err) {
+                brcmf_err("brcmf_construct_reginfo failed (%d)\n", err);
+                return err;
+        }
+
+        nband = band_list[0];
+        memset(bands, 0, sizeof(bands));
+
+        for (i = 1; i <= nband && i < ARRAY_SIZE(band_list); i++) {
+                index = -1;
+                if ((band_list[i] == WLC_BAND_5G) &&
+                    (__wl_band_5ghz_a.n_channels > 0)) {
+                        index = IEEE80211_BAND_5GHZ;
+                        bands[index] = &__wl_band_5ghz_a;
+                        if ((bw_cap == WLC_N_BW_40ALL) ||
+                            (bw_cap == WLC_N_BW_20IN2G_40IN5G))
+                                bands[index]->ht_cap.cap |=
+                                                        IEEE80211_HT_CAP_SGI_40;
+                } else if ((band_list[i] == WLC_BAND_2G) &&
+                           (__wl_band_2ghz.n_channels > 0)) {
+                        index = IEEE80211_BAND_2GHZ;
+                        bands[index] = &__wl_band_2ghz;
+                        if (bw_cap == WLC_N_BW_40ALL)
+                                bands[index]->ht_cap.cap |=
+                                                        IEEE80211_HT_CAP_SGI_40;
+                }
+
+                if ((index >= 0) && nmode) {
+                        bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
+                        bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
+                        bands[index]->ht_cap.ht_supported = true;
+                        bands[index]->ht_cap.ampdu_factor =
+                                                IEEE80211_HT_MAX_AMPDU_64K;
+                        bands[index]->ht_cap.ampdu_density =
+                                                IEEE80211_HT_MPDU_DENSITY_16;
+                        /* An HT shall support all EQM rates for one spatial
+                         * stream
+                         */
+                        bands[index]->ht_cap.mcs.rx_mask[0] = 0xff;
+                }
+        }
+
+        wiphy = cfg_to_wiphy(cfg);
+        wiphy->bands[IEEE80211_BAND_2GHZ] = bands[IEEE80211_BAND_2GHZ];
+        wiphy->bands[IEEE80211_BAND_5GHZ] = bands[IEEE80211_BAND_5GHZ];
+        wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
 
         return err;
 }
 
+
 static s32 brcmf_dongle_probecap(struct brcmf_cfg80211_info *cfg)
 {
-        return wl_update_wiphybands(cfg);
+        return brcmf_update_wiphybands(cfg);
 }
 
 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
@@ -5060,6 +5237,13 @@ s32 brcmf_cfg80211_down(struct net_device *ndev)
         return err;
 }
 
+enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
+{
+        struct wireless_dev *wdev = &ifp->vif->wdev;
+
+        return wdev->iftype;
+}
+
 u32 wl_get_vif_state_all(struct brcmf_cfg80211_info *cfg, unsigned long state)
 {
         struct brcmf_cfg80211_vif *vif;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
index 8b5d4989906c..0b9263e7dca4 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
@@ -17,6 +17,9 @@
 #ifndef _wl_cfg80211_h_
 #define _wl_cfg80211_h_
 
+/* for brcmu_d11inf */
+#include <brcmu_d11.h>
+
 #define WL_NUM_SCAN_MAX                 10
 #define WL_NUM_PMKIDS_MAX               MAXPMKID
 #define WL_TLV_INFO_MAX                 1024
@@ -238,9 +241,8 @@ struct escan_info {
         u32 escan_state;
         u8 escan_buf[WL_ESCAN_BUF_SIZE];
         struct wiphy *wiphy;
-        struct net_device *ndev;
-        s32 (*run)(struct brcmf_cfg80211_info *cfg,
-                   struct net_device *ndev,
+        struct brcmf_if *ifp;
+        s32 (*run)(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
                    struct cfg80211_scan_request *request, u16 action);
 };
 
@@ -409,6 +411,7 @@ struct brcmf_cfg80211_info {
         u8 vif_cnt;
         struct brcmf_cfg80211_vif_event vif_event;
         struct completion vif_disabled;
+        struct brcmu_d11inf d11inf;
 };
 
 /**
@@ -475,6 +478,7 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
 s32 brcmf_cfg80211_up(struct net_device *ndev);
 s32 brcmf_cfg80211_down(struct net_device *ndev);
+enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
 
 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
                                            enum nl80211_iftype type,
@@ -485,7 +489,8 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
                           const u8 *vndr_ie_buf, u32 vndr_ie_len);
 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif);
 struct brcmf_tlv *brcmf_parse_tlvs(void *buf, int buflen, uint key);
-u16 channel_to_chanspec(struct ieee80211_channel *ch);
+u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
+                        struct ieee80211_channel *ch);
 u32 wl_get_vif_state_all(struct brcmf_cfg80211_info *cfg, unsigned long state);
 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
                                   struct brcmf_cfg80211_vif *vif);
@@ -493,9 +498,9 @@ bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg);
 int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
                                           u8 action, ulong timeout);
 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
-                                struct net_device *ndev,
-                                bool aborted, bool fw_abort);
-void brcmf_set_mpc(struct net_device *ndev, int mpc);
+                                struct brcmf_if *ifp, bool aborted,
+                                bool fw_abort);
+void brcmf_set_mpc(struct brcmf_if *ndev, int mpc);
 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg);
 
 #endif                          /* _wl_cfg80211_h_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/Makefile b/drivers/net/wireless/brcm80211/brcmsmac/Makefile
index d3d4151c3eda..32464acccd90 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmsmac/Makefile
@@ -21,7 +21,7 @@ ccflags-y := \
         -Idrivers/net/wireless/brcm80211/brcmsmac/phy \
         -Idrivers/net/wireless/brcm80211/include
 
-BRCMSMAC_OFILES := \
+brcmsmac-y := \
         mac80211_if.o \
         ucode_loader.o \
         ampdu.o \
@@ -43,7 +43,6 @@ BRCMSMAC_OFILES := \
         brcms_trace_events.o \
         debug.o
 
-MODULEPFX := brcmsmac
+brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
 
-obj-$(CONFIG_BRCMSMAC)  += $(MODULEPFX).o
-$(MODULEPFX)-objs       = $(BRCMSMAC_OFILES)
+obj-$(CONFIG_BRCMSMAC)  += brcmsmac.o
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
index f0888a9ee32e..e4fd1ee3d690 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
@@ -318,12 +318,6 @@
 #define IS_SIM(chippkg) \
         ((chippkg == HDLSIM_PKG_ID) || (chippkg == HWSIM_PKG_ID))
 
-#ifdef DEBUG
-#define SI_MSG(fmt, ...)        pr_debug(fmt, ##__VA_ARGS__)
-#else
-#define SI_MSG(fmt, ...)        no_printk(fmt, ##__VA_ARGS__)
-#endif                          /* DEBUG */
-
 #define GOODCOREADDR(x, b) \
         (((x) >= (b)) && ((x) < ((b) + SI_MAXCORES * SI_CORE_SIZE)) && \
                 IS_ALIGNED((x), SI_CORE_SIZE))
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/d11.h b/drivers/net/wireless/brcm80211/brcmsmac/d11.h
index 3f659e09f1cc..9035cc4d6ff3 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/d11.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/d11.h
@@ -457,6 +457,7 @@ struct d11regs {
 /*== maccontrol register ==*/
 #define MCTL_GMODE              (1U << 31)
 #define MCTL_DISCARD_PMQ        (1 << 30)
+#define MCTL_TBTTHOLD           (1 << 28)
 #define MCTL_WAKE               (1 << 26)
 #define MCTL_HPS                (1 << 25)
 #define MCTL_PROMISC            (1 << 24)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/led.c b/drivers/net/wireless/brcm80211/brcmsmac/led.c
new file mode 100644
index 000000000000..74b17cecb189
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmsmac/led.c
@@ -0,0 +1,126 @@
+#include <net/mac80211.h>
+#include <linux/bcma/bcma_driver_chipcommon.h>
+#include <linux/gpio.h>
+
+#include "mac80211_if.h"
+#include "pub.h"
+#include "main.h"
+#include "led.h"
+
+        /* number of leds */
+#define  BRCMS_LED_NO           4
+        /* behavior mask */
+#define  BRCMS_LED_BEH_MASK     0x7f
+        /* activelow (polarity) bit */
+#define  BRCMS_LED_AL_MASK      0x80
+        /* radio enabled */
+#define  BRCMS_LED_RADIO        3
+
+static void brcms_radio_led_ctrl(struct brcms_info *wl, bool state)
+{
+        if (wl->radio_led.gpio == -1)
+                return;
+
+        if (wl->radio_led.active_low)
+                state = !state;
+
+        if (state)
+                gpio_set_value(wl->radio_led.gpio, 1);
+        else
+                gpio_set_value(wl->radio_led.gpio, 0);
+}
+
+
+/* Callback from the LED subsystem. */
+static void brcms_led_brightness_set(struct led_classdev *led_dev,
+                                   enum led_brightness brightness)
+{
+        struct brcms_info *wl = container_of(led_dev,
+                struct brcms_info, led_dev);
+        brcms_radio_led_ctrl(wl, brightness);
+}
+
+void brcms_led_unregister(struct brcms_info *wl)
+{
+        if (wl->led_dev.dev)
+                led_classdev_unregister(&wl->led_dev);
+        if (wl->radio_led.gpio != -1)
+                gpio_free(wl->radio_led.gpio);
+}
+
+int brcms_led_register(struct brcms_info *wl)
+{
+        int i, err;
+        struct brcms_led *radio_led = &wl->radio_led;
+        /* get CC core */
+        struct bcma_drv_cc *cc_drv  = &wl->wlc->hw->d11core->bus->drv_cc;
+        struct gpio_chip *bcma_gpio = &cc_drv->gpio;
+        struct ssb_sprom *sprom = &wl->wlc->hw->d11core->bus->sprom;
+        u8 *leds[] = { &sprom->gpio0,
+                &sprom->gpio1,
+                &sprom->gpio2,
+                &sprom->gpio3 };
+        unsigned gpio = -1;
+        bool active_low = false;
+
+        /* none by default */
+        radio_led->gpio = -1;
+        radio_led->active_low = false;
+
+        if (!bcma_gpio || !gpio_is_valid(bcma_gpio->base))
+                return -ENODEV;
+
+        /* find radio enabled LED */
+        for (i = 0; i < BRCMS_LED_NO; i++) {
+                u8 led = *leds[i];
+                if ((led & BRCMS_LED_BEH_MASK) == BRCMS_LED_RADIO) {
+                        gpio = bcma_gpio->base + i;
+                        if (led & BRCMS_LED_AL_MASK)
+                                active_low = true;
+                        break;
+                }
+        }
+
+        if (gpio == -1 || !gpio_is_valid(gpio))
+                return -ENODEV;
+
+        /* request and configure LED gpio */
+        err = gpio_request_one(gpio,
+                                active_low ? GPIOF_OUT_INIT_HIGH
+                                        : GPIOF_OUT_INIT_LOW,
+                                "radio on");
+        if (err) {
+                wiphy_err(wl->wiphy, "requesting led gpio %d failed (err: %d)\n",
+                          gpio, err);
+                return err;
+        }
+        err = gpio_direction_output(gpio, 1);
+        if (err) {
+                wiphy_err(wl->wiphy, "cannot set led gpio %d to output (err: %d)\n",
+                          gpio, err);
+                return err;
+        }
+
+        snprintf(wl->radio_led.name, sizeof(wl->radio_led.name),
+                 "brcmsmac-%s:radio", wiphy_name(wl->wiphy));
+
+        wl->led_dev.name = wl->radio_led.name;
+        wl->led_dev.default_trigger =
+                ieee80211_get_radio_led_name(wl->pub->ieee_hw);
+        wl->led_dev.brightness_set = brcms_led_brightness_set;
+        err = led_classdev_register(wiphy_dev(wl->wiphy), &wl->led_dev);
+
+        if (err) {
+                wiphy_err(wl->wiphy, "cannot register led device: %s (err: %d)\n",
+                          wl->radio_led.name, err);
+                return err;
+        }
+
+        wiphy_info(wl->wiphy, "registered radio enabled led device: %s gpio: %d\n",
+                   wl->radio_led.name,
+                   gpio);
+        radio_led->gpio = gpio;
+        radio_led->active_low = active_low;
+
+        return 0;
+}
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/led.h b/drivers/net/wireless/brcm80211/brcmsmac/led.h
new file mode 100644
index 000000000000..17a0b1f5dbcf
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmsmac/led.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _BRCM_LED_H_
+#define _BRCM_LED_H_
+struct brcms_led {
+        char name[32];
+        unsigned gpio;
+        bool active_low;
+};
+
+#ifdef CONFIG_BCMA_DRIVER_GPIO
+void brcms_led_unregister(struct brcms_info *wl);
+int brcms_led_register(struct brcms_info *wl);
+#else
+static inline void brcms_led_unregister(struct brcms_info *wl) {};
+static inline int brcms_led_register(struct brcms_info *wl)
+{
+        return -ENOTSUPP;
+};
+#endif
+
+#endif /* _BRCM_LED_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 70731d23ddb1..db663230088d 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2010 Broadcom Corporation
+ * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -34,6 +35,7 @@
 #include "mac80211_if.h"
 #include "main.h"
 #include "debug.h"
+#include "led.h"
 
 #define N_TX_QUEUES     4 /* #tx queues on mac80211<->driver interface */
 #define BRCMS_FLUSH_TIMEOUT     500 /* msec */
@@ -355,18 +357,26 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         struct brcms_info *wl = hw->priv;
 
-        /* Just STA for now */
-        if (vif->type != NL80211_IFTYPE_STATION) {
+        /* Just STA, AP and ADHOC for now */
+        if (vif->type != NL80211_IFTYPE_STATION &&
+            vif->type != NL80211_IFTYPE_AP &&
+            vif->type != NL80211_IFTYPE_ADHOC) {
                 brcms_err(wl->wlc->hw->d11core,
-                          "%s: Attempt to add type %d, only STA for now\n",
+                          "%s: Attempt to add type %d, only STA, AP and AdHoc for now\n",
                           __func__, vif->type);
                 return -EOPNOTSUPP;
         }
 
         spin_lock_bh(&wl->lock);
-        memcpy(wl->pub->cur_etheraddr, vif->addr, sizeof(vif->addr));
         wl->mute_tx = false;
         brcms_c_mute(wl->wlc, false);
+        if (vif->type == NL80211_IFTYPE_STATION)
+                brcms_c_start_station(wl->wlc, vif->addr);
+        else if (vif->type == NL80211_IFTYPE_AP)
+                brcms_c_start_ap(wl->wlc, vif->addr, vif->bss_conf.bssid,
+                                 vif->bss_conf.ssid, vif->bss_conf.ssid_len);
+        else if (vif->type == NL80211_IFTYPE_ADHOC)
+                brcms_c_start_adhoc(wl->wlc, vif->addr);
         spin_unlock_bh(&wl->lock);
 
         return 0;
@@ -518,14 +528,43 @@ brcms_ops_bss_info_changed(struct ieee80211_hw *hw,
                 brcms_c_set_addrmatch(wl->wlc, RCM_BSSID_OFFSET, info->bssid);
                 spin_unlock_bh(&wl->lock);
         }
-        if (changed & BSS_CHANGED_BEACON)
+        if (changed & BSS_CHANGED_SSID) {
+                /* BSSID changed, for whatever reason (IBSS and managed mode) */
+                spin_lock_bh(&wl->lock);
+                brcms_c_set_ssid(wl->wlc, info->ssid, info->ssid_len);
+                spin_unlock_bh(&wl->lock);
+        }
+        if (changed & BSS_CHANGED_BEACON) {
                 /* Beacon data changed, retrieve new beacon (beaconing modes) */
-                brcms_err(core, "%s: beacon changed\n", __func__);
+                struct sk_buff *beacon;
+                u16 tim_offset = 0;
+
+                spin_lock_bh(&wl->lock);
+                beacon = ieee80211_beacon_get_tim(hw, vif, &tim_offset, NULL);
+                brcms_c_set_new_beacon(wl->wlc, beacon, tim_offset,
+                                       info->dtim_period);
+                spin_unlock_bh(&wl->lock);
+        }
+
+        if (changed & BSS_CHANGED_AP_PROBE_RESP) {
+                struct sk_buff *probe_resp;
+
+                spin_lock_bh(&wl->lock);
+                probe_resp = ieee80211_proberesp_get(hw, vif);
+                brcms_c_set_new_probe_resp(wl->wlc, probe_resp);
+                spin_unlock_bh(&wl->lock);
+        }
 
         if (changed & BSS_CHANGED_BEACON_ENABLED) {
                 /* Beaconing should be enabled/disabled (beaconing modes) */
                 brcms_err(core, "%s: Beacon enabled: %s\n", __func__,
                           info->enable_beacon ? "true" : "false");
+                if (info->enable_beacon &&
+                    hw->wiphy->flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) {
+                        brcms_c_enable_probe_resp(wl->wlc, true);
+                } else {
+                        brcms_c_enable_probe_resp(wl->wlc, false);
+                }
         }
 
         if (changed & BSS_CHANGED_CQM) {
@@ -738,6 +777,28 @@ static void brcms_ops_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                            "ret=%d\n", jiffies_to_msecs(ret));
 }
 
+static u64 brcms_ops_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+{
+        struct brcms_info *wl = hw->priv;
+        u64 tsf;
+
+        spin_lock_bh(&wl->lock);
+        tsf = brcms_c_tsf_get(wl->wlc);
+        spin_unlock_bh(&wl->lock);
+
+        return tsf;
+}
+
+static void brcms_ops_set_tsf(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif, u64 tsf)
+{
+        struct brcms_info *wl = hw->priv;
+
+        spin_lock_bh(&wl->lock);
+        brcms_c_tsf_set(wl->wlc, tsf);
+        spin_unlock_bh(&wl->lock);
+}
+
 static const struct ieee80211_ops brcms_ops = {
         .tx = brcms_ops_tx,
         .start = brcms_ops_start,
@@ -754,6 +815,8 @@ static const struct ieee80211_ops brcms_ops = {
         .ampdu_action = brcms_ops_ampdu_action,
         .rfkill_poll = brcms_ops_rfkill_poll,
         .flush = brcms_ops_flush,
+        .get_tsf = brcms_ops_get_tsf,
+        .set_tsf = brcms_ops_set_tsf,
 };
 
 void brcms_dpc(unsigned long data)
@@ -904,6 +967,7 @@ static void brcms_remove(struct bcma_device *pdev)
         struct brcms_info *wl = hw->priv;
 
         if (wl->wlc) {
+                brcms_led_unregister(wl);
                 wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, false);
                 wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
                 ieee80211_unregister_hw(hw);
@@ -994,7 +1058,16 @@ static int ieee_hw_init(struct ieee80211_hw *hw)
 
         /* channel change time is dependent on chip and band  */
         hw->channel_change_time = 7 * 1000;
-        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                     BIT(NL80211_IFTYPE_AP) |
+                                     BIT(NL80211_IFTYPE_ADHOC);
+
+        /*
+         * deactivate sending probe responses by ucude, because this will
+         * cause problems when WPS is used.
+         *
+         * hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+         */
 
         hw->rate_control_algorithm = "minstrel_ht";
 
@@ -1151,6 +1224,8 @@ static int brcms_bcma_probe(struct bcma_device *pdev)
                 pr_err("%s: brcms_attach failed!\n", __func__);
                 return -ENODEV;
         }
+        brcms_led_register(wl);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
index 947ccacf43e6..4090032e81a2 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
@@ -20,8 +20,10 @@
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/workqueue.h>
+#include <linux/leds.h>
 
 #include "ucode_loader.h"
+#include "led.h"
 /*
  * Starting index for 5G rates in the
  * legacy rate table.
@@ -81,6 +83,8 @@ struct brcms_info {
         struct wiphy *wiphy;
         struct brcms_ucode ucode;
         bool mute_tx;
+        struct brcms_led radio_led;
+        struct led_classdev led_dev;
 };
 
 /* misc callbacks */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index e0dc1838cd19..28e7aeedd184 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2010 Broadcom Corporation
+ * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -448,6 +449,10 @@ static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
         kfree(wlc->corestate);
         kfree(wlc->hw->bandstate[0]);
         kfree(wlc->hw);
+        if (wlc->beacon)
+                dev_kfree_skb_any(wlc->beacon);
+        if (wlc->probe_resp)
+                dev_kfree_skb_any(wlc->probe_resp);
 
         /* free the wlc */
         kfree(wlc);
@@ -1069,7 +1074,7 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
 
 static void brcms_c_tbtt(struct brcms_c_info *wlc)
 {
-        if (!wlc->bsscfg->BSS)
+        if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
                 /*
                  * DirFrmQ is now valid...defer setting until end
                  * of ATIM window
@@ -2163,6 +2168,32 @@ void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
         }
 }
 
+void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr)
+{
+        memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
+        wlc->bsscfg->type = BRCMS_TYPE_STATION;
+}
+
+void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr, const u8 *bssid,
+                      u8 *ssid, size_t ssid_len)
+{
+        brcms_c_set_ssid(wlc, ssid, ssid_len);
+
+        memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
+        memcpy(wlc->bsscfg->BSSID, bssid, sizeof(wlc->bsscfg->BSSID));
+        wlc->bsscfg->type = BRCMS_TYPE_AP;
+
+        brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, MCTL_AP | MCTL_INFRA);
+}
+
+void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr)
+{
+        memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
+        wlc->bsscfg->type = BRCMS_TYPE_ADHOC;
+
+        brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, 0);
+}
+
 /* Initialize GPIOs that are controlled by D11 core */
 static void brcms_c_gpio_init(struct brcms_c_info *wlc)
 {
@@ -3043,8 +3074,6 @@ static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
  */
 static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
 {
-        struct brcms_bss_cfg *cfg = wlc->bsscfg;
-
         /* disallow PS when one of the following global conditions meets */
         if (!wlc->pub->associated)
                 return false;
@@ -3053,16 +3082,11 @@ static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
         if (wlc->filter_flags & FIF_PROMISC_IN_BSS)
                 return false;
 
-        if (cfg->associated) {
-                /*
-                 * disallow PS when one of the following
-                 * bsscfg specific conditions meets
-                 */
-                if (!cfg->BSS)
-                        return false;
+        if (wlc->bsscfg->type == BRCMS_TYPE_AP)
+                return false;
 
+        if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
                 return false;
-        }
 
         return true;
 }
@@ -3771,7 +3795,7 @@ static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
         struct brcms_c_info *wlc = bsscfg->wlc;
 
         /* enter the MAC addr into the RXE match registers */
-        brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, bsscfg->cur_etheraddr);
+        brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, wlc->pub->cur_etheraddr);
 
         brcms_c_ampdu_macaddr_upd(wlc);
 
@@ -3787,6 +3811,15 @@ static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
         brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
 }
 
+void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid, size_t ssid_len)
+{
+        u8 len = min_t(u8, sizeof(wlc->bsscfg->SSID), ssid_len);
+        memset(wlc->bsscfg->SSID, 0, sizeof(wlc->bsscfg->SSID));
+
+        memcpy(wlc->bsscfg->SSID, ssid, len);
+        wlc->bsscfg->SSID_len = len;
+}
+
 static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
 {
         wlc_hw->shortslot = shortslot;
@@ -3821,7 +3854,7 @@ static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
         if (wlc->home_chanspec != chanspec) {
                 wlc->home_chanspec = chanspec;
 
-                if (wlc->bsscfg->associated)
+                if (wlc->pub->associated)
                         wlc->bsscfg->current_bss->chanspec = chanspec;
         }
 }
@@ -4091,10 +4124,14 @@ void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
                                           *shm_entry++);
         }
 
-        if (suspend) {
+        if (suspend)
                 brcms_c_suspend_mac_and_wait(wlc);
+
+        brcms_c_update_beacon(wlc);
+        brcms_c_update_probe_resp(wlc, false);
+
+        if (suspend)
                 brcms_c_enable_mac(wlc);
-        }
 }
 
 static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
@@ -4332,7 +4369,6 @@ static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
 
         /* WME QoS mode is Auto by default */
         wlc->pub->_ampdu = AMPDU_AGG_HOST;
-        wlc->pub->bcmerror = 0;
 }
 
 static uint brcms_c_attach_module(struct brcms_c_info *wlc)
@@ -5072,8 +5108,8 @@ int brcms_c_up(struct brcms_c_info *wlc)
                                 struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
                                 mboolset(wlc->pub->radio_disabled,
                                          WL_RADIO_HW_DISABLE);
-
-                                if (bsscfg->enable && bsscfg->BSS)
+                                if (bsscfg->type == BRCMS_TYPE_STATION ||
+                                    bsscfg->type == BRCMS_TYPE_ADHOC)
                                         brcms_err(wlc->hw->d11core,
                                                   "wl%d: up: rfdisable -> "
                                                   "bsscfg_disable()\n",
@@ -5434,7 +5470,7 @@ static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
         u8 r;
         bool war = false;
 
-        if (wlc->bsscfg->associated)
+        if (wlc->pub->associated)
                 r = wlc->bsscfg->current_bss->rateset.rates[0];
         else
                 r = wlc->default_bss->rateset.rates[0];
@@ -5528,7 +5564,7 @@ int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
         /* merge rateset coming in with the current mcsset */
         if (wlc->pub->_n_enab & SUPPORT_11N) {
                 struct brcms_bss_info *mcsset_bss;
-                if (wlc->bsscfg->associated)
+                if (wlc->pub->associated)
                         mcsset_bss = wlc->bsscfg->current_bss;
                 else
                         mcsset_bss = wlc->default_bss;
@@ -5543,12 +5579,36 @@ int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
         return bcmerror;
 }
 
+static void brcms_c_time_lock(struct brcms_c_info *wlc)
+{
+        bcma_set32(wlc->hw->d11core, D11REGOFFS(maccontrol), MCTL_TBTTHOLD);
+        /* Commit the write */
+        bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
+}
+
+static void brcms_c_time_unlock(struct brcms_c_info *wlc)
+{
+        bcma_mask32(wlc->hw->d11core, D11REGOFFS(maccontrol), ~MCTL_TBTTHOLD);
+        /* Commit the write */
+        bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
+}
+
 int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
 {
+        u32 bcnint_us;
+
         if (period == 0)
                 return -EINVAL;
 
         wlc->default_bss->beacon_period = period;
+
+        bcnint_us = period << 10;
+        brcms_c_time_lock(wlc);
+        bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfprep),
+                     (bcnint_us << CFPREP_CBI_SHIFT));
+        bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfpstart), bcnint_us);
+        brcms_c_time_unlock(wlc);
+
         return 0;
 }
 
@@ -7291,72 +7351,110 @@ brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
         }
 }
 
-/*      Max buffering needed for beacon template/prb resp template is 142 bytes.
- *
- *      PLCP header is 6 bytes.
- *      802.11 A3 header is 24 bytes.
- *      Max beacon frame body template length is 112 bytes.
- *      Max probe resp frame body template length is 110 bytes.
- *
- *      *len on input contains the max length of the packet available.
- *
- *      The *len value is set to the number of bytes in buf used, and starts
- *      with the PLCP and included up to, but not including, the 4 byte FCS.
- */
-static void
-brcms_c_bcn_prb_template(struct brcms_c_info *wlc, u16 type,
-                         u32 bcn_rspec,
-                         struct brcms_bss_cfg *cfg, u16 *buf, int *len)
+int brcms_c_get_header_len(void)
 {
-        static const u8 ether_bcast[ETH_ALEN] = {255, 255, 255, 255, 255, 255};
-        struct cck_phy_hdr *plcp;
-        struct ieee80211_mgmt *h;
-        int hdr_len, body_len;
-
-        hdr_len = D11_PHY_HDR_LEN + DOT11_MAC_HDR_LEN;
+        return TXOFF;
+}
 
-        /* calc buffer size provided for frame body */
-        body_len = *len - hdr_len;
-        /* return actual size */
-        *len = hdr_len + body_len;
+static void brcms_c_beacon_write(struct brcms_c_info *wlc,
+                                 struct sk_buff *beacon, u16 tim_offset,
+                                 u16 dtim_period, bool bcn0, bool bcn1)
+{
+        size_t len;
+        struct ieee80211_tx_info *tx_info;
+        struct brcms_hardware *wlc_hw = wlc->hw;
+        struct ieee80211_hw *ieee_hw = brcms_c_pub(wlc)->ieee_hw;
 
-        /* format PHY and MAC headers */
-        memset(buf, 0, hdr_len);
+        /* Get tx_info */
+        tx_info = IEEE80211_SKB_CB(beacon);
 
-        plcp = (struct cck_phy_hdr *) buf;
+        len = min_t(size_t, beacon->len, BCN_TMPL_LEN);
+        wlc->bcn_rspec = ieee80211_get_tx_rate(ieee_hw, tx_info)->hw_value;
 
-        /*
-         * PLCP for Probe Response frames are filled in from
-         * core's rate table
-         */
-        if (type == IEEE80211_STYPE_BEACON)
-                /* fill in PLCP */
-                brcms_c_compute_plcp(wlc, bcn_rspec,
-                                 (DOT11_MAC_HDR_LEN + body_len + FCS_LEN),
-                                 (u8 *) plcp);
+        brcms_c_compute_plcp(wlc, wlc->bcn_rspec,
+                             len + FCS_LEN - D11_PHY_HDR_LEN, beacon->data);
 
         /* "Regular" and 16 MBSS but not for 4 MBSS */
         /* Update the phytxctl for the beacon based on the rspec */
-        brcms_c_beacon_phytxctl_txant_upd(wlc, bcn_rspec);
+        brcms_c_beacon_phytxctl_txant_upd(wlc, wlc->bcn_rspec);
 
-        h = (struct ieee80211_mgmt *)&plcp[1];
+        if (bcn0) {
+                /* write the probe response into the template region */
+                brcms_b_write_template_ram(wlc_hw, T_BCN0_TPL_BASE,
+                                            (len + 3) & ~3, beacon->data);
 
-        /* fill in 802.11 header */
-        h->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | type);
+                /* write beacon length to SCR */
+                brcms_b_write_shm(wlc_hw, M_BCN0_FRM_BYTESZ, (u16) len);
+        }
+        if (bcn1) {
+                /* write the probe response into the template region */
+                brcms_b_write_template_ram(wlc_hw, T_BCN1_TPL_BASE,
+                                            (len + 3) & ~3, beacon->data);
 
-        /* DUR is 0 for multicast bcn, or filled in by MAC for prb resp */
-        /* A1 filled in by MAC for prb resp, broadcast for bcn */
-        if (type == IEEE80211_STYPE_BEACON)
-                memcpy(&h->da, &ether_bcast, ETH_ALEN);
-        memcpy(&h->sa, &cfg->cur_etheraddr, ETH_ALEN);
-        memcpy(&h->bssid, &cfg->BSSID, ETH_ALEN);
+                /* write beacon length to SCR */
+                brcms_b_write_shm(wlc_hw, M_BCN1_FRM_BYTESZ, (u16) len);
+        }
 
-        /* SEQ filled in by MAC */
+        if (tim_offset != 0) {
+                brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
+                                  tim_offset + D11B_PHY_HDR_LEN);
+                brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, dtim_period);
+        } else {
+                brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
+                                  len + D11B_PHY_HDR_LEN);
+                brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, 0);
+        }
 }
 
-int brcms_c_get_header_len(void)
+static void brcms_c_update_beacon_hw(struct brcms_c_info *wlc,
+                                     struct sk_buff *beacon, u16 tim_offset,
+                                     u16 dtim_period)
 {
-        return TXOFF;
+        struct brcms_hardware *wlc_hw = wlc->hw;
+        struct bcma_device *core = wlc_hw->d11core;
+
+        /* Hardware beaconing for this config */
+        u32 both_valid = MCMD_BCN0VLD | MCMD_BCN1VLD;
+
+        /* Check if both templates are in use, if so sched. an interrupt
+         *      that will call back into this routine
+         */
+        if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid)
+                /* clear any previous status */
+                bcma_write32(core, D11REGOFFS(macintstatus), MI_BCNTPL);
+
+        if (wlc->beacon_template_virgin) {
+                wlc->beacon_template_virgin = false;
+                brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
+                                     true);
+                /* mark beacon0 valid */
+                bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
+                return;
+        }
+
+        /* Check that after scheduling the interrupt both of the
+         *      templates are still busy. if not clear the int. & remask
+         */
+        if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid) {
+                wlc->defmacintmask |= MI_BCNTPL;
+                return;
+        }
+
+        if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN0VLD)) {
+                brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
+                                     false);
+                /* mark beacon0 valid */
+                bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
+                return;
+        }
+        if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN1VLD)) {
+                brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period,
+                                     false, true);
+                /* mark beacon0 valid */
+                bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN1VLD);
+                return;
+        }
+        return;
 }
 
 /*
@@ -7366,9 +7464,57 @@ void brcms_c_update_beacon(struct brcms_c_info *wlc)
 {
         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
 
-        if (bsscfg->up && !bsscfg->BSS)
+        if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
+                             bsscfg->type == BRCMS_TYPE_ADHOC)) {
                 /* Clear the soft intmask */
                 wlc->defmacintmask &= ~MI_BCNTPL;
+                if (!wlc->beacon)
+                        return;
+                brcms_c_update_beacon_hw(wlc, wlc->beacon,
+                                         wlc->beacon_tim_offset,
+                                         wlc->beacon_dtim_period);
+        }
+}
+
+void brcms_c_set_new_beacon(struct brcms_c_info *wlc, struct sk_buff *beacon,
+                            u16 tim_offset, u16 dtim_period)
+{
+        if (!beacon)
+                return;
+        if (wlc->beacon)
+                dev_kfree_skb_any(wlc->beacon);
+        wlc->beacon = beacon;
+
+        /* add PLCP */
+        skb_push(wlc->beacon, D11_PHY_HDR_LEN);
+        wlc->beacon_tim_offset = tim_offset;
+        wlc->beacon_dtim_period = dtim_period;
+        brcms_c_update_beacon(wlc);
+}
+
+void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
+                                struct sk_buff *probe_resp)
+{
+        if (!probe_resp)
+                return;
+        if (wlc->probe_resp)
+                dev_kfree_skb_any(wlc->probe_resp);
+        wlc->probe_resp = probe_resp;
+
+        /* add PLCP */
+        skb_push(wlc->probe_resp, D11_PHY_HDR_LEN);
+        brcms_c_update_probe_resp(wlc, false);
+}
+
+void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable)
+{
+        /*
+         * prevent ucode from sending probe responses by setting the timeout
+         * to 1, it can not send it in that time frame.
+         */
+        wlc->prb_resp_timeout = enable ? BRCMS_PRB_RESP_TIMEOUT : 1;
+        brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
+        /* TODO: if (enable) => also deactivate receiving of probe request */
 }
 
 /* Write ssid into shared memory */
@@ -7390,30 +7536,19 @@ brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
 static void
 brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
                               struct brcms_bss_cfg *cfg,
+                              struct sk_buff *probe_resp,
                               bool suspend)
 {
-        u16 *prb_resp;
-        int len = BCN_TMPL_LEN;
-
-        prb_resp = kmalloc(BCN_TMPL_LEN, GFP_ATOMIC);
-        if (!prb_resp)
-                return;
-
-        /*
-         * write the probe response to hardware, or save in
-         * the config structure
-         */
+        int len;
 
-        /* create the probe response template */
-        brcms_c_bcn_prb_template(wlc, IEEE80211_STYPE_PROBE_RESP, 0,
-                                 cfg, prb_resp, &len);
+        len = min_t(size_t, probe_resp->len, BCN_TMPL_LEN);
 
         if (suspend)
                 brcms_c_suspend_mac_and_wait(wlc);
 
         /* write the probe response into the template region */
         brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
-                                    (len + 3) & ~3, prb_resp);
+                                    (len + 3) & ~3, probe_resp->data);
 
         /* write the length of the probe response frame (+PLCP/-FCS) */
         brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
@@ -7427,13 +7562,11 @@ brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
          * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
          * by subtracting the PLCP len and adding the FCS.
          */
-        len += (-D11_PHY_HDR_LEN + FCS_LEN);
-        brcms_c_mod_prb_rsp_rate_table(wlc, (u16) len);
+        brcms_c_mod_prb_rsp_rate_table(wlc,
+                                      (u16)len + FCS_LEN - D11_PHY_HDR_LEN);
 
         if (suspend)
                 brcms_c_enable_mac(wlc);
-
-        kfree(prb_resp);
 }
 
 void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
@@ -7441,8 +7574,13 @@ void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
 
         /* update AP or IBSS probe responses */
-        if (bsscfg->up && !bsscfg->BSS)
-                brcms_c_bss_update_probe_resp(wlc, bsscfg, suspend);
+        if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
+                             bsscfg->type == BRCMS_TYPE_ADHOC)) {
+                if (!wlc->probe_resp)
+                        return;
+                brcms_c_bss_update_probe_resp(wlc, bsscfg, wlc->probe_resp,
+                                              suspend);
+        }
 }
 
 int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
@@ -7481,7 +7619,6 @@ void brcms_c_scan_stop(struct brcms_c_info *wlc)
 void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
 {
         wlc->pub->associated = state;
-        wlc->bsscfg->associated = state;
 }
 
 /*
@@ -7526,6 +7663,36 @@ void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
                 brcms_c_bcn_li_upd(wlc);
 }
 
+u64 brcms_c_tsf_get(struct brcms_c_info *wlc)
+{
+        u32 tsf_h, tsf_l;
+        u64 tsf;
+
+        brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
+
+        tsf = tsf_h;
+        tsf <<= 32;
+        tsf |= tsf_l;
+
+        return tsf;
+}
+
+void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf)
+{
+        u32 tsf_h, tsf_l;
+
+        brcms_c_time_lock(wlc);
+
+        tsf_l = tsf;
+        tsf_h = (tsf >> 32);
+
+        /* read the tsf timer low, then high to get an atomic read */
+        bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerlow), tsf_l);
+        bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerhigh), tsf_h);
+
+        brcms_c_time_unlock(wlc);
+}
+
 int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
 {
         uint qdbm;
@@ -7737,6 +7904,10 @@ bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded)
                 brcms_rfkill_set_hw_state(wlc->wl);
         }
 
+        /* BCN template is available */
+        if (macintstatus & MI_BCNTPL)
+                brcms_c_update_beacon(wlc);
+
         /* it isn't done and needs to be resched if macintstatus is non-zero */
         return wlc->macintstatus != 0;
 
@@ -7765,7 +7936,7 @@ void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
         brcms_c_set_bssid(wlc->bsscfg);
 
         /* Update tsf_cfprep if associated and up */
-        if (wlc->pub->associated && wlc->bsscfg->up) {
+        if (wlc->pub->associated && wlc->pub->up) {
                 u32 bi;
 
                 /* get beacon period and convert to uS */
@@ -7810,9 +7981,14 @@ void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
 
         /* read the ucode version if we have not yet done so */
         if (wlc->ucode_rev == 0) {
-                wlc->ucode_rev =
-                    brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR) << NBITS(u16);
-                wlc->ucode_rev |= brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
+                u16 rev;
+                u16 patch;
+
+                rev = brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR);
+                patch = brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
+                wlc->ucode_rev = (rev << NBITS(u16)) | patch;
+                snprintf(wlc->wiphy->fw_version,
+                         sizeof(wlc->wiphy->fw_version), "%u.%u", rev, patch);
         }
 
         /* ..now really unleash hell (allow the MAC out of suspend) */
@@ -7868,6 +8044,7 @@ brcms_c_attach(struct brcms_info *wl, struct bcma_device *core, uint unit,
         pub->unit = unit;
         pub->_piomode = piomode;
         wlc->bandinit_pending = false;
+        wlc->beacon_template_virgin = true;
 
         /* populate struct brcms_c_info with default values  */
         brcms_c_info_init(wlc, unit);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.h b/drivers/net/wireless/brcm80211/brcmsmac/main.h
index fb447747c2c6..b5d7a38b53fe 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
@@ -492,6 +492,8 @@ struct brcms_c_info {
         bool radio_monitor;
         bool going_down;
 
+        bool beacon_template_virgin;
+
         struct brcms_timer *wdtimer;
         struct brcms_timer *radio_timer;
 
@@ -561,6 +563,11 @@ struct brcms_c_info {
 
         struct wiphy *wiphy;
         struct scb pri_scb;
+
+        struct sk_buff *beacon;
+        u16 beacon_tim_offset;
+        u16 beacon_dtim_period;
+        struct sk_buff *probe_resp;
 };
 
 /* antsel module specific state */
@@ -576,14 +583,17 @@ struct antsel_info {
         struct brcms_antselcfg antcfg_cur; /* current antenna config (auto) */
 };
 
+enum brcms_bss_type {
+        BRCMS_TYPE_STATION,
+        BRCMS_TYPE_AP,
+        BRCMS_TYPE_ADHOC,
+};
+
 /*
  * BSS configuration state
  *
  * wlc: wlc to which this bsscfg belongs to.
- * up: is this configuration up operational
- * enable: is this configuration enabled
- * associated: is BSS in ASSOCIATED state
- * BSS: infraustructure or adhoc
+ * type: interface type
  * SSID_len: the length of SSID
  * SSID: SSID string
  *
@@ -599,14 +609,10 @@ struct antsel_info {
  */
 struct brcms_bss_cfg {
         struct brcms_c_info *wlc;
-        bool up;
-        bool enable;
-        bool associated;
-        bool BSS;
+        enum brcms_bss_type type;
         u8 SSID_len;
         u8 SSID[IEEE80211_MAX_SSID_LEN];
         u8 BSSID[ETH_ALEN];
-        u8 cur_etheraddr[ETH_ALEN];
         struct brcms_bss_info *current_bss;
 };
 
@@ -631,7 +637,6 @@ extern u16 brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
 extern void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
                                struct ieee80211_sta *sta,
                                void (*dma_callback_fn));
-extern void brcms_c_update_beacon(struct brcms_c_info *wlc);
 extern void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend);
 extern int brcms_c_set_nmode(struct brcms_c_info *wlc);
 extern void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c
index 91937c5025ce..b0fd807f2b2b 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c
@@ -198,8 +198,6 @@ u16 read_radio_reg(struct brcms_phy *pi, u16 addr)
 
 void write_radio_reg(struct brcms_phy *pi, u16 addr, u16 val)
 {
-        struct si_info *sii = container_of(pi->sh->sih, struct si_info, pub);
-
         if ((D11REV_GE(pi->sh->corerev, 24)) ||
             (D11REV_IS(pi->sh->corerev, 22)
              && (pi->pubpi.phy_type != PHY_TYPE_SSN))) {
@@ -211,7 +209,7 @@ void write_radio_reg(struct brcms_phy *pi, u16 addr, u16 val)
                 bcma_write16(pi->d11core, D11REGOFFS(phy4wdatalo), val);
         }
 
-        if ((sii->icbus->hosttype == BCMA_HOSTTYPE_PCI) &&
+        if ((pi->d11core->bus->hosttype == BCMA_HOSTTYPE_PCI) &&
             (++pi->phy_wreg >= pi->phy_wreg_limit)) {
                 (void)bcma_read32(pi->d11core, D11REGOFFS(maccontrol));
                 pi->phy_wreg = 0;
@@ -297,10 +295,8 @@ void write_phy_reg(struct brcms_phy *pi, u16 addr, u16 val)
         if (addr == 0x72)
                 (void)bcma_read16(pi->d11core, D11REGOFFS(phyregdata));
 #else
-        struct si_info *sii = container_of(pi->sh->sih, struct si_info, pub);
-
         bcma_write32(pi->d11core, D11REGOFFS(phyregaddr), addr | (val << 16));
-        if ((sii->icbus->hosttype == BCMA_HOSTTYPE_PCI) &&
+        if ((pi->d11core->bus->hosttype == BCMA_HOSTTYPE_PCI) &&
             (++pi->phy_wreg >= pi->phy_wreg_limit)) {
                 pi->phy_wreg = 0;
                 (void)bcma_read16(pi->d11core, D11REGOFFS(phyversion));
@@ -374,7 +370,6 @@ struct shared_phy *wlc_phy_shared_attach(struct shared_phy_params *shp)
         if (sh == NULL)
                 return NULL;
 
-        sh->sih = shp->sih;
         sh->physhim = shp->physhim;
         sh->unit = shp->unit;
         sh->corerev = shp->corerev;
@@ -2911,29 +2906,24 @@ void wlc_lcnphy_epa_switch(struct brcms_phy *pi, bool mode)
                                 mod_phy_reg(pi, 0x44c, (0x1 << 2), (1) << 2);
 
                         }
-                        ai_cc_reg(pi->sh->sih,
-                                  offsetof(struct chipcregs, gpiocontrol),
-                                  ~0x0, 0x0);
-                        ai_cc_reg(pi->sh->sih,
-                                  offsetof(struct chipcregs, gpioout),
-                                  0x40, 0x40);
-                        ai_cc_reg(pi->sh->sih,
-                                  offsetof(struct chipcregs, gpioouten),
-                                  0x40, 0x40);
+
+                        bcma_chipco_gpio_control(&pi->d11core->bus->drv_cc,
+                                                 0x0, 0x0);
+                        bcma_chipco_gpio_out(&pi->d11core->bus->drv_cc,
+                                             ~0x40, 0x40);
+                        bcma_chipco_gpio_outen(&pi->d11core->bus->drv_cc,
+                                               ~0x40, 0x40);
                 } else {
                         mod_phy_reg(pi, 0x44c, (0x1 << 2), (0) << 2);
 
                         mod_phy_reg(pi, 0x44d, (0x1 << 2), (0) << 2);
 
-                        ai_cc_reg(pi->sh->sih,
-                                  offsetof(struct chipcregs, gpioout),
-                                  0x40, 0x00);
-                        ai_cc_reg(pi->sh->sih,
-                                  offsetof(struct chipcregs, gpioouten),
-                                  0x40, 0x0);
-                        ai_cc_reg(pi->sh->sih,
-                                  offsetof(struct chipcregs, gpiocontrol),
-                                  ~0x0, 0x40);
+                        bcma_chipco_gpio_out(&pi->d11core->bus->drv_cc,
+                                             ~0x40, 0x00);
+                        bcma_chipco_gpio_outen(&pi->d11core->bus->drv_cc,
+                                               ~0x40, 0x00);
+                        bcma_chipco_gpio_control(&pi->d11core->bus->drv_cc,
+                                                 0x0, 0x40);
                 }
         }
 }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
index af00e2c2b266..1dc767c31653 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
@@ -488,7 +488,6 @@ struct lcnphy_cal_results {
 struct shared_phy {
         struct brcms_phy *phy_head;
         uint unit;
-        struct si_pub *sih;
         struct phy_shim_info *physhim;
         uint corerev;
         u32 machwcap;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index 21a824232478..3d6b16ce4687 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1137,9 +1137,8 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
         gain0_15 = ((biq1 & 0xf) << 12) |
                    ((tia & 0xf) << 8) |
                    ((lna2 & 0x3) << 6) |
-                   ((lna2 & 0x3) << 4) |
-                   ((lna1 & 0x3) << 2) |
-                   ((lna1 & 0x3) << 0);
+                   ((lna2 &
+                     0x3) << 4) | ((lna1 & 0x3) << 2) | ((lna1 & 0x3) << 0);
 
         mod_phy_reg(pi, 0x4b6, (0xffff << 0), gain0_15 << 0);
         mod_phy_reg(pi, 0x4b7, (0xf << 0), gain16_19 << 0);
@@ -1157,8 +1156,6 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
         }
 
         mod_phy_reg(pi, 0x44d, (0x1 << 0), (!trsw) << 0);
-        mod_phy_reg(pi, 0x4b1, (0x3 << 11), lna1 << 11);
-        mod_phy_reg(pi, 0x4e6, (0x3 << 3), lna1 << 3);
 
 }
 
@@ -1331,43 +1328,6 @@ static u32 wlc_lcnphy_measure_digital_power(struct brcms_phy *pi, u16 nsamples)
         return (iq_est.i_pwr + iq_est.q_pwr) / nsamples;
 }
 
-static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
-                                      u16 tia_gain, u16 lna2_gain)
-{
-        u32 i_thresh_l, q_thresh_l;
-        u32 i_thresh_h, q_thresh_h;
-        struct lcnphy_iq_est iq_est_h, iq_est_l;
-
-        wlc_lcnphy_set_rx_gain_by_distribution(pi, 0, 0, 0, biq1_gain, tia_gain,
-                                               lna2_gain, 0);
-
-        wlc_lcnphy_rx_gain_override_enable(pi, true);
-        wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
-        udelay(500);
-        write_radio_reg(pi, RADIO_2064_REG112, 0);
-        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
-                return false;
-
-        wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
-        udelay(500);
-        write_radio_reg(pi, RADIO_2064_REG112, 0);
-        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
-                return false;
-
-        i_thresh_l = (iq_est_l.i_pwr << 1);
-        i_thresh_h = (iq_est_l.i_pwr << 2) + iq_est_l.i_pwr;
-
-        q_thresh_l = (iq_est_l.q_pwr << 1);
-        q_thresh_h = (iq_est_l.q_pwr << 2) + iq_est_l.q_pwr;
-        if ((iq_est_h.i_pwr > i_thresh_l) &&
-            (iq_est_h.i_pwr < i_thresh_h) &&
-            (iq_est_h.q_pwr > q_thresh_l) &&
-            (iq_est_h.q_pwr < q_thresh_h))
-                return true;
-
-        return false;
-}
-
 static bool
 wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                      const struct lcnphy_rx_iqcomp *iqcomp,
@@ -1382,8 +1342,8 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
             RFOverrideVal0_old, rfoverride2_old, rfoverride2val_old,
             rfoverride3_old, rfoverride3val_old, rfoverride4_old,
             rfoverride4val_old, afectrlovr_old, afectrlovrval_old;
-        int tia_gain, lna2_gain, biq1_gain;
-        bool set_gain;
+        int tia_gain;
+        u32 received_power, rx_pwr_threshold;
         u16 old_sslpnCalibClkEnCtrl, old_sslpnRxFeClkEnCtrl;
         u16 values_to_save[11];
         s16 *ptr;
@@ -1408,134 +1368,126 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                 goto cal_done;
         }
 
-        WARN_ON(module != 1);
-        tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
-        wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
-
-        for (i = 0; i < 11; i++)
-                values_to_save[i] =
-                        read_radio_reg(pi, rxiq_cal_rf_reg[i]);
-        Core1TxControl_old = read_phy_reg(pi, 0x631);
-
-        or_phy_reg(pi, 0x631, 0x0015);
-
-        RFOverride0_old = read_phy_reg(pi, 0x44c);
-        RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
-        rfoverride2_old = read_phy_reg(pi, 0x4b0);
-        rfoverride2val_old = read_phy_reg(pi, 0x4b1);
-        rfoverride3_old = read_phy_reg(pi, 0x4f9);
-        rfoverride3val_old = read_phy_reg(pi, 0x4fa);
-        rfoverride4_old = read_phy_reg(pi, 0x938);
-        rfoverride4val_old = read_phy_reg(pi, 0x939);
-        afectrlovr_old = read_phy_reg(pi, 0x43b);
-        afectrlovrval_old = read_phy_reg(pi, 0x43c);
-        old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
-        old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
-
-        tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
-        if (tx_gain_override_old) {
-                wlc_lcnphy_get_tx_gain(pi, &old_gains);
-                tx_gain_index_old = pi_lcn->lcnphy_current_index;
-        }
-
-        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
+        if (module == 1) {
 
-        mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
-        mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
+                tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
+                wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
 
-        mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
-        mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
+                for (i = 0; i < 11; i++)
+                        values_to_save[i] =
+                                read_radio_reg(pi, rxiq_cal_rf_reg[i]);
+                Core1TxControl_old = read_phy_reg(pi, 0x631);
+
+                or_phy_reg(pi, 0x631, 0x0015);
+
+                RFOverride0_old = read_phy_reg(pi, 0x44c);
+                RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
+                rfoverride2_old = read_phy_reg(pi, 0x4b0);
+                rfoverride2val_old = read_phy_reg(pi, 0x4b1);
+                rfoverride3_old = read_phy_reg(pi, 0x4f9);
+                rfoverride3val_old = read_phy_reg(pi, 0x4fa);
+                rfoverride4_old = read_phy_reg(pi, 0x938);
+                rfoverride4val_old = read_phy_reg(pi, 0x939);
+                afectrlovr_old = read_phy_reg(pi, 0x43b);
+                afectrlovrval_old = read_phy_reg(pi, 0x43c);
+                old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
+                old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
+
+                tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
+                if (tx_gain_override_old) {
+                        wlc_lcnphy_get_tx_gain(pi, &old_gains);
+                        tx_gain_index_old = pi_lcn->lcnphy_current_index;
+                }
 
-        write_radio_reg(pi, RADIO_2064_REG116, 0x06);
-        write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
-        write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
-        write_radio_reg(pi, RADIO_2064_REG098, 0x03);
-        write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
-        mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
-        write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
-        write_radio_reg(pi, RADIO_2064_REG114, 0x01);
-        write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
-        write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
-
-        mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
-        mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
-        mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
-        mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
-        mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
-        mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
-        mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
-        mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
-        mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
-        mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
+                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
 
-        mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
-        mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
+                mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
+                mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
 
-        write_phy_reg(pi, 0x6da, 0xffff);
-        or_phy_reg(pi, 0x6db, 0x3);
+                mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
+                mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
 
-        wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
-        set_gain = false;
-
-        lna2_gain = 3;
-        while ((lna2_gain >= 0) && !set_gain) {
-                tia_gain = 4;
-
-                while ((tia_gain >= 0) && !set_gain) {
-                        biq1_gain = 6;
-
-                        while ((biq1_gain >= 0) && !set_gain) {
-                                set_gain = wlc_lcnphy_rx_iq_cal_gain(pi,
-                                                                     (u16)
-                                                                     biq1_gain,
-                                                                     (u16)
-                                                                     tia_gain,
-                                                                     (u16)
-                                                                     lna2_gain);
-                                biq1_gain -= 1;
-                        }
+                write_radio_reg(pi, RADIO_2064_REG116, 0x06);
+                write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
+                write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
+                write_radio_reg(pi, RADIO_2064_REG098, 0x03);
+                write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
+                mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
+                write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
+                write_radio_reg(pi, RADIO_2064_REG114, 0x01);
+                write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
+                write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
+
+                mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
+                mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
+                mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
+                mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
+                mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
+                mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
+                mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
+                mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
+                mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
+                mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
+
+                mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
+                mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
+
+                wlc_lcnphy_start_tx_tone(pi, 2000, 120, 0);
+                write_phy_reg(pi, 0x6da, 0xffff);
+                or_phy_reg(pi, 0x6db, 0x3);
+                wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
+                wlc_lcnphy_rx_gain_override_enable(pi, true);
+
+                tia_gain = 8;
+                rx_pwr_threshold = 950;
+                while (tia_gain > 0) {
                         tia_gain -= 1;
+                        wlc_lcnphy_set_rx_gain_by_distribution(pi,
+                                                               0, 0, 2, 2,
+                                                               (u16)
+                                                               tia_gain, 1, 0);
+                        udelay(500);
+
+                        received_power =
+                                wlc_lcnphy_measure_digital_power(pi, 2000);
+                        if (received_power < rx_pwr_threshold)
+                                break;
                 }
-                lna2_gain -= 1;
-        }
+                result = wlc_lcnphy_calc_rx_iq_comp(pi, 0xffff);
 
-        if (set_gain)
-                result = wlc_lcnphy_calc_rx_iq_comp(pi, 1024);
-        else
-                result = false;
+                wlc_lcnphy_stop_tx_tone(pi);
 
-        wlc_lcnphy_stop_tx_tone(pi);
+                write_phy_reg(pi, 0x631, Core1TxControl_old);
 
-        write_phy_reg(pi, 0x631, Core1TxControl_old);
-
-        write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
-        write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
-        write_phy_reg(pi, 0x4b0, rfoverride2_old);
-        write_phy_reg(pi, 0x4b1, rfoverride2val_old);
-        write_phy_reg(pi, 0x4f9, rfoverride3_old);
-        write_phy_reg(pi, 0x4fa, rfoverride3val_old);
-        write_phy_reg(pi, 0x938, rfoverride4_old);
-        write_phy_reg(pi, 0x939, rfoverride4val_old);
-        write_phy_reg(pi, 0x43b, afectrlovr_old);
-        write_phy_reg(pi, 0x43c, afectrlovrval_old);
-        write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
-        write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
+                write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
+                write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
+                write_phy_reg(pi, 0x4b0, rfoverride2_old);
+                write_phy_reg(pi, 0x4b1, rfoverride2val_old);
+                write_phy_reg(pi, 0x4f9, rfoverride3_old);
+                write_phy_reg(pi, 0x4fa, rfoverride3val_old);
+                write_phy_reg(pi, 0x938, rfoverride4_old);
+                write_phy_reg(pi, 0x939, rfoverride4val_old);
+                write_phy_reg(pi, 0x43b, afectrlovr_old);
+                write_phy_reg(pi, 0x43c, afectrlovrval_old);
+                write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
+                write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
 
-        wlc_lcnphy_clear_trsw_override(pi);
+                wlc_lcnphy_clear_trsw_override(pi);
 
-        mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
+                mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
 
-        for (i = 0; i < 11; i++)
-                write_radio_reg(pi, rxiq_cal_rf_reg[i],
-                                values_to_save[i]);
+                for (i = 0; i < 11; i++)
+                        write_radio_reg(pi, rxiq_cal_rf_reg[i],
+                                        values_to_save[i]);
 
-        if (tx_gain_override_old)
-                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
-        else
-                wlc_lcnphy_disable_tx_gain_override(pi);
+                if (tx_gain_override_old)
+                        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
+                else
+                        wlc_lcnphy_disable_tx_gain_override(pi);
 
-        wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
-        wlc_lcnphy_rx_gain_override_enable(pi, false);
+                wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
+                wlc_lcnphy_rx_gain_override_enable(pi, false);
+        }
 
 cal_done:
         kfree(ptr);
@@ -1643,11 +1595,15 @@ wlc_lcnphy_set_chanspec_tweaks(struct brcms_phy *pi, u16 chanspec)
         if (channel == 1 || channel == 2 || channel == 3 ||
             channel == 4 || channel == 9 ||
             channel == 10 || channel == 11 || channel == 12) {
-                si_pmu_pllcontrol(pi->sh->sih, 0x2, 0xffffffff, 0x03000c04);
-                si_pmu_pllcontrol(pi->sh->sih, 0x3, 0xffffff, 0x0);
-                si_pmu_pllcontrol(pi->sh->sih, 0x4, 0xffffffff, 0x200005c0);
-
-                si_pmu_pllupd(pi->sh->sih);
+                bcma_chipco_pll_write(&pi->d11core->bus->drv_cc, 0x2,
+                                      0x03000c04);
+                bcma_chipco_pll_maskset(&pi->d11core->bus->drv_cc, 0x3,
+                                        ~0x00ffffff, 0x0);
+                bcma_chipco_pll_write(&pi->d11core->bus->drv_cc, 0x4,
+                                      0x200005c0);
+
+                bcma_cc_set32(&pi->d11core->bus->drv_cc, BCMA_CC_PMU_CTL,
+                              BCMA_CC_PMU_CTL_PLL_UPD);
                 write_phy_reg(pi, 0x942, 0);
                 wlc_lcnphy_txrx_spur_avoidance_mode(pi, false);
                 pi_lcn->lcnphy_spurmod = false;
@@ -1655,11 +1611,15 @@ wlc_lcnphy_set_chanspec_tweaks(struct brcms_phy *pi, u16 chanspec)
 
                 write_phy_reg(pi, 0x425, 0x5907);
         } else {
-                si_pmu_pllcontrol(pi->sh->sih, 0x2, 0xffffffff, 0x03140c04);
-                si_pmu_pllcontrol(pi->sh->sih, 0x3, 0xffffff, 0x333333);
-                si_pmu_pllcontrol(pi->sh->sih, 0x4, 0xffffffff, 0x202c2820);
-
-                si_pmu_pllupd(pi->sh->sih);
+                bcma_chipco_pll_write(&pi->d11core->bus->drv_cc, 0x2,
+                                      0x03140c04);
+                bcma_chipco_pll_maskset(&pi->d11core->bus->drv_cc, 0x3,
+                                        ~0x00ffffff, 0x333333);
+                bcma_chipco_pll_write(&pi->d11core->bus->drv_cc, 0x4,
+                                      0x202c2820);
+
+                bcma_cc_set32(&pi->d11core->bus->drv_cc, BCMA_CC_PMU_CTL,
+                              BCMA_CC_PMU_CTL_PLL_UPD);
                 write_phy_reg(pi, 0x942, 0);
                 wlc_lcnphy_txrx_spur_avoidance_mode(pi, true);
 
@@ -1829,17 +1789,6 @@ wlc_lcnphy_radio_2064_channel_tune_4313(struct brcms_phy *pi, u8 channel)
                 write_radio_reg(pi, RADIO_2064_REG038, 3);
                 write_radio_reg(pi, RADIO_2064_REG091, 7);
         }
-
-        if (!(pi->sh->boardflags & BFL_FEM)) {
-                u8 reg038[14] = {0xd, 0xe, 0xd, 0xd, 0xd, 0xc,
-                        0xa, 0xb, 0xb, 0x3, 0x3, 0x2, 0x0, 0x0};
-
-                write_radio_reg(pi, RADIO_2064_REG02A, 0xf);
-                write_radio_reg(pi, RADIO_2064_REG091, 0x3);
-                write_radio_reg(pi, RADIO_2064_REG038, 0x3);
-
-                write_radio_reg(pi, RADIO_2064_REG038, reg038[channel - 1]);
-        }
 }
 
 static int
@@ -2034,16 +1983,6 @@ wlc_lcnphy_set_tssi_mux(struct brcms_phy *pi, enum lcnphy_tssi_mode pos)
                 } else {
                         mod_radio_reg(pi, RADIO_2064_REG03A, 1, 0x1);
                         mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
-                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1, 0x0);
-                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x4, 1<<2);
-                        mod_radio_reg(pi, RADIO_2064_REG036, 0x10, 0x0);
-                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x10, 1<<4);
-                        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
-                        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x77);
-                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, 0xe<<1);
-                        mod_radio_reg(pi, RADIO_2064_REG112, 0x80, 1<<7);
-                        mod_radio_reg(pi, RADIO_2064_REG005, 0x7, 1<<1);
-                        mod_radio_reg(pi, RADIO_2064_REG029, 0xf0, 0<<4);
                 }
         } else {
                 mod_phy_reg(pi, 0x4d9, (0x1 << 2), (0x1) << 2);
@@ -2130,14 +2069,12 @@ static void wlc_lcnphy_pwrctrl_rssiparams(struct brcms_phy *pi)
                     (auxpga_vmid_temp << 0) | (auxpga_gain_temp << 12));
 
         mod_radio_reg(pi, RADIO_2064_REG082, (1 << 5), (1 << 5));
-        mod_radio_reg(pi, RADIO_2064_REG07C, (1 << 0), (1 << 0));
 }
 
 static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 {
         struct phytbl_info tab;
         u32 rfseq, ind;
-        u8 tssi_sel;
 
         tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
         tab.tbl_width = 32;
@@ -2159,13 +2096,7 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 
         mod_phy_reg(pi, 0x503, (0x1 << 4), (1) << 4);
 
-        if (pi->sh->boardflags & BFL_FEM) {
-                tssi_sel = 0x1;
-                wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
-        } else {
-                tssi_sel = 0xe;
-                wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_POST_PA);
-        }
+        wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
         mod_phy_reg(pi, 0x4a4, (0x1 << 14), (0) << 14);
 
         mod_phy_reg(pi, 0x4a4, (0x1 << 15), (1) << 15);
@@ -2201,10 +2132,9 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
         mod_phy_reg(pi, 0x49a, (0x1ff << 0), (0xff) << 0);
 
         if (LCNREV_IS(pi->pubpi.phy_rev, 2)) {
-                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, tssi_sel);
+                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, 0xe);
                 mod_radio_reg(pi, RADIO_2064_REG086, 0x4, 0x4);
         } else {
-                mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, tssi_sel << 1);
                 mod_radio_reg(pi, RADIO_2064_REG03A, 0x1, 1);
                 mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 1 << 3);
         }
@@ -2251,10 +2181,6 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 
         mod_phy_reg(pi, 0x4d7, (0xf << 8), (0) << 8);
 
-        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x0);
-        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
-        mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
-
         wlc_lcnphy_pwrctrl_rssiparams(pi);
 }
 
@@ -2873,8 +2799,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
                 read_radio_reg(pi, RADIO_2064_REG007) & 1;
         u16 SAVE_jtag_auxpga = read_radio_reg(pi, RADIO_2064_REG0FF) & 0x10;
         u16 SAVE_iqadc_aux_en = read_radio_reg(pi, RADIO_2064_REG11F) & 4;
-        u8 SAVE_bbmult = wlc_lcnphy_get_bbmult(pi);
-
         idleTssi = read_phy_reg(pi, 0x4ab);
         suspend = (0 == (bcma_read32(pi->d11core, D11REGOFFS(maccontrol)) &
                          MCTL_EN_MAC));
@@ -2892,12 +2816,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
         mod_radio_reg(pi, RADIO_2064_REG0FF, 0x10, 1 << 4);
         mod_radio_reg(pi, RADIO_2064_REG11F, 0x4, 1 << 2);
         wlc_lcnphy_tssi_setup(pi);
-
-        mod_phy_reg(pi, 0x4d7, (0x1 << 0), (1 << 0));
-        mod_phy_reg(pi, 0x4d7, (0x1 << 6), (1 << 6));
-
-        wlc_lcnphy_set_bbmult(pi, 0x0);
-
         wlc_phy_do_dummy_tx(pi, true, OFF);
         idleTssi = ((read_phy_reg(pi, 0x4ab) & (0x1ff << 0))
                     >> 0);
@@ -2919,7 +2837,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
 
         mod_phy_reg(pi, 0x44c, (0x1 << 12), (0) << 12);
 
-        wlc_lcnphy_set_bbmult(pi, SAVE_bbmult);
         wlc_lcnphy_set_tx_gain_override(pi, tx_gain_override_old);
         wlc_lcnphy_set_tx_gain(pi, &old_gains);
         wlc_lcnphy_set_tx_pwr_ctrl(pi, SAVE_txpwrctrl);
@@ -3133,11 +3050,6 @@ static void wlc_lcnphy_tx_pwr_ctrl_init(struct brcms_phy_pub *ppi)
                         wlc_lcnphy_write_table(pi, &tab);
                         tab.tbl_offset++;
                 }
-                mod_phy_reg(pi, 0x4d0, (0x1 << 0), (0) << 0);
-                mod_phy_reg(pi, 0x4d3, (0xff << 0), (0) << 0);
-                mod_phy_reg(pi, 0x4d3, (0xff << 8), (0) << 8);
-                mod_phy_reg(pi, 0x4d0, (0x1 << 4), (0) << 4);
-                mod_phy_reg(pi, 0x4d0, (0x1 << 2), (0) << 2);
 
                 mod_phy_reg(pi, 0x410, (0x1 << 7), (0) << 7);
 
@@ -3939,6 +3851,7 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
         target_gains.pad_gain = 21;
         target_gains.dac_gain = 0;
         wlc_lcnphy_set_tx_gain(pi, &target_gains);
+        wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
 
         if (LCNREV_IS(pi->pubpi.phy_rev, 1) || pi_lcn->lcnphy_hw_iqcal_en) {
 
@@ -3949,7 +3862,6 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
                                         lcnphy_recal ? LCNPHY_CAL_RECAL :
                                         LCNPHY_CAL_FULL), false);
         } else {
-                wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
                 wlc_lcnphy_tx_iqlo_soft_cal_full(pi);
         }
 
@@ -4374,22 +4286,17 @@ wlc_lcnphy_load_tx_gain_table(struct brcms_phy *pi,
         if (CHSPEC_IS5G(pi->radio_chanspec))
                 pa_gain = 0x70;
         else
-                pa_gain = 0x60;
+                pa_gain = 0x70;
 
         if (pi->sh->boardflags & BFL_FEM)
                 pa_gain = 0x10;
-
         tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
         tab.tbl_width = 32;
         tab.tbl_len = 1;
         tab.tbl_ptr = &val;
 
         for (j = 0; j < 128; j++) {
-                if (pi->sh->boardflags & BFL_FEM)
-                        gm_gain = gain_table[j].gm;
-                else
-                        gm_gain = 15;
-
+                gm_gain = gain_table[j].gm;
                 val = (((u32) pa_gain << 24) |
                        (gain_table[j].pad << 16) |
                        (gain_table[j].pga << 8) | gm_gain);
@@ -4600,10 +4507,7 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
 
         write_phy_reg(pi, 0x4ea, 0x4688);
 
-        if (pi->sh->boardflags & BFL_FEM)
-                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
-        else
-                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 3 << 0);
+        mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
 
         mod_phy_reg(pi, 0x4eb, (0x7 << 6), 0 << 6);
 
@@ -4614,13 +4518,6 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
         wlc_lcnphy_rcal(pi);
 
         wlc_lcnphy_rc_cal(pi);
-
-        if (!(pi->sh->boardflags & BFL_FEM)) {
-                write_radio_reg(pi, RADIO_2064_REG032, 0x6f);
-                write_radio_reg(pi, RADIO_2064_REG033, 0x19);
-                write_radio_reg(pi, RADIO_2064_REG039, 0xe);
-        }
-
 }
 
 static void wlc_lcnphy_radio_init(struct brcms_phy *pi)
@@ -4650,20 +4547,22 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
                 wlc_lcnphy_write_table(pi, &tab);
         }
 
-        if (!(pi->sh->boardflags & BFL_FEM)) {
-                tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
-                tab.tbl_width = 16;
-                tab.tbl_ptr = &val;
-                tab.tbl_len = 1;
+        tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
+        tab.tbl_width = 16;
+        tab.tbl_ptr = &val;
+        tab.tbl_len = 1;
 
-                val = 150;
-                tab.tbl_offset = 0;
-                wlc_lcnphy_write_table(pi, &tab);
+        val = 114;
+        tab.tbl_offset = 0;
+        wlc_lcnphy_write_table(pi, &tab);
 
-                val = 220;
-                tab.tbl_offset = 1;
-                wlc_lcnphy_write_table(pi, &tab);
-        }
+        val = 130;
+        tab.tbl_offset = 1;
+        wlc_lcnphy_write_table(pi, &tab);
+
+        val = 6;
+        tab.tbl_offset = 8;
+        wlc_lcnphy_write_table(pi, &tab);
 
         if (CHSPEC_IS2G(pi->radio_chanspec)) {
                 if (pi->sh->boardflags & BFL_FEM)
@@ -4864,9 +4763,10 @@ void wlc_phy_init_lcnphy(struct brcms_phy *pi)
 
         wlc_phy_chanspec_set((struct brcms_phy_pub *) pi, pi->radio_chanspec);
 
-        si_pmu_regcontrol(pi->sh->sih, 0, 0xf, 0x9);
+        bcma_chipco_regctl_maskset(&pi->d11core->bus->drv_cc, 0, ~0xf, 0x9);
 
-        si_pmu_chipcontrol(pi->sh->sih, 0, 0xffffffff, 0x03CDDDDD);
+        bcma_chipco_chipctl_maskset(&pi->d11core->bus->drv_cc, 0, 0x0,
+                                    0x03CDDDDD);
 
         if ((pi->sh->boardflags & BFL_FEM)
             && wlc_lcnphy_tempsense_based_pwr_ctrl_enabled(pi))
@@ -5055,7 +4955,6 @@ void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec)
                 wlc_lcnphy_load_tx_iir_filter(pi, true, 3);
 
         mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3);
-        wlc_lcnphy_tssi_setup(pi);
 }
 
 void wlc_phy_detach_lcnphy(struct brcms_phy *pi)
@@ -5078,7 +4977,7 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
                 pi->hwpwrctrl_capable = true;
         }
 
-        pi->xtalfreq = si_pmu_alp_clock(pi->sh->sih);
+        pi->xtalfreq = bcma_chipco_get_alp_clock(&pi->d11core->bus->drv_cc);
         pi_lcn->lcnphy_papd_rxGnCtrl_init = 0;
 
         pi->pi_fptr.init = wlc_phy_init_lcnphy;
@@ -5094,7 +4993,8 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
         if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
                 return false;
 
-        if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
+        if ((pi->sh->boardflags & BFL_FEM) &&
+            (LCNREV_IS(pi->pubpi.phy_rev, 1))) {
                 if (pi_lcn->lcnphy_tempsense_option == 3) {
                         pi->hwpwrctrl = true;
                         pi->hwpwrctrl_capable = true;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
index 65db9b7458dc..3e9f5b25be63 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
@@ -19321,14 +19321,13 @@ void wlc_phy_init_nphy(struct brcms_phy *pi)
              (pi->sh->chippkg == BCMA_PKG_ID_BCM4718))) {
                 if ((pi->sh->boardflags & BFL_EXTLNA) &&
                     (CHSPEC_IS2G(pi->radio_chanspec)))
-                        ai_cc_reg(pi->sh->sih,
-                                  offsetof(struct chipcregs, chipcontrol),
-                                  0x40, 0x40);
+                        bcma_cc_set32(&pi->d11core->bus->drv_cc,
+                                      BCMA_CC_CHIPCTL, 0x40);
         }
 
         if ((!PHY_IPA(pi)) && (pi->sh->chip == BCMA_CHIP_ID_BCM5357))
-                si_pmu_chipcontrol(pi->sh->sih, 1, CCTRL5357_EXTPA,
-                                   CCTRL5357_EXTPA);
+                bcma_chipco_chipctl_maskset(&pi->d11core->bus->drv_cc, 1,
+                                            ~CCTRL5357_EXTPA, CCTRL5357_EXTPA);
 
         if ((pi->nphy_gband_spurwar2_en) && CHSPEC_IS2G(pi->radio_chanspec) &&
             CHSPEC_IS40(pi->radio_chanspec)) {
@@ -21133,7 +21132,6 @@ wlc_phy_chanspec_nphy_setup(struct brcms_phy *pi, u16 chanspec,
                             const struct nphy_sfo_cfg *ci)
 {
         u16 val;
-        struct si_info *sii = container_of(pi->sh->sih, struct si_info, pub);
 
         val = read_phy_reg(pi, 0x09) & NPHY_BandControl_currentBand;
         if (CHSPEC_IS5G(chanspec) && !val) {
@@ -21221,11 +21219,11 @@ wlc_phy_chanspec_nphy_setup(struct brcms_phy *pi, u16 chanspec,
 
                 if ((pi->sh->chip == BCMA_CHIP_ID_BCM4716) ||
                     (pi->sh->chip == BCMA_CHIP_ID_BCM43225)) {
-                        bcma_pmu_spuravoid_pllupdate(&sii->icbus->drv_cc,
+                        bcma_pmu_spuravoid_pllupdate(&pi->d11core->bus->drv_cc,
                                                      spuravoid);
                 } else {
                         wlapi_bmac_core_phypll_ctl(pi->sh->physhim, false);
-                        bcma_pmu_spuravoid_pllupdate(&sii->icbus->drv_cc,
+                        bcma_pmu_spuravoid_pllupdate(&pi->d11core->bus->drv_cc,
                                                      spuravoid);
                         wlapi_bmac_core_phypll_ctl(pi->sh->physhim, true);
                 }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
index b7e95acc2084..622c01ca72c5 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
@@ -1992,70 +1992,70 @@ static const u16 dot11lcn_sw_ctrl_tbl_4313_epa_rev0[] = {
 };
 
 static const u16 dot11lcn_sw_ctrl_tbl_4313_rev0[] = {
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
 };
 
 static const u16 dot11lcn_sw_ctrl_tbl_rev0[] = {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pmu.c b/drivers/net/wireless/brcm80211/brcmsmac/pmu.c
index 7e9df566c733..71b80381f3ad 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pmu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pmu.c
@@ -115,60 +115,6 @@ u16 si_pmu_fast_pwrup_delay(struct si_pub *sih)
         return (u16) delay;
 }
 
-/* Read/write a chipcontrol reg */
-u32 si_pmu_chipcontrol(struct si_pub *sih, uint reg, u32 mask, u32 val)
-{
-        ai_cc_reg(sih, offsetof(struct chipcregs, chipcontrol_addr), ~0, reg);
-        return ai_cc_reg(sih, offsetof(struct chipcregs, chipcontrol_data),
-                         mask, val);
-}
-
-/* Read/write a regcontrol reg */
-u32 si_pmu_regcontrol(struct si_pub *sih, uint reg, u32 mask, u32 val)
-{
-        ai_cc_reg(sih, offsetof(struct chipcregs, regcontrol_addr), ~0, reg);
-        return ai_cc_reg(sih, offsetof(struct chipcregs, regcontrol_data),
-                         mask, val);
-}
-
-/* Read/write a pllcontrol reg */
-u32 si_pmu_pllcontrol(struct si_pub *sih, uint reg, u32 mask, u32 val)
-{
-        ai_cc_reg(sih, offsetof(struct chipcregs, pllcontrol_addr), ~0, reg);
-        return ai_cc_reg(sih, offsetof(struct chipcregs, pllcontrol_data),
-                         mask, val);
-}
-
-/* PMU PLL update */
-void si_pmu_pllupd(struct si_pub *sih)
-{
-        ai_cc_reg(sih, offsetof(struct chipcregs, pmucontrol),
-                  PCTL_PLL_PLLCTL_UPD, PCTL_PLL_PLLCTL_UPD);
-}
-
-/* query alp/xtal clock frequency */
-u32 si_pmu_alp_clock(struct si_pub *sih)
-{
-        u32 clock = ALP_CLOCK;
-
-        /* bail out with default */
-        if (!(ai_get_cccaps(sih) & CC_CAP_PMU))
-                return clock;
-
-        switch (ai_get_chip_id(sih)) {
-        case BCMA_CHIP_ID_BCM43224:
-        case BCMA_CHIP_ID_BCM43225:
-        case BCMA_CHIP_ID_BCM4313:
-                /* always 20Mhz */
-                clock = 20000 * 1000;
-                break;
-        default:
-                break;
-        }
-
-        return clock;
-}
-
 u32 si_pmu_measure_alpclk(struct si_pub *sih)
 {
         struct si_info *sii = container_of(sih, struct si_info, pub);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pmu.h b/drivers/net/wireless/brcm80211/brcmsmac/pmu.h
index f7cff873578b..20e2012d5a3a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pmu.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pmu.h
@@ -21,12 +21,6 @@
 #include "types.h"
 
 extern u16 si_pmu_fast_pwrup_delay(struct si_pub *sih);
-extern void si_pmu_sprom_enable(struct si_pub *sih, bool enable);
-extern u32 si_pmu_chipcontrol(struct si_pub *sih, uint reg, u32 mask, u32 val);
-extern u32 si_pmu_regcontrol(struct si_pub *sih, uint reg, u32 mask, u32 val);
-extern u32 si_pmu_alp_clock(struct si_pub *sih);
-extern void si_pmu_pllupd(struct si_pub *sih);
-extern u32 si_pmu_pllcontrol(struct si_pub *sih, uint reg, u32 mask, u32 val);
 extern u32 si_pmu_measure_alpclk(struct si_pub *sih);
 
 #endif /* _BRCM_PMU_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index b0f14b7b8616..d36ea5e1cc49 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -164,8 +164,6 @@ struct brcms_pub {
 
         u8 cur_etheraddr[ETH_ALEN];     /* our local ethernet address */
 
-        int bcmerror;           /* last bcm error */
-
         u32 radio_disabled;     /* bit vector for radio disabled reasons */
 
         u16 boardrev;   /* version # of particular board */
@@ -326,10 +324,25 @@ extern void brcms_c_set_shortslot_override(struct brcms_c_info *wlc,
                                     s8 sslot_override);
 extern void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc,
                                         u8 interval);
+extern u64 brcms_c_tsf_get(struct brcms_c_info *wlc);
+extern void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf);
 extern int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
 extern int brcms_c_get_tx_power(struct brcms_c_info *wlc);
 extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
 extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
 extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
+extern void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr);
+extern void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr,
+                             const u8 *bssid, u8 *ssid, size_t ssid_len);
+extern void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr);
+extern void brcms_c_update_beacon(struct brcms_c_info *wlc);
+extern void brcms_c_set_new_beacon(struct brcms_c_info *wlc,
+                                   struct sk_buff *beacon, u16 tim_offset,
+                                   u16 dtim_period);
+extern void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
+                                       struct sk_buff *probe_resp);
+extern void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable);
+extern void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid,
+                             size_t ssid_len);
 
 #endif                          /* _BRCM_PUB_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmutil/Makefile b/drivers/net/wireless/brcm80211/brcmutil/Makefile
index 6281c416289e..8a928184016a 100644
--- a/drivers/net/wireless/brcm80211/brcmutil/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmutil/Makefile
@@ -19,10 +19,5 @@ ccflags-y :=				\
         -Idrivers/net/wireless/brcm80211/brcmutil \
         -Idrivers/net/wireless/brcm80211/include
 
-BRCMUTIL_OFILES := \
-        utils.o
-
-MODULEPFX := brcmutil
-
-obj-$(CONFIG_BRCMUTIL)  += $(MODULEPFX).o
-$(MODULEPFX)-objs       = $(BRCMUTIL_OFILES)
+obj-$(CONFIG_BRCMUTIL)  += brcmutil.o
+brcmutil-objs   = utils.o d11.o
diff --git a/drivers/net/wireless/brcm80211/brcmutil/d11.c b/drivers/net/wireless/brcm80211/brcmutil/d11.c
new file mode 100644
index 000000000000..30e54e2c6c9b
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmutil/d11.c
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/*********************channel spec common functions*********************/
+
+#include <linux/module.h>
+
+#include <brcmu_utils.h>
+#include <brcmu_wifi.h>
+#include <brcmu_d11.h>
+
+static void brcmu_d11n_encchspec(struct brcmu_chan *ch)
+{
+        ch->chspec = ch->chnum & BRCMU_CHSPEC_CH_MASK;
+
+        switch (ch->bw) {
+        case BRCMU_CHAN_BW_20:
+                ch->chspec |= BRCMU_CHSPEC_D11N_BW_20 | BRCMU_CHSPEC_D11N_SB_N;
+                break;
+        case BRCMU_CHAN_BW_40:
+        default:
+                WARN_ON_ONCE(1);
+                break;
+        }
+
+        if (ch->chnum <= CH_MAX_2G_CHANNEL)
+                ch->chspec |= BRCMU_CHSPEC_D11N_BND_2G;
+        else
+                ch->chspec |= BRCMU_CHSPEC_D11N_BND_5G;
+}
+
+static void brcmu_d11ac_encchspec(struct brcmu_chan *ch)
+{
+        ch->chspec = ch->chnum & BRCMU_CHSPEC_CH_MASK;
+
+        switch (ch->bw) {
+        case BRCMU_CHAN_BW_20:
+                ch->chspec |= BRCMU_CHSPEC_D11AC_BW_20;
+                break;
+        case BRCMU_CHAN_BW_40:
+        case BRCMU_CHAN_BW_80:
+        case BRCMU_CHAN_BW_80P80:
+        case BRCMU_CHAN_BW_160:
+        default:
+                WARN_ON_ONCE(1);
+                break;
+        }
+
+        if (ch->chnum <= CH_MAX_2G_CHANNEL)
+                ch->chspec |= BRCMU_CHSPEC_D11AC_BND_2G;
+        else
+                ch->chspec |= BRCMU_CHSPEC_D11AC_BND_5G;
+}
+
+static void brcmu_d11n_decchspec(struct brcmu_chan *ch)
+{
+        u16 val;
+
+        ch->chnum = (u8)(ch->chspec & BRCMU_CHSPEC_CH_MASK);
+
+        switch (ch->chspec & BRCMU_CHSPEC_D11N_BW_MASK) {
+        case BRCMU_CHSPEC_D11N_BW_20:
+                ch->bw = BRCMU_CHAN_BW_20;
+                break;
+        case BRCMU_CHSPEC_D11N_BW_40:
+                ch->bw = BRCMU_CHAN_BW_40;
+                val = ch->chspec & BRCMU_CHSPEC_D11N_SB_MASK;
+                if (val == BRCMU_CHSPEC_D11N_SB_L) {
+                        ch->sb = BRCMU_CHAN_SB_L;
+                        ch->chnum -= CH_10MHZ_APART;
+                } else {
+                        ch->sb = BRCMU_CHAN_SB_U;
+                        ch->chnum += CH_10MHZ_APART;
+                }
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                break;
+        }
+
+        switch (ch->chspec & BRCMU_CHSPEC_D11N_BND_MASK) {
+        case BRCMU_CHSPEC_D11N_BND_5G:
+                ch->band = BRCMU_CHAN_BAND_5G;
+                break;
+        case BRCMU_CHSPEC_D11N_BND_2G:
+                ch->band = BRCMU_CHAN_BAND_2G;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                break;
+        }
+}
+
+static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
+{
+        u16 val;
+
+        ch->chnum = (u8)(ch->chspec & BRCMU_CHSPEC_CH_MASK);
+
+        switch (ch->chspec & BRCMU_CHSPEC_D11AC_BW_MASK) {
+        case BRCMU_CHSPEC_D11AC_BW_20:
+                ch->bw = BRCMU_CHAN_BW_20;
+                break;
+        case BRCMU_CHSPEC_D11AC_BW_40:
+                ch->bw = BRCMU_CHAN_BW_40;
+                val = ch->chspec & BRCMU_CHSPEC_D11AC_SB_MASK;
+                if (val == BRCMU_CHSPEC_D11AC_SB_L) {
+                        ch->sb = BRCMU_CHAN_SB_L;
+                        ch->chnum -= CH_10MHZ_APART;
+                } else if (val == BRCMU_CHSPEC_D11AC_SB_U) {
+                        ch->sb = BRCMU_CHAN_SB_U;
+                        ch->chnum += CH_10MHZ_APART;
+                } else {
+                        WARN_ON_ONCE(1);
+                }
+                break;
+        case BRCMU_CHSPEC_D11AC_BW_80:
+                ch->bw = BRCMU_CHAN_BW_80;
+                break;
+        case BRCMU_CHSPEC_D11AC_BW_8080:
+        case BRCMU_CHSPEC_D11AC_BW_160:
+        default:
+                WARN_ON_ONCE(1);
+                break;
+        }
+
+        switch (ch->chspec & BRCMU_CHSPEC_D11AC_BND_MASK) {
+        case BRCMU_CHSPEC_D11AC_BND_5G:
+                ch->band = BRCMU_CHAN_BAND_5G;
+                break;
+        case BRCMU_CHSPEC_D11AC_BND_2G:
+                ch->band = BRCMU_CHAN_BAND_2G;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                break;
+        }
+}
+
+void brcmu_d11_attach(struct brcmu_d11inf *d11inf)
+{
+        if (d11inf->io_type == BRCMU_D11N_IOTYPE) {
+                d11inf->encchspec = brcmu_d11n_encchspec;
+                d11inf->decchspec = brcmu_d11n_decchspec;
+        } else {
+                d11inf->encchspec = brcmu_d11ac_encchspec;
+                d11inf->decchspec = brcmu_d11ac_decchspec;
+        }
+}
+EXPORT_SYMBOL(brcmu_d11_attach);
diff --git a/drivers/net/wireless/brcm80211/brcmutil/utils.c b/drivers/net/wireless/brcm80211/brcmutil/utils.c
index 3e6405e06ac0..bf5e50fc21ba 100644
--- a/drivers/net/wireless/brcm80211/brcmutil/utils.c
+++ b/drivers/net/wireless/brcm80211/brcmutil/utils.c
@@ -116,6 +116,31 @@ struct sk_buff *brcmu_pktq_pdeq(struct pktq *pq, int prec)
 }
 EXPORT_SYMBOL(brcmu_pktq_pdeq);
 
+/*
+ * precedence based dequeue with match function. Passing a NULL pointer
+ * for the match function parameter is considered to be a wildcard so
+ * any packet on the queue is returned. In that case it is no different
+ * from brcmu_pktq_pdeq() above.
+ */
+struct sk_buff *brcmu_pktq_pdeq_match(struct pktq *pq, int prec,
+                                      bool (*match_fn)(struct sk_buff *skb,
+                                                       void *arg), void *arg)
+{
+        struct sk_buff_head *q;
+        struct sk_buff *p, *next;
+
+        q = &pq->q[prec].skblist;
+        skb_queue_walk_safe(q, p, next) {
+                if (match_fn == NULL || match_fn(p, arg)) {
+                        skb_unlink(p, q);
+                        pq->len--;
+                        return p;
+                }
+        }
+        return NULL;
+}
+EXPORT_SYMBOL(brcmu_pktq_pdeq_match);
+
 struct sk_buff *brcmu_pktq_pdeq_tail(struct pktq *pq, int prec)
 {
         struct sk_buff_head *q;
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index e8682855b73a..c1fe245bb07e 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -29,6 +29,7 @@
 
 /* Chipcommon Core Chip IDs */
 #define BCM4313_CHIP_ID         0x4313
+#define BCM43143_CHIP_ID        43143
 #define BCM43224_CHIP_ID        43224
 #define BCM43225_CHIP_ID        43225
 #define BCM43235_CHIP_ID        43235
@@ -39,5 +40,6 @@
 #define BCM4330_CHIP_ID         0x4330
 #define BCM4331_CHIP_ID         0x4331
 #define BCM4334_CHIP_ID         0x4334
+#define BCM4335_CHIP_ID         0x4335
 
 #endif                          /* _BRCM_HW_IDS_H_ */
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_d11.h b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
new file mode 100644
index 000000000000..92623f02b1c0
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
@@ -0,0 +1,145 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _BRCMU_D11_H_
+#define _BRCMU_D11_H_
+
+/* d11 io type */
+#define BRCMU_D11N_IOTYPE               1
+#define BRCMU_D11AC_IOTYPE              2
+
+/* A chanspec (channel specification) holds the channel number, band,
+ * bandwidth and control sideband
+ */
+
+/* chanspec binary format */
+
+#define BRCMU_CHSPEC_INVALID            255
+/* bit 0~7 channel number
+ * for 80+80 channels: bit 0~3 low channel id, bit 4~7 high channel id
+ */
+#define BRCMU_CHSPEC_CH_MASK            0x00ff
+#define BRCMU_CHSPEC_CH_SHIFT           0
+#define BRCMU_CHSPEC_CHL_MASK           0x000f
+#define BRCMU_CHSPEC_CHL_SHIFT          0
+#define BRCMU_CHSPEC_CHH_MASK           0x00f0
+#define BRCMU_CHSPEC_CHH_SHIFT          4
+
+/* bit 8~16 for dot 11n IO types
+ * bit 8~9 sideband
+ * bit 10~11 bandwidth
+ * bit 12~13 spectral band
+ * bit 14~15 not used
+ */
+#define BRCMU_CHSPEC_D11N_SB_MASK       0x0300
+#define BRCMU_CHSPEC_D11N_SB_SHIFT      8
+#define  BRCMU_CHSPEC_D11N_SB_L         0x0100  /* control lower */
+#define  BRCMU_CHSPEC_D11N_SB_U         0x0200  /* control upper */
+#define  BRCMU_CHSPEC_D11N_SB_N         0x0300  /* none */
+#define BRCMU_CHSPEC_D11N_BW_MASK       0x0c00
+#define BRCMU_CHSPEC_D11N_BW_SHIFT      10
+#define  BRCMU_CHSPEC_D11N_BW_10        0x0400
+#define  BRCMU_CHSPEC_D11N_BW_20        0x0800
+#define  BRCMU_CHSPEC_D11N_BW_40        0x0c00
+#define BRCMU_CHSPEC_D11N_BND_MASK      0x3000
+#define BRCMU_CHSPEC_D11N_BND_SHIFT     12
+#define  BRCMU_CHSPEC_D11N_BND_5G       0x1000
+#define  BRCMU_CHSPEC_D11N_BND_2G       0x2000
+
+/* bit 8~16 for dot 11ac IO types
+ * bit 8~10 sideband
+ * bit 11~13 bandwidth
+ * bit 14~15 spectral band
+ */
+#define BRCMU_CHSPEC_D11AC_SB_MASK      0x0700
+#define BRCMU_CHSPEC_D11AC_SB_SHIFT     8
+#define  BRCMU_CHSPEC_D11AC_SB_LLL      0x0000
+#define  BRCMU_CHSPEC_D11AC_SB_LLU      0x0100
+#define  BRCMU_CHSPEC_D11AC_SB_LUL      0x0200
+#define  BRCMU_CHSPEC_D11AC_SB_LUU      0x0300
+#define  BRCMU_CHSPEC_D11AC_SB_ULL      0x0400
+#define  BRCMU_CHSPEC_D11AC_SB_ULU      0x0500
+#define  BRCMU_CHSPEC_D11AC_SB_UUL      0x0600
+#define  BRCMU_CHSPEC_D11AC_SB_UUU      0x0700
+#define  BRCMU_CHSPEC_D11AC_SB_LL       BRCMU_CHSPEC_D11AC_SB_LLL
+#define  BRCMU_CHSPEC_D11AC_SB_LU       BRCMU_CHSPEC_D11AC_SB_LLU
+#define  BRCMU_CHSPEC_D11AC_SB_UL       BRCMU_CHSPEC_D11AC_SB_LUL
+#define  BRCMU_CHSPEC_D11AC_SB_UU       BRCMU_CHSPEC_D11AC_SB_LUU
+#define  BRCMU_CHSPEC_D11AC_SB_L        BRCMU_CHSPEC_D11AC_SB_LLL
+#define  BRCMU_CHSPEC_D11AC_SB_U        BRCMU_CHSPEC_D11AC_SB_LLU
+#define BRCMU_CHSPEC_D11AC_BW_MASK      0x3800
+#define BRCMU_CHSPEC_D11AC_BW_SHIFT     11
+#define  BRCMU_CHSPEC_D11AC_BW_5        0x0000
+#define  BRCMU_CHSPEC_D11AC_BW_10       0x0800
+#define  BRCMU_CHSPEC_D11AC_BW_20       0x1000
+#define  BRCMU_CHSPEC_D11AC_BW_40       0x1800
+#define  BRCMU_CHSPEC_D11AC_BW_80       0x2000
+#define  BRCMU_CHSPEC_D11AC_BW_160      0x2800
+#define  BRCMU_CHSPEC_D11AC_BW_8080     0x3000
+#define BRCMU_CHSPEC_D11AC_BND_MASK     0xc000
+#define BRCMU_CHSPEC_D11AC_BND_SHIFT    14
+#define  BRCMU_CHSPEC_D11AC_BND_2G      0x0000
+#define  BRCMU_CHSPEC_D11AC_BND_3G      0x4000
+#define  BRCMU_CHSPEC_D11AC_BND_4G      0x8000
+#define  BRCMU_CHSPEC_D11AC_BND_5G      0xc000
+
+#define BRCMU_CHAN_BAND_2G              0
+#define BRCMU_CHAN_BAND_5G              1
+
+enum brcmu_chan_bw {
+        BRCMU_CHAN_BW_20,
+        BRCMU_CHAN_BW_40,
+        BRCMU_CHAN_BW_80,
+        BRCMU_CHAN_BW_80P80,
+        BRCMU_CHAN_BW_160,
+};
+
+enum brcmu_chan_sb {
+        BRCMU_CHAN_SB_NONE = 0,
+        BRCMU_CHAN_SB_L,
+        BRCMU_CHAN_SB_U,
+        BRCMU_CHAN_SB_LL,
+        BRCMU_CHAN_SB_LU,
+        BRCMU_CHAN_SB_UL,
+        BRCMU_CHAN_SB_UU,
+        BRCMU_CHAN_SB_LLL,
+        BRCMU_CHAN_SB_LLU,
+        BRCMU_CHAN_SB_LUL,
+        BRCMU_CHAN_SB_LUU,
+        BRCMU_CHAN_SB_ULL,
+        BRCMU_CHAN_SB_ULU,
+        BRCMU_CHAN_SB_UUL,
+        BRCMU_CHAN_SB_UUU,
+};
+
+struct brcmu_chan {
+        u16 chspec;
+        u8 chnum;
+        u8 band;
+        enum brcmu_chan_bw bw;
+        enum brcmu_chan_sb sb;
+};
+
+struct brcmu_d11inf {
+        u8 io_type;
+
+        void (*encchspec)(struct brcmu_chan *ch);
+        void (*decchspec)(struct brcmu_chan *ch);
+};
+
+extern void brcmu_d11_attach(struct brcmu_d11inf *d11inf);
+
+#endif  /* _BRCMU_CHANNELS_H_ */
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_utils.h b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
index 477b92ad3d62..898cacb8d01d 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_utils.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
@@ -120,6 +120,10 @@ extern struct sk_buff *brcmu_pktq_penq_head(struct pktq *pq, int prec,
                                       struct sk_buff *p);
 extern struct sk_buff *brcmu_pktq_pdeq(struct pktq *pq, int prec);
 extern struct sk_buff *brcmu_pktq_pdeq_tail(struct pktq *pq, int prec);
+extern struct sk_buff *brcmu_pktq_pdeq_match(struct pktq *pq, int prec,
+                                             bool (*match_fn)(struct sk_buff *p,
+                                                              void *arg),
+                                             void *arg);
 
 /* packet primitives */
 extern struct sk_buff *brcmu_pkt_buf_get_skb(uint len);
@@ -173,6 +177,29 @@ extern void brcmu_pktq_flush(struct pktq *pq, bool dir,
 /* ip address */
 struct ipv4_addr;
 
+/*
+ * bitfield macros using masking and shift
+ *
+ * remark: the mask parameter should be a shifted mask.
+ */
+static inline void brcmu_maskset32(u32 *var, u32 mask, u8 shift, u32 value)
+{
+        value = (value << shift) & mask;
+        *var = (*var & ~mask) | value;
+}
+static inline u32 brcmu_maskget32(u32 var, u32 mask, u8 shift)
+{
+        return (var & mask) >> shift;
+}
+static inline void brcmu_maskset16(u16 *var, u16 mask, u8 shift, u16 value)
+{
+        value = (value << shift) & mask;
+        *var = (*var & ~mask) | value;
+}
+static inline u16 brcmu_maskget16(u16 var, u16 mask, u8 shift)
+{
+        return (var & mask) >> shift;
+}
 
 /* externs */
 /* format/print */
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
index c11a290a1edf..0505cc065e0d 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
@@ -32,8 +32,9 @@
 #define CH_20MHZ_APART                  4
 #define CH_10MHZ_APART                  2
 #define CH_5MHZ_APART                   1 /* 2G band channels are 5 Mhz apart */
+#define CH_MIN_2G_CHANNEL               1
 #define CH_MAX_2G_CHANNEL               14      /* Max channel in 2G band */
-#define BRCM_MAX_2G_CHANNEL     CH_MAX_2G_CHANNEL       /* legacy define */
+#define CH_MIN_5G_CHANNEL               34
 
 /* bandstate array indices */
 #define BAND_2G_INDEX           0       /* wlc->bandstate[x] index */
@@ -60,6 +61,7 @@
 #define WL_CHANSPEC_BW_10               0x0400
 #define WL_CHANSPEC_BW_20               0x0800
 #define WL_CHANSPEC_BW_40               0x0C00
+#define WL_CHANSPEC_BW_80               0x2000
 
 #define WL_CHANSPEC_BAND_MASK           0xf000
 #define WL_CHANSPEC_BAND_SHIFT          12
@@ -67,6 +69,25 @@
 #define WL_CHANSPEC_BAND_2G             0x2000
 #define INVCHANSPEC                     255
 
+#define WL_CHAN_VALID_HW                (1 << 0) /* valid with current HW */
+#define WL_CHAN_VALID_SW                (1 << 1) /* valid with country sett. */
+#define WL_CHAN_BAND_5G                 (1 << 2) /* 5GHz-band channel */
+#define WL_CHAN_RADAR                   (1 << 3) /* radar sensitive  channel */
+#define WL_CHAN_INACTIVE                (1 << 4) /* inactive due to radar */
+#define WL_CHAN_PASSIVE                 (1 << 5) /* channel in passive mode */
+#define WL_CHAN_RESTRICTED              (1 << 6) /* restricted use channel */
+
+/* values for band specific 40MHz capabilities  */
+#define WLC_N_BW_20ALL                  0
+#define WLC_N_BW_40ALL                  1
+#define WLC_N_BW_20IN2G_40IN5G          2
+
+/* band types */
+#define WLC_BAND_AUTO                   0       /* auto-select */
+#define WLC_BAND_5G                     1       /* 5 Ghz */
+#define WLC_BAND_2G                     2       /* 2.4 Ghz */
+#define WLC_BAND_ALL                    3       /* all bands */
+
 #define CHSPEC_CHANNEL(chspec)  ((u8)((chspec) & WL_CHANSPEC_CHAN_MASK))
 #define CHSPEC_BAND(chspec)     ((chspec) & WL_CHANSPEC_BAND_MASK)
 
@@ -79,10 +100,11 @@
 #define CHSPEC_IS20(chspec) \
         (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
 
-#ifndef CHSPEC_IS40
 #define CHSPEC_IS40(chspec) \
         (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)
-#endif
+
+#define CHSPEC_IS80(chspec) \
+        (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_80)
 
 #define CHSPEC_IS5G(chspec) \
         (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
diff --git a/drivers/net/wireless/brcm80211/include/chipcommon.h b/drivers/net/wireless/brcm80211/include/chipcommon.h
index f96834a7c055..d242333b7559 100644
--- a/drivers/net/wireless/brcm80211/include/chipcommon.h
+++ b/drivers/net/wireless/brcm80211/include/chipcommon.h
@@ -205,7 +205,7 @@ struct chipcregs {
         u32 res_req_timer_sel;
         u32 res_req_timer;
         u32 res_req_mask;
-        u32 PAD;
+        u32 pmucapabilities_ext; /* 0x64c, pmurev >=15 */
         u32 chipcontrol_addr;   /* 0x650 */
         u32 chipcontrol_data;   /* 0x654 */
         u32 regcontrol_addr;
@@ -214,7 +214,11 @@ struct chipcregs {
         u32 pllcontrol_data;
         u32 pmustrapopt;        /* 0x668, corerev >= 28 */
         u32 pmu_xtalfreq;       /* 0x66C, pmurev >= 10 */
-        u32 PAD[100];
+        u32 retention_ctl;          /* 0x670, pmurev >= 15 */
+        u32 PAD[3];
+        u32 retention_grpidx;       /* 0x680 */
+        u32 retention_grpctl;       /* 0x684 */
+        u32 PAD[94];
         u16 sromotp[768];
 };
 
@@ -276,6 +280,12 @@ struct chipcregs {
 #define PCAP5_VC_SHIFT  22
 #define PCAP5_CC_MASK   0xf8000000
 #define PCAP5_CC_SHIFT  27
+/* pmucapabilites_ext PMU rev >= 15 */
+#define PCAPEXT_SR_SUPPORTED_MASK       (1 << 1)
+/* retention_ctl PMU rev >= 15 */
+#define PMU_RCTL_MACPHY_DISABLE_MASK        (1 << 26)
+#define PMU_RCTL_LOGIC_DISABLE_MASK         (1 << 27)
+
 
 /*
 * Maximum delay for the PMU state transition in us.
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index cb066f62879d..15920aaa5dd6 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -4167,17 +4167,11 @@ static ssize_t show_debug_level(struct device_driver *d, char *buf)
 static ssize_t store_debug_level(struct device_driver *d,
                                  const char *buf, size_t count)
 {
-        char *p = (char *)buf;
         u32 val;
+        int ret;
 
-        if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
-                p++;
-                if (p[0] == 'x' || p[0] == 'X')
-                        p++;
-                val = simple_strtoul(p, &p, 16);
-        } else
-                val = simple_strtoul(p, &p, 10);
-        if (p == buf)
+        ret = kstrtou32(buf, 0, &val);
+        if (ret)
                 IPW_DEBUG_INFO(": %s is not in hex or decimal form.\n", buf);
         else
                 ipw2100_debug_level = val;
@@ -4238,27 +4232,15 @@ static ssize_t store_scan_age(struct device *d, struct device_attribute *attr,
 {
         struct ipw2100_priv *priv = dev_get_drvdata(d);
         struct net_device *dev = priv->net_dev;
-        char buffer[] = "00000000";
-        unsigned long len =
-            (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1;
         unsigned long val;
-        char *p = buffer;
+        int ret;
 
         (void)dev;              /* kill unused-var warning for debug-only code */
 
         IPW_DEBUG_INFO("enter\n");
 
-        strncpy(buffer, buf, len);
-        buffer[len] = 0;
-
-        if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
-                p++;
-                if (p[0] == 'x' || p[0] == 'X')
-                        p++;
-                val = simple_strtoul(p, &p, 16);
-        } else
-                val = simple_strtoul(p, &p, 10);
-        if (p == buffer) {
+        ret = kstrtoul(buf, 0, &val);
+        if (ret) {
                 IPW_DEBUG_INFO("%s: user supplied invalid value.\n", dev->name);
         } else {
                 priv->ieee->scan_age = val;
@@ -4266,7 +4248,7 @@ static ssize_t store_scan_age(struct device *d, struct device_attribute *attr,
         }
 
         IPW_DEBUG_INFO("exit\n");
-        return len;
+        return strnlen(buf, count);
 }
 
 static DEVICE_ATTR(scan_age, S_IWUSR | S_IRUGO, show_scan_age, store_scan_age);
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 3630a41df50d..b37a582ccbe7 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -475,6 +475,7 @@ il3945_tx_skb(struct il_priv *il,
         dma_addr_t txcmd_phys;
         int txq_id = skb_get_queue_mapping(skb);
         u16 len, idx, hdr_len;
+        u16 firstlen, secondlen;
         u8 id;
         u8 unicast;
         u8 sta_id;
@@ -589,21 +590,22 @@ il3945_tx_skb(struct il_priv *il,
         len =
             sizeof(struct il3945_tx_cmd) + sizeof(struct il_cmd_header) +
             hdr_len;
-        len = (len + 3) & ~3;
+        firstlen = (len + 3) & ~3;
 
         /* Physical address of this Tx command's header (not MAC header!),
          * within command buffer array. */
         txcmd_phys =
-            pci_map_single(il->pci_dev, &out_cmd->hdr, len, PCI_DMA_TODEVICE);
+            pci_map_single(il->pci_dev, &out_cmd->hdr, firstlen,
+                           PCI_DMA_TODEVICE);
         if (unlikely(pci_dma_mapping_error(il->pci_dev, txcmd_phys)))
                 goto drop_unlock;
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
-        len = skb->len - hdr_len;
-        if (len) {
+        secondlen = skb->len - hdr_len;
+        if (secondlen > 0) {
                 phys_addr =
-                    pci_map_single(il->pci_dev, skb->data + hdr_len, len,
+                    pci_map_single(il->pci_dev, skb->data + hdr_len, secondlen,
                                    PCI_DMA_TODEVICE);
                 if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr)))
                         goto drop_unlock;
@@ -611,12 +613,12 @@ il3945_tx_skb(struct il_priv *il,
 
         /* Add buffer containing Tx command and MAC(!) header to TFD's
          * first entry */
-        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, len, 1, 0);
+        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, firstlen, 1, 0);
         dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, len);
-        if (len)
-                il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, len, 0,
-                                               U32_PAD(len));
+        dma_unmap_len_set(out_meta, len, firstlen);
+        if (secondlen > 0)
+                il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, secondlen, 0,
+                                               U32_PAD(secondlen));
 
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
@@ -3475,7 +3477,7 @@ static struct attribute_group il3945_attribute_group = {
         .attrs = il3945_sysfs_entries,
 };
 
-struct ieee80211_ops il3945_mac_ops = {
+static struct ieee80211_ops il3945_mac_ops __read_mostly = {
         .tx = il3945_mac_tx,
         .start = il3945_mac_start,
         .stop = il3945_mac_stop,
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index cb5882ea5f3a..431ae6cc5f8f 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -612,7 +612,7 @@ il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr,
 
 /* Called for N_RX (legacy ABG frames), or
  * N_RX_MPDU (HT high-throughput N frames). */
-void
+static void
 il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct ieee80211_hdr *header;
@@ -744,7 +744,7 @@ il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
 
 /* Cache phy data (Rx signal strength, etc) for HT frame (N_RX_PHY).
  * This will be used later in il_hdl_rx() for N_RX_MPDU. */
-void
+static void
 il4965_hdl_rx_phy(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct il_rx_pkt *pkt = rxb_addr(rxb);
@@ -1250,7 +1250,7 @@ il4965_dump_fh(struct il_priv *il, char **buf, bool display)
         return 0;
 }
 
-void
+static void
 il4965_hdl_missed_beacon(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct il_rx_pkt *pkt = rxb_addr(rxb);
@@ -1357,7 +1357,7 @@ il4965_accumulative_stats(struct il_priv *il, __le32 * stats)
 }
 #endif
 
-void
+static void
 il4965_hdl_stats(struct il_priv *il, struct il_rx_buf *rxb)
 {
         const int recalib_seconds = 60;
@@ -1399,7 +1399,7 @@ il4965_hdl_stats(struct il_priv *il, struct il_rx_buf *rxb)
                 il4965_temperature_calib(il);
 }
 
-void
+static void
 il4965_hdl_c_stats(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct il_rx_pkt *pkt = rxb_addr(rxb);
@@ -2050,7 +2050,7 @@ il4965_txq_ctx_reset(struct il_priv *il)
                 il_tx_queue_reset(il, txq_id);
 }
 
-void
+static void
 il4965_txq_ctx_unmap(struct il_priv *il)
 {
         int txq_id;
@@ -2896,7 +2896,7 @@ il4965_hwrate_to_tx_control(struct il_priv *il, u32 rate_n_flags,
  * Handles block-acknowledge notification from device, which reports success
  * of frames sent via aggregation.
  */
-void
+static void
 il4965_hdl_compressed_ba(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct il_rx_pkt *pkt = rxb_addr(rxb);
@@ -6315,7 +6315,7 @@ il4965_tx_queue_set_status(struct il_priv *il, struct il_tx_queue *txq,
                scd_retry ? "BA" : "AC", txq_id, tx_fifo_id);
 }
 
-const struct ieee80211_ops il4965_mac_ops = {
+static const struct ieee80211_ops il4965_mac_ops = {
         .tx = il4965_mac_tx,
         .start = il4965_mac_start,
         .stop = il4965_mac_stop,
diff --git a/drivers/net/wireless/iwlegacy/4965-rs.c b/drivers/net/wireless/iwlegacy/4965-rs.c
index 1d92a59a85ad..1fc0b227e120 100644
--- a/drivers/net/wireless/iwlegacy/4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/4965-rs.c
@@ -2152,7 +2152,7 @@ il4965_rs_initialize_lq(struct il_priv *il, struct ieee80211_conf *conf,
         int rate_idx;
         int i;
         u32 rate;
-        u8 use_green = il4965_rs_use_green(il, sta);
+        u8 use_green;
         u8 active_tbl = 0;
         u8 valid_tx_ant;
         struct il_station_priv *sta_priv;
@@ -2160,6 +2160,7 @@ il4965_rs_initialize_lq(struct il_priv *il, struct ieee80211_conf *conf,
         if (!sta || !lq_sta)
                 return;
 
+        use_green = il4965_rs_use_green(il, sta);
         sta_priv = (void *)sta->drv_priv;
 
         i = lq_sta->last_txrate_idx;
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 025d8b0eeafe..65becfe57a7d 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -1122,7 +1122,7 @@ il_set_power(struct il_priv *il, struct il_powertable_cmd *cmd)
                                sizeof(struct il_powertable_cmd), cmd);
 }
 
-int
+static int
 il_power_set_mode(struct il_priv *il, struct il_powertable_cmd *cmd, bool force)
 {
         int ret;
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index ba319cba3f1e..56c2040a955b 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -6,7 +6,6 @@ config IWLWIFI
         select LEDS_CLASS
         select LEDS_TRIGGERS
         select MAC80211_LEDS
-        select IWLDVM
         ---help---
           Select to build the driver supporting the:
 
@@ -45,6 +44,7 @@ config IWLWIFI
 config IWLDVM
         tristate "Intel Wireless WiFi DVM Firmware support"
         depends on IWLWIFI
+        default IWLWIFI
         help
           This is the driver supporting the DVM firmware which is
           currently the only firmware available for existing devices.
@@ -58,6 +58,15 @@ config IWLMVM
 
           Say yes if you have such a device.
 
+# don't call it _MODULE -- will confuse Kconfig/fixdep/...
+config IWLWIFI_OPMODE_MODULAR
+        bool
+        default y if IWLDVM=m
+        default y if IWLMVM=m
+
+comment "WARNING: iwlwifi is useless without IWLDVM or IWLMVM"
+        depends on IWLWIFI && IWLDVM=n && IWLMVM=n
+
 menu "Debugging Options"
         depends on IWLWIFI
 
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 6c7800044a04..3b5613ea458b 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -7,8 +7,7 @@ iwlwifi-objs		+= iwl-notif-wait.o
 iwlwifi-objs            += iwl-eeprom-read.o iwl-eeprom-parse.o
 iwlwifi-objs            += iwl-phy-db.o iwl-nvm-parse.o
 iwlwifi-objs            += pcie/drv.o pcie/rx.o pcie/tx.o pcie/trans.o
-iwlwifi-objs            += pcie/1000.o pcie/2000.o pcie/5000.o pcie/6000.o
-iwlwifi-objs            += pcie/7000.o
+iwlwifi-objs            += iwl-1000.o iwl-2000.o iwl-5000.o iwl-6000.o iwl-7000.o
 
 iwlwifi-$(CONFIG_IWLWIFI_DEVICE_TRACING) += iwl-devtrace.o
 iwlwifi-$(CONFIG_IWLWIFI_DEVICE_TESTMODE) += iwl-test.o
diff --git a/drivers/net/wireless/iwlwifi/dvm/agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index 41ec27cb6efe..e575b9b0cda8 100644
--- a/drivers/net/wireless/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -73,6 +73,8 @@
 /* AUX (TX during scan dwell) queue */
 #define IWL_AUX_QUEUE           10
 
+#define IWL_INVALID_STATION     255
+
 /* device operations */
 extern struct iwl_lib_ops iwl1000_lib;
 extern struct iwl_lib_ops iwl2000_lib;
@@ -176,7 +178,7 @@ int iwlagn_hw_valid_rtc_data_addr(u32 addr);
 /* lib */
 int iwlagn_send_tx_power(struct iwl_priv *priv);
 void iwlagn_temperature(struct iwl_priv *priv);
-int iwlagn_txfifo_flush(struct iwl_priv *priv);
+int iwlagn_txfifo_flush(struct iwl_priv *priv, u32 scd_q_msk);
 void iwlagn_dev_txfifo_flush(struct iwl_priv *priv);
 int iwlagn_send_beacon_cmd(struct iwl_priv *priv);
 int iwl_send_statistics_request(struct iwl_priv *priv,
@@ -210,6 +212,8 @@ int iwlagn_tx_agg_oper(struct iwl_priv *priv, struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta, u16 tid, u8 buf_size);
 int iwlagn_tx_agg_stop(struct iwl_priv *priv, struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta, u16 tid);
+int iwlagn_tx_agg_flush(struct iwl_priv *priv, struct ieee80211_vif *vif,
+                        struct ieee80211_sta *sta, u16 tid);
 int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
                                    struct iwl_rx_cmd_buffer *rxb,
                                    struct iwl_device_cmd *cmd);
diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.c b/drivers/net/wireless/iwlwifi/dvm/calib.c
index 6468de8634b0..d6c4cf2ad7c5 100644
--- a/drivers/net/wireless/iwlwifi/dvm/calib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.h b/drivers/net/wireless/iwlwifi/dvm/calib.h
index 65e920cab2b7..cfddde194940 100644
--- a/drivers/net/wireless/iwlwifi/dvm/calib.h
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/dvm/commands.h b/drivers/net/wireless/iwlwifi/dvm/commands.h
index 84e2c0fcfef6..95ca026ecc9d 100644
--- a/drivers/net/wireless/iwlwifi/dvm/commands.h
+++ b/drivers/net/wireless/iwlwifi/dvm/commands.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -1526,6 +1526,7 @@ struct iwl_compressed_ba_resp {
         __le16 scd_ssn;
         u8 txed;        /* number of frames sent */
         u8 txed_2_done; /* number of frames acked */
+        __le16 reserved1;
 } __packed;
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index 20806cae11b7..7b8178be119f 100644
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -19,7 +19,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -2324,6 +2324,28 @@ static ssize_t iwl_dbgfs_calib_disabled_write(struct file *file,
         return count;
 }
 
+static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        bool restart_fw = iwlwifi_mod_params.restart_fw;
+        int ret;
+
+        iwlwifi_mod_params.restart_fw = true;
+
+        mutex_lock(&priv->mutex);
+
+        /* take the return value to make compiler happy - it will fail anyway */
+        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_ERROR, CMD_SYNC, 0, NULL);
+
+        mutex_unlock(&priv->mutex);
+
+        iwlwifi_mod_params.restart_fw = restart_fw;
+
+        return count;
+}
+
 DEBUGFS_READ_FILE_OPS(ucode_rx_stats);
 DEBUGFS_READ_FILE_OPS(ucode_tx_stats);
 DEBUGFS_READ_FILE_OPS(ucode_general_stats);
@@ -2343,6 +2365,7 @@ DEBUGFS_READ_FILE_OPS(bt_traffic);
 DEBUGFS_READ_WRITE_FILE_OPS(protection_mode);
 DEBUGFS_READ_FILE_OPS(reply_tx_error);
 DEBUGFS_WRITE_FILE_OPS(echo_test);
+DEBUGFS_WRITE_FILE_OPS(fw_restart);
 #ifdef CONFIG_IWLWIFI_DEBUG
 DEBUGFS_READ_WRITE_FILE_OPS(log_event);
 #endif
@@ -2400,6 +2423,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir)
         DEBUGFS_ADD_FILE(rxon_flags, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(rxon_filter_flags, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(echo_test, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(fw_restart, dir_debug, S_IWUSR);
 #ifdef CONFIG_IWLWIFI_DEBUG
         DEBUGFS_ADD_FILE(log_event, dir_debug, S_IWUSR | S_IRUSR);
 #endif
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index 86ea5f4c3939..54f553380aa8 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -19,7 +19,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -136,7 +136,7 @@ int iwlagn_manage_ibss_station(struct iwl_priv *priv,
  *  1. acquire mutex before calling
  *  2. make sure rf is on and not in exit state
  */
-int iwlagn_txfifo_flush(struct iwl_priv *priv)
+int iwlagn_txfifo_flush(struct iwl_priv *priv, u32 scd_q_msk)
 {
         struct iwl_txfifo_flush_cmd flush_cmd;
         struct iwl_host_cmd cmd = {
@@ -162,6 +162,9 @@ int iwlagn_txfifo_flush(struct iwl_priv *priv)
         if (priv->nvm_data->sku_cap_11n_enable)
                 flush_cmd.queue_control |= IWL_AGG_TX_QUEUE_MSK;
 
+        if (scd_q_msk)
+                flush_cmd.queue_control = cpu_to_le32(scd_q_msk);
+
         IWL_DEBUG_INFO(priv, "queue control: 0x%x\n",
                        flush_cmd.queue_control);
         flush_cmd.flush_control = cpu_to_le16(IWL_DROP_ALL);
@@ -173,7 +176,7 @@ void iwlagn_dev_txfifo_flush(struct iwl_priv *priv)
 {
         mutex_lock(&priv->mutex);
         ieee80211_stop_queues(priv->hw);
-        if (iwlagn_txfifo_flush(priv)) {
+        if (iwlagn_txfifo_flush(priv, 0)) {
                 IWL_ERR(priv, "flush request fail\n");
                 goto done;
         }
@@ -1084,7 +1087,14 @@ int iwlagn_suspend(struct iwl_priv *priv, struct cfg80211_wowlan *wowlan)
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         struct iwlagn_wowlan_kek_kck_material_cmd kek_kck_cmd;
         struct iwlagn_wowlan_tkip_params_cmd tkip_cmd = {};
-        struct iwlagn_d3_config_cmd d3_cfg_cmd = {};
+        struct iwlagn_d3_config_cmd d3_cfg_cmd = {
+                /*
+                 * Program the minimum sleep time to 10 seconds, as many
+                 * platforms have issues processing a wakeup signal while
+                 * still being in the process of suspending.
+                 */
+                .min_sleep_time = cpu_to_le32(10 * 1000 * 1000),
+        };
         struct wowlan_key_data key_data = {
                 .ctx = ctx,
                 .bssid = ctx->active.bssid_addr,
@@ -1262,6 +1272,15 @@ int iwl_dvm_send_cmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         }
 
         /*
+         * This can happen upon FW ASSERT: we clear the STATUS_FW_ERROR flag
+         * in iwl_down but cancel the workers only later.
+         */
+        if (!priv->ucode_loaded) {
+                IWL_ERR(priv, "Fw not loaded - dropping CMD: %x\n", cmd->id);
+                return -EIO;
+        }
+
+        /*
          * Synchronous commands from this op-mode must hold
          * the mutex, this ensures we don't try to send two
          * (or more) synchronous commands at a time.
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 2dc101fe0d24..cab23af0be9e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -777,9 +777,12 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
                 IWL_DEBUG_HT(priv, "start Tx\n");
                 ret = iwlagn_tx_agg_start(priv, vif, sta, tid, ssn);
                 break;
-        case IEEE80211_AMPDU_TX_STOP_CONT:
         case IEEE80211_AMPDU_TX_STOP_FLUSH:
         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+                IWL_DEBUG_HT(priv, "Flush Tx\n");
+                ret = iwlagn_tx_agg_flush(priv, vif, sta, tid);
+                break;
+        case IEEE80211_AMPDU_TX_STOP_CONT:
                 IWL_DEBUG_HT(priv, "stop Tx\n");
                 ret = iwlagn_tx_agg_stop(priv, vif, sta, tid);
                 if ((ret == 0) && (priv->agg_tids_count > 0)) {
@@ -1132,7 +1135,7 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
          */
         if (drop) {
                 IWL_DEBUG_MAC80211(priv, "send flush command\n");
-                if (iwlagn_txfifo_flush(priv)) {
+                if (iwlagn_txfifo_flush(priv, 0)) {
                         IWL_ERR(priv, "flush request fail\n");
                         goto done;
                 }
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index acbb50b5f1e8..707446fa00bd 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1420,6 +1420,14 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
+        if (changes & BSS_CHANGED_IDLE && bss_conf->idle) {
+                /*
+                 * If we go idle, then clearly no "passive-no-rx"
+                 * workaround is needed any more, this is a reset.
+                 */
+                iwlagn_lift_passive_no_rx(priv);
+        }
+
         if (unlikely(!iwl_is_ready(priv))) {
                 IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                 mutex_unlock(&priv->mutex);
@@ -1451,16 +1459,6 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
                         priv->timestamp = bss_conf->sync_tsf;
                         ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 } else {
-                        /*
-                         * If we disassociate while there are pending
-                         * frames, just wake up the queues and let the
-                         * frames "escape" ... This shouldn't really
-                         * be happening to start with, but we should
-                         * not get stuck in this case either since it
-                         * can happen if userspace gets confused.
-                         */
-                        iwlagn_lift_passive_no_rx(priv);
-
                         ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
 
                         if (ctx->ctxid == IWL_RXON_CTX_BSS)
diff --git a/drivers/net/wireless/iwlwifi/dvm/scan.c b/drivers/net/wireless/iwlwifi/dvm/scan.c
index 3a4aa5239c45..d69b55866714 100644
--- a/drivers/net/wireless/iwlwifi/dvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/dvm/scan.c
@@ -19,7 +19,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index 94ef33838bc6..b775769f8322 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -151,7 +151,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
                        sta_id, sta->sta.addr, flags & CMD_ASYNC ?  "a" : "");
 
         if (!(flags & CMD_ASYNC)) {
-                cmd.flags |= CMD_WANT_SKB | CMD_WANT_HCMD;
+                cmd.flags |= CMD_WANT_SKB;
                 might_sleep();
         }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/testmode.c b/drivers/net/wireless/iwlwifi/dvm/testmode.c
index dc6f965a123a..b89b9d9b9969 100644
--- a/drivers/net/wireless/iwlwifi/dvm/testmode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/testmode.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index d499a0366fa6..a900aaf47790 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -19,7 +19,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -674,6 +674,51 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
         return ret;
 }
 
+int iwlagn_tx_agg_flush(struct iwl_priv *priv, struct ieee80211_vif *vif,
+                        struct ieee80211_sta *sta, u16 tid)
+{
+        struct iwl_tid_data *tid_data;
+        enum iwl_agg_state agg_state;
+        int sta_id, txq_id;
+        sta_id = iwl_sta_id(sta);
+
+        /*
+         * First set the agg state to OFF to avoid calling
+         * ieee80211_stop_tx_ba_cb in iwlagn_check_ratid_empty.
+         */
+        spin_lock_bh(&priv->sta_lock);
+
+        tid_data = &priv->tid_data[sta_id][tid];
+        txq_id = tid_data->agg.txq_id;
+        agg_state = tid_data->agg.state;
+        IWL_DEBUG_TX_QUEUES(priv, "Flush AGG: sta %d tid %d q %d state %d\n",
+                            sta_id, tid, txq_id, tid_data->agg.state);
+
+        tid_data->agg.state = IWL_AGG_OFF;
+
+        spin_unlock_bh(&priv->sta_lock);
+
+        if (iwlagn_txfifo_flush(priv, BIT(txq_id)))
+                IWL_ERR(priv, "Couldn't flush the AGG queue\n");
+
+        if (test_bit(txq_id, priv->agg_q_alloc)) {
+                /*
+                 * If the transport didn't know that we wanted to start
+                 * agreggation, don't tell it that we want to stop them.
+                 * This can happen when we don't get the addBA response on
+                 * time, or we hadn't time to drain the AC queues.
+                 */
+                if (agg_state == IWL_AGG_ON)
+                        iwl_trans_txq_disable(priv->trans, txq_id);
+                else
+                        IWL_DEBUG_TX_QUEUES(priv, "Don't disable tx agg: %d\n",
+                                            agg_state);
+                iwlagn_dealloc_agg_txq(priv, txq_id);
+        }
+
+        return 0;
+}
+
 int iwlagn_tx_agg_oper(struct iwl_priv *priv, struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta, u16 tid, u8 buf_size)
 {
@@ -1193,7 +1238,7 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         memset(&info->status, 0, sizeof(info->status));
 
                         if (status == TX_STATUS_FAIL_PASSIVE_NO_RX &&
-                            iwl_is_associated_ctx(ctx) && ctx->vif &&
+                            ctx->vif &&
                             ctx->vif->type == NL80211_IFTYPE_STATION) {
                                 /* block and stop all queues */
                                 priv->passive_no_rx = true;
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index 736fe9bb140e..0a1cdc5e856b 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -19,7 +19,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -367,6 +367,8 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
                 return -EIO;
         }
 
+        priv->ucode_loaded = true;
+
         if (ucode_type != IWL_UCODE_WOWLAN) {
                 /* delay a bit to give rfkill time to run */
                 msleep(5);
@@ -380,8 +382,6 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
                 return ret;
         }
 
-        priv->ucode_loaded = true;
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index ff3389757281..c080ae3070b2 100644
--- a/drivers/net/wireless/iwlwifi/pcie/1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -29,7 +29,6 @@
 #include "iwl-config.h"
 #include "iwl-csr.h"
 #include "iwl-agn-hw.h"
-#include "cfg.h"
 
 /* Highest firmware API version supported */
 #define IWL1000_UCODE_API_MAX 5
diff --git a/drivers/net/wireless/iwlwifi/pcie/2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index e7de33128b16..a6ddd2f9fba0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -28,7 +28,6 @@
 #include <linux/stringify.h>
 #include "iwl-config.h"
 #include "iwl-agn-hw.h"
-#include "cfg.h"
 #include "dvm/commands.h" /* needed for BT for now */
 
 /* Highest firmware API version supported */
diff --git a/drivers/net/wireless/iwlwifi/pcie/5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 5096f7c96ab6..403f3f224bf6 100644
--- a/drivers/net/wireless/iwlwifi/pcie/5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -29,7 +29,6 @@
 #include "iwl-config.h"
 #include "iwl-agn-hw.h"
 #include "iwl-csr.h"
-#include "cfg.h"
 
 /* Highest firmware API version supported */
 #define IWL5000_UCODE_API_MAX 5
diff --git a/drivers/net/wireless/iwlwifi/pcie/6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 801ff49796dd..b5ab8d1bcac0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -28,7 +28,6 @@
 #include <linux/stringify.h>
 #include "iwl-config.h"
 #include "iwl-agn-hw.h"
-#include "cfg.h"
 #include "dvm/commands.h" /* needed for BT for now */
 
 /* Highest firmware API version supported */
diff --git a/drivers/net/wireless/iwlwifi/pcie/7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 6e35b2b72332..50263e87fe15 100644
--- a/drivers/net/wireless/iwlwifi/pcie/7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -1,34 +1,70 @@
 /******************************************************************************
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
  *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2 of the GNU General Public License as
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
  *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
  *
- * The full GNU General Public License is included in this distribution in the
- * file called LICENSE.
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
  *****************************************************************************/
 
 #include <linux/module.h>
 #include <linux/stringify.h>
 #include "iwl-config.h"
 #include "iwl-agn-hw.h"
-#include "cfg.h"
 
 /* Highest firmware API version supported */
 #define IWL7260_UCODE_API_MAX   6
@@ -70,7 +106,6 @@ static const struct iwl_base_params iwl7000_base_params = {
 };
 
 static const struct iwl_ht_params iwl7000_ht_params = {
-        .ht_greenfield_support = true,
         .use_rts_for_aggregation = true, /* use rts/cts protection */
         .ht40_bands = BIT(IEEE80211_BAND_2GHZ) | BIT(IEEE80211_BAND_5GHZ),
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
index e9975c54c276..6d73f943cefa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 743b48343358..c38aa8f77554 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -275,4 +275,51 @@ struct iwl_cfg {
         const bool temp_offset_v2;
 };
 
+/*
+ * This list declares the config structures for all devices.
+ */
+extern const struct iwl_cfg iwl5300_agn_cfg;
+extern const struct iwl_cfg iwl5100_agn_cfg;
+extern const struct iwl_cfg iwl5350_agn_cfg;
+extern const struct iwl_cfg iwl5100_bgn_cfg;
+extern const struct iwl_cfg iwl5100_abg_cfg;
+extern const struct iwl_cfg iwl5150_agn_cfg;
+extern const struct iwl_cfg iwl5150_abg_cfg;
+extern const struct iwl_cfg iwl6005_2agn_cfg;
+extern const struct iwl_cfg iwl6005_2abg_cfg;
+extern const struct iwl_cfg iwl6005_2bg_cfg;
+extern const struct iwl_cfg iwl6005_2agn_sff_cfg;
+extern const struct iwl_cfg iwl6005_2agn_d_cfg;
+extern const struct iwl_cfg iwl6005_2agn_mow1_cfg;
+extern const struct iwl_cfg iwl6005_2agn_mow2_cfg;
+extern const struct iwl_cfg iwl1030_bgn_cfg;
+extern const struct iwl_cfg iwl1030_bg_cfg;
+extern const struct iwl_cfg iwl6030_2agn_cfg;
+extern const struct iwl_cfg iwl6030_2abg_cfg;
+extern const struct iwl_cfg iwl6030_2bgn_cfg;
+extern const struct iwl_cfg iwl6030_2bg_cfg;
+extern const struct iwl_cfg iwl6000i_2agn_cfg;
+extern const struct iwl_cfg iwl6000i_2abg_cfg;
+extern const struct iwl_cfg iwl6000i_2bg_cfg;
+extern const struct iwl_cfg iwl6000_3agn_cfg;
+extern const struct iwl_cfg iwl6050_2agn_cfg;
+extern const struct iwl_cfg iwl6050_2abg_cfg;
+extern const struct iwl_cfg iwl6150_bgn_cfg;
+extern const struct iwl_cfg iwl6150_bg_cfg;
+extern const struct iwl_cfg iwl1000_bgn_cfg;
+extern const struct iwl_cfg iwl1000_bg_cfg;
+extern const struct iwl_cfg iwl100_bgn_cfg;
+extern const struct iwl_cfg iwl100_bg_cfg;
+extern const struct iwl_cfg iwl130_bgn_cfg;
+extern const struct iwl_cfg iwl130_bg_cfg;
+extern const struct iwl_cfg iwl2000_2bgn_cfg;
+extern const struct iwl_cfg iwl2000_2bgn_d_cfg;
+extern const struct iwl_cfg iwl2030_2bgn_cfg;
+extern const struct iwl_cfg iwl6035_2agn_cfg;
+extern const struct iwl_cfg iwl105_bgn_cfg;
+extern const struct iwl_cfg iwl105_bgn_d_cfg;
+extern const struct iwl_cfg iwl135_bgn_cfg;
+extern const struct iwl_cfg iwl7260_2ac_cfg;
+extern const struct iwl_cfg iwl3160_ac_cfg;
+
 #endif /* __IWL_CONFIG_H__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index df3463a38704..20e845d4da04 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.c b/drivers/net/wireless/iwlwifi/iwl-debug.c
index 87535a67de76..8a44f594528d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -66,6 +66,7 @@
 #include <linux/device.h>
 #include <linux/interrupt.h>
 #include <linux/export.h>
+#include "iwl-drv.h"
 #include "iwl-debug.h"
 #include "iwl-devtrace.h"
 
@@ -85,11 +86,11 @@ void __iwl_ ##fn(struct device *dev, const char *fmt, ...)	\
 }
 
 __iwl_fn(warn)
-EXPORT_SYMBOL_GPL(__iwl_warn);
+IWL_EXPORT_SYMBOL(__iwl_warn);
 __iwl_fn(info)
-EXPORT_SYMBOL_GPL(__iwl_info);
+IWL_EXPORT_SYMBOL(__iwl_info);
 __iwl_fn(crit)
-EXPORT_SYMBOL_GPL(__iwl_crit);
+IWL_EXPORT_SYMBOL(__iwl_crit);
 
 void __iwl_err(struct device *dev, bool rfkill_prefix, bool trace_only,
                 const char *fmt, ...)
@@ -110,7 +111,7 @@ void __iwl_err(struct device *dev, bool rfkill_prefix, bool trace_only,
         trace_iwlwifi_err(&vaf);
         va_end(args);
 }
-EXPORT_SYMBOL_GPL(__iwl_err);
+IWL_EXPORT_SYMBOL(__iwl_err);
 
 #if defined(CONFIG_IWLWIFI_DEBUG) || defined(CONFIG_IWLWIFI_DEVICE_TRACING)
 void __iwl_dbg(struct device *dev,
@@ -133,5 +134,5 @@ void __iwl_dbg(struct device *dev,
         trace_iwlwifi_dbg(level, in_interrupt(), function, &vaf);
         va_end(args);
 }
-EXPORT_SYMBOL_GPL(__iwl_dbg);
+IWL_EXPORT_SYMBOL(__iwl_dbg);
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 9a0f45ec9e01..4491c1c72cc7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -298,7 +298,7 @@ TRACE_EVENT(iwlwifi_dbg,
                                        MAX_MSG_LEN, vaf->fmt,
                                        *vaf->va) >= MAX_MSG_LEN);
         ),
-        TP_printk("%s", (char *)__get_dynamic_array(msg))
+        TP_printk("%s", __get_str(msg))
 );
 
 #undef TRACE_SYSTEM
@@ -349,25 +349,23 @@ TRACE_EVENT(iwlwifi_dev_rx_data,
 TRACE_EVENT(iwlwifi_dev_hcmd,
         TP_PROTO(const struct device *dev,
                  struct iwl_host_cmd *cmd, u16 total_size,
-                 const void *hdr, size_t hdr_len),
-        TP_ARGS(dev, cmd, total_size, hdr, hdr_len),
+                 struct iwl_cmd_header *hdr),
+        TP_ARGS(dev, cmd, total_size, hdr),
         TP_STRUCT__entry(
                 DEV_ENTRY
                 __dynamic_array(u8, hcmd, total_size)
                 __field(u32, flags)
         ),
         TP_fast_assign(
-                int i, offset = hdr_len;
+                int i, offset = sizeof(*hdr);
 
                 DEV_ASSIGN;
                 __entry->flags = cmd->flags;
-                memcpy(__get_dynamic_array(hcmd), hdr, hdr_len);
+                memcpy(__get_dynamic_array(hcmd), hdr, sizeof(*hdr));
 
-                for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+                for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
                         if (!cmd->len[i])
                                 continue;
-                        if (!(cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY))
-                                continue;
                         memcpy((u8 *)__get_dynamic_array(hcmd) + offset,
                                cmd->data[i], cmd->len[i]);
                         offset += cmd->len[i];
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 6f228bb2b844..39aad9893e0b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -912,8 +912,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
                 }
         }
 
-        IWL_INFO(drv, "loaded firmware version %s", drv->fw.fw_version);
-
         /*
          * In mvm uCode there is no difference between data and instructions
          * sections.
@@ -970,6 +968,9 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
         else
                 op = &iwlwifi_opmode_table[DVM_OP_MODE];
 
+        IWL_INFO(drv, "loaded firmware version %s op_mode %s\n",
+                 drv->fw.fw_version, op->name);
+
         /* add this device to the list of devices using this op_mode */
         list_add_tail(&drv->list, &op->drv);
 
@@ -997,8 +998,13 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
          * else from proceeding if the module fails to load
          * or hangs loading.
          */
-        if (load_module)
-                request_module("%s", op->name);
+        if (load_module) {
+                err = request_module("%s", op->name);
+                if (err)
+                        IWL_ERR(drv,
+                                "failed to load module %s (error %d), is dynamic loading enabled?\n",
+                                op->name, err);
+        }
         return;
 
  try_again:
@@ -1102,8 +1108,7 @@ void iwl_drv_stop(struct iwl_drv *drv)
 
 /* shared module parameters */
 struct iwl_mod_params iwlwifi_mod_params = {
-        .amsdu_size_8K = 1,
-        .restart_fw = 1,
+        .restart_fw = true,
         .plcp_check = true,
         .bt_coex_active = true,
         .power_level = IWL_POWER_INDEX_1,
@@ -1112,7 +1117,7 @@ struct iwl_mod_params iwlwifi_mod_params = {
         .wd_disable = true,
         /* the rest are 0 by default */
 };
-EXPORT_SYMBOL_GPL(iwlwifi_mod_params);
+IWL_EXPORT_SYMBOL(iwlwifi_mod_params);
 
 int iwl_opmode_register(const char *name, const struct iwl_op_mode_ops *ops)
 {
@@ -1136,7 +1141,7 @@ int iwl_opmode_register(const char *name, const struct iwl_op_mode_ops *ops)
         mutex_unlock(&iwlwifi_opmode_table_mtx);
         return -EIO;
 }
-EXPORT_SYMBOL_GPL(iwl_opmode_register);
+IWL_EXPORT_SYMBOL(iwl_opmode_register);
 
 void iwl_opmode_deregister(const char *name)
 {
@@ -1158,7 +1163,7 @@ void iwl_opmode_deregister(const char *name)
         }
         mutex_unlock(&iwlwifi_opmode_table_mtx);
 }
-EXPORT_SYMBOL_GPL(iwl_opmode_deregister);
+IWL_EXPORT_SYMBOL(iwl_opmode_deregister);
 
 static int __init iwl_drv_init(void)
 {
@@ -1207,9 +1212,9 @@ MODULE_PARM_DESC(11n_disable,
         "disable 11n functionality, bitmap: 1: full, 2: agg TX, 4: agg RX");
 module_param_named(amsdu_size_8K, iwlwifi_mod_params.amsdu_size_8K,
                    int, S_IRUGO);
-MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size");
-module_param_named(fw_restart, iwlwifi_mod_params.restart_fw, int, S_IRUGO);
-MODULE_PARM_DESC(fw_restart, "restart firmware in case of error");
+MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size (default 0)");
+module_param_named(fw_restart, iwlwifi_mod_params.restart_fw, bool, S_IRUGO);
+MODULE_PARM_DESC(fw_restart, "restart firmware in case of error (default true)");
 
 module_param_named(antenna_coupling, iwlwifi_mod_params.ant_coupling,
                    int, S_IRUGO);
@@ -1267,7 +1272,3 @@ module_param_named(auto_agg, iwlwifi_mod_params.auto_agg,
                 bool, S_IRUGO);
 MODULE_PARM_DESC(auto_agg,
                  "enable agg w/o check traffic load (default: enable)");
-
-module_param_named(5ghz_disable, iwlwifi_mod_params.disable_5ghz,
-                bool, S_IRUGO);
-MODULE_PARM_DESC(5ghz_disable, "disable 5GHz band (default: 0 [enabled])");
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.h b/drivers/net/wireless/iwlwifi/iwl-drv.h
index 594a5c71b272..7d1450916308 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.h
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -63,6 +63,8 @@
 #ifndef __iwl_drv_h__
 #define __iwl_drv_h__
 
+#include <linux/module.h>
+
 /* for all modules */
 #define DRV_NAME        "iwlwifi"
 #define IWLWIFI_VERSION "in-tree:"
@@ -123,4 +125,17 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans,
  */
 void iwl_drv_stop(struct iwl_drv *drv);
 
+/*
+ * exported symbol management
+ *
+ * The driver can be split into multiple modules, in which case some symbols
+ * must be exported for the sub-modules. However, if it's not split and
+ * everything is built-in, then we can avoid that.
+ */
+#ifdef CONFIG_IWLWIFI_OPMODE_MODULAR
+#define IWL_EXPORT_SYMBOL(sym)  EXPORT_SYMBOL_GPL(sym)
+#else
+#define IWL_EXPORT_SYMBOL(sym)
+#endif
+
 #endif /* __iwl_drv_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
index 034f2ff4f43d..600c9fdd7f71 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -62,6 +62,7 @@
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include "iwl-drv.h"
 #include "iwl-modparams.h"
 #include "iwl-eeprom-parse.h"
 
@@ -749,7 +750,7 @@ void iwl_init_ht_hw_capab(const struct iwl_cfg *cfg,
         }
 
         ht_info->ht_supported = true;
-        ht_info->cap = 0;
+        ht_info->cap = IEEE80211_HT_CAP_DSSSCCK40;
 
         if (iwlwifi_mod_params.amsdu_size_8K)
                 ht_info->cap |= IEEE80211_HT_CAP_MAX_AMSDU;
@@ -909,7 +910,7 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
         kfree(data);
         return NULL;
 }
-EXPORT_SYMBOL_GPL(iwl_parse_eeprom_data);
+IWL_EXPORT_SYMBOL(iwl_parse_eeprom_data);
 
 /* helper functions */
 int iwl_nvm_check_version(struct iwl_nvm_data *data,
@@ -928,4 +929,4 @@ int iwl_nvm_check_version(struct iwl_nvm_data *data,
                 data->calib_version,  trans->cfg->nvm_calib_ver);
         return -EINVAL;
 }
-EXPORT_SYMBOL_GPL(iwl_nvm_check_version);
+IWL_EXPORT_SYMBOL(iwl_nvm_check_version);
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
index 683fe6a8c58f..37f115390b19 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
index ef4806f27cf8..e5f2e362ab0b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -63,6 +63,7 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 
+#include "iwl-drv.h"
 #include "iwl-debug.h"
 #include "iwl-eeprom-read.h"
 #include "iwl-io.h"
@@ -460,4 +461,4 @@ int iwl_read_eeprom(struct iwl_trans *trans, u8 **eeprom, size_t *eeprom_size)
 
         return ret;
 }
-EXPORT_SYMBOL_GPL(iwl_read_eeprom);
+IWL_EXPORT_SYMBOL(iwl_read_eeprom);
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
index b2588c5cbf93..8e941f8bd7d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index f5592fb3b1ed..484d318245fb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index 90873eca35f7..8b6c6fd95ed0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index b545178e46e3..c4c446d41eb0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -73,12 +73,14 @@
  *      treats good CRC threshold as a boolean
  * @IWL_UCODE_TLV_FLAGS_MFP: This uCode image supports MFP (802.11w).
  * @IWL_UCODE_TLV_FLAGS_P2P: This uCode image supports P2P.
+ * @IWL_UCODE_TLV_FLAGS_DW_BC_TABLE: The SCD byte count table is in DWORDS
  */
 enum iwl_ucode_tlv_flag {
         IWL_UCODE_TLV_FLAGS_PAN         = BIT(0),
         IWL_UCODE_TLV_FLAGS_NEWSCAN     = BIT(1),
         IWL_UCODE_TLV_FLAGS_MFP         = BIT(2),
         IWL_UCODE_TLV_FLAGS_P2P         = BIT(3),
+        IWL_UCODE_TLV_FLAGS_DW_BC_TABLE = BIT(4),
 };
 
 /* The default calibrate table size if not specified by firmware file */
@@ -152,6 +154,19 @@ struct iwl_tlv_calib_ctrl {
         __le32 event_trigger;
 } __packed;
 
+enum iwl_fw_phy_cfg {
+        FW_PHY_CFG_RADIO_TYPE_POS = 0,
+        FW_PHY_CFG_RADIO_TYPE = 0x3 << FW_PHY_CFG_RADIO_TYPE_POS,
+        FW_PHY_CFG_RADIO_STEP_POS = 2,
+        FW_PHY_CFG_RADIO_STEP = 0x3 << FW_PHY_CFG_RADIO_STEP_POS,
+        FW_PHY_CFG_RADIO_DASH_POS = 4,
+        FW_PHY_CFG_RADIO_DASH = 0x3 << FW_PHY_CFG_RADIO_DASH_POS,
+        FW_PHY_CFG_TX_CHAIN_POS = 16,
+        FW_PHY_CFG_TX_CHAIN = 0xf << FW_PHY_CFG_TX_CHAIN_POS,
+        FW_PHY_CFG_RX_CHAIN_POS = 20,
+        FW_PHY_CFG_RX_CHAIN = 0xf << FW_PHY_CFG_RX_CHAIN_POS,
+};
+
 /**
  * struct iwl_fw - variables associated with the firmware
  *
@@ -188,4 +203,16 @@ struct iwl_fw {
         bool mvm_fw;
 };
 
+static inline u8 iwl_fw_valid_tx_ant(const struct iwl_fw *fw)
+{
+        return (fw->phy_config & FW_PHY_CFG_TX_CHAIN) >>
+                FW_PHY_CFG_TX_CHAIN_POS;
+}
+
+static inline u8 iwl_fw_valid_rx_ant(const struct iwl_fw *fw)
+{
+        return (fw->phy_config & FW_PHY_CFG_RX_CHAIN) >>
+                FW_PHY_CFG_RX_CHAIN_POS;
+}
+
 #endif  /* __iwl_fw_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index 276410d82de4..305c81f2c2b4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -29,6 +29,7 @@
 #include <linux/device.h>
 #include <linux/export.h>
 
+#include "iwl-drv.h"
 #include "iwl-io.h"
 #include "iwl-csr.h"
 #include "iwl-debug.h"
@@ -49,7 +50,7 @@ int iwl_poll_bit(struct iwl_trans *trans, u32 addr,
 
         return -ETIMEDOUT;
 }
-EXPORT_SYMBOL_GPL(iwl_poll_bit);
+IWL_EXPORT_SYMBOL(iwl_poll_bit);
 
 u32 iwl_read_direct32(struct iwl_trans *trans, u32 reg)
 {
@@ -62,7 +63,7 @@ u32 iwl_read_direct32(struct iwl_trans *trans, u32 reg)
 
         return value;
 }
-EXPORT_SYMBOL_GPL(iwl_read_direct32);
+IWL_EXPORT_SYMBOL(iwl_read_direct32);
 
 void iwl_write_direct32(struct iwl_trans *trans, u32 reg, u32 value)
 {
@@ -73,7 +74,7 @@ void iwl_write_direct32(struct iwl_trans *trans, u32 reg, u32 value)
                 iwl_trans_release_nic_access(trans, &flags);
         }
 }
-EXPORT_SYMBOL_GPL(iwl_write_direct32);
+IWL_EXPORT_SYMBOL(iwl_write_direct32);
 
 int iwl_poll_direct_bit(struct iwl_trans *trans, u32 addr, u32 mask,
                         int timeout)
@@ -89,7 +90,7 @@ int iwl_poll_direct_bit(struct iwl_trans *trans, u32 addr, u32 mask,
 
         return -ETIMEDOUT;
 }
-EXPORT_SYMBOL_GPL(iwl_poll_direct_bit);
+IWL_EXPORT_SYMBOL(iwl_poll_direct_bit);
 
 static inline u32 __iwl_read_prph(struct iwl_trans *trans, u32 ofs)
 {
@@ -115,7 +116,7 @@ u32 iwl_read_prph(struct iwl_trans *trans, u32 ofs)
         }
         return val;
 }
-EXPORT_SYMBOL_GPL(iwl_read_prph);
+IWL_EXPORT_SYMBOL(iwl_read_prph);
 
 void iwl_write_prph(struct iwl_trans *trans, u32 ofs, u32 val)
 {
@@ -126,7 +127,7 @@ void iwl_write_prph(struct iwl_trans *trans, u32 ofs, u32 val)
                 iwl_trans_release_nic_access(trans, &flags);
         }
 }
-EXPORT_SYMBOL_GPL(iwl_write_prph);
+IWL_EXPORT_SYMBOL(iwl_write_prph);
 
 void iwl_set_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask)
 {
@@ -138,7 +139,7 @@ void iwl_set_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask)
                 iwl_trans_release_nic_access(trans, &flags);
         }
 }
-EXPORT_SYMBOL_GPL(iwl_set_bits_prph);
+IWL_EXPORT_SYMBOL(iwl_set_bits_prph);
 
 void iwl_set_bits_mask_prph(struct iwl_trans *trans, u32 ofs,
                             u32 bits, u32 mask)
@@ -151,7 +152,7 @@ void iwl_set_bits_mask_prph(struct iwl_trans *trans, u32 ofs,
                 iwl_trans_release_nic_access(trans, &flags);
         }
 }
-EXPORT_SYMBOL_GPL(iwl_set_bits_mask_prph);
+IWL_EXPORT_SYMBOL(iwl_set_bits_mask_prph);
 
 void iwl_clear_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask)
 {
@@ -164,4 +165,4 @@ void iwl_clear_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask)
                 iwl_trans_release_nic_access(trans, &flags);
         }
 }
-EXPORT_SYMBOL_GPL(iwl_clear_bits_prph);
+IWL_EXPORT_SYMBOL(iwl_clear_bits_prph);
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index e5e3a79eae2f..d6f6c37c09fd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -91,7 +91,7 @@ enum iwl_power_level {
  * @sw_crypto: using hardware encryption, default = 0
  * @disable_11n: disable 11n capabilities, default = 0,
  *      use IWL_DISABLE_HT_* constants
- * @amsdu_size_8K: enable 8K amsdu size, default = 1
+ * @amsdu_size_8K: enable 8K amsdu size, default = 0
  * @restart_fw: restart firmware, default = 1
  * @plcp_check: enable plcp health check, default = true
  * @wd_disable: enable stuck queue check, default = 0
@@ -103,13 +103,12 @@ enum iwl_power_level {
  * @ant_coupling: antenna coupling in dB, default = 0
  * @bt_ch_announce: BT channel inhibition, default = enable
  * @auto_agg: enable agg. without check, default = true
- * @disable_5ghz: disable 5GHz capability, default = false
  */
 struct iwl_mod_params {
         int sw_crypto;
         unsigned int disable_11n;
         int amsdu_size_8K;
-        int restart_fw;
+        bool restart_fw;
         bool plcp_check;
         int  wd_disable;
         bool bt_coex_active;
@@ -120,7 +119,6 @@ struct iwl_mod_params {
         int ant_coupling;
         bool bt_ch_announce;
         bool auto_agg;
-        bool disable_5ghz;
 };
 
 #endif /* #__iwl_modparams_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-notif-wait.c b/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
index c3affbc62cdf..940b8a9d5285 100644
--- a/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
+++ b/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -63,6 +63,7 @@
 #include <linux/sched.h>
 #include <linux/export.h>
 
+#include "iwl-drv.h"
 #include "iwl-notif-wait.h"
 
 
@@ -72,7 +73,7 @@ void iwl_notification_wait_init(struct iwl_notif_wait_data *notif_wait)
         INIT_LIST_HEAD(&notif_wait->notif_waits);
         init_waitqueue_head(&notif_wait->notif_waitq);
 }
-EXPORT_SYMBOL_GPL(iwl_notification_wait_init);
+IWL_EXPORT_SYMBOL(iwl_notification_wait_init);
 
 void iwl_notification_wait_notify(struct iwl_notif_wait_data *notif_wait,
                                   struct iwl_rx_packet *pkt)
@@ -117,7 +118,7 @@ void iwl_notification_wait_notify(struct iwl_notif_wait_data *notif_wait,
         if (triggered)
                 wake_up_all(&notif_wait->notif_waitq);
 }
-EXPORT_SYMBOL_GPL(iwl_notification_wait_notify);
+IWL_EXPORT_SYMBOL(iwl_notification_wait_notify);
 
 void iwl_abort_notification_waits(struct iwl_notif_wait_data *notif_wait)
 {
@@ -130,7 +131,7 @@ void iwl_abort_notification_waits(struct iwl_notif_wait_data *notif_wait)
 
         wake_up_all(&notif_wait->notif_waitq);
 }
-EXPORT_SYMBOL_GPL(iwl_abort_notification_waits);
+IWL_EXPORT_SYMBOL(iwl_abort_notification_waits);
 
 void
 iwl_init_notification_wait(struct iwl_notif_wait_data *notif_wait,
@@ -154,7 +155,7 @@ iwl_init_notification_wait(struct iwl_notif_wait_data *notif_wait,
         list_add(&wait_entry->list, &notif_wait->notif_waits);
         spin_unlock_bh(&notif_wait->notif_wait_lock);
 }
-EXPORT_SYMBOL_GPL(iwl_init_notification_wait);
+IWL_EXPORT_SYMBOL(iwl_init_notification_wait);
 
 int iwl_wait_notification(struct iwl_notif_wait_data *notif_wait,
                           struct iwl_notification_wait *wait_entry,
@@ -178,7 +179,7 @@ int iwl_wait_notification(struct iwl_notif_wait_data *notif_wait,
                 return -ETIMEDOUT;
         return 0;
 }
-EXPORT_SYMBOL_GPL(iwl_wait_notification);
+IWL_EXPORT_SYMBOL(iwl_wait_notification);
 
 void iwl_remove_notification(struct iwl_notif_wait_data *notif_wait,
                              struct iwl_notification_wait *wait_entry)
@@ -187,4 +188,4 @@ void iwl_remove_notification(struct iwl_notif_wait_data *notif_wait,
         list_del(&wait_entry->list);
         spin_unlock_bh(&notif_wait->notif_wait_lock);
 }
-EXPORT_SYMBOL_GPL(iwl_remove_notification);
+IWL_EXPORT_SYMBOL(iwl_remove_notification);
diff --git a/drivers/net/wireless/iwlwifi/iwl-notif-wait.h b/drivers/net/wireless/iwlwifi/iwl-notif-wait.h
index c2ce764463a3..2e2f1c8c99f9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-notif-wait.h
+++ b/drivers/net/wireless/iwlwifi/iwl-notif-wait.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index a70213bdb83c..6199a0a597a6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -62,6 +62,7 @@
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include "iwl-drv.h"
 #include "iwl-modparams.h"
 #include "iwl-nvm-parse.h"
 
@@ -149,6 +150,8 @@ static struct ieee80211_rate iwl_cfg80211_rates[] = {
  * @NVM_CHANNEL_DFS: dynamic freq selection candidate
  * @NVM_CHANNEL_WIDE: 20 MHz channel okay (?)
  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay (?)
+ * @NVM_CHANNEL_80MHZ: 80 MHz channel okay (?)
+ * @NVM_CHANNEL_160MHZ: 160 MHz channel okay (?)
  */
 enum iwl_nvm_channel_flags {
         NVM_CHANNEL_VALID = BIT(0),
@@ -158,6 +161,8 @@ enum iwl_nvm_channel_flags {
         NVM_CHANNEL_DFS = BIT(7),
         NVM_CHANNEL_WIDE = BIT(8),
         NVM_CHANNEL_40MHZ = BIT(9),
+        NVM_CHANNEL_80MHZ = BIT(10),
+        NVM_CHANNEL_160MHZ = BIT(11),
 };
 
 #define CHECK_AND_PRINT_I(x)    \
@@ -210,6 +215,10 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
                         else
                                 channel->flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
                 }
+                if (!(ch_flags & NVM_CHANNEL_80MHZ))
+                        channel->flags |= IEEE80211_CHAN_NO_80MHZ;
+                if (!(ch_flags & NVM_CHANNEL_160MHZ))
+                        channel->flags |= IEEE80211_CHAN_NO_160MHZ;
 
                 if (!(ch_flags & NVM_CHANNEL_IBSS))
                         channel->flags |= IEEE80211_CHAN_NO_IBSS;
@@ -245,6 +254,43 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
         return n_channels;
 }
 
+static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
+                                  struct iwl_nvm_data *data,
+                                  struct ieee80211_sta_vht_cap *vht_cap)
+{
+        /* For now, assume new devices with NVM are VHT capable */
+
+        vht_cap->vht_supported = true;
+
+        vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
+                       IEEE80211_VHT_CAP_RXSTBC_1 |
+                       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+                       7 << IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
+
+        if (iwlwifi_mod_params.amsdu_size_8K)
+                vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
+
+        vht_cap->vht_mcs.rx_mcs_map =
+                cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
+                            IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
+                            IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
+                            IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
+                            IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
+                            IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
+                            IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
+                            IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
+
+        if (data->valid_rx_ant == 1 || cfg->rx_with_siso_diversity) {
+                vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN |
+                                IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
+                /* this works because NOT_SUPPORTED == 3 */
+                vht_cap->vht_mcs.rx_mcs_map |=
+                        cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
+        }
+
+        vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
+}
+
 static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
                             struct iwl_nvm_data *data, const __le16 *nvm_sw)
 {
@@ -268,6 +314,7 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
         n_used += iwl_init_sband_channels(data, sband, n_channels,
                                           IEEE80211_BAND_5GHZ);
         iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_5GHZ);
+        iwl_init_vht_hw_capab(cfg, data, &sband->vht_cap);
 
         if (n_channels != n_used)
                 IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
@@ -343,4 +390,4 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
 
         return data;
 }
-EXPORT_SYMBOL_GPL(iwl_parse_nvm_data);
+IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
index b2692bd287fa..e57fb989661e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-op-mode.h b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
index 4a680019e117..98c7aa7346da 100644
--- a/drivers/net/wireless/iwlwifi/iwl-op-mode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.c b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
index 14fc8d39fc28..25745daa0d5d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.c
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -65,6 +65,7 @@
 #include <linux/string.h>
 #include <linux/export.h>
 
+#include "iwl-drv.h"
 #include "iwl-phy-db.h"
 #include "iwl-debug.h"
 #include "iwl-op-mode.h"
@@ -136,12 +137,6 @@ struct iwl_calib_res_notif_phy_db {
         u8 data[];
 } __packed;
 
-#define IWL_PHY_DB_STATIC_PIC cpu_to_le32(0x21436587)
-static inline void iwl_phy_db_test_pic(__le32 pic)
-{
-        WARN_ON(IWL_PHY_DB_STATIC_PIC != pic);
-}
-
 struct iwl_phy_db *iwl_phy_db_init(struct iwl_trans *trans)
 {
         struct iwl_phy_db *phy_db = kzalloc(sizeof(struct iwl_phy_db),
@@ -155,7 +150,7 @@ struct iwl_phy_db *iwl_phy_db_init(struct iwl_trans *trans)
         /* TODO: add default values of the phy db. */
         return phy_db;
 }
-EXPORT_SYMBOL(iwl_phy_db_init);
+IWL_EXPORT_SYMBOL(iwl_phy_db_init);
 
 /*
  * get phy db section: returns a pointer to a phy db section specified by
@@ -221,7 +216,7 @@ void iwl_phy_db_free(struct iwl_phy_db *phy_db)
 
         kfree(phy_db);
 }
-EXPORT_SYMBOL(iwl_phy_db_free);
+IWL_EXPORT_SYMBOL(iwl_phy_db_free);
 
 int iwl_phy_db_set_section(struct iwl_phy_db *phy_db, struct iwl_rx_packet *pkt,
                            gfp_t alloc_ctx)
@@ -260,18 +255,13 @@ int iwl_phy_db_set_section(struct iwl_phy_db *phy_db, struct iwl_rx_packet *pkt,
                         (size - CHANNEL_NUM_SIZE) / phy_db->channel_num;
         }
 
-        /* Test PIC */
-        if (type != IWL_PHY_DB_CFG)
-                iwl_phy_db_test_pic(*(((__le32 *)phy_db_notif->data) +
-                                      (size / sizeof(__le32)) - 1));
-
         IWL_DEBUG_INFO(phy_db->trans,
                        "%s(%d): [PHYDB]SET: Type %d , Size: %d\n",
                        __func__, __LINE__, type, size);
 
         return 0;
 }
-EXPORT_SYMBOL(iwl_phy_db_set_section);
+IWL_EXPORT_SYMBOL(iwl_phy_db_set_section);
 
 static int is_valid_channel(u16 ch_id)
 {
@@ -372,11 +362,6 @@ int iwl_phy_db_get_section_data(struct iwl_phy_db *phy_db,
                 *size = entry->size;
         }
 
-        /* Test PIC */
-        if (type != IWL_PHY_DB_CFG)
-                iwl_phy_db_test_pic(*(((__le32 *)*data) +
-                                      (*size / sizeof(__le32)) - 1));
-
         IWL_DEBUG_INFO(phy_db->trans,
                        "%s(%d): [PHYDB] GET: Type %d , Size: %d\n",
                        __func__, __LINE__, type, *size);
@@ -511,4 +496,4 @@ int iwl_send_phy_db_data(struct iwl_phy_db *phy_db)
                        "Finished sending phy db non channel data\n");
         return 0;
 }
-EXPORT_SYMBOL(iwl_send_phy_db_data);
+IWL_EXPORT_SYMBOL(iwl_send_phy_db_data);
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.h b/drivers/net/wireless/iwlwifi/iwl-phy-db.h
index d0e43d96ab38..ce983af79644 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.h
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index f76e9cad7757..386f2a7c87cb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-test.c b/drivers/net/wireless/iwlwifi/iwl-test.c
index ce0c67b425ee..5cfd55b86ed3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-test.c
+++ b/drivers/net/wireless/iwlwifi/iwl-test.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -64,6 +64,7 @@
 #include <linux/export.h>
 #include <net/netlink.h>
 
+#include "iwl-drv.h"
 #include "iwl-io.h"
 #include "iwl-fh.h"
 #include "iwl-prph.h"
@@ -271,7 +272,7 @@ static int iwl_test_fw_cmd(struct iwl_test *tst, struct nlattr **tb)
 
         reply_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
         skb = iwl_test_alloc_reply(tst, reply_len + 20);
-        reply_buf = kmalloc(reply_len, GFP_KERNEL);
+        reply_buf = kmemdup(&pkt->hdr, reply_len, GFP_KERNEL);
         if (!skb || !reply_buf) {
                 kfree_skb(skb);
                 kfree(reply_buf);
@@ -279,7 +280,6 @@ static int iwl_test_fw_cmd(struct iwl_test *tst, struct nlattr **tb)
         }
 
         /* The reply is in a page, that we cannot send to user space. */
-        memcpy(reply_buf, &(pkt->hdr), reply_len);
         iwl_free_resp(&cmd);
 
         if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
@@ -653,7 +653,7 @@ int iwl_test_parse(struct iwl_test *tst, struct nlattr **tb,
         }
         return 0;
 }
-EXPORT_SYMBOL_GPL(iwl_test_parse);
+IWL_EXPORT_SYMBOL(iwl_test_parse);
 
 /*
  * Handle test commands.
@@ -715,7 +715,7 @@ int iwl_test_handle_cmd(struct iwl_test *tst, struct nlattr **tb)
         }
         return result;
 }
-EXPORT_SYMBOL_GPL(iwl_test_handle_cmd);
+IWL_EXPORT_SYMBOL(iwl_test_handle_cmd);
 
 static int iwl_test_trace_dump(struct iwl_test *tst, struct sk_buff *skb,
                                struct netlink_callback *cb)
@@ -803,7 +803,7 @@ int iwl_test_dump(struct iwl_test *tst, u32 cmd, struct sk_buff *skb,
         }
         return result;
 }
-EXPORT_SYMBOL_GPL(iwl_test_dump);
+IWL_EXPORT_SYMBOL(iwl_test_dump);
 
 /*
  * Multicast a spontaneous messages from the device to the user space.
@@ -849,4 +849,4 @@ void iwl_test_rx(struct iwl_test *tst, struct iwl_rx_cmd_buffer *rxb)
         if (tst->notify)
                 iwl_test_send_rx(tst, rxb);
 }
-EXPORT_SYMBOL_GPL(iwl_test_rx);
+IWL_EXPORT_SYMBOL(iwl_test_rx);
diff --git a/drivers/net/wireless/iwlwifi/iwl-test.h b/drivers/net/wireless/iwlwifi/iwl-test.h
index 7fbf4d717caa..8fbd21704840 100644
--- a/drivers/net/wireless/iwlwifi/iwl-test.h
+++ b/drivers/net/wireless/iwlwifi/iwl-test.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-testmode.h b/drivers/net/wireless/iwlwifi/iwl-testmode.h
index a963f45c6849..98f48a9afc98 100644
--- a/drivers/net/wireless/iwlwifi/iwl-testmode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-testmode.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 00bdc5b00af3..7a13790b5bfe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -183,19 +183,13 @@ struct iwl_rx_packet {
  * @CMD_ASYNC: Return right away and don't want for the response
  * @CMD_WANT_SKB: valid only with CMD_SYNC. The caller needs the buffer of the
  *      response. The caller needs to call iwl_free_resp when done.
- * @CMD_WANT_HCMD: The caller needs to get the HCMD that was sent in the
- *      response handler. Chunks flagged by %IWL_HCMD_DFL_NOCOPY won't be
- *      copied. The pointer passed to the response handler is in the transport
- *      ownership and don't need to be freed by the op_mode. This also means
- *      that the pointer is invalidated after the op_mode's handler returns.
  * @CMD_ON_DEMAND: This command is sent by the test mode pipe.
  */
 enum CMD_MODE {
         CMD_SYNC                = 0,
         CMD_ASYNC               = BIT(0),
         CMD_WANT_SKB            = BIT(1),
-        CMD_WANT_HCMD           = BIT(2),
-        CMD_ON_DEMAND           = BIT(3),
+        CMD_ON_DEMAND           = BIT(2),
 };
 
 #define DEF_CMD_PAYLOAD_SIZE 320
@@ -214,7 +208,11 @@ struct iwl_device_cmd {
 
 #define TFD_MAX_PAYLOAD_SIZE (sizeof(struct iwl_device_cmd))
 
-#define IWL_MAX_CMD_TFDS        2
+/*
+ * number of transfer buffers (fragments) per transmit frame descriptor;
+ * this is just the driver's idea, the hardware supports 20
+ */
+#define IWL_MAX_CMD_TBS_PER_TFD 2
 
 /**
  * struct iwl_hcmd_dataflag - flag for each one of the chunks of the command
@@ -251,15 +249,15 @@ enum iwl_hcmd_dataflag {
  * @id: id of the host command
  */
 struct iwl_host_cmd {
-        const void *data[IWL_MAX_CMD_TFDS];
+        const void *data[IWL_MAX_CMD_TBS_PER_TFD];
         struct iwl_rx_packet *resp_pkt;
         unsigned long _rx_page_addr;
         u32 _rx_page_order;
         int handler_status;
 
         u32 flags;
-        u16 len[IWL_MAX_CMD_TFDS];
-        u8 dataflags[IWL_MAX_CMD_TFDS];
+        u16 len[IWL_MAX_CMD_TBS_PER_TFD];
+        u8 dataflags[IWL_MAX_CMD_TBS_PER_TFD];
         u8 id;
 };
 
@@ -307,7 +305,6 @@ static inline void iwl_free_rxb(struct iwl_rx_cmd_buffer *r)
  * currently supports
  */
 #define IWL_MAX_HW_QUEUES               32
-#define IWL_INVALID_STATION     255
 #define IWL_MAX_TID_COUNT       8
 #define IWL_FRAME_LIMIT 64
 
@@ -684,7 +681,7 @@ static inline void iwl_trans_txq_enable(struct iwl_trans *trans, int queue,
 static inline void iwl_trans_ac_txq_enable(struct iwl_trans *trans, int queue,
                                            int fifo)
 {
-        iwl_trans_txq_enable(trans, queue, fifo, IWL_INVALID_STATION,
+        iwl_trans_txq_enable(trans, queue, fifo, -1,
                              IWL_MAX_TID_COUNT, IWL_FRAME_LIMIT, 0);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/Makefile b/drivers/net/wireless/iwlwifi/mvm/Makefile
index 807b250ec396..2acc44b40986 100644
--- a/drivers/net/wireless/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/mvm/Makefile
@@ -2,7 +2,7 @@ obj-$(CONFIG_IWLMVM)   += iwlmvm.o
 iwlmvm-y += fw.o mac80211.o nvm.o ops.o phy-ctxt.o mac-ctxt.o
 iwlmvm-y += utils.o rx.o tx.o binding.o quota.o sta.o
 iwlmvm-y += scan.o time-event.o rs.o
-iwlmvm-y += power.o
+iwlmvm-y += power.o bt-coex.o
 iwlmvm-y += led.o
 iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o
 iwlmvm-$(CONFIG_PM_SLEEP) += d3.o
diff --git a/drivers/net/wireless/iwlwifi/mvm/binding.c b/drivers/net/wireless/iwlwifi/mvm/binding.c
index 73d24aacb90a..93fd1457954b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/binding.c
+++ b/drivers/net/wireless/iwlwifi/mvm/binding.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
new file mode 100644
index 000000000000..810bfa5f6de0
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -0,0 +1,589 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include <net/mac80211.h>
+
+#include "fw-api-bt-coex.h"
+#include "iwl-modparams.h"
+#include "mvm.h"
+#include "iwl-debug.h"
+
+#define EVENT_PRIO_ANT(_evt, _prio, _shrd_ant)                  \
+        [(_evt)] = (((_prio) << BT_COEX_PRIO_TBL_PRIO_POS) |    \
+                   ((_shrd_ant) << BT_COEX_PRIO_TBL_SHRD_ANT_POS))
+
+static const u8 iwl_bt_prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX] = {
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_INIT_CALIB1,
+                       BT_COEX_PRIO_TBL_PRIO_BYPASS, 0),
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_INIT_CALIB2,
+                       BT_COEX_PRIO_TBL_PRIO_BYPASS, 1),
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_LOW1,
+                       BT_COEX_PRIO_TBL_PRIO_LOW, 0),
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_LOW2,
+                       BT_COEX_PRIO_TBL_PRIO_LOW, 1),
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_HIGH1,
+                       BT_COEX_PRIO_TBL_PRIO_HIGH, 0),
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_HIGH2,
+                       BT_COEX_PRIO_TBL_PRIO_HIGH, 1),
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_DTIM,
+                       BT_COEX_PRIO_TBL_DISABLED, 0),
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_SCAN52,
+                       BT_COEX_PRIO_TBL_PRIO_COEX_OFF, 0),
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_SCAN24,
+                       BT_COEX_PRIO_TBL_PRIO_COEX_ON, 0),
+        EVENT_PRIO_ANT(BT_COEX_PRIO_TBL_EVT_IDLE,
+                       BT_COEX_PRIO_TBL_PRIO_COEX_IDLE, 0),
+        0, 0, 0, 0, 0, 0,
+};
+
+#undef EVENT_PRIO_ANT
+
+/* BT Antenna Coupling Threshold (dB) */
+#define IWL_BT_ANTENNA_COUPLING_THRESHOLD       (35)
+#define IWL_BT_LOAD_FORCE_SISO_THRESHOLD        (3)
+
+#define BT_ENABLE_REDUCED_TXPOWER_THRESHOLD     (-62)
+#define BT_DISABLE_REDUCED_TXPOWER_THRESHOLD    (-65)
+#define BT_REDUCED_TX_POWER_BIT                 BIT(7)
+
+static inline bool is_loose_coex(void)
+{
+        return iwlwifi_mod_params.ant_coupling >
+                IWL_BT_ANTENNA_COUPLING_THRESHOLD;
+}
+
+int iwl_send_bt_prio_tbl(struct iwl_mvm *mvm)
+{
+        return iwl_mvm_send_cmd_pdu(mvm, BT_COEX_PRIO_TABLE, CMD_SYNC,
+                                    sizeof(struct iwl_bt_coex_prio_tbl_cmd),
+                                    &iwl_bt_prio_tbl);
+}
+
+static int iwl_send_bt_env(struct iwl_mvm *mvm, u8 action, u8 type)
+{
+        struct iwl_bt_coex_prot_env_cmd env_cmd;
+        int ret;
+
+        env_cmd.action = action;
+        env_cmd.type = type;
+        ret = iwl_mvm_send_cmd_pdu(mvm, BT_COEX_PROT_ENV, CMD_SYNC,
+                                   sizeof(env_cmd), &env_cmd);
+        if (ret)
+                IWL_ERR(mvm, "failed to send BT env command\n");
+        return ret;
+}
+
+enum iwl_bt_kill_msk {
+        BT_KILL_MSK_DEFAULT,
+        BT_KILL_MSK_SCO_HID_A2DP,
+        BT_KILL_MSK_REDUCED_TXPOW,
+        BT_KILL_MSK_MAX,
+};
+
+static const u32 iwl_bt_ack_kill_msk[BT_KILL_MSK_MAX] = {
+        [BT_KILL_MSK_DEFAULT] = 0xffff0000,
+        [BT_KILL_MSK_SCO_HID_A2DP] = 0xffffffff,
+        [BT_KILL_MSK_REDUCED_TXPOW] = 0,
+};
+
+static const u32 iwl_bt_cts_kill_msk[BT_KILL_MSK_MAX] = {
+        [BT_KILL_MSK_DEFAULT] = 0xffff0000,
+        [BT_KILL_MSK_SCO_HID_A2DP] = 0xffffffff,
+        [BT_KILL_MSK_REDUCED_TXPOW] = 0,
+};
+
+#define IWL_BT_DEFAULT_BOOST (0xf0f0f0f0)
+
+/* Tight Coex */
+static const __le32 iwl_tight_lookup[BT_COEX_LUT_SIZE] = {
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaeaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xcc00ff28),
+        cpu_to_le32(0x0000aaaa),
+        cpu_to_le32(0xcc00aaaa),
+        cpu_to_le32(0x0000aaaa),
+        cpu_to_le32(0xc0004000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0xf0005000),
+        cpu_to_le32(0xf0005000),
+};
+
+/* Loose Coex */
+static const __le32 iwl_loose_lookup[BT_COEX_LUT_SIZE] = {
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaeaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xcc00ff28),
+        cpu_to_le32(0x0000aaaa),
+        cpu_to_le32(0xcc00aaaa),
+        cpu_to_le32(0x0000aaaa),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0xf0005000),
+        cpu_to_le32(0xf0005000),
+};
+
+/* Full concurrency */
+static const __le32 iwl_concurrent_lookup[BT_COEX_LUT_SIZE] = {
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x00000000),
+};
+
+int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
+{
+        struct iwl_bt_coex_cmd cmd = {
+                .max_kill = 5,
+                .bt3_time_t7_value = 1,
+                .bt3_prio_sample_time = 2,
+                .bt3_timer_t2_value = 0xc,
+        };
+        int ret;
+
+        cmd.flags = iwlwifi_mod_params.bt_coex_active ?
+                        BT_COEX_NW : BT_COEX_DISABLE;
+        cmd.flags |= BT_CH_PRIMARY_EN | BT_SYNC_2_BT_DISABLE;
+
+        cmd.valid_bit_msk = cpu_to_le16(BT_VALID_ENABLE |
+                                        BT_VALID_BT_PRIO_BOOST |
+                                        BT_VALID_MAX_KILL |
+                                        BT_VALID_3W_TMRS |
+                                        BT_VALID_KILL_ACK |
+                                        BT_VALID_KILL_CTS |
+                                        BT_VALID_REDUCED_TX_POWER |
+                                        BT_VALID_LUT);
+
+        if (is_loose_coex())
+                memcpy(&cmd.decision_lut, iwl_loose_lookup,
+                       sizeof(iwl_tight_lookup));
+        else
+                memcpy(&cmd.decision_lut, iwl_tight_lookup,
+                       sizeof(iwl_tight_lookup));
+
+        cmd.bt_prio_boost = cpu_to_le32(IWL_BT_DEFAULT_BOOST);
+        cmd.kill_ack_msk =
+                cpu_to_le32(iwl_bt_ack_kill_msk[BT_KILL_MSK_DEFAULT]);
+        cmd.kill_cts_msk =
+                cpu_to_le32(iwl_bt_cts_kill_msk[BT_KILL_MSK_DEFAULT]);
+
+        memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
+
+        /* go to CALIB state in internal BT-Coex state machine */
+        ret = iwl_send_bt_env(mvm, BT_COEX_ENV_OPEN,
+                              BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+        if (ret)
+                return ret;
+
+        ret  = iwl_send_bt_env(mvm, BT_COEX_ENV_CLOSE,
+                               BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+        if (ret)
+                return ret;
+
+        return iwl_mvm_send_cmd_pdu(mvm, BT_CONFIG, CMD_SYNC,
+                                    sizeof(cmd), &cmd);
+}
+
+static int iwl_mvm_bt_udpate_ctrl_kill_msk(struct iwl_mvm *mvm,
+                                           bool reduced_tx_power)
+{
+        enum iwl_bt_kill_msk bt_kill_msk;
+        struct iwl_bt_coex_cmd cmd = {};
+        struct iwl_bt_coex_profile_notif *notif = &mvm->last_bt_notif;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (reduced_tx_power) {
+                /* Reduced Tx power has precedence on the type of the profile */
+                bt_kill_msk = BT_KILL_MSK_REDUCED_TXPOW;
+        } else {
+                /* Low latency BT profile is active: give higher prio to BT */
+                if (BT_MBOX_MSG(notif, 3, SCO_STATE)  ||
+                    BT_MBOX_MSG(notif, 3, A2DP_STATE) ||
+                    BT_MBOX_MSG(notif, 3, SNIFF_STATE))
+                        bt_kill_msk = BT_KILL_MSK_SCO_HID_A2DP;
+                else
+                        bt_kill_msk = BT_KILL_MSK_DEFAULT;
+        }
+
+        IWL_DEBUG_COEX(mvm,
+                       "Update kill_msk: %d - SCO %sactive A2DP %sactive SNIFF %sactive\n",
+                       bt_kill_msk,
+                       BT_MBOX_MSG(notif, 3, SCO_STATE) ? "" : "in",
+                       BT_MBOX_MSG(notif, 3, A2DP_STATE) ? "" : "in",
+                       BT_MBOX_MSG(notif, 3, SNIFF_STATE) ? "" : "in");
+
+        /* Don't send HCMD if there is no update */
+        if (bt_kill_msk == mvm->bt_kill_msk)
+                return 0;
+
+        mvm->bt_kill_msk = bt_kill_msk;
+        cmd.kill_ack_msk = cpu_to_le32(iwl_bt_ack_kill_msk[bt_kill_msk]);
+        cmd.kill_cts_msk = cpu_to_le32(iwl_bt_cts_kill_msk[bt_kill_msk]);
+        cmd.valid_bit_msk = cpu_to_le16(BT_VALID_KILL_ACK | BT_VALID_KILL_CTS);
+
+        IWL_DEBUG_COEX(mvm, "bt_kill_msk = %d\n", bt_kill_msk);
+        return iwl_mvm_send_cmd_pdu(mvm, BT_CONFIG, CMD_SYNC,
+                                    sizeof(cmd), &cmd);
+}
+
+static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
+                                       bool enable)
+{
+        struct iwl_bt_coex_cmd cmd = {
+                .valid_bit_msk = cpu_to_le16(BT_VALID_REDUCED_TX_POWER),
+                .bt_reduced_tx_power = sta_id,
+        };
+        struct ieee80211_sta *sta;
+        struct iwl_mvm_sta *mvmsta;
+
+        /* This can happen if the station has been removed right now */
+        if (sta_id == IWL_MVM_STATION_COUNT)
+                return 0;
+
+        sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],
+                                        lockdep_is_held(&mvm->mutex));
+        mvmsta = (void *)sta->drv_priv;
+
+        /* nothing to do */
+        if (mvmsta->bt_reduced_txpower == enable)
+                return 0;
+
+        if (enable)
+                cmd.bt_reduced_tx_power |= BT_REDUCED_TX_POWER_BIT;
+
+        IWL_DEBUG_COEX(mvm, "%sable reduced Tx Power for sta %d\n",
+                       enable ? "en" : "dis", sta_id);
+
+        mvmsta->bt_reduced_txpower = enable;
+
+        /* Send ASYNC since this can be sent from an atomic context */
+        return iwl_mvm_send_cmd_pdu(mvm, BT_CONFIG, CMD_ASYNC,
+                                    sizeof(cmd), &cmd);
+}
+
+struct iwl_bt_iterator_data {
+        struct iwl_bt_coex_profile_notif *notif;
+        struct iwl_mvm *mvm;
+        u32 num_bss_ifaces;
+        bool reduced_tx_power;
+};
+
+static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
+                                      struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_bt_iterator_data *data = _data;
+        struct iwl_mvm *mvm = data->mvm;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        enum ieee80211_smps_mode smps_mode;
+        enum ieee80211_band band;
+        int ave_rssi;
+
+        if (vif->type != NL80211_IFTYPE_STATION)
+                return;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(vif->chanctx_conf);
+        if (chanctx_conf && chanctx_conf->def.chan)
+                band = chanctx_conf->def.chan->band;
+        else
+                band = -1;
+        rcu_read_unlock();
+
+        smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+        if (band != IEEE80211_BAND_2GHZ) {
+                ieee80211_request_smps(vif, smps_mode);
+                return;
+        }
+
+        if (data->notif->bt_status)
+                smps_mode = IEEE80211_SMPS_DYNAMIC;
+
+        if (data->notif->bt_traffic_load >= IWL_BT_LOAD_FORCE_SISO_THRESHOLD)
+                smps_mode = IEEE80211_SMPS_STATIC;
+
+        IWL_DEBUG_COEX(data->mvm,
+                       "mac %d: bt_status %d traffic_load %d smps_req %d\n",
+                       mvmvif->id,  data->notif->bt_status,
+                       data->notif->bt_traffic_load, smps_mode);
+
+        ieee80211_request_smps(vif, smps_mode);
+
+        /* don't reduce the Tx power if in loose scheme */
+        if (is_loose_coex())
+                return;
+
+        data->num_bss_ifaces++;
+
+        /* reduced Txpower only if there are open BT connections, so ...*/
+        if (!BT_MBOX_MSG(data->notif, 3, OPEN_CON_2)) {
+                /* ... cancel reduced Tx power ... */
+                if (iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id, false))
+                        IWL_ERR(mvm, "Couldn't send BT_CONFIG cmd\n");
+                data->reduced_tx_power = false;
+
+                /* ... and there is no need to get reports on RSSI any more. */
+                ieee80211_disable_rssi_reports(vif);
+                return;
+        }
+
+        ave_rssi = ieee80211_ave_rssi(vif);
+
+        /* if the RSSI isn't valid, fake it is very low */
+        if (!ave_rssi)
+                ave_rssi = -100;
+        if (ave_rssi > BT_ENABLE_REDUCED_TXPOWER_THRESHOLD) {
+                if (iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id, true))
+                        IWL_ERR(mvm, "Couldn't send BT_CONFIG cmd\n");
+
+                /*
+                 * bt_kill_msk can be BT_KILL_MSK_REDUCED_TXPOW only if all the
+                 * BSS / P2P clients have rssi above threshold.
+                 * We set the bt_kill_msk to BT_KILL_MSK_REDUCED_TXPOW before
+                 * the iteration, if one interface's rssi isn't good enough,
+                 * bt_kill_msk will be set to default values.
+                 */
+        } else if (ave_rssi < BT_DISABLE_REDUCED_TXPOWER_THRESHOLD) {
+                if (iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id, false))
+                        IWL_ERR(mvm, "Couldn't send BT_CONFIG cmd\n");
+
+                /*
+                 * One interface hasn't rssi above threshold, bt_kill_msk must
+                 * be set to default values.
+                 */
+                data->reduced_tx_power = false;
+        }
+
+        /* Begin to monitor the RSSI: it may influence the reduced Tx power */
+        ieee80211_enable_rssi_reports(vif, BT_DISABLE_REDUCED_TXPOWER_THRESHOLD,
+                                      BT_ENABLE_REDUCED_TXPOWER_THRESHOLD);
+}
+
+static void iwl_mvm_bt_coex_notif_handle(struct iwl_mvm *mvm)
+{
+        struct iwl_bt_iterator_data data = {
+                .mvm = mvm,
+                .notif = &mvm->last_bt_notif,
+                .reduced_tx_power = true,
+        };
+
+        ieee80211_iterate_active_interfaces_atomic(
+                                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                                        iwl_mvm_bt_notif_iterator, &data);
+
+        /*
+         * If there are no BSS / P2P client interfaces, reduced Tx Power is
+         * irrelevant since it is based on the RSSI coming from the beacon.
+         * Use BT_KILL_MSK_DEFAULT in that case.
+         */
+        data.reduced_tx_power = data.reduced_tx_power && data.num_bss_ifaces;
+
+        if (iwl_mvm_bt_udpate_ctrl_kill_msk(mvm, data.reduced_tx_power))
+                IWL_ERR(mvm, "Failed to update the ctrl_kill_msk\n");
+}
+
+/* upon association, the fw will send in BT Coex notification */
+int iwl_mvm_rx_bt_coex_notif(struct iwl_mvm *mvm,
+                             struct iwl_rx_cmd_buffer *rxb,
+                             struct iwl_device_cmd *dev_cmd)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_bt_coex_profile_notif *notif = (void *)pkt->data;
+
+
+        IWL_DEBUG_COEX(mvm, "BT Coex Notification received\n");
+        IWL_DEBUG_COEX(mvm, "\tBT %salive\n", notif->bt_status ? "" : "not ");
+        IWL_DEBUG_COEX(mvm, "\tBT open conn %d\n", notif->bt_open_conn);
+        IWL_DEBUG_COEX(mvm, "\tBT traffic load %d\n", notif->bt_traffic_load);
+        IWL_DEBUG_COEX(mvm, "\tBT agg traffic load %d\n",
+                       notif->bt_agg_traffic_load);
+        IWL_DEBUG_COEX(mvm, "\tBT ci compliance %d\n", notif->bt_ci_compliance);
+
+        /* remember this notification for future use: rssi fluctuations */
+        memcpy(&mvm->last_bt_notif, notif, sizeof(mvm->last_bt_notif));
+
+        iwl_mvm_bt_coex_notif_handle(mvm);
+
+        /*
+         * This is an async handler for a notification, returning anything other
+         * than 0 doesn't make sense even if HCMD failed.
+         */
+        return 0;
+}
+
+static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
+                                   struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_bt_iterator_data *data = _data;
+        struct iwl_mvm *mvm = data->mvm;
+
+        struct ieee80211_sta *sta;
+        struct iwl_mvm_sta *mvmsta;
+
+        if (vif->type != NL80211_IFTYPE_STATION ||
+            mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT)
+                return;
+
+        sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id],
+                                        lockdep_is_held(&mvm->mutex));
+        mvmsta = (void *)sta->drv_priv;
+
+        /*
+         * This interface doesn't support reduced Tx power (because of low
+         * RSSI probably), then set bt_kill_msk to default values.
+         */
+        if (!mvmsta->bt_reduced_txpower)
+                data->reduced_tx_power = false;
+        /* else - possibly leave it to BT_KILL_MSK_REDUCED_TXPOW */
+}
+
+void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                           enum ieee80211_rssi_event rssi_event)
+{
+        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_bt_iterator_data data = {
+                .mvm = mvm,
+                .reduced_tx_power = true,
+        };
+        int ret;
+
+        mutex_lock(&mvm->mutex);
+
+        /* Rssi update while not associated ?! */
+        if (WARN_ON_ONCE(mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT))
+                goto out_unlock;
+
+        /* No open connection - reports should be disabled */
+        if (!BT_MBOX_MSG(&mvm->last_bt_notif, 3, OPEN_CON_2))
+                goto out_unlock;
+
+        IWL_DEBUG_COEX(mvm, "RSSI for %pM is now %s\n", vif->bss_conf.bssid,
+                       rssi_event == RSSI_EVENT_HIGH ? "HIGH" : "LOW");
+
+        /*
+         * Check if rssi is good enough for reduced Tx power, but not in loose
+         * scheme.
+         */
+        if (rssi_event == RSSI_EVENT_LOW || is_loose_coex())
+                ret = iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id,
+                                                  false);
+        else
+                ret = iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id, true);
+
+        if (ret)
+                IWL_ERR(mvm, "couldn't send BT_CONFIG HCMD upon RSSI event\n");
+
+        ieee80211_iterate_active_interfaces_atomic(
+                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                iwl_mvm_bt_rssi_iterator, &data);
+
+        /*
+         * If there are no BSS / P2P client interfaces, reduced Tx Power is
+         * irrelevant since it is based on the RSSI coming from the beacon.
+         * Use BT_KILL_MSK_DEFAULT in that case.
+         */
+        data.reduced_tx_power = data.reduced_tx_power && data.num_bss_ifaces;
+
+        if (iwl_mvm_bt_udpate_ctrl_kill_msk(mvm, data.reduced_tx_power))
+                IWL_ERR(mvm, "Failed to update the ctrl_kill_msk\n");
+
+ out_unlock:
+        mutex_unlock(&mvm->mutex);
+}
+
+void iwl_mvm_bt_coex_vif_assoc(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        enum ieee80211_band band;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(vif->chanctx_conf);
+        if (chanctx_conf && chanctx_conf->def.chan)
+                band = chanctx_conf->def.chan->band;
+        else
+                band = -1;
+        rcu_read_unlock();
+
+        /* if we are in 2GHz we will get a notification from the fw */
+        if (band == IEEE80211_BAND_2GHZ)
+                return;
+
+        /* else, we can remove all the constraints */
+        memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
+
+        iwl_mvm_bt_coex_notif_handle(mvm);
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index c64d864799cd..16bbdcc8627a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -61,8 +61,11 @@
  *
  *****************************************************************************/
 
+#include <linux/etherdevice.h>
+#include <linux/ip.h>
 #include <net/cfg80211.h>
 #include <net/ipv6.h>
+#include <net/tcp.h>
 #include "iwl-modparams.h"
 #include "fw-api.h"
 #include "mvm.h"
@@ -192,6 +195,11 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                                            sizeof(wkc), &wkc);
                 data->error = ret != 0;
 
+                mvm->ptk_ivlen = key->iv_len;
+                mvm->ptk_icvlen = key->icv_len;
+                mvm->gtk_ivlen = key->iv_len;
+                mvm->gtk_icvlen = key->icv_len;
+
                 /* don't upload key again */
                 goto out_unlock;
         }
@@ -304,9 +312,13 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
          */
         if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
                 key->hw_key_idx = 0;
+                mvm->ptk_ivlen = key->iv_len;
+                mvm->ptk_icvlen = key->icv_len;
         } else {
                 data->gtk_key_idx++;
                 key->hw_key_idx = data->gtk_key_idx;
+                mvm->gtk_ivlen = key->iv_len;
+                mvm->gtk_icvlen = key->icv_len;
         }
 
         ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, true);
@@ -392,6 +404,233 @@ static int iwl_mvm_send_proto_offload(struct iwl_mvm *mvm,
                                     sizeof(cmd), &cmd);
 }
 
+enum iwl_mvm_tcp_packet_type {
+        MVM_TCP_TX_SYN,
+        MVM_TCP_RX_SYNACK,
+        MVM_TCP_TX_DATA,
+        MVM_TCP_RX_ACK,
+        MVM_TCP_RX_WAKE,
+        MVM_TCP_TX_FIN,
+};
+
+static __le16 pseudo_hdr_check(int len, __be32 saddr, __be32 daddr)
+{
+        __sum16 check = tcp_v4_check(len, saddr, daddr, 0);
+        return cpu_to_le16(be16_to_cpu((__force __be16)check));
+}
+
+static void iwl_mvm_build_tcp_packet(struct iwl_mvm *mvm,
+                                     struct ieee80211_vif *vif,
+                                     struct cfg80211_wowlan_tcp *tcp,
+                                     void *_pkt, u8 *mask,
+                                     __le16 *pseudo_hdr_csum,
+                                     enum iwl_mvm_tcp_packet_type ptype)
+{
+        struct {
+                struct ethhdr eth;
+                struct iphdr ip;
+                struct tcphdr tcp;
+                u8 data[];
+        } __packed *pkt = _pkt;
+        u16 ip_tot_len = sizeof(struct iphdr) + sizeof(struct tcphdr);
+        int i;
+
+        pkt->eth.h_proto = cpu_to_be16(ETH_P_IP),
+        pkt->ip.version = 4;
+        pkt->ip.ihl = 5;
+        pkt->ip.protocol = IPPROTO_TCP;
+
+        switch (ptype) {
+        case MVM_TCP_TX_SYN:
+        case MVM_TCP_TX_DATA:
+        case MVM_TCP_TX_FIN:
+                memcpy(pkt->eth.h_dest, tcp->dst_mac, ETH_ALEN);
+                memcpy(pkt->eth.h_source, vif->addr, ETH_ALEN);
+                pkt->ip.ttl = 128;
+                pkt->ip.saddr = tcp->src;
+                pkt->ip.daddr = tcp->dst;
+                pkt->tcp.source = cpu_to_be16(tcp->src_port);
+                pkt->tcp.dest = cpu_to_be16(tcp->dst_port);
+                /* overwritten for TX SYN later */
+                pkt->tcp.doff = sizeof(struct tcphdr) / 4;
+                pkt->tcp.window = cpu_to_be16(65000);
+                break;
+        case MVM_TCP_RX_SYNACK:
+        case MVM_TCP_RX_ACK:
+        case MVM_TCP_RX_WAKE:
+                memcpy(pkt->eth.h_dest, vif->addr, ETH_ALEN);
+                memcpy(pkt->eth.h_source, tcp->dst_mac, ETH_ALEN);
+                pkt->ip.saddr = tcp->dst;
+                pkt->ip.daddr = tcp->src;
+                pkt->tcp.source = cpu_to_be16(tcp->dst_port);
+                pkt->tcp.dest = cpu_to_be16(tcp->src_port);
+                break;
+        default:
+                WARN_ON(1);
+                return;
+        }
+
+        switch (ptype) {
+        case MVM_TCP_TX_SYN:
+                /* firmware assumes 8 option bytes - 8 NOPs for now */
+                memset(pkt->data, 0x01, 8);
+                ip_tot_len += 8;
+                pkt->tcp.doff = (sizeof(struct tcphdr) + 8) / 4;
+                pkt->tcp.syn = 1;
+                break;
+        case MVM_TCP_TX_DATA:
+                ip_tot_len += tcp->payload_len;
+                memcpy(pkt->data, tcp->payload, tcp->payload_len);
+                pkt->tcp.psh = 1;
+                pkt->tcp.ack = 1;
+                break;
+        case MVM_TCP_TX_FIN:
+                pkt->tcp.fin = 1;
+                pkt->tcp.ack = 1;
+                break;
+        case MVM_TCP_RX_SYNACK:
+                pkt->tcp.syn = 1;
+                pkt->tcp.ack = 1;
+                break;
+        case MVM_TCP_RX_ACK:
+                pkt->tcp.ack = 1;
+                break;
+        case MVM_TCP_RX_WAKE:
+                ip_tot_len += tcp->wake_len;
+                pkt->tcp.psh = 1;
+                pkt->tcp.ack = 1;
+                memcpy(pkt->data, tcp->wake_data, tcp->wake_len);
+                break;
+        }
+
+        switch (ptype) {
+        case MVM_TCP_TX_SYN:
+        case MVM_TCP_TX_DATA:
+        case MVM_TCP_TX_FIN:
+                pkt->ip.tot_len = cpu_to_be16(ip_tot_len);
+                pkt->ip.check = ip_fast_csum(&pkt->ip, pkt->ip.ihl);
+                break;
+        case MVM_TCP_RX_WAKE:
+                for (i = 0; i < DIV_ROUND_UP(tcp->wake_len, 8); i++) {
+                        u8 tmp = tcp->wake_mask[i];
+                        mask[i + 6] |= tmp << 6;
+                        if (i + 1 < DIV_ROUND_UP(tcp->wake_len, 8))
+                                mask[i + 7] = tmp >> 2;
+                }
+                /* fall through for ethernet/IP/TCP headers mask */
+        case MVM_TCP_RX_SYNACK:
+        case MVM_TCP_RX_ACK:
+                mask[0] = 0xff; /* match ethernet */
+                /*
+                 * match ethernet, ip.version, ip.ihl
+                 * the ip.ihl half byte is really masked out by firmware
+                 */
+                mask[1] = 0x7f;
+                mask[2] = 0x80; /* match ip.protocol */
+                mask[3] = 0xfc; /* match ip.saddr, ip.daddr */
+                mask[4] = 0x3f; /* match ip.daddr, tcp.source, tcp.dest */
+                mask[5] = 0x80; /* match tcp flags */
+                /* leave rest (0 or set for MVM_TCP_RX_WAKE) */
+                break;
+        };
+
+        *pseudo_hdr_csum = pseudo_hdr_check(ip_tot_len - sizeof(struct iphdr),
+                                            pkt->ip.saddr, pkt->ip.daddr);
+}
+
+static int iwl_mvm_send_remote_wake_cfg(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif,
+                                        struct cfg80211_wowlan_tcp *tcp)
+{
+        struct iwl_wowlan_remote_wake_config *cfg;
+        struct iwl_host_cmd cmd = {
+                .id = REMOTE_WAKE_CONFIG_CMD,
+                .len = { sizeof(*cfg), },
+                .dataflags = { IWL_HCMD_DFL_NOCOPY, },
+                .flags = CMD_SYNC,
+        };
+        int ret;
+
+        if (!tcp)
+                return 0;
+
+        cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
+        if (!cfg)
+                return -ENOMEM;
+        cmd.data[0] = cfg;
+
+        cfg->max_syn_retries = 10;
+        cfg->max_data_retries = 10;
+        cfg->tcp_syn_ack_timeout = 1; /* seconds */
+        cfg->tcp_ack_timeout = 1; /* seconds */
+
+        /* SYN (TX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->syn_tx.data, NULL,
+                &cfg->syn_tx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_TX_SYN);
+        cfg->syn_tx.info.tcp_payload_length = 0;
+
+        /* SYN/ACK (RX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->synack_rx.data, cfg->synack_rx.rx_mask,
+                &cfg->synack_rx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_RX_SYNACK);
+        cfg->synack_rx.info.tcp_payload_length = 0;
+
+        /* KEEPALIVE/ACK (TX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->keepalive_tx.data, NULL,
+                &cfg->keepalive_tx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_TX_DATA);
+        cfg->keepalive_tx.info.tcp_payload_length =
+                cpu_to_le16(tcp->payload_len);
+        cfg->sequence_number_offset = tcp->payload_seq.offset;
+        /* length must be 0..4, the field is little endian */
+        cfg->sequence_number_length = tcp->payload_seq.len;
+        cfg->initial_sequence_number = cpu_to_le32(tcp->payload_seq.start);
+        cfg->keepalive_interval = cpu_to_le16(tcp->data_interval);
+        if (tcp->payload_tok.len) {
+                cfg->token_offset = tcp->payload_tok.offset;
+                cfg->token_length = tcp->payload_tok.len;
+                cfg->num_tokens =
+                        cpu_to_le16(tcp->tokens_size % tcp->payload_tok.len);
+                memcpy(cfg->tokens, tcp->payload_tok.token_stream,
+                       tcp->tokens_size);
+        } else {
+                /* set tokens to max value to almost never run out */
+                cfg->num_tokens = cpu_to_le16(65535);
+        }
+
+        /* ACK (RX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->keepalive_ack_rx.data,
+                cfg->keepalive_ack_rx.rx_mask,
+                &cfg->keepalive_ack_rx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_RX_ACK);
+        cfg->keepalive_ack_rx.info.tcp_payload_length = 0;
+
+        /* WAKEUP (RX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->wake_rx.data, cfg->wake_rx.rx_mask,
+                &cfg->wake_rx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_RX_WAKE);
+        cfg->wake_rx.info.tcp_payload_length =
+                cpu_to_le16(tcp->wake_len);
+
+        /* FIN */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->fin_tx.data, NULL,
+                &cfg->fin_tx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_TX_FIN);
+        cfg->fin_tx.info.tcp_payload_length = 0;
+
+        ret = iwl_mvm_send_cmd(mvm, &cmd);
+        kfree(cfg);
+
+        return ret;
+}
+
 struct iwl_d3_iter_data {
         struct iwl_mvm *mvm;
         struct ieee80211_vif *vif;
@@ -530,7 +769,14 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         struct iwl_wowlan_config_cmd wowlan_config_cmd = {};
         struct iwl_wowlan_kek_kck_material_cmd kek_kck_cmd = {};
         struct iwl_wowlan_tkip_params_cmd tkip_cmd = {};
-        struct iwl_d3_manager_config d3_cfg_cmd = {};
+        struct iwl_d3_manager_config d3_cfg_cmd = {
+                /*
+                 * Program the minimum sleep time to 10 seconds, as many
+                 * platforms have issues processing a wakeup signal while
+                 * still being in the process of suspending.
+                 */
+                .min_sleep_time = cpu_to_le32(10 * 1000 * 1000),
+        };
         struct wowlan_key_data key_data = {
                 .use_rsc_tsc = false,
                 .tkip = &tkip_cmd,
@@ -627,9 +873,21 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_PATTERN_MATCH);
 
         if (wowlan->rfkill_release)
-                d3_cfg_cmd.wakeup_flags |=
+                wowlan_config_cmd.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_RF_KILL_DEASSERT);
 
+        if (wowlan->tcp) {
+                /*
+                 * Set the "link change" (really "link lost") flag as well
+                 * since that implies losing the TCP connection.
+                 */
+                wowlan_config_cmd.wakeup_filter |=
+                        cpu_to_le32(IWL_WOWLAN_WAKEUP_REMOTE_LINK_LOSS |
+                                    IWL_WOWLAN_WAKEUP_REMOTE_SIGNATURE_TABLE |
+                                    IWL_WOWLAN_WAKEUP_REMOTE_WAKEUP_PACKET |
+                                    IWL_WOWLAN_WAKEUP_LINK_CHANGE);
+        }
+
         iwl_mvm_cancel_scan(mvm);
 
         iwl_trans_stop_device(mvm->trans);
@@ -649,6 +907,11 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         /* We reprogram keys and shouldn't allocate new key indices */
         memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
 
+        mvm->ptk_ivlen = 0;
+        mvm->ptk_icvlen = 0;
+        mvm->ptk_ivlen = 0;
+        mvm->ptk_icvlen = 0;
+
         /*
          * The D3 firmware still hardcodes the AP station ID for the
          * BSS we're associated with as 0. As a result, we have to move
@@ -740,6 +1003,10 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         if (ret)
                 goto out;
 
+        ret = iwl_mvm_send_remote_wake_cfg(mvm, vif, wowlan->tcp);
+        if (ret)
+                goto out;
+
         /* must be last -- this switches firmware state */
         ret = iwl_mvm_send_cmd_pdu(mvm, D3_CONFIG_CMD, CMD_SYNC,
                                    sizeof(d3_cfg_cmd), &d3_cfg_cmd);
@@ -783,7 +1050,6 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         struct iwl_wowlan_status *status;
         u32 reasons;
         int ret, len;
-        bool pkt8023 = false;
         struct sk_buff *pkt = NULL;
 
         iwl_trans_read_mem_bytes(mvm->trans, base,
@@ -824,7 +1090,8 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         status = (void *)cmd.resp_pkt->data;
 
         if (len - sizeof(struct iwl_cmd_header) !=
-            sizeof(*status) + le32_to_cpu(status->wake_packet_bufsize)) {
+            sizeof(*status) +
+            ALIGN(le32_to_cpu(status->wake_packet_bufsize), 4)) {
                 IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
                 goto out;
         }
@@ -836,61 +1103,105 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
                 goto report;
         }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_MAGIC_PACKET) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_MAGIC_PACKET)
                 wakeup.magic_pkt = true;
-                pkt8023 = true;
-        }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_PATTERN) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_PATTERN)
                 wakeup.pattern_idx =
                         le16_to_cpu(status->pattern_number);
-                pkt8023 = true;
-        }
 
         if (reasons & (IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_MISSED_BEACON |
                        IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_DEAUTH))
                 wakeup.disconnect = true;
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_GTK_REKEY_FAILURE) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_GTK_REKEY_FAILURE)
                 wakeup.gtk_rekey_failure = true;
-                pkt8023 = true;
-        }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED)
                 wakeup.rfkill_release = true;
-                pkt8023 = true;
-        }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_EAPOL_REQUEST) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_EAPOL_REQUEST)
                 wakeup.eap_identity_req = true;
-                pkt8023 = true;
-        }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_FOUR_WAY_HANDSHAKE) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_FOUR_WAY_HANDSHAKE)
                 wakeup.four_way_handshake = true;
-                pkt8023 = true;
-        }
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_REM_WAKE_LINK_LOSS)
+                wakeup.tcp_connlost = true;
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_REM_WAKE_SIGNATURE_TABLE)
+                wakeup.tcp_nomoretokens = true;
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_REM_WAKE_WAKEUP_PACKET)
+                wakeup.tcp_match = true;
 
         if (status->wake_packet_bufsize) {
-                u32 pktsize = le32_to_cpu(status->wake_packet_bufsize);
-                u32 pktlen = le32_to_cpu(status->wake_packet_length);
+                int pktsize = le32_to_cpu(status->wake_packet_bufsize);
+                int pktlen = le32_to_cpu(status->wake_packet_length);
+                const u8 *pktdata = status->wake_packet;
+                struct ieee80211_hdr *hdr = (void *)pktdata;
+                int truncated = pktlen - pktsize;
+
+                /* this would be a firmware bug */
+                if (WARN_ON_ONCE(truncated < 0))
+                        truncated = 0;
+
+                if (ieee80211_is_data(hdr->frame_control)) {
+                        int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+                        int ivlen = 0, icvlen = 4; /* also FCS */
 
-                if (pkt8023) {
                         pkt = alloc_skb(pktsize, GFP_KERNEL);
                         if (!pkt)
                                 goto report;
-                        memcpy(skb_put(pkt, pktsize), status->wake_packet,
-                               pktsize);
+
+                        memcpy(skb_put(pkt, hdrlen), pktdata, hdrlen);
+                        pktdata += hdrlen;
+                        pktsize -= hdrlen;
+
+                        if (ieee80211_has_protected(hdr->frame_control)) {
+                                if (is_multicast_ether_addr(hdr->addr1)) {
+                                        ivlen = mvm->gtk_ivlen;
+                                        icvlen += mvm->gtk_icvlen;
+                                } else {
+                                        ivlen = mvm->ptk_ivlen;
+                                        icvlen += mvm->ptk_icvlen;
+                                }
+                        }
+
+                        /* if truncated, FCS/ICV is (partially) gone */
+                        if (truncated >= icvlen) {
+                                icvlen = 0;
+                                truncated -= icvlen;
+                        } else {
+                                icvlen -= truncated;
+                                truncated = 0;
+                        }
+
+                        pktsize -= ivlen + icvlen;
+                        pktdata += ivlen;
+
+                        memcpy(skb_put(pkt, pktsize), pktdata, pktsize);
+
                         if (ieee80211_data_to_8023(pkt, vif->addr, vif->type))
                                 goto report;
                         wakeup.packet = pkt->data;
                         wakeup.packet_present_len = pkt->len;
-                        wakeup.packet_len = pkt->len - (pktlen - pktsize);
+                        wakeup.packet_len = pkt->len - truncated;
                         wakeup.packet_80211 = false;
                 } else {
+                        int fcslen = 4;
+
+                        if (truncated >= 4) {
+                                truncated -= 4;
+                                fcslen = 0;
+                        } else {
+                                fcslen -= truncated;
+                                truncated = 0;
+                        }
+                        pktsize -= fcslen;
                         wakeup.packet = status->wake_packet;
                         wakeup.packet_present_len = pktsize;
-                        wakeup.packet_len = pktlen;
+                        wakeup.packet_len = pktlen - truncated;
                         wakeup.packet_80211 = true;
                 }
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index c1bdb5582126..2053dccefcd6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -69,12 +69,6 @@ struct iwl_dbgfs_mvm_ctx {
         struct ieee80211_vif *vif;
 };
 
-static int iwl_dbgfs_open_file_generic(struct inode *inode, struct file *file)
-{
-        file->private_data = inode->i_private;
-        return 0;
-}
-
 static ssize_t iwl_dbgfs_tx_flush_write(struct file *file,
                                         const char __user *user_buf,
                                         size_t count, loff_t *ppos)
@@ -306,10 +300,191 @@ static ssize_t iwl_dbgfs_power_down_d3_allow_write(struct file *file,
         return count;
 }
 
+static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->dbgfs_data;
+        u8 ap_sta_id;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        char buf[512];
+        int bufsz = sizeof(buf);
+        int pos = 0;
+        int i;
+
+        mutex_lock(&mvm->mutex);
+
+        ap_sta_id = mvmvif->ap_sta_id;
+
+        pos += scnprintf(buf+pos, bufsz-pos, "mac id/color: %d / %d\n",
+                         mvmvif->id, mvmvif->color);
+        pos += scnprintf(buf+pos, bufsz-pos, "bssid: %pM\n",
+                         vif->bss_conf.bssid);
+        pos += scnprintf(buf+pos, bufsz-pos, "QoS:\n");
+        for (i = 0; i < ARRAY_SIZE(mvmvif->queue_params); i++) {
+                pos += scnprintf(buf+pos, bufsz-pos,
+                                 "\t%d: txop:%d - cw_min:%d - cw_max = %d - aifs = %d upasd = %d\n",
+                                 i, mvmvif->queue_params[i].txop,
+                                 mvmvif->queue_params[i].cw_min,
+                                 mvmvif->queue_params[i].cw_max,
+                                 mvmvif->queue_params[i].aifs,
+                                 mvmvif->queue_params[i].uapsd);
+        }
+
+        if (vif->type == NL80211_IFTYPE_STATION &&
+            ap_sta_id != IWL_MVM_STATION_COUNT) {
+                struct ieee80211_sta *sta;
+                struct iwl_mvm_sta *mvm_sta;
+
+                sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[ap_sta_id],
+                                                lockdep_is_held(&mvm->mutex));
+                mvm_sta = (void *)sta->drv_priv;
+                pos += scnprintf(buf+pos, bufsz-pos,
+                                 "ap_sta_id %d - reduced Tx power %d\n",
+                                 ap_sta_id, mvm_sta->bt_reduced_txpower);
+        }
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(vif->chanctx_conf);
+        if (chanctx_conf) {
+                pos += scnprintf(buf+pos, bufsz-pos,
+                                 "idle rx chains %d, active rx chains: %d\n",
+                                 chanctx_conf->rx_chains_static,
+                                 chanctx_conf->rx_chains_dynamic);
+        }
+        rcu_read_unlock();
+
+        mutex_unlock(&mvm->mutex);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+#define BT_MBOX_MSG(_notif, _num, _field)                                    \
+        ((le32_to_cpu((_notif)->mbox_msg[(_num)]) & BT_MBOX##_num##_##_field)\
+        >> BT_MBOX##_num##_##_field##_POS)
+
+
+#define BT_MBOX_PRINT(_num, _field, _end)                                   \
+                        pos += scnprintf(buf + pos, bufsz - pos,            \
+                                         "\t%s: %d%s",                      \
+                                         #_field,                           \
+                                         BT_MBOX_MSG(notif, _num, _field),  \
+                                         true ? "\n" : ", ");
+
+static ssize_t iwl_dbgfs_bt_notif_read(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        struct iwl_bt_coex_profile_notif *notif = &mvm->last_bt_notif;
+        char *buf;
+        int ret, pos = 0, bufsz = sizeof(char) * 1024;
+
+        buf = kmalloc(bufsz, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        mutex_lock(&mvm->mutex);
+
+        pos += scnprintf(buf+pos, bufsz-pos, "MBOX dw0:\n");
+
+        BT_MBOX_PRINT(0, LE_SLAVE_LAT, false);
+        BT_MBOX_PRINT(0, LE_PROF1, false);
+        BT_MBOX_PRINT(0, LE_PROF2, false);
+        BT_MBOX_PRINT(0, LE_PROF_OTHER, false);
+        BT_MBOX_PRINT(0, CHL_SEQ_N, false);
+        BT_MBOX_PRINT(0, INBAND_S, false);
+        BT_MBOX_PRINT(0, LE_MIN_RSSI, false);
+        BT_MBOX_PRINT(0, LE_SCAN, false);
+        BT_MBOX_PRINT(0, LE_ADV, false);
+        BT_MBOX_PRINT(0, LE_MAX_TX_POWER, false);
+        BT_MBOX_PRINT(0, OPEN_CON_1, true);
+
+        pos += scnprintf(buf+pos, bufsz-pos, "MBOX dw1:\n");
+
+        BT_MBOX_PRINT(1, BR_MAX_TX_POWER, false);
+        BT_MBOX_PRINT(1, IP_SR, false);
+        BT_MBOX_PRINT(1, LE_MSTR, false);
+        BT_MBOX_PRINT(1, AGGR_TRFC_LD, false);
+        BT_MBOX_PRINT(1, MSG_TYPE, false);
+        BT_MBOX_PRINT(1, SSN, true);
+
+        pos += scnprintf(buf+pos, bufsz-pos, "MBOX dw2:\n");
+
+        BT_MBOX_PRINT(2, SNIFF_ACT, false);
+        BT_MBOX_PRINT(2, PAG, false);
+        BT_MBOX_PRINT(2, INQUIRY, false);
+        BT_MBOX_PRINT(2, CONN, false);
+        BT_MBOX_PRINT(2, SNIFF_INTERVAL, false);
+        BT_MBOX_PRINT(2, DISC, false);
+        BT_MBOX_PRINT(2, SCO_TX_ACT, false);
+        BT_MBOX_PRINT(2, SCO_RX_ACT, false);
+        BT_MBOX_PRINT(2, ESCO_RE_TX, false);
+        BT_MBOX_PRINT(2, SCO_DURATION, true);
+
+        pos += scnprintf(buf+pos, bufsz-pos, "MBOX dw3:\n");
+
+        BT_MBOX_PRINT(3, SCO_STATE, false);
+        BT_MBOX_PRINT(3, SNIFF_STATE, false);
+        BT_MBOX_PRINT(3, A2DP_STATE, false);
+        BT_MBOX_PRINT(3, ACL_STATE, false);
+        BT_MBOX_PRINT(3, MSTR_STATE, false);
+        BT_MBOX_PRINT(3, OBX_STATE, false);
+        BT_MBOX_PRINT(3, OPEN_CON_2, false);
+        BT_MBOX_PRINT(3, TRAFFIC_LOAD, false);
+        BT_MBOX_PRINT(3, CHL_SEQN_LSB, false);
+        BT_MBOX_PRINT(3, INBAND_P, false);
+        BT_MBOX_PRINT(3, MSG_TYPE_2, false);
+        BT_MBOX_PRINT(3, SSN_2, false);
+        BT_MBOX_PRINT(3, UPDATE_REQUEST, true);
+
+        pos += scnprintf(buf+pos, bufsz-pos, "bt_status = %d\n",
+                                         notif->bt_status);
+        pos += scnprintf(buf+pos, bufsz-pos, "bt_open_conn = %d\n",
+                                         notif->bt_open_conn);
+        pos += scnprintf(buf+pos, bufsz-pos, "bt_traffic_load = %d\n",
+                                         notif->bt_traffic_load);
+        pos += scnprintf(buf+pos, bufsz-pos, "bt_agg_traffic_load = %d\n",
+                                         notif->bt_agg_traffic_load);
+        pos += scnprintf(buf+pos, bufsz-pos, "bt_ci_compliance = %d\n",
+                                         notif->bt_ci_compliance);
+
+        mutex_unlock(&mvm->mutex);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+
+        return ret;
+}
+#undef BT_MBOX_PRINT
+
+static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        bool restart_fw = iwlwifi_mod_params.restart_fw;
+        int ret;
+
+        iwlwifi_mod_params.restart_fw = true;
+
+        mutex_lock(&mvm->mutex);
+
+        /* take the return value to make compiler happy - it will fail anyway */
+        ret = iwl_mvm_send_cmd_pdu(mvm, REPLY_ERROR, CMD_SYNC, 0, NULL);
+
+        mutex_unlock(&mvm->mutex);
+
+        iwlwifi_mod_params.restart_fw = restart_fw;
+
+        return count;
+}
+
 #define MVM_DEBUGFS_READ_FILE_OPS(name)                                 \
 static const struct file_operations iwl_dbgfs_##name##_ops = {  \
         .read = iwl_dbgfs_##name##_read,                                \
-        .open = iwl_dbgfs_open_file_generic,                            \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 }
 
@@ -317,14 +492,14 @@ static const struct file_operations iwl_dbgfs_##name##_ops = {	\
 static const struct file_operations iwl_dbgfs_##name##_ops = {  \
         .write = iwl_dbgfs_##name##_write,                              \
         .read = iwl_dbgfs_##name##_read,                                \
-        .open = iwl_dbgfs_open_file_generic,                            \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 };
 
 #define MVM_DEBUGFS_WRITE_FILE_OPS(name)                                \
 static const struct file_operations iwl_dbgfs_##name##_ops = {  \
         .write = iwl_dbgfs_##name##_write,                              \
-        .open = iwl_dbgfs_open_file_generic,                            \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 };
 
@@ -345,8 +520,13 @@ MVM_DEBUGFS_WRITE_FILE_OPS(tx_flush);
 MVM_DEBUGFS_WRITE_FILE_OPS(sta_drain);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(sram);
 MVM_DEBUGFS_READ_FILE_OPS(stations);
+MVM_DEBUGFS_READ_FILE_OPS(bt_notif);
 MVM_DEBUGFS_WRITE_FILE_OPS(power_down_allow);
 MVM_DEBUGFS_WRITE_FILE_OPS(power_down_d3_allow);
+MVM_DEBUGFS_WRITE_FILE_OPS(fw_restart);
+
+/* Interface specific debugfs entries */
+MVM_DEBUGFS_READ_FILE_OPS(mac_params);
 
 int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
 {
@@ -358,8 +538,10 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
         MVM_DEBUGFS_ADD_FILE(sta_drain, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(sram, mvm->debugfs_dir, S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(stations, dbgfs_dir, S_IRUSR);
+        MVM_DEBUGFS_ADD_FILE(bt_notif, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(power_down_allow, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(power_down_d3_allow, mvm->debugfs_dir, S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_restart, mvm->debugfs_dir, S_IWUSR);
 
         /*
          * Create a symlink with mac80211. It will be removed when mac80211
@@ -376,3 +558,58 @@ err:
         IWL_ERR(mvm, "Can't create the mvm debugfs directory\n");
         return -ENOMEM;
 }
+
+void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+        struct dentry *dbgfs_dir = vif->debugfs_dir;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        char buf[100];
+
+        if (!dbgfs_dir)
+                return;
+
+        mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
+        mvmvif->dbgfs_data = mvm;
+
+        if (!mvmvif->dbgfs_dir) {
+                IWL_ERR(mvm, "Failed to create debugfs directory under %s\n",
+                        dbgfs_dir->d_name.name);
+                return;
+        }
+
+        MVM_DEBUGFS_ADD_FILE_VIF(mac_params, mvmvif->dbgfs_dir,
+                                 S_IRUSR);
+
+        /*
+         * Create symlink for convenience pointing to interface specific
+         * debugfs entries for the driver. For example, under
+         * /sys/kernel/debug/iwlwifi/0000\:02\:00.0/iwlmvm/
+         * find
+         * netdev:wlan0 -> ../../../ieee80211/phy0/netdev:wlan0/iwlmvm/
+         */
+        snprintf(buf, 100, "../../../%s/%s/%s/%s",
+                 dbgfs_dir->d_parent->d_parent->d_name.name,
+                 dbgfs_dir->d_parent->d_name.name,
+                 dbgfs_dir->d_name.name,
+                 mvmvif->dbgfs_dir->d_name.name);
+
+        mvmvif->dbgfs_slink = debugfs_create_symlink(dbgfs_dir->d_name.name,
+                                                     mvm->debugfs_dir, buf);
+        if (!mvmvif->dbgfs_slink)
+                IWL_ERR(mvm, "Can't create debugfs symbolic link under %s\n",
+                        dbgfs_dir->d_name.name);
+        return;
+err:
+        IWL_ERR(mvm, "Can't create debugfs entity\n");
+}
+
+void iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        debugfs_remove(mvmvif->dbgfs_slink);
+        mvmvif->dbgfs_slink = NULL;
+
+        debugfs_remove_recursive(mvmvif->dbgfs_dir);
+        mvmvif->dbgfs_dir = NULL;
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h
new file mode 100644
index 000000000000..05c61d6f384e
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h
@@ -0,0 +1,319 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef __fw_api_bt_coex_h__
+#define __fw_api_bt_coex_h__
+
+#include <linux/types.h>
+#include <linux/bitops.h>
+
+#define BITS(nb) (BIT(nb) - 1)
+
+/**
+ * enum iwl_bt_coex_flags - flags for BT_COEX command
+ * @BT_CH_PRIMARY_EN:
+ * @BT_CH_SECONDARY_EN:
+ * @BT_NOTIF_COEX_OFF:
+ * @BT_COEX_MODE_POS:
+ * @BT_COEX_MODE_MSK:
+ * @BT_COEX_DISABLE:
+ * @BT_COEX_2W:
+ * @BT_COEX_3W:
+ * @BT_COEX_NW:
+ * @BT_USE_DEFAULTS:
+ * @BT_SYNC_2_BT_DISABLE:
+ * @BT_COEX_CORUNNING_TBL_EN:
+ */
+enum iwl_bt_coex_flags {
+        BT_CH_PRIMARY_EN                = BIT(0),
+        BT_CH_SECONDARY_EN              = BIT(1),
+        BT_NOTIF_COEX_OFF               = BIT(2),
+        BT_COEX_MODE_POS                = 3,
+        BT_COEX_MODE_MSK                = BITS(3) << BT_COEX_MODE_POS,
+        BT_COEX_DISABLE                 = 0x0 << BT_COEX_MODE_POS,
+        BT_COEX_2W                      = 0x1 << BT_COEX_MODE_POS,
+        BT_COEX_3W                      = 0x2 << BT_COEX_MODE_POS,
+        BT_COEX_NW                      = 0x3 << BT_COEX_MODE_POS,
+        BT_USE_DEFAULTS                 = BIT(6),
+        BT_SYNC_2_BT_DISABLE            = BIT(7),
+        /*
+         * For future use - when the flags will be enlarged
+         * BT_COEX_CORUNNING_TBL_EN     = BIT(8),
+         */
+};
+
+/*
+ * indicates what has changed in the BT_COEX command.
+ */
+enum iwl_bt_coex_valid_bit_msk {
+        BT_VALID_ENABLE                 = BIT(0),
+        BT_VALID_BT_PRIO_BOOST          = BIT(1),
+        BT_VALID_MAX_KILL               = BIT(2),
+        BT_VALID_3W_TMRS                = BIT(3),
+        BT_VALID_KILL_ACK               = BIT(4),
+        BT_VALID_KILL_CTS               = BIT(5),
+        BT_VALID_REDUCED_TX_POWER       = BIT(6),
+        BT_VALID_LUT                    = BIT(7),
+        BT_VALID_WIFI_RX_SW_PRIO_BOOST  = BIT(8),
+        BT_VALID_WIFI_TX_SW_PRIO_BOOST  = BIT(9),
+        BT_VALID_MULTI_PRIO_LUT         = BIT(10),
+        BT_VALID_TRM_KICK_FILTER        = BIT(11),
+        BT_VALID_CORUN_LUT_20           = BIT(12),
+        BT_VALID_CORUN_LUT_40           = BIT(13),
+        BT_VALID_ANT_ISOLATION          = BIT(14),
+        BT_VALID_ANT_ISOLATION_THRS     = BIT(15),
+        /*
+         * For future use - when the valid flags will be enlarged
+         * BT_VALID_TXTX_DELTA_FREQ_THRS        = BIT(16),
+         * BT_VALID_TXRX_MAX_FREQ_0     = BIT(17),
+         */
+};
+
+/**
+ * enum iwl_bt_reduced_tx_power - allows to reduce txpower for WiFi frames.
+ * @BT_REDUCED_TX_POWER_CTL: reduce Tx power for control frames
+ * @BT_REDUCED_TX_POWER_DATA: reduce Tx power for data frames
+ *
+ * This mechanism allows to have BT and WiFi run concurrently. Since WiFi
+ * reduces its Tx power, it can work along with BT, hence reducing the amount
+ * of WiFi frames being killed by BT.
+ */
+enum iwl_bt_reduced_tx_power {
+        BT_REDUCED_TX_POWER_CTL         = BIT(0),
+        BT_REDUCED_TX_POWER_DATA        = BIT(1),
+};
+
+#define BT_COEX_LUT_SIZE (12)
+
+/**
+ * struct iwl_bt_coex_cmd - bt coex configuration command
+ * @flags:&enum iwl_bt_coex_flags
+ * @lead_time:
+ * @max_kill:
+ * @bt3_time_t7_value:
+ * @kill_ack_msk:
+ * @kill_cts_msk:
+ * @bt3_prio_sample_time:
+ * @bt3_timer_t2_value:
+ * @bt4_reaction_time:
+ * @decision_lut[12]:
+ * @bt_reduced_tx_power: enum %iwl_bt_reduced_tx_power
+ * @valid_bit_msk: enum %iwl_bt_coex_valid_bit_msk
+ * @bt_prio_boost: values for PTA boost register
+ * @wifi_tx_prio_boost: SW boost of wifi tx priority
+ * @wifi_rx_prio_boost: SW boost of wifi rx priority
+ *
+ * The structure is used for the BT_COEX command.
+ */
+struct iwl_bt_coex_cmd {
+        u8 flags;
+        u8 lead_time;
+        u8 max_kill;
+        u8 bt3_time_t7_value;
+        __le32 kill_ack_msk;
+        __le32 kill_cts_msk;
+        u8 bt3_prio_sample_time;
+        u8 bt3_timer_t2_value;
+        __le16 bt4_reaction_time;
+        __le32 decision_lut[BT_COEX_LUT_SIZE];
+        u8 bt_reduced_tx_power;
+        u8 reserved;
+        __le16 valid_bit_msk;
+        __le32 bt_prio_boost;
+        u8 reserved2;
+        u8 wifi_tx_prio_boost;
+        __le16 wifi_rx_prio_boost;
+} __packed; /* BT_COEX_CMD_API_S_VER_3 */
+
+#define BT_MBOX(n_dw, _msg, _pos, _nbits)       \
+        BT_MBOX##n_dw##_##_msg##_POS = (_pos),  \
+        BT_MBOX##n_dw##_##_msg = BITS(_nbits) << BT_MBOX##n_dw##_##_msg##_POS
+
+enum iwl_bt_mxbox_dw0 {
+        BT_MBOX(0, LE_SLAVE_LAT, 0, 3),
+        BT_MBOX(0, LE_PROF1, 3, 1),
+        BT_MBOX(0, LE_PROF2, 4, 1),
+        BT_MBOX(0, LE_PROF_OTHER, 5, 1),
+        BT_MBOX(0, CHL_SEQ_N, 8, 4),
+        BT_MBOX(0, INBAND_S, 13, 1),
+        BT_MBOX(0, LE_MIN_RSSI, 16, 4),
+        BT_MBOX(0, LE_SCAN, 20, 1),
+        BT_MBOX(0, LE_ADV, 21, 1),
+        BT_MBOX(0, LE_MAX_TX_POWER, 24, 4),
+        BT_MBOX(0, OPEN_CON_1, 28, 2),
+};
+
+enum iwl_bt_mxbox_dw1 {
+        BT_MBOX(1, BR_MAX_TX_POWER, 0, 4),
+        BT_MBOX(1, IP_SR, 4, 1),
+        BT_MBOX(1, LE_MSTR, 5, 1),
+        BT_MBOX(1, AGGR_TRFC_LD, 8, 6),
+        BT_MBOX(1, MSG_TYPE, 16, 3),
+        BT_MBOX(1, SSN, 19, 2),
+};
+
+enum iwl_bt_mxbox_dw2 {
+        BT_MBOX(2, SNIFF_ACT, 0, 3),
+        BT_MBOX(2, PAG, 3, 1),
+        BT_MBOX(2, INQUIRY, 4, 1),
+        BT_MBOX(2, CONN, 5, 1),
+        BT_MBOX(2, SNIFF_INTERVAL, 8, 5),
+        BT_MBOX(2, DISC, 13, 1),
+        BT_MBOX(2, SCO_TX_ACT, 16, 2),
+        BT_MBOX(2, SCO_RX_ACT, 18, 2),
+        BT_MBOX(2, ESCO_RE_TX, 20, 2),
+        BT_MBOX(2, SCO_DURATION, 24, 6),
+};
+
+enum iwl_bt_mxbox_dw3 {
+        BT_MBOX(3, SCO_STATE, 0, 1),
+        BT_MBOX(3, SNIFF_STATE, 1, 1),
+        BT_MBOX(3, A2DP_STATE, 2, 1),
+        BT_MBOX(3, ACL_STATE, 3, 1),
+        BT_MBOX(3, MSTR_STATE, 4, 1),
+        BT_MBOX(3, OBX_STATE, 5, 1),
+        BT_MBOX(3, OPEN_CON_2, 8, 2),
+        BT_MBOX(3, TRAFFIC_LOAD, 10, 2),
+        BT_MBOX(3, CHL_SEQN_LSB, 12, 1),
+        BT_MBOX(3, INBAND_P, 13, 1),
+        BT_MBOX(3, MSG_TYPE_2, 16, 3),
+        BT_MBOX(3, SSN_2, 19, 2),
+        BT_MBOX(3, UPDATE_REQUEST, 21, 1),
+};
+
+#define BT_MBOX_MSG(_notif, _num, _field)                                    \
+        ((le32_to_cpu((_notif)->mbox_msg[(_num)]) & BT_MBOX##_num##_##_field)\
+        >> BT_MBOX##_num##_##_field##_POS)
+
+/**
+ * struct iwl_bt_coex_profile_notif - notification about BT coex
+ * @mbox_msg: message from BT to WiFi
+ * @:bt_status: 0 - off, 1 - on
+ * @:bt_open_conn: number of BT connections open
+ * @:bt_traffic_load: load of BT traffic
+ * @:bt_agg_traffic_load: aggregated load of BT traffic
+ * @:bt_ci_compliance: 0 - no CI compliance, 1 - CI compliant
+ */
+struct iwl_bt_coex_profile_notif {
+        __le32 mbox_msg[4];
+        u8 bt_status;
+        u8 bt_open_conn;
+        u8 bt_traffic_load;
+        u8 bt_agg_traffic_load;
+        u8 bt_ci_compliance;
+        u8 reserved[3];
+} __packed; /* BT_COEX_PROFILE_NTFY_API_S_VER_2 */
+
+enum iwl_bt_coex_prio_table_event {
+        BT_COEX_PRIO_TBL_EVT_INIT_CALIB1                = 0,
+        BT_COEX_PRIO_TBL_EVT_INIT_CALIB2                = 1,
+        BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_LOW1        = 2,
+        BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_LOW2        = 3,
+        BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_HIGH1       = 4,
+        BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_HIGH2       = 5,
+        BT_COEX_PRIO_TBL_EVT_DTIM                       = 6,
+        BT_COEX_PRIO_TBL_EVT_SCAN52                     = 7,
+        BT_COEX_PRIO_TBL_EVT_SCAN24                     = 8,
+        BT_COEX_PRIO_TBL_EVT_IDLE                       = 9,
+        BT_COEX_PRIO_TBL_EVT_MAX                        = 16,
+}; /* BT_COEX_PRIO_TABLE_EVENTS_API_E_VER_1 */
+
+enum iwl_bt_coex_prio_table_prio {
+        BT_COEX_PRIO_TBL_DISABLED       = 0,
+        BT_COEX_PRIO_TBL_PRIO_LOW       = 1,
+        BT_COEX_PRIO_TBL_PRIO_HIGH      = 2,
+        BT_COEX_PRIO_TBL_PRIO_BYPASS    = 3,
+        BT_COEX_PRIO_TBL_PRIO_COEX_OFF  = 4,
+        BT_COEX_PRIO_TBL_PRIO_COEX_ON   = 5,
+        BT_COEX_PRIO_TBL_PRIO_COEX_IDLE = 6,
+        BT_COEX_PRIO_TBL_MAX            = 8,
+}; /* BT_COEX_PRIO_TABLE_PRIORITIES_API_E_VER_1 */
+
+#define BT_COEX_PRIO_TBL_SHRD_ANT_POS     (0)
+#define BT_COEX_PRIO_TBL_PRIO_POS         (1)
+#define BT_COEX_PRIO_TBL_RESERVED_POS     (4)
+
+/**
+ * struct iwl_bt_coex_prio_tbl_cmd - priority table for BT coex
+ * @prio_tbl:
+ */
+struct iwl_bt_coex_prio_tbl_cmd {
+        u8 prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX];
+} __packed;
+
+enum iwl_bt_coex_env_action {
+        BT_COEX_ENV_CLOSE        = 0,
+        BT_COEX_ENV_OPEN         = 1,
+}; /* BT_COEX_PROT_ENV_ACTION_API_E_VER_1 */
+
+/**
+ * struct iwl_bt_coex_prot_env_cmd - BT Protection Envelope
+ * @action: enum %iwl_bt_coex_env_action
+ * @type: enum %iwl_bt_coex_prio_table_event
+ */
+struct iwl_bt_coex_prot_env_cmd {
+        u8 action; /* 0 = closed, 1 = open */
+        u8 type; /* 0 .. 15 */
+        u8 reserved[2];
+} __packed;
+
+#endif /* __fw_api_bt_coex_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
index cf6f9a02fb74..51e015d1dfb2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -258,7 +258,7 @@ enum iwl_wowlan_wakeup_reason {
         IWL_WOWLAN_WAKEUP_BY_FOUR_WAY_HANDSHAKE                 = BIT(8),
         IWL_WOWLAN_WAKEUP_BY_REM_WAKE_LINK_LOSS                 = BIT(9),
         IWL_WOWLAN_WAKEUP_BY_REM_WAKE_SIGNATURE_TABLE           = BIT(10),
-        IWL_WOWLAN_WAKEUP_BY_REM_WAKE_TCP_EXTERNAL              = BIT(11),
+        /* BIT(11) reserved */
         IWL_WOWLAN_WAKEUP_BY_REM_WAKE_WAKEUP_PACKET             = BIT(12),
 }; /* WOWLAN_WAKE_UP_REASON_API_E_VER_2 */
 
@@ -277,6 +277,55 @@ struct iwl_wowlan_status {
         u8 wake_packet[]; /* can be truncated from _length to _bufsize */
 } __packed; /* WOWLAN_STATUSES_API_S_VER_4 */
 
+#define IWL_WOWLAN_TCP_MAX_PACKET_LEN           64
+#define IWL_WOWLAN_REMOTE_WAKE_MAX_PACKET_LEN   128
+#define IWL_WOWLAN_REMOTE_WAKE_MAX_TOKENS       2048
+
+struct iwl_tcp_packet_info {
+        __le16 tcp_pseudo_header_checksum;
+        __le16 tcp_payload_length;
+} __packed; /* TCP_PACKET_INFO_API_S_VER_2 */
+
+struct iwl_tcp_packet {
+        struct iwl_tcp_packet_info info;
+        u8 rx_mask[IWL_WOWLAN_MAX_PATTERN_LEN / 8];
+        u8 data[IWL_WOWLAN_TCP_MAX_PACKET_LEN];
+} __packed; /* TCP_PROTOCOL_PACKET_API_S_VER_1 */
+
+struct iwl_remote_wake_packet {
+        struct iwl_tcp_packet_info info;
+        u8 rx_mask[IWL_WOWLAN_MAX_PATTERN_LEN / 8];
+        u8 data[IWL_WOWLAN_REMOTE_WAKE_MAX_PACKET_LEN];
+} __packed; /* TCP_PROTOCOL_PACKET_API_S_VER_1 */
+
+struct iwl_wowlan_remote_wake_config {
+        __le32 connection_max_time; /* unused */
+        /* TCP_PROTOCOL_CONFIG_API_S_VER_1 */
+        u8 max_syn_retries;
+        u8 max_data_retries;
+        u8 tcp_syn_ack_timeout;
+        u8 tcp_ack_timeout;
+
+        struct iwl_tcp_packet syn_tx;
+        struct iwl_tcp_packet synack_rx;
+        struct iwl_tcp_packet keepalive_ack_rx;
+        struct iwl_tcp_packet fin_tx;
+
+        struct iwl_remote_wake_packet keepalive_tx;
+        struct iwl_remote_wake_packet wake_rx;
+
+        /* REMOTE_WAKE_OFFSET_INFO_API_S_VER_1 */
+        u8 sequence_number_offset;
+        u8 sequence_number_length;
+        u8 token_offset;
+        u8 token_length;
+        /* REMOTE_WAKE_PROTOCOL_PARAMS_API_S_VER_1 */
+        __le32 initial_sequence_number;
+        __le16 keepalive_interval;
+        __le16 num_tokens;
+        u8 tokens[IWL_WOWLAN_REMOTE_WAKE_MAX_TOKENS];
+} __packed; /* REMOTE_WAKE_CONFIG_API_S_VER_2 */
+
 /* TODO: NetDetect API */
 
 #endif /* __fw_api_d3_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
index ae39b7dfda7b..d68640ea41d4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index be36b7604b7f..81fe45f46be7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -68,73 +68,53 @@
 
 /**
  * enum iwl_scan_flags - masks for power table command flags
+ * @POWER_FLAGS_POWER_SAVE_ENA_MSK: '1' Allow to save power by turning off
+ *              receiver and transmitter. '0' - does not allow.
  * @POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK: '0' Driver disables power management,
  *              '1' Driver enables PM (use rest of parameters)
- * @POWER_FLAGS_SLEEP_OVER_DTIM_MSK: '0' PM have to walk up every DTIM,
+ * @POWER_FLAGS_SKIP_OVER_DTIM_MSK: '0' PM have to walk up every DTIM,
  *              '1' PM could sleep over DTIM till listen Interval.
- * @POWER_FLAGS_LPRX_ENA_MSK: Low Power RX enable.
- * @POWER_FLAGS_SNOOZE_ENA_MSK: Enable snoozing only if uAPSD is enabled and all
- *              access categories are both delivery and trigger enabled.
- * @POWER_FLAGS_BT_SCO_ENA: Enable BT SCO coex only if uAPSD and
- *              PBW Snoozing enabled
  * @POWER_FLAGS_ADVANCE_PM_ENA_MSK: Advanced PM (uAPSD) enable mask
+ * @POWER_FLAGS_LPRX_ENA_MSK: Low Power RX enable.
 */
 enum iwl_power_flags {
-        POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK    = BIT(0),
-        POWER_FLAGS_SLEEP_OVER_DTIM_MSK         = BIT(1),
-        POWER_FLAGS_LPRX_ENA_MSK                = BIT(2),
-        POWER_FLAGS_SNOOZE_ENA_MSK              = BIT(3),
-        POWER_FLAGS_BT_SCO_ENA                  = BIT(4),
-        POWER_FLAGS_ADVANCE_PM_ENA_MSK          = BIT(5)
+        POWER_FLAGS_POWER_SAVE_ENA_MSK          = BIT(0),
+        POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK    = BIT(1),
+        POWER_FLAGS_SKIP_OVER_DTIM_MSK          = BIT(2),
+        POWER_FLAGS_ADVANCE_PM_ENA_MSK          = BIT(9),
+        POWER_FLAGS_LPRX_ENA_MSK                = BIT(11),
 };
 
+#define IWL_POWER_VEC_SIZE 5
+
 /**
  * struct iwl_powertable_cmd - Power Table Command
  * POWER_TABLE_CMD = 0x77 (command, has simple generic response)
  *
- * @id_and_color:       MAC contex identifier
- * @action:             Action on context - no action, add new,
- *                      modify existent, remove
  * @flags:              Power table command flags from POWER_FLAGS_*
  * @keep_alive_seconds: Keep alive period in seconds. Default - 25 sec.
- *                      Minimum allowed:- 3 * DTIM
+ *                      Minimum allowed:- 3 * DTIM. Keep alive period must be
+ *                      set regardless of power scheme or current power state.
+ *                      FW use this value also when PM is disabled.
  * @rx_data_timeout:    Minimum time (usec) from last Rx packet for AM to
  *                      PSM transition - legacy PM
  * @tx_data_timeout:    Minimum time (usec) from last Tx packet for AM to
  *                      PSM transition - legacy PM
- * @rx_data_timeout_uapsd: Minimum time (usec) from last Rx packet for AM to
- *                      PSM transition - uAPSD
- * @tx_data_timeout_uapsd: Minimum time (usec) from last Tx packet for AM to
- *                      PSM transition - uAPSD
+ * @sleep_interval:     not in use
+ * @keep_alive_beacons: not in use
  * @lprx_rssi_threshold: Signal strength up to which LP RX can be enabled.
  *                      Default: 80dbm
- * @num_skip_dtim:      Number of DTIMs to skip if Skip over DTIM flag is set
- * @snooze_interval:    TBD
- * @snooze_window:      TBD
- * @snooze_step:        TBD
- * @qndp_tid:           TBD
- * @uapsd_ac_flags:     TBD
- * @uapsd_max_sp:       TBD
  */
 struct iwl_powertable_cmd {
-        /* COMMON_INDEX_HDR_API_S_VER_1 */
-        __le32 id_and_color;
-        __le32 action;
+        /* PM_POWER_TABLE_CMD_API_S_VER_5 */
         __le16 flags;
-        u8 reserved;
-        __le16 keep_alive_seconds;
+        u8 keep_alive_seconds;
+        u8 debug_flags;
         __le32 rx_data_timeout;
         __le32 tx_data_timeout;
-        __le32 rx_data_timeout_uapsd;
-        __le32 tx_data_timeout_uapsd;
-        u8 lprx_rssi_threshold;
-        u8 num_skip_dtim;
-        __le16 snooze_interval;
-        __le16 snooze_window;
-        u8 snooze_step;
-        u8 qndp_tid;
-        u8 uapsd_ac_flags;
-        u8 uapsd_max_sp;
+        __le32 sleep_interval[IWL_POWER_VEC_SIZE];
+        __le32 keep_alive_beacons;
+        __le32 lprx_rssi_threshold;
 } __packed;
 
 #endif
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
index aa3474d08231..fdd33bc0a594 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 670ac8f95e26..b60d14151721 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
index 0acb53dda22d..a30691a8a85b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index 2677914bf0a6..007a93b25bd7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -537,6 +537,12 @@ struct iwl_mac_beacon_cmd {
         struct ieee80211_hdr frame[0];
 } __packed;
 
+struct iwl_beacon_notif {
+        struct iwl_mvm_tx_resp beacon_notify_hdr;
+        __le64 tsf;
+        __le32 ibss_mgr_status;
+} __packed;
+
 /**
  * enum iwl_dump_control - dump (flush) control flags
  * @DUMP_TX_FIFO_FLUSH: Dump MSDUs until the the FIFO is empty
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 23eebda848b0..191dcae8ba47 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -70,6 +70,7 @@
 #include "fw-api-mac.h"
 #include "fw-api-power.h"
 #include "fw-api-d3.h"
+#include "fw-api-bt-coex.h"
 
 /* queue and FIFO numbers by usage */
 enum {
@@ -150,8 +151,10 @@ enum {
 
         SET_CALIB_DEFAULT_CMD = 0x8e,
 
+        BEACON_NOTIFICATION = 0x90,
         BEACON_TEMPLATE_CMD = 0x91,
         TX_ANT_CONFIGURATION_CMD = 0x98,
+        BT_CONFIG = 0x9b,
         STATISTICS_NOTIFICATION = 0x9d,
 
         /* RF-KILL commands and notifications */
@@ -162,6 +165,11 @@ enum {
         REPLY_RX_MPDU_CMD = 0xc1,
         BA_NOTIF = 0xc5,
 
+        /* BT Coex */
+        BT_COEX_PRIO_TABLE = 0xcc,
+        BT_COEX_PROT_ENV = 0xcd,
+        BT_PROFILE_NOTIFICATION = 0xce,
+
         REPLY_DEBUG_CMD = 0xf0,
         DEBUG_LOG_MSG = 0xf7,
 
@@ -271,38 +279,7 @@ enum {
         NVM_ACCESS_TARGET_EEPROM = 2,
 };
 
-/**
- * struct iwl_nvm_access_cmd_ver1 - Request the device to send the NVM.
- * @op_code: 0 - read, 1 - write.
- * @target: NVM_ACCESS_TARGET_*. should be 0 for read.
- * @cache_refresh: 0 - None, 1- NVM.
- * @offset: offset in the nvm data.
- * @length: of the chunk.
- * @data: empty on read, the NVM chunk on write
- */
-struct iwl_nvm_access_cmd_ver1 {
-        u8 op_code;
-        u8 target;
-        u8 cache_refresh;
-        u8 reserved;
-        __le16 offset;
-        __le16 length;
-        u8 data[];
-} __packed; /* NVM_ACCESS_CMD_API_S_VER_1 */
-
-/**
- * struct iwl_nvm_access_resp_ver1 - response to NVM_ACCESS_CMD
- * @offset: the offset in the nvm data
- * @length: of the chunk
- * @data: the nvm chunk on when NVM_ACCESS_CMD was read, nothing on write
- */
-struct iwl_nvm_access_resp_ver1 {
-        __le16 offset;
-        __le16 length;
-        u8 data[];
-} __packed; /* NVM_ACCESS_CMD_RESP_API_S_VER_1 */
-
-/* Section types for NVM_ACCESS_CMD version 2 */
+/* Section types for NVM_ACCESS_CMD */
 enum {
         NVM_SECTION_TYPE_HW = 0,
         NVM_SECTION_TYPE_SW,
@@ -323,7 +300,7 @@ enum {
  * @length: in bytes, to read/write
  * @data: if write operation, the data to write. On read its empty
  */
-struct iwl_nvm_access_cmd_ver2 {
+struct iwl_nvm_access_cmd {
         u8 op_code;
         u8 target;
         __le16 type;
@@ -340,7 +317,7 @@ struct iwl_nvm_access_cmd_ver2 {
  * @status: 0 for success, fail otherwise
  * @data: if read operation, the data returned. Empty on write.
  */
-struct iwl_nvm_access_resp_ver2 {
+struct iwl_nvm_access_resp {
         __le16 offset;
         __le16 length;
         __le16 type;
@@ -503,15 +480,34 @@ enum {
         TE_DEP_TSF              = 2,
         TE_EVENT_SOCIOPATHIC    = 4,
 }; /* MAC_EVENT_DEPENDENCY_POLICY_API_E_VER_2 */
-
-/* When to send Time Event notifications and to whom (internal = FW) */
+/*
+ * Supported Time event notifications configuration.
+ * A notification (both event and fragment) includes a status indicating weather
+ * the FW was able to schedule the event or not. For fragment start/end
+ * notification the status is always success. There is no start/end fragment
+ * notification for monolithic events.
+ *
+ * @TE_NOTIF_NONE: no notifications
+ * @TE_NOTIF_HOST_EVENT_START: request/receive notification on event start
+ * @TE_NOTIF_HOST_EVENT_END:request/receive notification on event end
+ * @TE_NOTIF_INTERNAL_EVENT_START: internal FW use
+ * @TE_NOTIF_INTERNAL_EVENT_END: internal FW use.
+ * @TE_NOTIF_HOST_FRAG_START: request/receive notification on frag start
+ * @TE_NOTIF_HOST_FRAG_END:request/receive notification on frag end
+ * @TE_NOTIF_INTERNAL_FRAG_START: internal FW use.
+ * @TE_NOTIF_INTERNAL_FRAG_END: internal FW use.
+ */
 enum {
         TE_NOTIF_NONE = 0,
-        TE_NOTIF_HOST_START = 0x1,
-        TE_NOTIF_HOST_END = 0x2,
-        TE_NOTIF_INTERNAL_START = 0x4,
-        TE_NOTIF_INTERNAL_END = 0x8
-}; /* MAC_EVENT_ACTION_API_E_VER_1 */
+        TE_NOTIF_HOST_EVENT_START = 0x1,
+        TE_NOTIF_HOST_EVENT_END = 0x2,
+        TE_NOTIF_INTERNAL_EVENT_START = 0x4,
+        TE_NOTIF_INTERNAL_EVENT_END = 0x8,
+        TE_NOTIF_HOST_FRAG_START = 0x10,
+        TE_NOTIF_HOST_FRAG_END = 0x20,
+        TE_NOTIF_INTERNAL_FRAG_START = 0x40,
+        TE_NOTIF_INTERNAL_FRAG_END = 0x80
+}; /* MAC_EVENT_ACTION_API_E_VER_2 */
 
 /*
  * @TE_FRAG_NONE: fragmentation of the time event is NOT allowed.
@@ -762,18 +758,20 @@ struct iwl_phy_context_cmd {
 #define IWL_RX_INFO_PHY_CNT 8
 #define IWL_RX_INFO_AGC_IDX 1
 #define IWL_RX_INFO_RSSI_AB_IDX 2
-#define IWL_RX_INFO_RSSI_C_IDX 3
-#define IWL_OFDM_AGC_DB_MSK 0xfe00
-#define IWL_OFDM_AGC_DB_POS 9
+#define IWL_OFDM_AGC_A_MSK 0x0000007f
+#define IWL_OFDM_AGC_A_POS 0
+#define IWL_OFDM_AGC_B_MSK 0x00003f80
+#define IWL_OFDM_AGC_B_POS 7
+#define IWL_OFDM_AGC_CODE_MSK 0x3fe00000
+#define IWL_OFDM_AGC_CODE_POS 20
 #define IWL_OFDM_RSSI_INBAND_A_MSK 0x00ff
-#define IWL_OFDM_RSSI_ALLBAND_A_MSK 0xff00
 #define IWL_OFDM_RSSI_A_POS 0
+#define IWL_OFDM_RSSI_ALLBAND_A_MSK 0xff00
+#define IWL_OFDM_RSSI_ALLBAND_A_POS 8
 #define IWL_OFDM_RSSI_INBAND_B_MSK 0xff0000
-#define IWL_OFDM_RSSI_ALLBAND_B_MSK 0xff000000
 #define IWL_OFDM_RSSI_B_POS 16
-#define IWL_OFDM_RSSI_INBAND_C_MSK 0x00ff
-#define IWL_OFDM_RSSI_ALLBAND_C_MSK 0xff00
-#define IWL_OFDM_RSSI_C_POS 0
+#define IWL_OFDM_RSSI_ALLBAND_B_MSK 0xff000000
+#define IWL_OFDM_RSSI_ALLBAND_B_POS 24
 
 /**
  * struct iwl_rx_phy_info - phy info
@@ -792,6 +790,7 @@ struct iwl_phy_context_cmd {
  * @byte_count: frame's byte-count
  * @frame_time: frame's time on the air, based on byte count and frame rate
  *      calculation
+ * @mac_active_msk: what MACs were active when the frame was received
  *
  * Before each Rx, the device sends this data. It contains PHY information
  * about the reception of the packet.
@@ -809,7 +808,7 @@ struct iwl_rx_phy_info {
         __le32 non_cfg_phy[IWL_RX_INFO_PHY_CNT];
         __le32 rate_n_flags;
         __le32 byte_count;
-        __le16 reserved2;
+        __le16 mac_active_msk;
         __le16 frame_time;
 } __packed;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index d3d959db03a9..e18c92dd60ec 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -79,17 +79,8 @@
 #define UCODE_VALID_OK  cpu_to_le32(0x1)
 
 /* Default calibration values for WkP - set to INIT image w/o running */
-static const u8 wkp_calib_values_bb_filter[] = { 0xbf, 0x00, 0x5f, 0x00, 0x2f,
-                                                 0x00, 0x18, 0x00 };
-static const u8 wkp_calib_values_rx_dc[] = { 0x7f, 0x7f, 0x7f, 0x7f, 0x7f,
-                                             0x7f, 0x7f, 0x7f };
-static const u8 wkp_calib_values_tx_lo[] = { 0x00, 0x00, 0x00, 0x00 };
-static const u8 wkp_calib_values_tx_iq[] = { 0xff, 0x00, 0xff, 0x00, 0x00,
-                                             0x00 };
-static const u8 wkp_calib_values_rx_iq[] = { 0xff, 0x00, 0x00, 0x00 };
 static const u8 wkp_calib_values_rx_iq_skew[] = { 0x00, 0x00, 0x01, 0x00 };
 static const u8 wkp_calib_values_tx_iq_skew[] = { 0x01, 0x00, 0x00, 0x00 };
-static const u8 wkp_calib_values_xtal[] = { 0xd2, 0xd2 };
 
 struct iwl_calib_default_data {
         u16 size;
@@ -99,12 +90,7 @@ struct iwl_calib_default_data {
 #define CALIB_SIZE_N_DATA(_buf) {.size = sizeof(_buf), .data = &_buf}
 
 static const struct iwl_calib_default_data wkp_calib_default_data[12] = {
-        [5] = CALIB_SIZE_N_DATA(wkp_calib_values_rx_dc),
-        [6] = CALIB_SIZE_N_DATA(wkp_calib_values_bb_filter),
-        [7] = CALIB_SIZE_N_DATA(wkp_calib_values_tx_lo),
-        [8] = CALIB_SIZE_N_DATA(wkp_calib_values_tx_iq),
         [9] = CALIB_SIZE_N_DATA(wkp_calib_values_tx_iq_skew),
-        [10] = CALIB_SIZE_N_DATA(wkp_calib_values_rx_iq),
         [11] = CALIB_SIZE_N_DATA(wkp_calib_values_rx_iq_skew),
 };
 
@@ -128,7 +114,7 @@ static int iwl_send_tx_ant_cfg(struct iwl_mvm *mvm, u8 valid_tx_ant)
                 .valid = cpu_to_le32(valid_tx_ant),
         };
 
-        IWL_DEBUG_HC(mvm, "select valid tx ant: %u\n", valid_tx_ant);
+        IWL_DEBUG_FW(mvm, "select valid tx ant: %u\n", valid_tx_ant);
         return iwl_mvm_send_cmd_pdu(mvm, TX_ANT_CONFIGURATION_CMD, CMD_SYNC,
                                     sizeof(tx_ant_cmd), &tx_ant_cmd);
 }
@@ -148,9 +134,10 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
         alive_data->scd_base_addr = le32_to_cpu(palive->scd_base_ptr);
 
         alive_data->valid = le16_to_cpu(palive->status) == IWL_ALIVE_STATUS_OK;
-        IWL_DEBUG_FW(mvm, "Alive ucode status 0x%04x revision 0x%01X 0x%01X\n",
+        IWL_DEBUG_FW(mvm,
+                     "Alive ucode status 0x%04x revision 0x%01X 0x%01X flags 0x%01X\n",
                      le16_to_cpu(palive->status), palive->ver_type,
-                     palive->ver_subtype);
+                     palive->ver_subtype, palive->flags);
 
         return true;
 }
@@ -241,20 +228,6 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
 
         return 0;
 }
-#define IWL_HW_REV_ID_RAINBOW   0x2
-#define IWL_PROJ_TYPE_LHP       0x5
-
-static u32 iwl_mvm_build_phy_cfg(struct iwl_mvm *mvm)
-{
-        struct iwl_nvm_data *data = mvm->nvm_data;
-        /* Temp calls to static definitions, will be changed to CSR calls */
-        u8 hw_rev_id = IWL_HW_REV_ID_RAINBOW;
-        u8 project_type = IWL_PROJ_TYPE_LHP;
-
-        return data->radio_cfg_dash | (data->radio_cfg_step << 2) |
-                (hw_rev_id << 4) | ((project_type & 0x7f) << 6) |
-                (data->valid_tx_ant << 16) | (data->valid_rx_ant << 20);
-}
 
 static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
 {
@@ -262,7 +235,7 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
         enum iwl_ucode_type ucode_type = mvm->cur_ucode;
 
         /* Set parameters */
-        phy_cfg_cmd.phy_cfg = cpu_to_le32(iwl_mvm_build_phy_cfg(mvm));
+        phy_cfg_cmd.phy_cfg = cpu_to_le32(mvm->fw->phy_config);
         phy_cfg_cmd.calib_control.event_trigger =
                 mvm->fw->default_calib[ucode_type].event_trigger;
         phy_cfg_cmd.calib_control.flow_trigger =
@@ -275,103 +248,6 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
                                     sizeof(phy_cfg_cmd), &phy_cfg_cmd);
 }
 
-/* Starting with the new PHY DB implementation - New calibs are enabled */
-/* Value - 0x405e7 */
-#define IWL_CALIB_DEFAULT_FLOW_INIT     (IWL_CALIB_CFG_XTAL_IDX         |\
-                                         IWL_CALIB_CFG_TEMPERATURE_IDX  |\
-                                         IWL_CALIB_CFG_VOLTAGE_READ_IDX |\
-                                         IWL_CALIB_CFG_DC_IDX           |\
-                                         IWL_CALIB_CFG_BB_FILTER_IDX    |\
-                                         IWL_CALIB_CFG_LO_LEAKAGE_IDX   |\
-                                         IWL_CALIB_CFG_TX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_RX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_AGC_IDX)
-
-#define IWL_CALIB_DEFAULT_EVENT_INIT    0x0
-
-/* Value 0x41567 */
-#define IWL_CALIB_DEFAULT_FLOW_RUN      (IWL_CALIB_CFG_XTAL_IDX         |\
-                                         IWL_CALIB_CFG_TEMPERATURE_IDX  |\
-                                         IWL_CALIB_CFG_VOLTAGE_READ_IDX |\
-                                         IWL_CALIB_CFG_BB_FILTER_IDX    |\
-                                         IWL_CALIB_CFG_DC_IDX           |\
-                                         IWL_CALIB_CFG_TX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_RX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_SENSITIVITY_IDX  |\
-                                         IWL_CALIB_CFG_AGC_IDX)
-
-#define IWL_CALIB_DEFAULT_EVENT_RUN     (IWL_CALIB_CFG_XTAL_IDX         |\
-                                         IWL_CALIB_CFG_TEMPERATURE_IDX  |\
-                                         IWL_CALIB_CFG_VOLTAGE_READ_IDX |\
-                                         IWL_CALIB_CFG_TX_PWR_IDX       |\
-                                         IWL_CALIB_CFG_DC_IDX           |\
-                                         IWL_CALIB_CFG_TX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_SENSITIVITY_IDX)
-
-/*
- * Sets the calibrations trigger values that will be sent to the FW for runtime
- * and init calibrations.
- * The ones given in the FW TLV are not correct.
- */
-static void iwl_set_default_calib_trigger(struct iwl_mvm *mvm)
-{
-        struct iwl_tlv_calib_ctrl default_calib;
-
-        /*
-         * WkP FW TLV calib bits are wrong, overwrite them.
-         * This defines the dynamic calibrations which are implemented in the
-         * uCode both for init(flow) calculation and event driven calibs.
-         */
-
-        /* Init Image */
-        default_calib.event_trigger = cpu_to_le32(IWL_CALIB_DEFAULT_EVENT_INIT);
-        default_calib.flow_trigger = cpu_to_le32(IWL_CALIB_DEFAULT_FLOW_INIT);
-
-        if (default_calib.event_trigger !=
-            mvm->fw->default_calib[IWL_UCODE_INIT].event_trigger)
-                IWL_ERR(mvm,
-                        "Updating the event calib for INIT image: 0x%x -> 0x%x\n",
-                        mvm->fw->default_calib[IWL_UCODE_INIT].event_trigger,
-                        default_calib.event_trigger);
-        if (default_calib.flow_trigger !=
-            mvm->fw->default_calib[IWL_UCODE_INIT].flow_trigger)
-                IWL_ERR(mvm,
-                        "Updating the flow calib for INIT image: 0x%x -> 0x%x\n",
-                        mvm->fw->default_calib[IWL_UCODE_INIT].flow_trigger,
-                        default_calib.flow_trigger);
-
-        memcpy((void *)&mvm->fw->default_calib[IWL_UCODE_INIT],
-               &default_calib, sizeof(struct iwl_tlv_calib_ctrl));
-        IWL_ERR(mvm,
-                "Setting uCode init calibrations event 0x%x, trigger 0x%x\n",
-                default_calib.event_trigger,
-                default_calib.flow_trigger);
-
-        /* Run time image */
-        default_calib.event_trigger = cpu_to_le32(IWL_CALIB_DEFAULT_EVENT_RUN);
-        default_calib.flow_trigger = cpu_to_le32(IWL_CALIB_DEFAULT_FLOW_RUN);
-
-        if (default_calib.event_trigger !=
-            mvm->fw->default_calib[IWL_UCODE_REGULAR].event_trigger)
-                IWL_ERR(mvm,
-                        "Updating the event calib for RT image: 0x%x -> 0x%x\n",
-                        mvm->fw->default_calib[IWL_UCODE_REGULAR].event_trigger,
-                        default_calib.event_trigger);
-        if (default_calib.flow_trigger !=
-            mvm->fw->default_calib[IWL_UCODE_REGULAR].flow_trigger)
-                IWL_ERR(mvm,
-                        "Updating the flow calib for RT image: 0x%x -> 0x%x\n",
-                        mvm->fw->default_calib[IWL_UCODE_REGULAR].flow_trigger,
-                        default_calib.flow_trigger);
-
-        memcpy((void *)&mvm->fw->default_calib[IWL_UCODE_REGULAR],
-               &default_calib, sizeof(struct iwl_tlv_calib_ctrl));
-        IWL_ERR(mvm,
-                "Setting uCode runtime calibs event 0x%x, trigger 0x%x\n",
-                default_calib.event_trigger,
-                default_calib.flow_trigger);
-}
-
 static int iwl_set_default_calibrations(struct iwl_mvm *mvm)
 {
         u8 cmd_raw[16]; /* holds the variable size commands */
@@ -434,6 +310,10 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                 goto error;
         }
 
+        ret = iwl_send_bt_prio_tbl(mvm);
+        if (ret)
+                goto error;
+
         if (read_nvm) {
                 /* Read nvm */
                 ret = iwl_nvm_init(mvm);
@@ -446,15 +326,15 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         ret = iwl_nvm_check_version(mvm->nvm_data, mvm->trans);
         WARN_ON(ret);
 
-        /* Override the calibrations from TLV and the const of fw */
-        iwl_set_default_calib_trigger(mvm);
+        /* Send TX valid antennas before triggering calibrations */
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_fw_valid_tx_ant(mvm->fw));
+        if (ret)
+                goto error;
 
-        /* WkP doesn't have all calibrations, need to set default values */
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
-                ret = iwl_set_default_calibrations(mvm);
-                if (ret)
-                        goto error;
-        }
+        /* need to set default values */
+        ret = iwl_set_default_calibrations(mvm);
+        if (ret)
+                goto error;
 
         /*
          * Send phy configurations command to init uCode
@@ -533,7 +413,15 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 goto error;
         }
 
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->nvm_data->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_fw_valid_tx_ant(mvm->fw));
+        if (ret)
+                goto error;
+
+        ret = iwl_send_bt_prio_tbl(mvm);
+        if (ret)
+                goto error;
+
+        ret = iwl_send_bt_init_conf(mvm);
         if (ret)
                 goto error;
 
@@ -579,7 +467,7 @@ int iwl_mvm_load_d3_fw(struct iwl_mvm *mvm)
                 goto error;
         }
 
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->nvm_data->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_fw_valid_tx_ant(mvm->fw));
         if (ret)
                 goto error;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/led.c b/drivers/net/wireless/iwlwifi/mvm/led.c
index 011906e73a05..2269a9e5cc67 100644
--- a/drivers/net/wireless/iwlwifi/mvm/led.c
+++ b/drivers/net/wireless/iwlwifi/mvm/led.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 1d20287b1120..e6eca4d66f6c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -196,7 +196,7 @@ u32 iwl_mvm_mac_get_queues_mask(struct iwl_mvm *mvm,
         u32 qmask, ac;
 
         if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
-                return BIT(IWL_OFFCHANNEL_QUEUE);
+                return BIT(IWL_MVM_OFFCHANNEL_QUEUE);
 
         qmask = (vif->cab_queue != IEEE80211_INVAL_HW_QUEUE) ?
                 BIT(vif->cab_queue) : 0;
@@ -553,9 +553,9 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
         if (vif->bss_conf.qos)
                 cmd->qos_flags |= cpu_to_le32(MAC_QOS_FLG_UPDATE_EDCA);
 
+        /* Don't use cts to self as the fw doesn't support it currently. */
         if (vif->bss_conf.use_cts_prot)
-                cmd->protection_flags |= cpu_to_le32(MAC_PROT_FLG_TGG_PROTECT |
-                                                     MAC_PROT_FLG_SELF_CTS_EN);
+                cmd->protection_flags |= cpu_to_le32(MAC_PROT_FLG_TGG_PROTECT);
 
         /*
          * I think that we should enable these 2 flags regardless the HT PROT
@@ -651,6 +651,13 @@ static int iwl_mvm_mac_ctxt_cmd_station(struct iwl_mvm *mvm,
         /* Fill the common data for all mac context types */
         iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
 
+        /* Allow beacons to pass through as long as we are not associated,or we
+         * do not have dtim period information */
+        if (!vif->bss_conf.assoc || !vif->bss_conf.dtim_period)
+                cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_BEACON);
+        else
+                cmd.filter_flags &= ~cpu_to_le32(MAC_FILTER_IN_BEACON);
+
         /* Fill the data specific for station mode */
         iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.sta);
 
@@ -687,7 +694,12 @@ static int iwl_mvm_mac_ctxt_cmd_listener(struct iwl_mvm *mvm,
         WARN_ON(vif->type != NL80211_IFTYPE_MONITOR);
 
         iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
-        /* No other data to be filled */
+
+        cmd.filter_flags = cpu_to_le32(MAC_FILTER_IN_PROMISC |
+                                       MAC_FILTER_IN_CONTROL_AND_MGMT |
+                                       MAC_FILTER_IN_BEACON |
+                                       MAC_FILTER_IN_PROBE_REQUEST);
+
         return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd);
 }
 
@@ -716,7 +728,9 @@ static int iwl_mvm_mac_ctxt_cmd_p2p_device(struct iwl_mvm *mvm,
         iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
 
         cmd.protection_flags |= cpu_to_le32(MAC_PROT_FLG_TGG_PROTECT);
-        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROMISC);
+
+        /* Override the filter flags to accept only probe requests */
+        cmd.filter_flags = cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST);
 
         /*
          * This flag should be set to true when the P2P Device is
@@ -791,7 +805,7 @@ static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
                                              TX_CMD_FLG_TSF);
 
         mvm->mgmt_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->nvm_data->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_fw_valid_tx_ant(mvm->fw),
                                      mvm->mgmt_last_antenna_idx);
 
         beacon_cmd.tx.rate_n_flags =
@@ -848,10 +862,10 @@ int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
  */
 static void iwl_mvm_mac_ctxt_cmd_fill_ap(struct iwl_mvm *mvm,
                                          struct ieee80211_vif *vif,
-                                         struct iwl_mac_data_ap *ctxt_ap)
+                                         struct iwl_mac_data_ap *ctxt_ap,
+                                         bool add)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        u32 curr_dev_time;
 
         ctxt_ap->bi = cpu_to_le32(vif->bss_conf.beacon_int);
         ctxt_ap->bi_reciprocal =
@@ -863,10 +877,19 @@ static void iwl_mvm_mac_ctxt_cmd_fill_ap(struct iwl_mvm *mvm,
                                                vif->bss_conf.dtim_period));
 
         ctxt_ap->mcast_qid = cpu_to_le32(vif->cab_queue);
-        curr_dev_time = iwl_read_prph(mvm->trans, DEVICE_SYSTEM_TIME_REG);
-        ctxt_ap->beacon_time = cpu_to_le32(curr_dev_time);
 
-        ctxt_ap->beacon_tsf = cpu_to_le64(curr_dev_time);
+        /*
+         * Only read the system time when the MAC is being added, when we
+         * just modify the MAC then we should keep the time -- the firmware
+         * can otherwise have a "jumping" TBTT.
+         */
+        if (add)
+                mvmvif->ap_beacon_time =
+                        iwl_read_prph(mvm->trans, DEVICE_SYSTEM_TIME_REG);
+
+        ctxt_ap->beacon_time = cpu_to_le32(mvmvif->ap_beacon_time);
+
+        ctxt_ap->beacon_tsf = 0; /* unused */
 
         /* TODO: Assume that the beacon id == mac context id */
         ctxt_ap->beacon_template = cpu_to_le32(mvmvif->id);
@@ -883,8 +906,12 @@ static int iwl_mvm_mac_ctxt_cmd_ap(struct iwl_mvm *mvm,
         /* Fill the common data for all mac context types */
         iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
 
+        /* Also enable probe requests to pass */
+        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST);
+
         /* Fill the data specific for ap mode */
-        iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.ap);
+        iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.ap,
+                                     action == FW_CTXT_ACTION_ADD);
 
         return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd);
 }
@@ -902,7 +929,8 @@ static int iwl_mvm_mac_ctxt_cmd_go(struct iwl_mvm *mvm,
         iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
 
         /* Fill the data specific for GO mode */
-        iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.go.ap);
+        iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.go.ap,
+                                     action == FW_CTXT_ACTION_ADD);
 
         cmd.go.ctwin = cpu_to_le32(noa->oppps_ctwindow &
                                         IEEE80211_P2P_OPPPS_CTWINDOW_MASK);
@@ -996,3 +1024,22 @@ int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         mvmvif->uploaded = false;
         return 0;
 }
+
+int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
+                            struct iwl_rx_cmd_buffer *rxb,
+                            struct iwl_device_cmd *cmd)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_beacon_notif *beacon = (void *)pkt->data;
+        u16 status __maybe_unused =
+                le16_to_cpu(beacon->beacon_notify_hdr.status.status);
+        u32 rate __maybe_unused =
+                le32_to_cpu(beacon->beacon_notify_hdr.initial_rate);
+
+        IWL_DEBUG_RX(mvm, "beacon status %#x retries:%d tsf:0x%16llX rate:%d\n",
+                     status & TX_STATUS_MSK,
+                     beacon->beacon_notify_hdr.failure_frame,
+                     le64_to_cpu(beacon->tsf),
+                     rate);
+        return 0;
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 23460f4a4c75..fe031608fd91 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -65,7 +65,9 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/ip.h>
 #include <net/mac80211.h>
+#include <net/tcp.h>
 
 #include "iwl-op-mode.h"
 #include "iwl-io.h"
@@ -102,10 +104,33 @@ static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
         },
 };
 
+#ifdef CONFIG_PM_SLEEP
+static const struct nl80211_wowlan_tcp_data_token_feature
+iwl_mvm_wowlan_tcp_token_feature = {
+        .min_len = 0,
+        .max_len = 255,
+        .bufsize = IWL_WOWLAN_REMOTE_WAKE_MAX_TOKENS,
+};
+
+static const struct wiphy_wowlan_tcp_support iwl_mvm_wowlan_tcp_support = {
+        .tok = &iwl_mvm_wowlan_tcp_token_feature,
+        .data_payload_max = IWL_WOWLAN_TCP_MAX_PACKET_LEN -
+                            sizeof(struct ethhdr) -
+                            sizeof(struct iphdr) -
+                            sizeof(struct tcphdr),
+        .data_interval_max = 65535, /* __le16 in API */
+        .wake_payload_max = IWL_WOWLAN_REMOTE_WAKE_MAX_PACKET_LEN -
+                            sizeof(struct ethhdr) -
+                            sizeof(struct iphdr) -
+                            sizeof(struct tcphdr),
+        .seq = true,
+};
+#endif
+
 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 {
         struct ieee80211_hw *hw = mvm->hw;
-        int num_mac, ret;
+        int num_mac, ret, i;
 
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
@@ -118,8 +143,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                     IEEE80211_HW_AMPDU_AGGREGATION |
                     IEEE80211_HW_TIMING_BEACON_ONLY;
 
-        hw->queues = IWL_FIRST_AMPDU_QUEUE;
-        hw->offchannel_tx_hw_queue = IWL_OFFCHANNEL_QUEUE;
+        hw->queues = IWL_MVM_FIRST_AGG_QUEUE;
+        hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
         hw->rate_control_algorithm = "iwl-mvm-rs";
 
         /*
@@ -149,18 +174,22 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         hw->wiphy->n_iface_combinations =
                 ARRAY_SIZE(iwl_mvm_iface_combinations);
 
-        hw->wiphy->max_remain_on_channel_duration = 500;
+        hw->wiphy->max_remain_on_channel_duration = 10000;
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
 
         /* Extract MAC address */
         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
         hw->wiphy->addresses = mvm->addresses;
         hw->wiphy->n_addresses = 1;
-        num_mac = mvm->nvm_data->n_hw_addrs;
-        if (num_mac > 1) {
-                memcpy(mvm->addresses[1].addr, mvm->addresses[0].addr,
+
+        /* Extract additional MAC addresses if available */
+        num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
+                min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
+
+        for (i = 1; i < num_mac; i++) {
+                memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
                        ETH_ALEN);
-                mvm->addresses[1].addr[5]++;
+                mvm->addresses[i].addr[5]++;
                 hw->wiphy->n_addresses++;
         }
 
@@ -206,6 +235,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->wiphy->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
                 hw->wiphy->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
                 hw->wiphy->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
+                hw->wiphy->wowlan.tcp = &iwl_mvm_wowlan_tcp_support;
         }
 #endif
 
@@ -227,7 +257,7 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
                 goto drop;
         }
 
-        if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_OFFCHANNEL_QUEUE &&
+        if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
             !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status))
                 goto drop;
 
@@ -273,12 +303,18 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false);
                 break;
         case IEEE80211_AMPDU_TX_START:
+                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) {
+                        ret = -EINVAL;
+                        break;
+                }
                 ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
                 break;
         case IEEE80211_AMPDU_TX_STOP_CONT:
+                ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
+                break;
         case IEEE80211_AMPDU_TX_STOP_FLUSH:
         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
-                ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
+                ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
                 ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid, buf_size);
@@ -466,11 +502,15 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         /*
          * TODO: remove this temporary code.
          * Currently MVM FW supports power management only on single MAC.
-         * Iterate and disable PM on all active interfaces.
+         * If new interface added, disable PM on existing interface.
+         * P2P device is a special case, since it is handled by FW similary to
+         * scan. If P2P deviced is added, PM remains enabled on existing
+         * interface.
          * Note: the method below does not count the new interface being added
          * at this moment.
          */
-        mvm->vif_count++;
+        if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
+                mvm->vif_count++;
         if (mvm->vif_count > 1) {
                 IWL_DEBUG_MAC80211(mvm,
                                    "Disable power on existing interfaces\n");
@@ -526,6 +566,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                 mvm->p2p_device_vif = vif;
         }
 
+        iwl_mvm_vif_dbgfs_register(mvm, vif);
         goto out_unlock;
 
  out_unbind:
@@ -539,10 +580,11 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         /*
          * TODO: remove this temporary code.
          * Currently MVM FW supports power management only on single MAC.
-         * Check if only one additional interface remains after rereasing
+         * Check if only one additional interface remains after releasing
          * current one. Update power mode on the remaining interface.
          */
-        mvm->vif_count--;
+        if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
+                mvm->vif_count--;
         IWL_DEBUG_MAC80211(mvm, "Currently %d interfaces active\n",
                            mvm->vif_count);
         if (mvm->vif_count == 1) {
@@ -557,11 +599,9 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         return ret;
 }
 
-static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
-                                         struct ieee80211_vif *vif)
+static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif)
 {
-        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         u32 tfd_msk = 0, ac;
 
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
@@ -594,12 +634,23 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
                  */
                 flush_work(&mvm->sta_drained_wk);
         }
+}
+
+static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        iwl_mvm_prepare_mac_removal(mvm, vif);
 
         mutex_lock(&mvm->mutex);
 
+        iwl_mvm_vif_dbgfs_clean(mvm, vif);
+
         /*
          * For AP/GO interface, the tear down of the resources allocated to the
-         * interface should be handled as part of the bss_info_changed flow.
+         * interface is be handled as part of the stop_ap flow.
          */
         if (vif->type == NL80211_IFTYPE_AP) {
                 iwl_mvm_dealloc_int_sta(mvm, &mvmvif->bcast_sta);
@@ -620,7 +671,7 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
          * Check if only one additional interface remains after removing
          * current one. Update power mode on the remaining interface.
          */
-        if (mvm->vif_count)
+        if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
                 mvm->vif_count--;
         IWL_DEBUG_MAC80211(mvm, "Currently %d interfaces active\n",
                            mvm->vif_count);
@@ -670,6 +721,7 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                 IWL_ERR(mvm, "failed to update quotas\n");
                                 return;
                         }
+                        iwl_mvm_bt_coex_vif_assoc(mvm, vif);
                 } else if (mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
                         /* remove AP station now that the MAC is unassoc */
                         ret = iwl_mvm_rm_sta_id(mvm, vif, mvmvif->ap_sta_id);
@@ -763,6 +815,8 @@ static void iwl_mvm_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
+        iwl_mvm_prepare_mac_removal(mvm, vif);
+
         mutex_lock(&mvm->mutex);
 
         mvmvif->ap_active = false;
@@ -886,7 +940,7 @@ static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
                  */
                 break;
         case STA_NOTIFY_AWAKE:
-                if (WARN_ON(mvmsta->sta_id == IWL_INVALID_STATION))
+                if (WARN_ON(mvmsta->sta_id == IWL_MVM_STATION_COUNT))
                         break;
                 iwl_mvm_sta_modify_ps_wake(mvm, sta);
                 break;
@@ -1042,6 +1096,13 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
 
         switch (cmd) {
         case SET_KEY:
+                if (vif->type == NL80211_IFTYPE_AP && !sta) {
+                        /* GTK on AP interface is a TX-only key, return 0 */
+                        ret = 0;
+                        key->hw_key_idx = STA_KEY_IDX_INVALID;
+                        break;
+                }
+
                 IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
                 ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, false);
                 if (ret) {
@@ -1050,11 +1111,17 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                          * can't add key for RX, but we don't need it
                          * in the device for TX so still return 0
                          */
+                        key->hw_key_idx = STA_KEY_IDX_INVALID;
                         ret = 0;
                 }
 
                 break;
         case DISABLE_KEY:
+                if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
+                        ret = 0;
+                        break;
+                }
+
                 IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
                 ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
                 break;
@@ -1103,7 +1170,7 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
                                        &chandef, 1, 1);
 
         /* Schedule the time events */
-        ret = iwl_mvm_start_p2p_roc(mvm, vif, duration);
+        ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
 
         mutex_unlock(&mvm->mutex);
         IWL_DEBUG_MAC80211(mvm, "leave\n");
@@ -1207,6 +1274,7 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
          * will handle quota settings.
          */
         if (vif->type == NL80211_IFTYPE_MONITOR) {
+                mvmvif->monitor_active = true;
                 ret = iwl_mvm_update_quotas(mvm, vif);
                 if (ret)
                         goto out_remove_binding;
@@ -1237,15 +1305,16 @@ static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
         if (vif->type == NL80211_IFTYPE_AP)
                 goto out_unlock;
 
-        iwl_mvm_binding_remove_vif(mvm, vif);
         switch (vif->type) {
         case NL80211_IFTYPE_MONITOR:
-                iwl_mvm_update_quotas(mvm, vif);
+                mvmvif->monitor_active = false;
+                iwl_mvm_update_quotas(mvm, NULL);
                 break;
         default:
                 break;
         }
 
+        iwl_mvm_binding_remove_vif(mvm, vif);
 out_unlock:
         mvmvif->phy_ctxt = NULL;
         mutex_unlock(&mvm->mutex);
@@ -1266,6 +1335,15 @@ static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
         return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
 }
 
+static void iwl_mvm_mac_rssi_callback(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      enum ieee80211_rssi_event rssi_event)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        iwl_mvm_bt_rssi_event(mvm, vif, rssi_event);
+}
+
 struct ieee80211_ops iwl_mvm_hw_ops = {
         .tx = iwl_mvm_mac_tx,
         .ampdu_action = iwl_mvm_mac_ampdu_action,
@@ -1289,6 +1367,7 @@ struct ieee80211_ops iwl_mvm_hw_ops = {
         .update_tkip_key = iwl_mvm_mac_update_tkip_key,
         .remain_on_channel = iwl_mvm_roc,
         .cancel_remain_on_channel = iwl_mvm_cancel_roc,
+        .rssi_callback = iwl_mvm_mac_rssi_callback,
 
         .add_chanctx = iwl_mvm_add_chanctx,
         .remove_chanctx = iwl_mvm_remove_chanctx,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 4e339ccfa800..8269bc562951 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -79,8 +79,9 @@
 #include "fw-api.h"
 
 #define IWL_INVALID_MAC80211_QUEUE      0xff
-#define IWL_MVM_MAX_ADDRESSES           2
-#define IWL_RSSI_OFFSET 44
+#define IWL_MVM_MAX_ADDRESSES           5
+/* RSSI offset for WkP */
+#define IWL_RSSI_OFFSET 50
 
 enum iwl_mvm_tx_fifo {
         IWL_MVM_TX_FIFO_BK = 0,
@@ -89,10 +90,6 @@ enum iwl_mvm_tx_fifo {
         IWL_MVM_TX_FIFO_VO,
 };
 
-/* Placeholder */
-#define IWL_OFFCHANNEL_QUEUE 8
-#define IWL_FIRST_AMPDU_QUEUE 11
-
 extern struct ieee80211_ops iwl_mvm_hw_ops;
 /**
  * struct iwl_mvm_mod_params - module parameters for iwlmvm
@@ -160,6 +157,8 @@ enum iwl_power_scheme {
  * @uploaded: indicates the MAC context has been added to the device
  * @ap_active: indicates that ap context is configured, and that the interface
  *  should get quota etc.
+ * @monitor_active: indicates that monitor context is configured, and that the
+ * interface should get quota etc.
  * @queue_params: QoS params for this MAC
  * @bcast_sta: station used for broadcast packets. Used by the following
  *  vifs: P2P_DEVICE, GO and AP.
@@ -172,6 +171,9 @@ struct iwl_mvm_vif {
 
         bool uploaded;
         bool ap_active;
+        bool monitor_active;
+
+        u32 ap_beacon_time;
 
         enum iwl_tsf_id tsf_id;
 
@@ -210,6 +212,7 @@ struct iwl_mvm_vif {
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         struct dentry *dbgfs_dir;
+        struct dentry *dbgfs_slink;
         void *dbgfs_data;
 #endif
 };
@@ -278,10 +281,7 @@ struct iwl_mvm {
         atomic_t queue_stop_count[IWL_MAX_HW_QUEUES];
 
         struct iwl_nvm_data *nvm_data;
-        /* eeprom blob for debugfs/testmode */
-        u8 *eeprom_blob;
-        size_t eeprom_blob_size;
-        /* NVM sections for 7000 family */
+        /* NVM sections */
         struct iwl_nvm_section nvm_sections[NVM_NUM_OF_SECTIONS];
 
         /* EEPROM MAC addresses */
@@ -322,11 +322,26 @@ struct iwl_mvm {
          * can hold 16 keys at most. Reflect this fact.
          */
         unsigned long fw_key_table[BITS_TO_LONGS(STA_KEY_MAX_NUM)];
+
+        /*
+         * This counter of created interfaces is referenced only in conjunction
+         * with FW limitation related to power management. Currently PM is
+         * supported only on a single interface.
+         * IMPORTANT: this variable counts all interfaces except P2P device.
+         */
         u8 vif_count;
 
         struct led_classdev led;
 
         struct ieee80211_vif *p2p_device_vif;
+
+#ifdef CONFIG_PM_SLEEP
+        int gtk_ivlen, gtk_icvlen, ptk_ivlen, ptk_icvlen;
+#endif
+
+        /* BT-Coex */
+        u8 bt_kill_msk;
+        struct iwl_bt_coex_profile_notif last_bt_notif;
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -440,6 +455,9 @@ u32 iwl_mvm_mac_get_queues_mask(struct iwl_mvm *mvm,
                                 struct ieee80211_vif *vif);
 int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
                                     struct ieee80211_vif *vif);
+int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
+                            struct iwl_rx_cmd_buffer *rxb,
+                            struct iwl_device_cmd *cmd);
 
 /* Bindings */
 int iwl_mvm_binding_add_vif(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
@@ -461,16 +479,22 @@ void iwl_mvm_cancel_scan(struct iwl_mvm *mvm);
 /* MVM debugfs */
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir);
-int iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                               struct dentry *dbgfs_dir);
-void iwl_power_get_params(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                          struct iwl_powertable_cmd *cmd);
+void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+void iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 #else
 static inline int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm,
                                          struct dentry *dbgfs_dir)
 {
         return 0;
 }
+static inline void
+iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+}
+static inline void
+iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+}
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 
 /* rate scaling */
@@ -480,6 +504,8 @@ int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
 /* power managment */
 int iwl_mvm_power_update_mode(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 int iwl_mvm_power_disable(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                             struct iwl_powertable_cmd *cmd);
 
 int iwl_mvm_leds_init(struct iwl_mvm *mvm);
 void iwl_mvm_leds_exit(struct iwl_mvm *mvm);
@@ -497,4 +523,14 @@ void iwl_mvm_ipv6_addr_change(struct ieee80211_hw *hw,
 void iwl_mvm_set_default_unicast_key(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif, int idx);
 
+/* BT Coex */
+int iwl_send_bt_prio_tbl(struct iwl_mvm *mvm);
+int iwl_send_bt_init_conf(struct iwl_mvm *mvm);
+int iwl_mvm_rx_bt_coex_notif(struct iwl_mvm *mvm,
+                             struct iwl_rx_cmd_buffer *rxb,
+                             struct iwl_device_cmd *cmd);
+void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                           enum ieee80211_rssi_event rssi_event);
+void iwl_mvm_bt_coex_vif_assoc(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+
 #endif /* __IWL_MVM_H__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index 20016bcbdeab..b8ec02f89acc 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -74,26 +74,11 @@ static const int nvm_to_read[] = {
         NVM_SECTION_TYPE_PRODUCTION,
 };
 
-/* used to simplify the shared operations on NCM_ACCESS_CMD versions */
-union iwl_nvm_access_cmd {
-        struct iwl_nvm_access_cmd_ver1 ver1;
-        struct iwl_nvm_access_cmd_ver2 ver2;
-};
-union iwl_nvm_access_resp {
-        struct iwl_nvm_access_resp_ver1 ver1;
-        struct iwl_nvm_access_resp_ver2 ver2;
-};
-
-static inline void iwl_nvm_fill_read_ver1(struct iwl_nvm_access_cmd_ver1 *cmd,
-                                          u16 offset, u16 length)
-{
-        cmd->offset = cpu_to_le16(offset);
-        cmd->length = cpu_to_le16(length);
-        cmd->cache_refresh = 1;
-}
+/* Default NVM size to read */
+#define IWL_NVM_DEFAULT_CHUNK_SIZE (2*1024);
 
-static inline void iwl_nvm_fill_read_ver2(struct iwl_nvm_access_cmd_ver2 *cmd,
-                                          u16 offset, u16 length, u16 section)
+static inline void iwl_nvm_fill_read(struct iwl_nvm_access_cmd *cmd,
+                                     u16 offset, u16 length, u16 section)
 {
         cmd->offset = cpu_to_le16(offset);
         cmd->length = cpu_to_le16(length);
@@ -103,8 +88,8 @@ static inline void iwl_nvm_fill_read_ver2(struct iwl_nvm_access_cmd_ver2 *cmd,
 static int iwl_nvm_read_chunk(struct iwl_mvm *mvm, u16 section,
                               u16 offset, u16 length, u8 *data)
 {
-        union iwl_nvm_access_cmd nvm_access_cmd;
-        union iwl_nvm_access_resp *nvm_resp;
+        struct iwl_nvm_access_cmd nvm_access_cmd = {};
+        struct iwl_nvm_access_resp *nvm_resp;
         struct iwl_rx_packet *pkt;
         struct iwl_host_cmd cmd = {
                 .id = NVM_ACCESS_CMD,
@@ -114,18 +99,8 @@ static int iwl_nvm_read_chunk(struct iwl_mvm *mvm, u16 section,
         int ret, bytes_read, offset_read;
         u8 *resp_data;
 
-        memset(&nvm_access_cmd, 0, sizeof(nvm_access_cmd));
-
-        /* TODO: not sure family should be the decider, maybe FW version? */
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
-                iwl_nvm_fill_read_ver2(&(nvm_access_cmd.ver2),
-                                       offset, length, section);
-                cmd.len[0] = sizeof(struct iwl_nvm_access_cmd_ver2);
-        } else {
-                iwl_nvm_fill_read_ver1(&(nvm_access_cmd.ver1),
-                                       offset, length);
-                cmd.len[0] = sizeof(struct iwl_nvm_access_cmd_ver1);
-        }
+        iwl_nvm_fill_read(&nvm_access_cmd, offset, length, section);
+        cmd.len[0] = sizeof(struct iwl_nvm_access_cmd);
 
         ret = iwl_mvm_send_cmd(mvm, &cmd);
         if (ret)
@@ -141,17 +116,10 @@ static int iwl_nvm_read_chunk(struct iwl_mvm *mvm, u16 section,
 
         /* Extract NVM response */
         nvm_resp = (void *)pkt->data;
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
-                ret = le16_to_cpu(nvm_resp->ver2.status);
-                bytes_read = le16_to_cpu(nvm_resp->ver2.length);
-                offset_read = le16_to_cpu(nvm_resp->ver2.offset);
-                resp_data = nvm_resp->ver2.data;
-        } else {
-                ret = le16_to_cpu(nvm_resp->ver1.length) <= 0;
-                bytes_read = le16_to_cpu(nvm_resp->ver1.length);
-                offset_read = le16_to_cpu(nvm_resp->ver1.offset);
-                resp_data = nvm_resp->ver1.data;
-        }
+        ret = le16_to_cpu(nvm_resp->status);
+        bytes_read = le16_to_cpu(nvm_resp->length);
+        offset_read = le16_to_cpu(nvm_resp->offset);
+        resp_data = nvm_resp->data;
         if (ret) {
                 IWL_ERR(mvm,
                         "NVM access command failed with status %d (device: %s)\n",
@@ -191,17 +159,10 @@ static int iwl_nvm_read_section(struct iwl_mvm *mvm, u16 section,
 {
         u16 length, offset = 0;
         int ret;
-        bool old_eeprom = mvm->cfg->device_family != IWL_DEVICE_FAMILY_7000;
 
-        length = (iwlwifi_mod_params.amsdu_size_8K ? (8 * 1024) : (4 * 1024))
-                - sizeof(union iwl_nvm_access_cmd)
-                - sizeof(struct iwl_rx_packet);
-        /*
-         * if length is greater than EEPROM size, truncate it because uCode
-         * doesn't check it by itself, and exit the loop when reached.
-         */
-        if (old_eeprom && length > mvm->cfg->base_params->eeprom_size)
-                length = mvm->cfg->base_params->eeprom_size;
+        /* Set nvm section read length */
+        length = IWL_NVM_DEFAULT_CHUNK_SIZE;
+
         ret = length;
 
         /* Read the NVM until exhausted (reading less than requested) */
@@ -214,8 +175,6 @@ static int iwl_nvm_read_section(struct iwl_mvm *mvm, u16 section,
                         return ret;
                 }
                 offset += ret;
-                if (old_eeprom && offset == mvm->cfg->base_params->eeprom_size)
-                        break;
         }
 
         IWL_INFO(mvm, "NVM section %d read completed\n", section);
@@ -249,63 +208,31 @@ int iwl_nvm_init(struct iwl_mvm *mvm)
         int ret, i, section;
         u8 *nvm_buffer, *temp;
 
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
-                /* TODO: find correct NVM max size for a section */
-                nvm_buffer = kmalloc(mvm->cfg->base_params->eeprom_size,
-                                     GFP_KERNEL);
-                if (!nvm_buffer)
-                        return -ENOMEM;
-                for (i = 0; i < ARRAY_SIZE(nvm_to_read); i++) {
-                        section = nvm_to_read[i];
-                        /* we override the constness for initial read */
-                        ret = iwl_nvm_read_section(mvm, section, nvm_buffer);
-                        if (ret < 0)
-                                break;
-                        temp = kmemdup(nvm_buffer, ret, GFP_KERNEL);
-                        if (!temp) {
-                                ret = -ENOMEM;
-                                break;
-                        }
-                        mvm->nvm_sections[section].data = temp;
-                        mvm->nvm_sections[section].length = ret;
-                }
-                kfree(nvm_buffer);
+        /* TODO: find correct NVM max size for a section */
+        nvm_buffer = kmalloc(mvm->cfg->base_params->eeprom_size,
+                             GFP_KERNEL);
+        if (!nvm_buffer)
+                return -ENOMEM;
+        for (i = 0; i < ARRAY_SIZE(nvm_to_read); i++) {
+                section = nvm_to_read[i];
+                /* we override the constness for initial read */
+                ret = iwl_nvm_read_section(mvm, section, nvm_buffer);
                 if (ret < 0)
-                        return ret;
-        } else {
-                /* allocate eeprom */
-                mvm->eeprom_blob_size = mvm->cfg->base_params->eeprom_size;
-                IWL_DEBUG_EEPROM(mvm->trans->dev, "NVM size = %zd\n",
-                                 mvm->eeprom_blob_size);
-                mvm->eeprom_blob = kzalloc(mvm->eeprom_blob_size, GFP_KERNEL);
-                if (!mvm->eeprom_blob)
-                        return -ENOMEM;
-
-                ret = iwl_nvm_read_section(mvm, 0, mvm->eeprom_blob);
-                if (ret != mvm->eeprom_blob_size) {
-                        IWL_ERR(mvm, "Read partial NVM %d/%zd\n",
-                                ret, mvm->eeprom_blob_size);
-                        kfree(mvm->eeprom_blob);
-                        mvm->eeprom_blob = NULL;
-                        return -EINVAL;
+                        break;
+                temp = kmemdup(nvm_buffer, ret, GFP_KERNEL);
+                if (!temp) {
+                        ret = -ENOMEM;
+                        break;
                 }
+                mvm->nvm_sections[section].data = temp;
+                mvm->nvm_sections[section].length = ret;
         }
+        kfree(nvm_buffer);
+        if (ret < 0)
+                return ret;
 
         ret = 0;
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000)
-                mvm->nvm_data = iwl_parse_nvm_sections(mvm);
-        else
-                mvm->nvm_data =
-                        iwl_parse_eeprom_data(mvm->trans->dev,
-                                              mvm->cfg,
-                                              mvm->eeprom_blob,
-                                              mvm->eeprom_blob_size);
-
-        if (!mvm->nvm_data) {
-                kfree(mvm->eeprom_blob);
-                mvm->eeprom_blob = NULL;
-                ret = -ENOMEM;
-        }
+        mvm->nvm_data = iwl_parse_nvm_sections(mvm);
 
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index aa59adf87db3..fe031d304d1e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -143,21 +143,12 @@ static void iwl_mvm_nic_config(struct iwl_op_mode *op_mode)
         u8 radio_cfg_type, radio_cfg_step, radio_cfg_dash;
         u32 reg_val = 0;
 
-        /*
-         * We can't upload the correct value to the INIT image
-         * as we don't have nvm_data by that time.
-         *
-         * TODO: Figure out what we should do here
-         */
-        if (mvm->nvm_data) {
-                radio_cfg_type = mvm->nvm_data->radio_cfg_type;
-                radio_cfg_step = mvm->nvm_data->radio_cfg_step;
-                radio_cfg_dash = mvm->nvm_data->radio_cfg_dash;
-        } else {
-                radio_cfg_type = 0;
-                radio_cfg_step = 0;
-                radio_cfg_dash = 0;
-        }
+        radio_cfg_type = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_TYPE) >>
+                          FW_PHY_CFG_RADIO_TYPE_POS;
+        radio_cfg_step = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_STEP) >>
+                          FW_PHY_CFG_RADIO_STEP_POS;
+        radio_cfg_dash = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_DASH) >>
+                          FW_PHY_CFG_RADIO_DASH_POS;
 
         /* SKU control */
         reg_val |= CSR_HW_REV_STEP(mvm->trans->hw_rev) <<
@@ -175,7 +166,6 @@ static void iwl_mvm_nic_config(struct iwl_op_mode *op_mode)
 
         /* silicon bits */
         reg_val |= CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI;
-        reg_val |= CSR_HW_IF_CONFIG_REG_BIT_MAC_SI;
 
         iwl_trans_set_bits_mask(mvm->trans, CSR_HW_IF_CONFIG_REG,
                                 CSR_HW_IF_CONFIG_REG_MSK_MAC_DASH |
@@ -230,6 +220,9 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
         RX_HANDLER(SCAN_REQUEST_CMD, iwl_mvm_rx_scan_response, false),
         RX_HANDLER(SCAN_COMPLETE_NOTIFICATION, iwl_mvm_rx_scan_complete, false),
 
+        RX_HANDLER(BT_PROFILE_NOTIFICATION, iwl_mvm_rx_bt_coex_notif, true),
+        RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, false),
+
         RX_HANDLER(RADIO_VERSION_NOTIFICATION, iwl_mvm_rx_radio_ver, false),
         RX_HANDLER(CARD_STATE_NOTIFICATION, iwl_mvm_rx_card_state_notif, false),
 
@@ -274,6 +267,7 @@ static const char *iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(WEP_KEY),
         CMD(REPLY_RX_PHY_CMD),
         CMD(REPLY_RX_MPDU_CMD),
+        CMD(BEACON_NOTIFICATION),
         CMD(BEACON_TEMPLATE_CMD),
         CMD(STATISTICS_NOTIFICATION),
         CMD(TX_ANT_CONFIGURATION_CMD),
@@ -293,6 +287,11 @@ static const char *iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(NET_DETECT_PROFILES_CMD),
         CMD(NET_DETECT_HOTSPOTS_CMD),
         CMD(NET_DETECT_HOTSPOTS_QUERY_CMD),
+        CMD(CARD_STATE_NOTIFICATION),
+        CMD(BT_COEX_PRIO_TABLE),
+        CMD(BT_COEX_PROT_ENV),
+        CMD(BT_PROFILE_NOTIFICATION),
+        CMD(BT_CONFIG),
 };
 #undef CMD
 
@@ -312,16 +311,6 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         };
         int err, scan_size;
 
-        switch (cfg->device_family) {
-        case IWL_DEVICE_FAMILY_6030:
-        case IWL_DEVICE_FAMILY_6005:
-        case IWL_DEVICE_FAMILY_7000:
-                break;
-        default:
-                IWL_ERR(trans, "Trying to load mvm on an unsupported device\n");
-                return NULL;
-        }
-
         /********************************
          * 1. Allocating and configuring HW data
          ********************************/
@@ -363,8 +352,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         trans_cfg.n_no_reclaim_cmds = ARRAY_SIZE(no_reclaim_cmds);
         trans_cfg.rx_buf_size_8k = iwlwifi_mod_params.amsdu_size_8K;
 
-        /* TODO: this should really be a TLV */
-        if (cfg->device_family == IWL_DEVICE_FAMILY_7000)
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_DW_BC_TABLE)
                 trans_cfg.bc_table_dword = true;
 
         if (!iwlwifi_mod_params.wd_disable)
@@ -438,7 +426,6 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
  out_free:
         iwl_phy_db_free(mvm->phy_db);
         kfree(mvm->scan_cmd);
-        kfree(mvm->eeprom_blob);
         iwl_trans_stop_hw(trans, true);
         ieee80211_free_hw(mvm->hw);
         return NULL;
@@ -460,7 +447,6 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
         iwl_phy_db_free(mvm->phy_db);
         mvm->phy_db = NULL;
 
-        kfree(mvm->eeprom_blob);
         iwl_free_nvm_data(mvm->nvm_data);
         for (i = 0; i < NVM_NUM_OF_SECTIONS; i++)
                 kfree(mvm->nvm_sections[i].data);
@@ -624,12 +610,8 @@ static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
         ieee80211_free_txskb(mvm->hw, skb);
 }
 
-static void iwl_mvm_nic_error(struct iwl_op_mode *op_mode)
+static void iwl_mvm_nic_restart(struct iwl_mvm *mvm)
 {
-        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
-
-        iwl_mvm_dump_nic_error_log(mvm);
-
         iwl_abort_notification_waits(&mvm->notif_wait);
 
         /*
@@ -663,9 +645,21 @@ static void iwl_mvm_nic_error(struct iwl_op_mode *op_mode)
         }
 }
 
+static void iwl_mvm_nic_error(struct iwl_op_mode *op_mode)
+{
+        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+
+        iwl_mvm_dump_nic_error_log(mvm);
+
+        iwl_mvm_nic_restart(mvm);
+}
+
 static void iwl_mvm_cmd_queue_full(struct iwl_op_mode *op_mode)
 {
+        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+
         WARN_ON(1);
+        iwl_mvm_nic_restart(mvm);
 }
 
 static const struct iwl_op_mode_ops iwl_mvm_ops = {
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index b428448f8ddf..0f0b44eabd93 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -142,7 +142,7 @@ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm,
                                       struct cfg80211_chan_def *chandef,
                                       u8 chains_static, u8 chains_dynamic)
 {
-        u8 valid_rx_chains, active_cnt, idle_cnt;
+        u8 active_cnt, idle_cnt;
 
         /* Set the channel info data */
         cmd->ci.band = (chandef->chan->band == IEEE80211_BAND_2GHZ ?
@@ -158,17 +158,16 @@ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm,
          * Need to add on chain noise calibration limitations, and
          * BT coex considerations.
          */
-        valid_rx_chains = mvm->nvm_data->valid_rx_ant;
         idle_cnt = chains_static;
         active_cnt = chains_dynamic;
 
-        cmd->rxchain_info = cpu_to_le32(valid_rx_chains <<
+        cmd->rxchain_info = cpu_to_le32(iwl_fw_valid_rx_ant(mvm->fw) <<
                                         PHY_RX_CHAIN_VALID_POS);
         cmd->rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS);
         cmd->rxchain_info |= cpu_to_le32(active_cnt <<
                                          PHY_RX_CHAIN_MIMO_CNT_POS);
 
-        cmd->txchain_info = cpu_to_le32(mvm->nvm_data->valid_tx_ant);
+        cmd->txchain_info = cpu_to_le32(iwl_fw_valid_tx_ant(mvm->fw));
 }
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 5a92a4978795..9395ab2a1af2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -75,23 +75,49 @@
 
 #define POWER_KEEP_ALIVE_PERIOD_SEC    25
 
-static void iwl_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                                struct iwl_powertable_cmd *cmd)
+static void iwl_mvm_power_log(struct iwl_mvm *mvm,
+                              struct iwl_powertable_cmd *cmd)
+{
+        IWL_DEBUG_POWER(mvm,
+                        "Sending power table command for power level %d, flags = 0x%X\n",
+                        iwlmvm_mod_params.power_scheme,
+                        le16_to_cpu(cmd->flags));
+        IWL_DEBUG_POWER(mvm, "Keep alive = %u sec\n", cmd->keep_alive_seconds);
+
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
+                IWL_DEBUG_POWER(mvm, "Rx timeout = %u usec\n",
+                                le32_to_cpu(cmd->rx_data_timeout));
+                IWL_DEBUG_POWER(mvm, "Tx timeout = %u usec\n",
+                                le32_to_cpu(cmd->tx_data_timeout));
+                IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
+                                cmd->lprx_rssi_threshold);
+        }
+}
+
+void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                             struct iwl_powertable_cmd *cmd)
 {
         struct ieee80211_hw *hw = mvm->hw;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
         int dtimper, dtimper_msec;
         int keep_alive;
         bool radar_detect = false;
 
-        cmd->id_and_color = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
-                                                            mvmvif->color));
-        cmd->action = cpu_to_le32(FW_CTXT_ACTION_MODIFY);
+        /*
+         * Regardless of power management state the driver must set
+         * keep alive period. FW will use it for sending keep alive NDPs
+         * immediately after association.
+         */
+        cmd->keep_alive_seconds = POWER_KEEP_ALIVE_PERIOD_SEC;
+
+        if ((iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM) ||
+            !iwlwifi_mod_params.power_save)
+                return;
+
+        cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
 
-        if ((!vif->bss_conf.ps) ||
-            (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM))
+        if (!vif->bss_conf.ps)
                 return;
 
         cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK);
@@ -110,26 +136,23 @@ static void iwl_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         /* Check skip over DTIM conditions */
         if (!radar_detect && (dtimper <= 10) &&
-            (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_LP)) {
-                cmd->flags |= cpu_to_le16(POWER_FLAGS_SLEEP_OVER_DTIM_MSK);
-                cmd->num_skip_dtim = 2;
-        }
+            (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_LP))
+                cmd->flags |= cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
 
         /* Check that keep alive period is at least 3 * DTIM */
         dtimper_msec = dtimper * vif->bss_conf.beacon_int;
         keep_alive = max_t(int, 3 * dtimper_msec,
-                           MSEC_PER_SEC * POWER_KEEP_ALIVE_PERIOD_SEC);
+                           MSEC_PER_SEC * cmd->keep_alive_seconds);
         keep_alive = DIV_ROUND_UP(keep_alive, MSEC_PER_SEC);
-
-        cmd->keep_alive_seconds = cpu_to_le16(keep_alive);
+        cmd->keep_alive_seconds = keep_alive;
 
         if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_LP) {
                 /* TODO: Also for D3 (device sleep / WoWLAN) */
-                cmd->rx_data_timeout = cpu_to_le32(10);
-                cmd->tx_data_timeout = cpu_to_le32(10);
+                cmd->rx_data_timeout = cpu_to_le32(10 * USEC_PER_MSEC);
+                cmd->tx_data_timeout = cpu_to_le32(10 * USEC_PER_MSEC);
         } else {
-                cmd->rx_data_timeout = cpu_to_le32(50);
-                cmd->tx_data_timeout = cpu_to_le32(50);
+                cmd->rx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
+                cmd->tx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
         }
 }
 
@@ -137,36 +160,11 @@ int iwl_mvm_power_update_mode(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
         struct iwl_powertable_cmd cmd = {};
 
-        if (!iwlwifi_mod_params.power_save) {
-                IWL_DEBUG_POWER(mvm, "Power management is not allowed\n");
-                return 0;
-        }
-
         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
-        iwl_power_build_cmd(mvm, vif, &cmd);
-
-        IWL_DEBUG_POWER(mvm,
-                        "Sending power table command on mac id 0x%X for power level %d, flags = 0x%X\n",
-                        cmd.id_and_color, iwlmvm_mod_params.power_scheme,
-                        le16_to_cpu(cmd.flags));
-
-        if (cmd.flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
-                IWL_DEBUG_POWER(mvm, "Keep alive = %u sec\n",
-                                le16_to_cpu(cmd.keep_alive_seconds));
-                IWL_DEBUG_POWER(mvm, "Rx timeout = %u usec\n",
-                                le32_to_cpu(cmd.rx_data_timeout));
-                IWL_DEBUG_POWER(mvm, "Tx timeout = %u usec\n",
-                                le32_to_cpu(cmd.tx_data_timeout));
-                IWL_DEBUG_POWER(mvm, "Rx timeout (uAPSD) = %u usec\n",
-                                le32_to_cpu(cmd.rx_data_timeout_uapsd));
-                IWL_DEBUG_POWER(mvm, "Tx timeout = %u usec\n",
-                                le32_to_cpu(cmd.tx_data_timeout_uapsd));
-                IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
-                                cmd.lprx_rssi_threshold);
-                IWL_DEBUG_POWER(mvm, "DTIMs to skip = %u\n", cmd.num_skip_dtim);
-        }
+        iwl_mvm_power_build_cmd(mvm, vif, &cmd);
+        iwl_mvm_power_log(mvm, &cmd);
 
         return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_SYNC,
                                     sizeof(cmd), &cmd);
@@ -175,33 +173,16 @@ int iwl_mvm_power_update_mode(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 int iwl_mvm_power_disable(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
         struct iwl_powertable_cmd cmd = {};
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-
-        if (!iwlwifi_mod_params.power_save) {
-                IWL_DEBUG_POWER(mvm, "Power management is not allowed\n");
-                return 0;
-        }
 
         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
-        cmd.id_and_color = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
-                                                            mvmvif->color));
-        cmd.action = cpu_to_le32(FW_CTXT_ACTION_MODIFY);
+        if ((iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM) &&
+            iwlwifi_mod_params.power_save)
+                cmd.flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
 
-        IWL_DEBUG_POWER(mvm,
-                        "Sending power table command on mac id 0x%X for power level %d, flags = 0x%X\n",
-                        cmd.id_and_color, iwlmvm_mod_params.power_scheme,
-                        le16_to_cpu(cmd.flags));
+        iwl_mvm_power_log(mvm, &cmd);
 
         return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_ASYNC,
                                     sizeof(cmd), &cmd);
 }
-
-#ifdef CONFIG_IWLWIFI_DEBUGFS
-void iwl_power_get_params(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                          struct iwl_powertable_cmd *cmd)
-{
-        iwl_power_build_cmd(mvm, vif, cmd);
-}
-#endif /* CONFIG_IWLWIFI_DEBUGFS */
diff --git a/drivers/net/wireless/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwlwifi/mvm/quota.c
index 925628468146..a1e3e923ea3e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwlwifi/mvm/quota.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -114,7 +114,8 @@ static void iwl_mvm_quota_iterator(void *_data, u8 *mac,
                         data->n_interfaces[id]++;
                 break;
         case NL80211_IFTYPE_MONITOR:
-                data->n_interfaces[id]++;
+                if (mvmvif->monitor_active)
+                        data->n_interfaces[id]++;
                 break;
         case NL80211_IFTYPE_P2P_DEVICE:
                 break;
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 56b636d9ab30..55334d542e26 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -680,12 +680,14 @@ static int rs_toggle_antenna(u32 valid_ant, u32 *rate_n_flags,
  */
 static bool rs_use_green(struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_sta *sta_priv = (void *)sta->drv_priv;
-
-        bool use_green = !(sta_priv->vif->bss_conf.ht_operation_mode &
-                                IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
-
-        return (sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD) && use_green;
+        /*
+         * There's a bug somewhere in this code that causes the
+         * scaling to get stuck because GF+SGI can't be combined
+         * in SISO rates. Until we find that bug, disable GF, it
+         * has only limited benefit and we still interoperate with
+         * GF APs since we can always receive GF transmissions.
+         */
+        return false;
 }
 
 /**
@@ -791,7 +793,7 @@ static u32 rs_get_lower_rate(struct iwl_lq_sta *lq_sta,
 
                 if (num_of_ant(tbl->ant_type) > 1)
                         tbl->ant_type =
-                            first_antenna(mvm->nvm_data->valid_tx_ant);
+                            first_antenna(iwl_fw_valid_tx_ant(mvm->fw));
 
                 tbl->is_ht40 = 0;
                 tbl->is_SGI = 0;
@@ -1233,7 +1235,7 @@ static int rs_switch_to_mimo2(struct iwl_mvm *mvm,
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
-        if (num_of_ant(mvm->nvm_data->valid_tx_ant) < 2)
+        if (num_of_ant(iwl_fw_valid_tx_ant(mvm->fw)) < 2)
                 return -1;
 
         IWL_DEBUG_RATE(mvm, "LQ: try to switch to MIMO2\n");
@@ -1285,7 +1287,7 @@ static int rs_switch_to_mimo3(struct iwl_mvm *mvm,
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
-        if (num_of_ant(mvm->nvm_data->valid_tx_ant) < 3)
+        if (num_of_ant(iwl_fw_valid_tx_ant(mvm->fw)) < 3)
                 return -1;
 
         IWL_DEBUG_RATE(mvm, "LQ: try to switch to MIMO3\n");
@@ -1379,7 +1381,7 @@ static int rs_move_legacy_other(struct iwl_mvm *mvm,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = mvm->nvm_data->valid_tx_ant;
+        u8 valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
         u8 tx_chains_num = num_of_ant(valid_tx_ant);
         int ret;
         u8 update_search_tbl_counter = 0;
@@ -1512,7 +1514,7 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = mvm->nvm_data->valid_tx_ant;
+        u8 valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
         u8 tx_chains_num = num_of_ant(valid_tx_ant);
         u8 update_search_tbl_counter = 0;
         int ret;
@@ -1647,7 +1649,7 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = mvm->nvm_data->valid_tx_ant;
+        u8 valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
         u8 tx_chains_num = num_of_ant(valid_tx_ant);
         u8 update_search_tbl_counter = 0;
         int ret;
@@ -1784,7 +1786,7 @@ static int rs_move_mimo3_to_other(struct iwl_mvm *mvm,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = mvm->nvm_data->valid_tx_ant;
+        u8 valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
         u8 tx_chains_num = num_of_ant(valid_tx_ant);
         int ret;
         u8 update_search_tbl_counter = 0;
@@ -2447,7 +2449,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
 
         i = lq_sta->last_txrate_idx;
 
-        valid_tx_ant = mvm->nvm_data->valid_tx_ant;
+        valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
 
         if (!lq_sta->search_better_tbl)
                 active_tbl = lq_sta->active_tbl;
@@ -2637,15 +2639,15 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
         /* These values will be overridden later */
         lq_sta->lq.single_stream_ant_msk =
-                first_antenna(mvm->nvm_data->valid_tx_ant);
+                first_antenna(iwl_fw_valid_tx_ant(mvm->fw));
         lq_sta->lq.dual_stream_ant_msk =
-                mvm->nvm_data->valid_tx_ant &
-                ~first_antenna(mvm->nvm_data->valid_tx_ant);
+                iwl_fw_valid_tx_ant(mvm->fw) &
+                ~first_antenna(iwl_fw_valid_tx_ant(mvm->fw));
         if (!lq_sta->lq.dual_stream_ant_msk) {
                 lq_sta->lq.dual_stream_ant_msk = ANT_AB;
-        } else if (num_of_ant(mvm->nvm_data->valid_tx_ant) == 2) {
+        } else if (num_of_ant(iwl_fw_valid_tx_ant(mvm->fw)) == 2) {
                 lq_sta->lq.dual_stream_ant_msk =
-                        mvm->nvm_data->valid_tx_ant;
+                        iwl_fw_valid_tx_ant(mvm->fw);
         }
 
         /* as default allow aggregation for all tids */
@@ -2706,7 +2708,7 @@ static void rs_fill_link_cmd(struct iwl_mvm *mvm,
         index++;
         repeat_rate--;
         if (mvm)
-                valid_tx_ant = mvm->nvm_data->valid_tx_ant;
+                valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
 
         /* Fill rest of rate table */
         while (index < LINK_QUAL_MAX_RETRY_NUM) {
@@ -2811,7 +2813,7 @@ static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
         u8 ant_sel_tx;
 
         mvm = lq_sta->drv;
-        valid_tx_ant = mvm->nvm_data->valid_tx_ant;
+        valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
         if (lq_sta->dbg_fixed_rate) {
                 ant_sel_tx =
                   ((lq_sta->dbg_fixed_rate & RATE_MCS_ANT_ABC_MSK)
@@ -2882,9 +2884,9 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
         desc += sprintf(buff+desc, "fixed rate 0x%X\n",
                         lq_sta->dbg_fixed_rate);
         desc += sprintf(buff+desc, "valid_tx_ant %s%s%s\n",
-            (mvm->nvm_data->valid_tx_ant & ANT_A) ? "ANT_A," : "",
-            (mvm->nvm_data->valid_tx_ant & ANT_B) ? "ANT_B," : "",
-            (mvm->nvm_data->valid_tx_ant & ANT_C) ? "ANT_C" : "");
+            (iwl_fw_valid_tx_ant(mvm->fw) & ANT_A) ? "ANT_A," : "",
+            (iwl_fw_valid_tx_ant(mvm->fw) & ANT_B) ? "ANT_B," : "",
+            (iwl_fw_valid_tx_ant(mvm->fw) & ANT_C) ? "ANT_C" : "");
         desc += sprintf(buff+desc, "lq type %s\n",
            (is_legacy(tbl->lq_type)) ? "legacy" : "HT");
         if (is_Ht(tbl->lq_type)) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 3f40ab05bbd8..4dfc21a3e83e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -131,33 +131,42 @@ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
 static int iwl_mvm_calc_rssi(struct iwl_mvm *mvm,
                              struct iwl_rx_phy_info *phy_info)
 {
-        u32 rssi_a, rssi_b, rssi_c, max_rssi, agc_db;
+        int rssi_a, rssi_b, rssi_a_dbm, rssi_b_dbm, max_rssi_dbm;
+        int rssi_all_band_a, rssi_all_band_b;
+        u32 agc_a, agc_b, max_agc;
         u32 val;
 
-        /* Find max rssi among 3 possible receivers.
+        /* Find max rssi among 2 possible receivers.
          * These values are measured by the Digital Signal Processor (DSP).
          * They should stay fairly constant even as the signal strength varies,
          * if the radio's Automatic Gain Control (AGC) is working right.
          * AGC value (see below) will provide the "interesting" info.
          */
+        val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_AGC_IDX]);
+        agc_a = (val & IWL_OFDM_AGC_A_MSK) >> IWL_OFDM_AGC_A_POS;
+        agc_b = (val & IWL_OFDM_AGC_B_MSK) >> IWL_OFDM_AGC_B_POS;
+        max_agc = max_t(u32, agc_a, agc_b);
+
         val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_RSSI_AB_IDX]);
         rssi_a = (val & IWL_OFDM_RSSI_INBAND_A_MSK) >> IWL_OFDM_RSSI_A_POS;
         rssi_b = (val & IWL_OFDM_RSSI_INBAND_B_MSK) >> IWL_OFDM_RSSI_B_POS;
-        val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_RSSI_C_IDX]);
-        rssi_c = (val & IWL_OFDM_RSSI_INBAND_C_MSK) >> IWL_OFDM_RSSI_C_POS;
-
-        val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_AGC_IDX]);
-        agc_db = (val & IWL_OFDM_AGC_DB_MSK) >> IWL_OFDM_AGC_DB_POS;
+        rssi_all_band_a = (val & IWL_OFDM_RSSI_ALLBAND_A_MSK) >>
+                                IWL_OFDM_RSSI_ALLBAND_A_POS;
+        rssi_all_band_b = (val & IWL_OFDM_RSSI_ALLBAND_B_MSK) >>
+                                IWL_OFDM_RSSI_ALLBAND_B_POS;
 
-        max_rssi = max_t(u32, rssi_a, rssi_b);
-        max_rssi = max_t(u32, max_rssi, rssi_c);
+        /*
+         * dBm = rssi dB - agc dB - constant.
+         * Higher AGC (higher radio gain) means lower signal.
+         */
+        rssi_a_dbm = rssi_a - IWL_RSSI_OFFSET - agc_a;
+        rssi_b_dbm = rssi_b - IWL_RSSI_OFFSET - agc_b;
+        max_rssi_dbm = max_t(int, rssi_a_dbm, rssi_b_dbm);
 
-        IWL_DEBUG_STATS(mvm, "Rssi In A %d B %d C %d Max %d AGC dB %d\n",
-                        rssi_a, rssi_b, rssi_c, max_rssi, agc_db);
+        IWL_DEBUG_STATS(mvm, "Rssi In A %d B %d Max %d AGCA %d AGCB %d\n",
+                        rssi_a_dbm, rssi_b_dbm, max_rssi_dbm, agc_a, agc_b);
 
-        /* dBm = max_rssi dB - agc dB - constant.
-         * Higher AGC (higher radio gain) means lower signal. */
-        return max_rssi - agc_db - IWL_RSSI_OFFSET;
+        return max_rssi_dbm;
 }
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 9b21b92aa8d1..2157b0f8ced5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -74,7 +74,7 @@
 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
 {
         u16 rx_chain;
-        u8 rx_ant = mvm->nvm_data->valid_rx_ant;
+        u8 rx_ant = iwl_fw_valid_rx_ant(mvm->fw);
 
         rx_chain = rx_ant << PHY_RX_CHAIN_VALID_POS;
         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_MIMO_SEL_POS;
@@ -115,7 +115,7 @@ iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum ieee80211_band band,
         u32 tx_ant;
 
         mvm->scan_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->nvm_data->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_fw_valid_tx_ant(mvm->fw),
                                      mvm->scan_last_antenna_idx);
         tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 52aecf20d0df..0fd96e4da461 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -101,8 +101,55 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         }
         add_sta_cmd.add_modify = update ? 1 : 0;
 
-        /* STA_FLG_FAT_EN_MSK ? */
-        /* STA_FLG_MIMO_EN_MSK ? */
+        add_sta_cmd.station_flags_msk |= cpu_to_le32(STA_FLG_FAT_EN_MSK |
+                                                     STA_FLG_MIMO_EN_MSK);
+
+        switch (sta->bandwidth) {
+        case IEEE80211_STA_RX_BW_160:
+                add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_FAT_EN_160MHZ);
+                /* fall through */
+        case IEEE80211_STA_RX_BW_80:
+                add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_FAT_EN_80MHZ);
+                /* fall through */
+        case IEEE80211_STA_RX_BW_40:
+                add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_FAT_EN_40MHZ);
+                /* fall through */
+        case IEEE80211_STA_RX_BW_20:
+                if (sta->ht_cap.ht_supported)
+                        add_sta_cmd.station_flags |=
+                                cpu_to_le32(STA_FLG_FAT_EN_20MHZ);
+                break;
+        }
+
+        switch (sta->rx_nss) {
+        case 1:
+                add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_MIMO_EN_SISO);
+                break;
+        case 2:
+                add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_MIMO_EN_MIMO2);
+                break;
+        case 3 ... 8:
+                add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_MIMO_EN_MIMO3);
+                break;
+        }
+
+        switch (sta->smps_mode) {
+        case IEEE80211_SMPS_AUTOMATIC:
+        case IEEE80211_SMPS_NUM_MODES:
+                WARN_ON(1);
+                break;
+        case IEEE80211_SMPS_STATIC:
+                /* override NSS */
+                add_sta_cmd.station_flags &= ~cpu_to_le32(STA_FLG_MIMO_EN_MSK);
+                add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_MIMO_EN_SISO);
+                break;
+        case IEEE80211_SMPS_DYNAMIC:
+                add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_RTS_MIMO_PROT);
+                break;
+        case IEEE80211_SMPS_OFF:
+                /* nothing */
+                break;
+        }
 
         if (sta->ht_cap.ht_supported) {
                 add_sta_cmd.station_flags_msk |=
@@ -340,6 +387,9 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
 
         if (vif->type == NL80211_IFTYPE_STATION &&
             mvmvif->ap_sta_id == mvm_sta->sta_id) {
+                /* flush its queues here since we are freeing mvm_sta */
+                ret = iwl_mvm_flush_tx_path(mvm, mvm_sta->tfd_queue_msk, true);
+
                 /*
                  * Put a non-NULL since the fw station isn't removed.
                  * It will be removed after the MAC will be set as
@@ -348,9 +398,6 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
                 rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
                                    ERR_PTR(-EINVAL));
 
-                /* flush its queues here since we are freeing mvm_sta */
-                ret = iwl_mvm_flush_tx_path(mvm, mvm_sta->tfd_queue_msk, true);
-
                 /* if we are associated - we can't remove the AP STA now */
                 if (vif->bss_conf.assoc)
                         return ret;
@@ -770,6 +817,16 @@ int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         u16 txq_id;
         int err;
 
+
+        /*
+         * If mac80211 is cleaning its state, then say that we finished since
+         * our state has been cleared anyway.
+         */
+        if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                return 0;
+        }
+
         spin_lock_bh(&mvmsta->lock);
 
         txq_id = tid_data->txq_id;
@@ -824,6 +881,34 @@ int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         return err;
 }
 
+int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta, u16 tid)
+{
+        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
+        u16 txq_id;
+
+        /*
+         * First set the agg state to OFF to avoid calling
+         * ieee80211_stop_tx_ba_cb in iwl_mvm_check_ratid_empty.
+         */
+        spin_lock_bh(&mvmsta->lock);
+        txq_id = tid_data->txq_id;
+        IWL_DEBUG_TX_QUEUES(mvm, "Flush AGG: sta %d tid %d q %d state %d\n",
+                            mvmsta->sta_id, tid, txq_id, tid_data->state);
+        tid_data->state = IWL_AGG_OFF;
+        spin_unlock_bh(&mvmsta->lock);
+
+        if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
+                IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
+
+        iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
+        mvm->queue_to_mac80211[tid_data->txq_id] =
+                                IWL_INVALID_MAC80211_QUEUE;
+
+        return 0;
+}
+
 static int iwl_mvm_set_fw_key_idx(struct iwl_mvm *mvm)
 {
         int i;
@@ -860,7 +945,7 @@ static u8 iwl_mvm_get_key_sta_id(struct ieee80211_vif *vif,
             mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT)
                 return mvmvif->ap_sta_id;
 
-        return IWL_INVALID_STATION;
+        return IWL_MVM_STATION_COUNT;
 }
 
 static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
@@ -1008,7 +1093,7 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
 
         /* Get the station id from the mvm local station table */
         sta_id = iwl_mvm_get_key_sta_id(vif, sta);
-        if (sta_id == IWL_INVALID_STATION) {
+        if (sta_id == IWL_MVM_STATION_COUNT) {
                 IWL_ERR(mvm, "Failed to find station id\n");
                 return -EINVAL;
         }
@@ -1103,7 +1188,7 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
                 return -ENOENT;
         }
 
-        if (sta_id == IWL_INVALID_STATION) {
+        if (sta_id == IWL_MVM_STATION_COUNT) {
                 IWL_DEBUG_WEP(mvm, "station non-existent, early return.\n");
                 return 0;
         }
@@ -1169,7 +1254,7 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm,
         struct iwl_mvm_sta *mvm_sta;
         u8 sta_id = iwl_mvm_get_key_sta_id(vif, sta);
 
-        if (WARN_ON_ONCE(sta_id == IWL_INVALID_STATION))
+        if (WARN_ON_ONCE(sta_id == IWL_MVM_STATION_COUNT))
                 return;
 
         rcu_read_lock();
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.h b/drivers/net/wireless/iwlwifi/mvm/sta.h
index 896f88ac8145..12abd2d71835 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -271,6 +271,7 @@ struct iwl_mvm_tid_data {
  * @tid_disable_agg: bitmap: if bit(tid) is set, the fw won't send ampdus for
  *      tid.
  * @max_agg_bufsize: the maximal size of the AGG buffer for this station
+ * @bt_reduced_txpower: is reduced tx power enabled for this station
  * @lock: lock to protect the whole struct. Since %tid_data is access from Tx
  * and from Tx response flow, it needs a spinlock.
  * @pending_frames: number of frames for this STA on the shared Tx queues.
@@ -287,6 +288,7 @@ struct iwl_mvm_sta {
         u32 mac_id_n_color;
         u16 tid_disable_agg;
         u8 max_agg_bufsize;
+        bool bt_reduced_txpower;
         spinlock_t lock;
         atomic_t pending_frames;
         struct iwl_mvm_tid_data tid_data[IWL_MAX_TID_COUNT];
@@ -348,6 +350,8 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta, u16 tid, u8 buf_size);
 int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                             struct ieee80211_sta *sta, u16 tid);
+int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta, u16 tid);
 
 int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm);
 int iwl_mvm_allocate_int_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *sta,
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index e437e02c7149..ad9bbca99213 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -76,14 +76,12 @@
 #define TU_TO_JIFFIES(_tu)      (usecs_to_jiffies((_tu) * 1024))
 #define MSEC_TO_TU(_msec)       (_msec*1000/1024)
 
-/* For ROC use a TE type which has priority high enough to be scheduled when
- * there is a concurrent BSS or GO/AP. Currently, use a TE type that has
- * priority similar to the TE priority used for action scans by the FW.
- * TODO: This needs to be changed, based on the reason for the ROC, i.e., use
- * TE_P2P_DEVICE_DISCOVERABLE for remain on channel without mgmt skb, and use
- * TE_P2P_DEVICE_ACTION_SCAN
+/*
+ * For the high priority TE use a time event type that has similar priority to
+ * the FW's action scan priority.
  */
-#define IWL_MVM_ROC_TE_TYPE TE_P2P_DEVICE_ACTION_SCAN
+#define IWL_MVM_ROC_TE_TYPE_NORMAL TE_P2P_DEVICE_DISCOVERABLE
+#define IWL_MVM_ROC_TE_TYPE_MGMT_TX TE_P2P_CLIENT_ASSOC
 
 void iwl_mvm_te_clear_data(struct iwl_mvm *mvm,
                            struct iwl_mvm_time_event_data *te_data)
@@ -116,7 +114,7 @@ void iwl_mvm_roc_done_wk(struct work_struct *wk)
          * issue as it will have to complete before the next command is
          * executed, and a new time event means a new command.
          */
-        iwl_mvm_flush_tx_path(mvm, BIT(IWL_OFFCHANNEL_QUEUE), false);
+        iwl_mvm_flush_tx_path(mvm, BIT(IWL_MVM_OFFCHANNEL_QUEUE), false);
 }
 
 static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
@@ -168,7 +166,7 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
         WARN_ONCE(!le32_to_cpu(notif->status),
                   "Failed to schedule time event\n");
 
-        if (le32_to_cpu(notif->action) == TE_NOTIF_HOST_END) {
+        if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_END) {
                 IWL_DEBUG_TE(mvm,
                              "TE ended - current time %lu, estimated end %lu\n",
                              jiffies, te_data->end_jiffies);
@@ -191,7 +189,7 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                 }
 
                 iwl_mvm_te_clear_data(mvm, te_data);
-        } else if (le32_to_cpu(notif->action) == TE_NOTIF_HOST_START) {
+        } else if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_START) {
                 te_data->running = true;
                 te_data->end_jiffies = jiffies +
                         TU_TO_JIFFIES(te_data->duration);
@@ -370,7 +368,8 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
         time_cmd.interval_reciprocal = cpu_to_le32(iwl_mvm_reciprocal(1));
         time_cmd.duration = cpu_to_le32(duration);
         time_cmd.repeat = cpu_to_le32(1);
-        time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_START | TE_NOTIF_HOST_END);
+        time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_EVENT_START |
+                                      TE_NOTIF_HOST_EVENT_END);
 
         iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
@@ -438,7 +437,7 @@ void iwl_mvm_stop_session_protection(struct iwl_mvm *mvm,
 }
 
 int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                          int duration)
+                          int duration, enum ieee80211_roc_type type)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
@@ -459,27 +458,36 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_ADD);
         time_cmd.id_and_color =
                 cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
-        time_cmd.id = cpu_to_le32(IWL_MVM_ROC_TE_TYPE);
+
+        switch (type) {
+        case IEEE80211_ROC_TYPE_NORMAL:
+                time_cmd.id = cpu_to_le32(IWL_MVM_ROC_TE_TYPE_NORMAL);
+                break;
+        case IEEE80211_ROC_TYPE_MGMT_TX:
+                time_cmd.id = cpu_to_le32(IWL_MVM_ROC_TE_TYPE_MGMT_TX);
+                break;
+        default:
+                WARN_ONCE(1, "Got an invalid ROC type\n");
+                return -EINVAL;
+        }
 
         time_cmd.apply_time = cpu_to_le32(0);
         time_cmd.dep_policy = cpu_to_le32(TE_INDEPENDENT);
         time_cmd.is_present = cpu_to_le32(1);
-
         time_cmd.interval = cpu_to_le32(1);
 
         /*
-         * IWL_MVM_ROC_TE_TYPE can have lower priority than other events
+         * The P2P Device TEs can have lower priority than other events
          * that are being scheduled by the driver/fw, and thus it might not be
-         * scheduled. To improve the chances of it being scheduled, allow it to
-         * be fragmented.
-         * In addition, for the same reasons, allow to delay the scheduling of
-         * the time event.
+         * scheduled. To improve the chances of it being scheduled, allow them
+         * to be fragmented, and in addition allow them to be delayed.
          */
         time_cmd.max_frags = cpu_to_le32(MSEC_TO_TU(duration)/20);
         time_cmd.max_delay = cpu_to_le32(MSEC_TO_TU(duration/2));
         time_cmd.duration = cpu_to_le32(MSEC_TO_TU(duration));
         time_cmd.repeat = cpu_to_le32(1);
-        time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_START | TE_NOTIF_HOST_END);
+        time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_EVENT_START |
+                                      TE_NOTIF_HOST_EVENT_END);
 
         return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.h b/drivers/net/wireless/iwlwifi/mvm/time-event.h
index 64fb57a5ab43..f86c51065ed3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.h
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.h
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -162,6 +162,7 @@ int iwl_mvm_rx_time_event_notif(struct iwl_mvm *mvm,
  * that the vif type is NL80211_IFTYPE_P2P_DEVICE
  * @duration: the requested duration in millisecond for the fw to be on the
  * channel that is bound to the vif.
+ * @type: the remain on channel request type
  *
  * This function can be used to issue a remain on channel session,
  * which means that the fw will stay in the channel for the request %duration
@@ -172,7 +173,7 @@ int iwl_mvm_rx_time_event_notif(struct iwl_mvm *mvm,
  * another notification to the driver.
  */
 int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                          int duration);
+                          int duration, enum ieee80211_roc_type type);
 
 /**
  * iwl_mvm_stop_p2p_roc - stop remain on channel for p2p device functionlity
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 56df249b215e..479074303bd7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -205,7 +205,7 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm,
         rate_plcp = iwl_mvm_mac80211_idx_to_hwrate(rate_idx);
 
         mvm->mgmt_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->nvm_data->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_fw_valid_tx_ant(mvm->fw),
                                      mvm->mgmt_last_antenna_idx);
         rate_flags = BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS;
 
@@ -365,7 +365,7 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
         if (WARN_ON_ONCE(!mvmsta))
                 return -1;
 
-        if (WARN_ON_ONCE(mvmsta->sta_id == IWL_INVALID_STATION))
+        if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_STATION_COUNT))
                 return -1;
 
         dev_cmd = iwl_mvm_set_tx_params(mvm, skb, sta, mvmsta->sta_id);
@@ -417,7 +417,7 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
         spin_unlock(&mvmsta->lock);
 
         if (mvmsta->vif->type == NL80211_IFTYPE_AP &&
-            txq_id < IWL_FIRST_AMPDU_QUEUE)
+            txq_id < IWL_MVM_FIRST_AGG_QUEUE)
                 atomic_inc(&mvmsta->pending_frames);
 
         return 0;
@@ -606,13 +606,9 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                                              info);
 
                 /* Single frame failure in an AMPDU queue => send BAR */
-                if (txq_id >= IWL_FIRST_AMPDU_QUEUE &&
-                    !(info->flags & IEEE80211_TX_STAT_ACK)) {
-                        /* there must be only one skb in the skb_list */
-                        WARN_ON_ONCE(skb_freed > 1 ||
-                                     !skb_queue_empty(&skbs));
+                if (txq_id >= IWL_MVM_FIRST_AGG_QUEUE &&
+                    !(info->flags & IEEE80211_TX_STAT_ACK))
                         info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
-                }
 
                 /* W/A FW bug: seq_ctl is wrong when the queue is flushed */
                 if (status == TX_STATUS_FAIL_FIFO_FLUSHED) {
@@ -623,7 +619,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                 ieee80211_tx_status_ni(mvm->hw, skb);
         }
 
-        if (txq_id >= IWL_FIRST_AMPDU_QUEUE) {
+        if (txq_id >= IWL_MVM_FIRST_AGG_QUEUE) {
                 /* If this is an aggregation queue, we use the ssn since:
                  * ssn = wifi seq_num % 256.
                  * The seq_ctl is the sequence control of the packet to which
@@ -645,10 +641,12 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         }
 
         IWL_DEBUG_TX_REPLY(mvm,
-                           "TXQ %d status %s (0x%08x)\n\t\t\t\tinitial_rate 0x%x "
-                            "retries %d, idx=%d ssn=%d next_reclaimed=0x%x seq_ctl=0x%x\n",
-                           txq_id, iwl_mvm_get_tx_fail_reason(status),
-                           status, le32_to_cpu(tx_resp->initial_rate),
+                           "TXQ %d status %s (0x%08x)\n",
+                           txq_id, iwl_mvm_get_tx_fail_reason(status), status);
+
+        IWL_DEBUG_TX_REPLY(mvm,
+                           "\t\t\t\tinitial_rate 0x%x retries %d, idx=%d ssn=%d next_reclaimed=0x%x seq_ctl=0x%x\n",
+                           le32_to_cpu(tx_resp->initial_rate),
                            tx_resp->failure_frame, SEQ_TO_INDEX(sequence),
                            ssn, next_reclaimed, seq_ctl);
 
@@ -685,7 +683,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
          * If there are no pending frames for this STA, notify mac80211 that
          * this station can go to sleep in its STA table.
          */
-        if (txq_id < IWL_FIRST_AMPDU_QUEUE && mvmsta &&
+        if (txq_id < IWL_MVM_FIRST_AGG_QUEUE && mvmsta &&
             !WARN_ON(skb_freed > 1) &&
             mvmsta->vif->type == NL80211_IFTYPE_AP &&
             atomic_sub_and_test(skb_freed, &mvmsta->pending_frames)) {
@@ -754,7 +752,7 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
         struct ieee80211_sta *sta;
 
-        if (WARN_ON_ONCE(SEQ_TO_QUEUE(sequence) < IWL_FIRST_AMPDU_QUEUE))
+        if (WARN_ON_ONCE(SEQ_TO_QUEUE(sequence) < IWL_MVM_FIRST_AGG_QUEUE))
                 return;
 
         if (WARN_ON_ONCE(tid == IWL_TID_NON_QOS))
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index 000e842c2edd..0cc8d8c0d393 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -462,7 +462,7 @@ int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
                 .data = { lq, },
         };
 
-        if (WARN_ON(lq->sta_id == IWL_INVALID_STATION))
+        if (WARN_ON(lq->sta_id == IWL_MVM_STATION_COUNT))
                 return -EINVAL;
 
         if (WARN_ON(init && (cmd.flags & CMD_ASYNC)))
diff --git a/drivers/net/wireless/iwlwifi/pcie/cfg.h b/drivers/net/wireless/iwlwifi/pcie/cfg.h
deleted file mode 100644
index c6f8e83c3551..000000000000
--- a/drivers/net/wireless/iwlwifi/pcie/cfg.h
+++ /dev/null
@@ -1,115 +0,0 @@
-/******************************************************************************
- *
- * This file is provided under a dual BSD/GPLv2 license.  When using or
- * redistributing this file, you may do so under either license.
- *
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
- * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- * BSD LICENSE
- *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *  * Neither the name Intel Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *****************************************************************************/
-#ifndef __iwl_pci_h__
-#define __iwl_pci_h__
-
-
-/*
- * This file declares the config structures for all devices.
- */
-
-extern const struct iwl_cfg iwl5300_agn_cfg;
-extern const struct iwl_cfg iwl5100_agn_cfg;
-extern const struct iwl_cfg iwl5350_agn_cfg;
-extern const struct iwl_cfg iwl5100_bgn_cfg;
-extern const struct iwl_cfg iwl5100_abg_cfg;
-extern const struct iwl_cfg iwl5150_agn_cfg;
-extern const struct iwl_cfg iwl5150_abg_cfg;
-extern const struct iwl_cfg iwl6005_2agn_cfg;
-extern const struct iwl_cfg iwl6005_2abg_cfg;
-extern const struct iwl_cfg iwl6005_2bg_cfg;
-extern const struct iwl_cfg iwl6005_2agn_sff_cfg;
-extern const struct iwl_cfg iwl6005_2agn_d_cfg;
-extern const struct iwl_cfg iwl6005_2agn_mow1_cfg;
-extern const struct iwl_cfg iwl6005_2agn_mow2_cfg;
-extern const struct iwl_cfg iwl1030_bgn_cfg;
-extern const struct iwl_cfg iwl1030_bg_cfg;
-extern const struct iwl_cfg iwl6030_2agn_cfg;
-extern const struct iwl_cfg iwl6030_2abg_cfg;
-extern const struct iwl_cfg iwl6030_2bgn_cfg;
-extern const struct iwl_cfg iwl6030_2bg_cfg;
-extern const struct iwl_cfg iwl6000i_2agn_cfg;
-extern const struct iwl_cfg iwl6000i_2abg_cfg;
-extern const struct iwl_cfg iwl6000i_2bg_cfg;
-extern const struct iwl_cfg iwl6000_3agn_cfg;
-extern const struct iwl_cfg iwl6050_2agn_cfg;
-extern const struct iwl_cfg iwl6050_2abg_cfg;
-extern const struct iwl_cfg iwl6150_bgn_cfg;
-extern const struct iwl_cfg iwl6150_bg_cfg;
-extern const struct iwl_cfg iwl1000_bgn_cfg;
-extern const struct iwl_cfg iwl1000_bg_cfg;
-extern const struct iwl_cfg iwl100_bgn_cfg;
-extern const struct iwl_cfg iwl100_bg_cfg;
-extern const struct iwl_cfg iwl130_bgn_cfg;
-extern const struct iwl_cfg iwl130_bg_cfg;
-extern const struct iwl_cfg iwl2000_2bgn_cfg;
-extern const struct iwl_cfg iwl2000_2bgn_d_cfg;
-extern const struct iwl_cfg iwl2030_2bgn_cfg;
-extern const struct iwl_cfg iwl6035_2agn_cfg;
-extern const struct iwl_cfg iwl105_bgn_cfg;
-extern const struct iwl_cfg iwl105_bgn_d_cfg;
-extern const struct iwl_cfg iwl135_bgn_cfg;
-extern const struct iwl_cfg iwl7260_2ac_cfg;
-extern const struct iwl_cfg iwl3160_ac_cfg;
-
-#endif /* __iwl_pci_h__ */
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 7bc0fb9128dd..0016bb24b3d7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -69,8 +69,6 @@
 
 #include "iwl-trans.h"
 #include "iwl-drv.h"
-
-#include "cfg.h"
 #include "internal.h"
 
 #define IWL_PCI_DEVICE(dev, subdev, cfg) \
@@ -243,6 +241,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x088F, 0x4260, iwl6035_2agn_cfg)},
         {IWL_PCI_DEVICE(0x088E, 0x4460, iwl6035_2agn_cfg)},
         {IWL_PCI_DEVICE(0x088E, 0x4860, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088F, 0x5260, iwl6035_2agn_cfg)},
 
 /* 105 Series */
         {IWL_PCI_DEVICE(0x0894, 0x0022, iwl105_bgn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index aa2a39a637dd..148843e7f34f 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -137,10 +137,6 @@ static inline int iwl_queue_dec_wrap(int index, int n_bd)
 struct iwl_cmd_meta {
         /* only for SYNC commands, iff the reply skb is wanted */
         struct iwl_host_cmd *source;
-
-        DEFINE_DMA_UNMAP_ADDR(mapping);
-        DEFINE_DMA_UNMAP_LEN(len);
-
         u32 flags;
 };
 
@@ -182,19 +178,39 @@ struct iwl_queue {
 #define TFD_TX_CMD_SLOTS 256
 #define TFD_CMD_SLOTS 32
 
+/*
+ * The FH will write back to the first TB only, so we need
+ * to copy some data into the buffer regardless of whether
+ * it should be mapped or not. This indicates how big the
+ * first TB must be to include the scratch buffer. Since
+ * the scratch is 4 bytes at offset 12, it's 16 now. If we
+ * make it bigger then allocations will be bigger and copy
+ * slower, so that's probably not useful.
+ */
+#define IWL_HCMD_SCRATCHBUF_SIZE        16
+
 struct iwl_pcie_txq_entry {
         struct iwl_device_cmd *cmd;
-        struct iwl_device_cmd *copy_cmd;
         struct sk_buff *skb;
         /* buffer to free after command completes */
         const void *free_buf;
         struct iwl_cmd_meta meta;
 };
 
+struct iwl_pcie_txq_scratch_buf {
+        struct iwl_cmd_header hdr;
+        u8 buf[8];
+        __le32 scratch;
+};
+
 /**
  * struct iwl_txq - Tx Queue for DMA
  * @q: generic Rx/Tx queue descriptor
  * @tfds: transmit frame descriptors (DMA memory)
+ * @scratchbufs: start of command headers, including scratch buffers, for
+ *      the writeback -- this is DMA memory and an array holding one buffer
+ *      for each command on the queue
+ * @scratchbufs_dma: DMA address for the scratchbufs start
  * @entries: transmit entries (driver state)
  * @lock: queue lock
  * @stuck_timer: timer that fires if queue gets stuck
@@ -208,6 +224,8 @@ struct iwl_pcie_txq_entry {
 struct iwl_txq {
         struct iwl_queue q;
         struct iwl_tfd *tfds;
+        struct iwl_pcie_txq_scratch_buf *scratchbufs;
+        dma_addr_t scratchbufs_dma;
         struct iwl_pcie_txq_entry *entries;
         spinlock_t lock;
         struct timer_list stuck_timer;
@@ -216,6 +234,13 @@ struct iwl_txq {
         u8 active;
 };
 
+static inline dma_addr_t
+iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
+{
+        return txq->scratchbufs_dma +
+               sizeof(struct iwl_pcie_txq_scratch_buf) * idx;
+}
+
 /**
  * struct iwl_trans_pcie - PCIe transport specific data
  * @rxq: all the RX queue data
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index b0ae06d2456f..567e67ad1f61 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -637,22 +637,14 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                 index = SEQ_TO_INDEX(sequence);
                 cmd_index = get_cmd_index(&txq->q, index);
 
-                if (reclaim) {
-                        struct iwl_pcie_txq_entry *ent;
-                        ent = &txq->entries[cmd_index];
-                        cmd = ent->copy_cmd;
-                        WARN_ON_ONCE(!cmd && ent->meta.flags & CMD_WANT_HCMD);
-                } else {
+                if (reclaim)
+                        cmd = txq->entries[cmd_index].cmd;
+                else
                         cmd = NULL;
-                }
 
                 err = iwl_op_mode_rx(trans->op_mode, &rxcb, cmd);
 
                 if (reclaim) {
-                        /* The original command isn't needed any more */
-                        kfree(txq->entries[cmd_index].copy_cmd);
-                        txq->entries[cmd_index].copy_cmd = NULL;
-                        /* nor is the duplicated part of the command */
                         kfree(txq->entries[cmd_index].free_buf);
                         txq->entries[cmd_index].free_buf = NULL;
                 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 17bedc50e753..50ba0a468f94 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -475,6 +475,10 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
 
         /* If platform's RF_KILL switch is NOT set to KILL */
         hw_rfkill = iwl_is_rfkill_set(trans);
+        if (hw_rfkill)
+                set_bit(STATUS_RFKILL, &trans_pcie->status);
+        else
+                clear_bit(STATUS_RFKILL, &trans_pcie->status);
         iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
         if (hw_rfkill && !run_in_rfkill)
                 return -ERFKILL;
@@ -641,6 +645,7 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
 
 static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         bool hw_rfkill;
         int err;
 
@@ -656,6 +661,10 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
         iwl_enable_rfkill_int(trans);
 
         hw_rfkill = iwl_is_rfkill_set(trans);
+        if (hw_rfkill)
+                set_bit(STATUS_RFKILL, &trans_pcie->status);
+        else
+                clear_bit(STATUS_RFKILL, &trans_pcie->status);
         iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
 
         return 0;
@@ -694,6 +703,10 @@ static void iwl_trans_pcie_stop_hw(struct iwl_trans *trans,
                  * op_mode.
                  */
                 hw_rfkill = iwl_is_rfkill_set(trans);
+                if (hw_rfkill)
+                        set_bit(STATUS_RFKILL, &trans_pcie->status);
+                else
+                        clear_bit(STATUS_RFKILL, &trans_pcie->status);
                 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
         }
 }
@@ -715,7 +728,8 @@ static u32 iwl_trans_pcie_read32(struct iwl_trans *trans, u32 ofs)
 
 static u32 iwl_trans_pcie_read_prph(struct iwl_trans *trans, u32 reg)
 {
-        iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_RADDR, reg | (3 << 24));
+        iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_RADDR,
+                               ((reg & 0x000FFFFF) | (3 << 24)));
         return iwl_trans_pcie_read32(trans, HBUS_TARG_PRPH_RDAT);
 }
 
@@ -723,7 +737,7 @@ static void iwl_trans_pcie_write_prph(struct iwl_trans *trans, u32 addr,
                                       u32 val)
 {
         iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_WADDR,
-                               ((addr & 0x0000FFFF) | (3 << 24)));
+                               ((addr & 0x000FFFFF) | (3 << 24)));
         iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_WDAT, val);
 }
 
@@ -1370,28 +1384,11 @@ static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
         return ret;
 }
 
-static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
-                                          const char __user *user_buf,
-                                          size_t count, loff_t *ppos)
-{
-        struct iwl_trans *trans = file->private_data;
-
-        if (!trans->op_mode)
-                return -EAGAIN;
-
-        local_bh_disable();
-        iwl_op_mode_nic_error(trans->op_mode);
-        local_bh_enable();
-
-        return count;
-}
-
 DEBUGFS_READ_WRITE_FILE_OPS(interrupt);
 DEBUGFS_READ_FILE_OPS(fh_reg);
 DEBUGFS_READ_FILE_OPS(rx_queue);
 DEBUGFS_READ_FILE_OPS(tx_queue);
 DEBUGFS_WRITE_FILE_OPS(csr);
-DEBUGFS_WRITE_FILE_OPS(fw_restart);
 
 /*
  * Create the debugfs files and directories
@@ -1405,7 +1402,6 @@ static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
         DEBUGFS_ADD_FILE(interrupt, dir, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(csr, dir, S_IWUSR);
         DEBUGFS_ADD_FILE(fh_reg, dir, S_IRUSR);
-        DEBUGFS_ADD_FILE(fw_restart, dir, S_IWUSR);
         return 0;
 
 err:
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index ad7441dfa6fb..d97c1fad7bc3 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -191,12 +191,9 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
         }
 
         for (i = q->read_ptr; i != q->write_ptr;
-             i = iwl_queue_inc_wrap(i, q->n_bd)) {
-                struct iwl_tx_cmd *tx_cmd =
-                        (struct iwl_tx_cmd *)txq->entries[i].cmd->payload;
+             i = iwl_queue_inc_wrap(i, q->n_bd))
                 IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
-                        get_unaligned_le32(&tx_cmd->scratch));
-        }
+                        le32_to_cpu(txq->scratchbufs[i].scratch));
 
         iwl_op_mode_nic_error(trans->op_mode);
 }
@@ -367,8 +364,8 @@ static inline u8 iwl_pcie_tfd_get_num_tbs(struct iwl_tfd *tfd)
 }
 
 static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
-                               struct iwl_cmd_meta *meta, struct iwl_tfd *tfd,
-                               enum dma_data_direction dma_dir)
+                               struct iwl_cmd_meta *meta,
+                               struct iwl_tfd *tfd)
 {
         int i;
         int num_tbs;
@@ -382,17 +379,12 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
                 return;
         }
 
-        /* Unmap tx_cmd */
-        if (num_tbs)
-                dma_unmap_single(trans->dev,
-                                dma_unmap_addr(meta, mapping),
-                                dma_unmap_len(meta, len),
-                                DMA_BIDIRECTIONAL);
+        /* first TB is never freed - it's the scratchbuf data */
 
-        /* Unmap chunks, if any. */
         for (i = 1; i < num_tbs; i++)
                 dma_unmap_single(trans->dev, iwl_pcie_tfd_tb_get_addr(tfd, i),
-                                 iwl_pcie_tfd_tb_get_len(tfd, i), dma_dir);
+                                 iwl_pcie_tfd_tb_get_len(tfd, i),
+                                 DMA_TO_DEVICE);
 
         tfd->num_tbs = 0;
 }
@@ -406,8 +398,7 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
  * Does NOT advance any TFD circular buffer read/write indexes
  * Does NOT free the TFD itself (which is within circular buffer)
  */
-static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq,
-                                  enum dma_data_direction dma_dir)
+static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
 {
         struct iwl_tfd *tfd_tmp = txq->tfds;
 
@@ -418,8 +409,7 @@ static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq,
         lockdep_assert_held(&txq->lock);
 
         /* We have only q->n_window txq->entries, but we use q->n_bd tfds */
-        iwl_pcie_tfd_unmap(trans, &txq->entries[idx].meta, &tfd_tmp[rd_ptr],
-                           dma_dir);
+        iwl_pcie_tfd_unmap(trans, &txq->entries[idx].meta, &tfd_tmp[rd_ptr]);
 
         /* free SKB */
         if (txq->entries) {
@@ -479,6 +469,7 @@ static int iwl_pcie_txq_alloc(struct iwl_trans *trans,
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         size_t tfd_sz = sizeof(struct iwl_tfd) * TFD_QUEUE_SIZE_MAX;
+        size_t scratchbuf_sz;
         int i;
 
         if (WARN_ON(txq->entries || txq->tfds))
@@ -514,9 +505,25 @@ static int iwl_pcie_txq_alloc(struct iwl_trans *trans,
                 IWL_ERR(trans, "dma_alloc_coherent(%zd) failed\n", tfd_sz);
                 goto error;
         }
+
+        BUILD_BUG_ON(IWL_HCMD_SCRATCHBUF_SIZE != sizeof(*txq->scratchbufs));
+        BUILD_BUG_ON(offsetof(struct iwl_pcie_txq_scratch_buf, scratch) !=
+                        sizeof(struct iwl_cmd_header) +
+                        offsetof(struct iwl_tx_cmd, scratch));
+
+        scratchbuf_sz = sizeof(*txq->scratchbufs) * slots_num;
+
+        txq->scratchbufs = dma_alloc_coherent(trans->dev, scratchbuf_sz,
+                                              &txq->scratchbufs_dma,
+                                              GFP_KERNEL);
+        if (!txq->scratchbufs)
+                goto err_free_tfds;
+
         txq->q.id = txq_id;
 
         return 0;
+err_free_tfds:
+        dma_free_coherent(trans->dev, tfd_sz, txq->tfds, txq->q.dma_addr);
 error:
         if (txq->entries && txq_id == trans_pcie->cmd_queue)
                 for (i = 0; i < slots_num; i++)
@@ -565,22 +572,13 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_txq *txq = &trans_pcie->txq[txq_id];
         struct iwl_queue *q = &txq->q;
-        enum dma_data_direction dma_dir;
 
         if (!q->n_bd)
                 return;
 
-        /* In the command queue, all the TBs are mapped as BIDI
-         * so unmap them as such.
-         */
-        if (txq_id == trans_pcie->cmd_queue)
-                dma_dir = DMA_BIDIRECTIONAL;
-        else
-                dma_dir = DMA_TO_DEVICE;
-
         spin_lock_bh(&txq->lock);
         while (q->write_ptr != q->read_ptr) {
-                iwl_pcie_txq_free_tfd(trans, txq, dma_dir);
+                iwl_pcie_txq_free_tfd(trans, txq);
                 q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
         }
         spin_unlock_bh(&txq->lock);
@@ -610,7 +608,6 @@ static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id)
         if (txq_id == trans_pcie->cmd_queue)
                 for (i = 0; i < txq->q.n_window; i++) {
                         kfree(txq->entries[i].cmd);
-                        kfree(txq->entries[i].copy_cmd);
                         kfree(txq->entries[i].free_buf);
                 }
 
@@ -619,6 +616,10 @@ static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id)
                 dma_free_coherent(dev, sizeof(struct iwl_tfd) *
                                   txq->q.n_bd, txq->tfds, txq->q.dma_addr);
                 txq->q.dma_addr = 0;
+
+                dma_free_coherent(dev,
+                                  sizeof(*txq->scratchbufs) * txq->q.n_window,
+                                  txq->scratchbufs, txq->scratchbufs_dma);
         }
 
         kfree(txq->entries);
@@ -962,7 +963,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
                 iwl_pcie_txq_inval_byte_cnt_tbl(trans, txq);
 
-                iwl_pcie_txq_free_tfd(trans, txq, DMA_TO_DEVICE);
+                iwl_pcie_txq_free_tfd(trans, txq);
         }
 
         iwl_pcie_txq_progress(trans_pcie, txq);
@@ -1062,7 +1063,7 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
                 iwl_set_bits_prph(trans, SCD_QUEUECHAIN_SEL, BIT(txq_id));
 
         /* If this queue is mapped to a certain station: it is an AGG queue */
-        if (sta_id != IWL_INVALID_STATION) {
+        if (sta_id >= 0) {
                 u16 ra_tid = BUILD_RAxTID(sta_id, tid);
 
                 /* Map receiver-address / traffic-ID to this queue */
@@ -1152,20 +1153,37 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         void *dup_buf = NULL;
         dma_addr_t phys_addr;
         int idx;
-        u16 copy_size, cmd_size;
+        u16 copy_size, cmd_size, scratch_size;
         bool had_nocopy = false;
         int i;
         u32 cmd_pos;
+        const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD];
+        u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD];
 
         copy_size = sizeof(out_cmd->hdr);
         cmd_size = sizeof(out_cmd->hdr);
 
         /* need one for the header if the first is NOCOPY */
-        BUILD_BUG_ON(IWL_MAX_CMD_TFDS > IWL_NUM_OF_TBS - 1);
+        BUILD_BUG_ON(IWL_MAX_CMD_TBS_PER_TFD > IWL_NUM_OF_TBS - 1);
+
+        for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
+                cmddata[i] = cmd->data[i];
+                cmdlen[i] = cmd->len[i];
 
-        for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
                 if (!cmd->len[i])
                         continue;
+
+                /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
+                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
+                        int copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
+
+                        if (copy > cmdlen[i])
+                                copy = cmdlen[i];
+                        cmdlen[i] -= copy;
+                        cmddata[i] += copy;
+                        copy_size += copy;
+                }
+
                 if (cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY) {
                         had_nocopy = true;
                         if (WARN_ON(cmd->dataflags[i] & IWL_HCMD_DFL_DUP)) {
@@ -1185,7 +1203,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                                 goto free_dup_buf;
                         }
 
-                        dup_buf = kmemdup(cmd->data[i], cmd->len[i],
+                        dup_buf = kmemdup(cmddata[i], cmdlen[i],
                                           GFP_ATOMIC);
                         if (!dup_buf)
                                 return -ENOMEM;
@@ -1195,7 +1213,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                                 idx = -EINVAL;
                                 goto free_dup_buf;
                         }
-                        copy_size += cmd->len[i];
+                        copy_size += cmdlen[i];
                 }
                 cmd_size += cmd->len[i];
         }
@@ -1242,30 +1260,30 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
 
         /* and copy the data that needs to be copied */
         cmd_pos = offsetof(struct iwl_device_cmd, payload);
-        for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+        copy_size = sizeof(out_cmd->hdr);
+        for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
+                int copy = 0;
+
                 if (!cmd->len[i])
                         continue;
-                if (cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
-                                         IWL_HCMD_DFL_DUP))
-                        break;
-                memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], cmd->len[i]);
-                cmd_pos += cmd->len[i];
-        }
 
-        WARN_ON_ONCE(txq->entries[idx].copy_cmd);
+                /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
+                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
+                        copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
 
-        /*
-         * since out_cmd will be the source address of the FH, it will write
-         * the retry count there. So when the user needs to receivce the HCMD
-         * that corresponds to the response in the response handler, it needs
-         * to set CMD_WANT_HCMD.
-         */
-        if (cmd->flags & CMD_WANT_HCMD) {
-                txq->entries[idx].copy_cmd =
-                        kmemdup(out_cmd, cmd_pos, GFP_ATOMIC);
-                if (unlikely(!txq->entries[idx].copy_cmd)) {
-                        idx = -ENOMEM;
-                        goto out;
+                        if (copy > cmd->len[i])
+                                copy = cmd->len[i];
+                }
+
+                /* copy everything if not nocopy/dup */
+                if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
+                                           IWL_HCMD_DFL_DUP)))
+                        copy = cmd->len[i];
+
+                if (copy) {
+                        memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
+                        cmd_pos += copy;
+                        copy_size += copy;
                 }
         }
 
@@ -1275,22 +1293,35 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                      out_cmd->hdr.cmd, le16_to_cpu(out_cmd->hdr.sequence),
                      cmd_size, q->write_ptr, idx, trans_pcie->cmd_queue);
 
-        phys_addr = dma_map_single(trans->dev, &out_cmd->hdr, copy_size,
-                                   DMA_BIDIRECTIONAL);
-        if (unlikely(dma_mapping_error(trans->dev, phys_addr))) {
-                idx = -ENOMEM;
-                goto out;
-        }
-
-        dma_unmap_addr_set(out_meta, mapping, phys_addr);
-        dma_unmap_len_set(out_meta, len, copy_size);
+        /* start the TFD with the scratchbuf */
+        scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
+        memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
+        iwl_pcie_txq_build_tfd(trans, txq,
+                               iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
+                               scratch_size, 1);
+
+        /* map first command fragment, if any remains */
+        if (copy_size > scratch_size) {
+                phys_addr = dma_map_single(trans->dev,
+                                           ((u8 *)&out_cmd->hdr) + scratch_size,
+                                           copy_size - scratch_size,
+                                           DMA_TO_DEVICE);
+                if (dma_mapping_error(trans->dev, phys_addr)) {
+                        iwl_pcie_tfd_unmap(trans, out_meta,
+                                           &txq->tfds[q->write_ptr]);
+                        idx = -ENOMEM;
+                        goto out;
+                }
 
-        iwl_pcie_txq_build_tfd(trans, txq, phys_addr, copy_size, 1);
+                iwl_pcie_txq_build_tfd(trans, txq, phys_addr,
+                                       copy_size - scratch_size, 0);
+        }
 
-        for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
-                const void *data = cmd->data[i];
+        /* map the remaining (adjusted) nocopy/dup fragments */
+        for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
+                const void *data = cmddata[i];
 
-                if (!cmd->len[i])
+                if (!cmdlen[i])
                         continue;
                 if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
                                            IWL_HCMD_DFL_DUP)))
@@ -1298,16 +1329,15 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                 if (cmd->dataflags[i] & IWL_HCMD_DFL_DUP)
                         data = dup_buf;
                 phys_addr = dma_map_single(trans->dev, (void *)data,
-                                           cmd->len[i], DMA_BIDIRECTIONAL);
+                                           cmdlen[i], DMA_TO_DEVICE);
                 if (dma_mapping_error(trans->dev, phys_addr)) {
                         iwl_pcie_tfd_unmap(trans, out_meta,
-                                           &txq->tfds[q->write_ptr],
-                                           DMA_BIDIRECTIONAL);
+                                           &txq->tfds[q->write_ptr]);
                         idx = -ENOMEM;
                         goto out;
                 }
 
-                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmd->len[i], 0);
+                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], 0);
         }
 
         out_meta->flags = cmd->flags;
@@ -1317,8 +1347,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
 
         txq->need_update = 1;
 
-        trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size,
-                               &out_cmd->hdr, copy_size);
+        trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size, &out_cmd->hdr);
 
         /* start timer if queue currently empty */
         if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
@@ -1377,7 +1406,7 @@ void iwl_pcie_hcmd_complete(struct iwl_trans *trans,
         cmd = txq->entries[cmd_index].cmd;
         meta = &txq->entries[cmd_index].meta;
 
-        iwl_pcie_tfd_unmap(trans, meta, &txq->tfds[index], DMA_BIDIRECTIONAL);
+        iwl_pcie_tfd_unmap(trans, meta, &txq->tfds[index]);
 
         /* Input error checking is done when commands are added to queue. */
         if (meta->flags & CMD_WANT_SKB) {
@@ -1537,8 +1566,11 @@ int iwl_trans_pcie_send_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
         if (test_bit(STATUS_FW_ERROR, &trans_pcie->status))
                 return -EIO;
 
-        if (test_bit(STATUS_RFKILL, &trans_pcie->status))
+        if (test_bit(STATUS_RFKILL, &trans_pcie->status)) {
+                IWL_DEBUG_RF_KILL(trans, "Dropping CMD 0x%x: RF KILL\n",
+                                  cmd->id);
                 return -ERFKILL;
+        }
 
         if (cmd->flags & CMD_ASYNC)
                 return iwl_pcie_send_hcmd_async(trans, cmd);
@@ -1556,10 +1588,9 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         struct iwl_cmd_meta *out_meta;
         struct iwl_txq *txq;
         struct iwl_queue *q;
-        dma_addr_t phys_addr = 0;
-        dma_addr_t txcmd_phys;
-        dma_addr_t scratch_phys;
-        u16 len, firstlen, secondlen;
+        dma_addr_t tb0_phys, tb1_phys, scratch_phys;
+        void *tb1_addr;
+        u16 len, tb1_len, tb2_len;
         u8 wait_write_ptr = 0;
         __le16 fc = hdr->frame_control;
         u8 hdr_len = ieee80211_hdrlen(fc);
@@ -1597,85 +1628,80 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                 cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
                             INDEX_TO_SEQ(q->write_ptr)));
 
+        tb0_phys = iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr);
+        scratch_phys = tb0_phys + sizeof(struct iwl_cmd_header) +
+                       offsetof(struct iwl_tx_cmd, scratch);
+
+        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
+        tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
+
         /* Set up first empty entry in queue's array of Tx/cmd buffers */
         out_meta = &txq->entries[q->write_ptr].meta;
 
         /*
-         * Use the first empty entry in this queue's command buffer array
-         * to contain the Tx command and MAC header concatenated together
-         * (payload data will be in another buffer).
-         * Size of this varies, due to varying MAC header length.
-         * If end is not dword aligned, we'll have 2 extra bytes at the end
-         * of the MAC header (device reads on dword boundaries).
-         * We'll tell device about this padding later.
+         * The second TB (tb1) points to the remainder of the TX command
+         * and the 802.11 header - dword aligned size
+         * (This calculation modifies the TX command, so do it before the
+         * setup of the first TB)
          */
-        len = sizeof(struct iwl_tx_cmd) +
-                sizeof(struct iwl_cmd_header) + hdr_len;
-        firstlen = (len + 3) & ~3;
+        len = sizeof(struct iwl_tx_cmd) + sizeof(struct iwl_cmd_header) +
+              hdr_len - IWL_HCMD_SCRATCHBUF_SIZE;
+        tb1_len = (len + 3) & ~3;
 
         /* Tell NIC about any 2-byte padding after MAC header */
-        if (firstlen != len)
+        if (tb1_len != len)
                 tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
 
-        /* Physical address of this Tx command's header (not MAC header!),
-         * within command buffer array. */
-        txcmd_phys = dma_map_single(trans->dev,
-                                    &dev_cmd->hdr, firstlen,
-                                    DMA_BIDIRECTIONAL);
-        if (unlikely(dma_mapping_error(trans->dev, txcmd_phys)))
-                goto out_err;
-        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, firstlen);
+        /* The first TB points to the scratchbuf data - min_copy bytes */
+        memcpy(&txq->scratchbufs[q->write_ptr], &dev_cmd->hdr,
+               IWL_HCMD_SCRATCHBUF_SIZE);
+        iwl_pcie_txq_build_tfd(trans, txq, tb0_phys,
+                               IWL_HCMD_SCRATCHBUF_SIZE, 1);
 
-        if (!ieee80211_has_morefrags(fc)) {
-                txq->need_update = 1;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
+        /* there must be data left over for TB1 or this code must be changed */
+        BUILD_BUG_ON(sizeof(struct iwl_tx_cmd) < IWL_HCMD_SCRATCHBUF_SIZE);
+
+        /* map the data for TB1 */
+        tb1_addr = ((u8 *)&dev_cmd->hdr) + IWL_HCMD_SCRATCHBUF_SIZE;
+        tb1_phys = dma_map_single(trans->dev, tb1_addr, tb1_len, DMA_TO_DEVICE);
+        if (unlikely(dma_mapping_error(trans->dev, tb1_phys)))
+                goto out_err;
+        iwl_pcie_txq_build_tfd(trans, txq, tb1_phys, tb1_len, 0);
 
-        /* Set up TFD's 2nd entry to point directly to remainder of skb,
-         * if any (802.11 null frames have no payload). */
-        secondlen = skb->len - hdr_len;
-        if (secondlen > 0) {
-                phys_addr = dma_map_single(trans->dev, skb->data + hdr_len,
-                                           secondlen, DMA_TO_DEVICE);
-                if (unlikely(dma_mapping_error(trans->dev, phys_addr))) {
-                        dma_unmap_single(trans->dev,
-                                         dma_unmap_addr(out_meta, mapping),
-                                         dma_unmap_len(out_meta, len),
-                                         DMA_BIDIRECTIONAL);
+        /*
+         * Set up TFD's third entry to point directly to remainder
+         * of skb, if any (802.11 null frames have no payload).
+         */
+        tb2_len = skb->len - hdr_len;
+        if (tb2_len > 0) {
+                dma_addr_t tb2_phys = dma_map_single(trans->dev,
+                                                     skb->data + hdr_len,
+                                                     tb2_len, DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(trans->dev, tb2_phys))) {
+                        iwl_pcie_tfd_unmap(trans, out_meta,
+                                           &txq->tfds[q->write_ptr]);
                         goto out_err;
                 }
+                iwl_pcie_txq_build_tfd(trans, txq, tb2_phys, tb2_len, 0);
         }
 
-        /* Attach buffers to TFD */
-        iwl_pcie_txq_build_tfd(trans, txq, txcmd_phys, firstlen, 1);
-        if (secondlen > 0)
-                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, secondlen, 0);
-
-        scratch_phys = txcmd_phys + sizeof(struct iwl_cmd_header) +
-                                offsetof(struct iwl_tx_cmd, scratch);
-
-        /* take back ownership of DMA buffer to enable update */
-        dma_sync_single_for_cpu(trans->dev, txcmd_phys, firstlen,
-                                DMA_BIDIRECTIONAL);
-        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
-        tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
-
         /* Set up entry for this TFD in Tx byte-count array */
         iwl_pcie_txq_update_byte_cnt_tbl(trans, txq, le16_to_cpu(tx_cmd->len));
 
-        dma_sync_single_for_device(trans->dev, txcmd_phys, firstlen,
-                                   DMA_BIDIRECTIONAL);
-
         trace_iwlwifi_dev_tx(trans->dev, skb,
                              &txq->tfds[txq->q.write_ptr],
                              sizeof(struct iwl_tfd),
-                             &dev_cmd->hdr, firstlen,
-                             skb->data + hdr_len, secondlen);
+                             &dev_cmd->hdr, IWL_HCMD_SCRATCHBUF_SIZE + tb1_len,
+                             skb->data + hdr_len, tb2_len);
         trace_iwlwifi_dev_tx_data(trans->dev, skb,
-                                  skb->data + hdr_len, secondlen);
+                                  skb->data + hdr_len, tb2_len);
+
+        if (!ieee80211_has_morefrags(fc)) {
+                txq->need_update = 1;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
+        }
 
         /* start timer if queue currently empty */
         if (txq->need_update && q->read_ptr == q->write_ptr &&
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 739309e70d8b..45578335e420 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -825,6 +825,11 @@ static void if_sdio_finish_power_on(struct if_sdio_card *card)
 
         sdio_release_host(func);
 
+        /* Set fw_ready before queuing any commands so that
+         * lbs_thread won't block from sending them to firmware.
+         */
+        priv->fw_ready = 1;
+
         /*
          * FUNC_INIT is required for SD8688 WLAN/BT multiple functions
          */
@@ -839,7 +844,6 @@ static void if_sdio_finish_power_on(struct if_sdio_card *card)
                         netdev_alert(priv->dev, "CMD_FUNC_INIT cmd failed\n");
         }
 
-        priv->fw_ready = 1;
         wake_up(&card->pwron_waitq);
 
         if (!card->started) {
diff --git a/drivers/net/wireless/mwifiex/11ac.c b/drivers/net/wireless/mwifiex/11ac.c
index cf43b3c29250..966a78f8e21a 100644
--- a/drivers/net/wireless/mwifiex/11ac.c
+++ b/drivers/net/wireless/mwifiex/11ac.c
@@ -259,3 +259,44 @@ int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,
 
         return ret_len;
 }
+
+int mwifiex_cmd_11ac_cfg(struct mwifiex_private *priv,
+                         struct host_cmd_ds_command *cmd, u16 cmd_action,
+                         struct mwifiex_11ac_vht_cfg *cfg)
+{
+        struct host_cmd_11ac_vht_cfg *vhtcfg = &cmd->params.vht_cfg;
+
+        cmd->command = cpu_to_le16(HostCmd_CMD_11AC_CFG);
+        cmd->size = cpu_to_le16(sizeof(struct host_cmd_11ac_vht_cfg) +
+                                S_DS_GEN);
+        vhtcfg->action = cpu_to_le16(cmd_action);
+        vhtcfg->band_config = cfg->band_config;
+        vhtcfg->misc_config = cfg->misc_config;
+        vhtcfg->cap_info = cpu_to_le32(cfg->cap_info);
+        vhtcfg->mcs_tx_set = cpu_to_le32(cfg->mcs_tx_set);
+        vhtcfg->mcs_rx_set = cpu_to_le32(cfg->mcs_rx_set);
+
+        return 0;
+}
+
+/* This function initializes the BlockACK setup information for given
+ * mwifiex_private structure for 11ac enabled networks.
+ */
+void mwifiex_set_11ac_ba_params(struct mwifiex_private *priv)
+{
+        priv->add_ba_param.timeout = MWIFIEX_DEFAULT_BLOCK_ACK_TIMEOUT;
+
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
+                priv->add_ba_param.tx_win_size =
+                                           MWIFIEX_11AC_UAP_AMPDU_DEF_TXWINSIZE;
+                priv->add_ba_param.rx_win_size =
+                                           MWIFIEX_11AC_UAP_AMPDU_DEF_RXWINSIZE;
+        } else {
+                priv->add_ba_param.tx_win_size =
+                                           MWIFIEX_11AC_STA_AMPDU_DEF_TXWINSIZE;
+                priv->add_ba_param.rx_win_size =
+                                           MWIFIEX_11AC_STA_AMPDU_DEF_RXWINSIZE;
+        }
+
+        return;
+}
diff --git a/drivers/net/wireless/mwifiex/11ac.h b/drivers/net/wireless/mwifiex/11ac.h
index 80fd1ba46200..7c2c69b5b3eb 100644
--- a/drivers/net/wireless/mwifiex/11ac.h
+++ b/drivers/net/wireless/mwifiex/11ac.h
@@ -20,7 +20,24 @@
 #ifndef _MWIFIEX_11AC_H_
 #define _MWIFIEX_11AC_H_
 
+#define VHT_CFG_2GHZ BIT(0)
+#define VHT_CFG_5GHZ BIT(1)
+
+enum vht_cfg_misc_config {
+        VHT_CAP_TX_OPERATION = 1,
+        VHT_CAP_ASSOCIATION,
+        VHT_CAP_UAP_ONLY
+};
+
+#define DEFAULT_VHT_MCS_SET 0xfffa
+#define DISABLE_VHT_MCS_SET 0xffff
+
+#define VHT_BW_80_160_80P80 BIT(2)
+
 int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,
                                 struct mwifiex_bssdescriptor *bss_desc,
                                 u8 **buffer);
+int mwifiex_cmd_11ac_cfg(struct mwifiex_private *priv,
+                         struct host_cmd_ds_command *cmd, u16 cmd_action,
+                         struct mwifiex_11ac_vht_cfg *cfg);
 #endif /* _MWIFIEX_11AC_H_ */
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 45f19716687e..41e9d25a2d8e 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -679,3 +679,25 @@ void mwifiex_del_tx_ba_stream_tbl_by_ra(struct mwifiex_private *priv, u8 *ra)
 
         return;
 }
+
+/* This function initializes the BlockACK setup information for given
+ * mwifiex_private structure.
+ */
+void mwifiex_set_ba_params(struct mwifiex_private *priv)
+{
+        priv->add_ba_param.timeout = MWIFIEX_DEFAULT_BLOCK_ACK_TIMEOUT;
+
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
+                priv->add_ba_param.tx_win_size =
+                                                MWIFIEX_UAP_AMPDU_DEF_TXWINSIZE;
+                priv->add_ba_param.rx_win_size =
+                                                MWIFIEX_UAP_AMPDU_DEF_RXWINSIZE;
+        } else {
+                priv->add_ba_param.tx_win_size =
+                                                MWIFIEX_STA_AMPDU_DEF_TXWINSIZE;
+                priv->add_ba_param.rx_win_size =
+                                                MWIFIEX_STA_AMPDU_DEF_RXWINSIZE;
+        }
+
+        return;
+}
diff --git a/drivers/net/wireless/mwifiex/Makefile b/drivers/net/wireless/mwifiex/Makefile
index 97b245cbafd8..ecf28464367f 100644
--- a/drivers/net/wireless/mwifiex/Makefile
+++ b/drivers/net/wireless/mwifiex/Makefile
@@ -39,6 +39,7 @@ mwifiex-y += sta_tx.o
 mwifiex-y += sta_rx.o
 mwifiex-y += uap_txrx.o
 mwifiex-y += cfg80211.o
+mwifiex-y += ethtool.o
 mwifiex-$(CONFIG_DEBUG_FS) += debugfs.o
 obj-$(CONFIG_MWIFIEX) += mwifiex.o
 
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index a44023a7bd57..47012947a447 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1374,6 +1374,18 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
         }
 
         mwifiex_set_ht_params(priv, bss_cfg, params);
+
+        if (priv->adapter->is_hw_11ac_capable) {
+                mwifiex_set_vht_params(priv, bss_cfg, params);
+                mwifiex_set_vht_width(priv, params->chandef.width,
+                                      priv->ap_11ac_enabled);
+        }
+
+        if (priv->ap_11ac_enabled)
+                mwifiex_set_11ac_ba_params(priv);
+        else
+                mwifiex_set_ba_params(priv);
+
         mwifiex_set_wmm_params(priv, bss_cfg, params);
 
         if (params->inactivity_timeout > 0) {
@@ -1892,7 +1904,8 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
                 }
         }
 
-        for (i = 0; i < request->n_channels; i++) {
+        for (i = 0; i < min_t(u32, request->n_channels,
+                              MWIFIEX_USER_SCAN_CHAN_MAX); i++) {
                 chan = request->channels[i];
                 priv->user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
                 priv->user_scan_cfg->chan_list[i].radio_type = chan->band;
@@ -1932,66 +1945,10 @@ static void mwifiex_setup_vht_caps(struct ieee80211_sta_vht_cap *vht_info,
                                    struct mwifiex_private *priv)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
-        u32 vht_cap = 0, cap = adapter->hw_dot_11ac_dev_cap;
 
         vht_info->vht_supported = true;
 
-        switch (GET_VHTCAP_MAXMPDULEN(cap)) {
-        case 0x00:
-                vht_cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
-                break;
-        case 0x01:
-                vht_cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
-                break;
-        case 0x10:
-                vht_cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
-            break;
-        default:
-            dev_err(adapter->dev, "unsupported MAX MPDU len\n");
-            break;
-        }
-
-        if (ISSUPP_11ACVHTHTCVHT(cap))
-                vht_cap |= IEEE80211_VHT_CAP_HTC_VHT;
-
-        if (ISSUPP_11ACVHTTXOPPS(cap))
-                vht_cap |= IEEE80211_VHT_CAP_VHT_TXOP_PS;
-
-        if (ISSUPP_11ACMURXBEAMFORMEE(cap))
-                vht_cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
-
-        if (ISSUPP_11ACMUTXBEAMFORMEE(cap))
-                vht_cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
-
-        if (ISSUPP_11ACSUBEAMFORMER(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
-
-        if (ISSUPP_11ACSUBEAMFORMEE(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
-
-        if (ISSUPP_11ACRXSTBC(cap))
-                vht_cap |= IEEE80211_VHT_CAP_RXSTBC_1;
-
-        if (ISSUPP_11ACTXSTBC(cap))
-                vht_cap |= IEEE80211_VHT_CAP_TXSTBC;
-
-        if (ISSUPP_11ACSGI160(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
-
-        if (ISSUPP_11ACSGI80(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
-
-        if (ISSUPP_11ACLDPC(cap))
-                vht_cap |= IEEE80211_VHT_CAP_RXLDPC;
-
-        if (ISSUPP_11ACBW8080(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
-
-        if (ISSUPP_11ACBW160(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
-
-        vht_info->cap = vht_cap;
-
+        vht_info->cap = adapter->hw_dot_11ac_dev_cap;
         /* Update MCS support for VHT */
         vht_info->vht_mcs.rx_mcs_map = cpu_to_le16(
                                 adapter->hw_dot_11ac_mcs_support & 0xFFFF);
@@ -2235,6 +2192,7 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
         dev->watchdog_timeo = MWIFIEX_DEFAULT_WATCHDOG_TIMEOUT;
         dev->hard_header_len += MWIFIEX_MIN_DATA_HEADER_LEN;
+        dev->ethtool_ops = &mwifiex_ethtool_ops;
 
         mdev_priv = netdev_priv(dev);
         *((unsigned long *) mdev_priv) = (unsigned long) priv;
@@ -2293,6 +2251,152 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 }
 EXPORT_SYMBOL_GPL(mwifiex_del_virtual_intf);
 
+#ifdef CONFIG_PM
+static bool
+mwifiex_is_pattern_supported(struct cfg80211_wowlan_trig_pkt_pattern *pat,
+                             s8 *byte_seq)
+{
+        int j, k, valid_byte_cnt = 0;
+        bool dont_care_byte = false;
+
+        for (j = 0; j < DIV_ROUND_UP(pat->pattern_len, 8); j++) {
+                for (k = 0; k < 8; k++) {
+                        if (pat->mask[j] & 1 << k) {
+                                memcpy(byte_seq + valid_byte_cnt,
+                                       &pat->pattern[j * 8 + k], 1);
+                                valid_byte_cnt++;
+                                if (dont_care_byte)
+                                        return false;
+                        } else {
+                                if (valid_byte_cnt)
+                                        dont_care_byte = true;
+                        }
+
+                        if (valid_byte_cnt > MAX_BYTESEQ)
+                                return false;
+                }
+        }
+
+        byte_seq[MAX_BYTESEQ] = valid_byte_cnt;
+
+        return true;
+}
+
+static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
+                                    struct cfg80211_wowlan *wowlan)
+{
+        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
+        struct mwifiex_ds_mef_cfg mef_cfg;
+        struct mwifiex_mef_entry *mef_entry;
+        int i, filt_num = 0, ret;
+        bool first_pat = true;
+        u8 byte_seq[MAX_BYTESEQ + 1];
+        const u8 ipv4_mc_mac[] = {0x33, 0x33};
+        const u8 ipv6_mc_mac[] = {0x01, 0x00, 0x5e};
+        struct mwifiex_private *priv =
+                        mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
+
+        if (!wowlan) {
+                dev_warn(adapter->dev, "None of the WOWLAN triggers enabled\n");
+                return 0;
+        }
+
+        if (!priv->media_connected) {
+                dev_warn(adapter->dev,
+                         "Can not configure WOWLAN in disconnected state\n");
+                return 0;
+        }
+
+        mef_entry = kzalloc(sizeof(*mef_entry), GFP_KERNEL);
+        if (!mef_entry)
+                return -ENOMEM;
+
+        memset(&mef_cfg, 0, sizeof(mef_cfg));
+        mef_cfg.num_entries = 1;
+        mef_cfg.mef_entry = mef_entry;
+        mef_entry->mode = MEF_MODE_HOST_SLEEP;
+        mef_entry->action = MEF_ACTION_ALLOW_AND_WAKEUP_HOST;
+
+        for (i = 0; i < wowlan->n_patterns; i++) {
+                memset(byte_seq, 0, sizeof(byte_seq));
+                if (!mwifiex_is_pattern_supported(&wowlan->patterns[i],
+                                                  byte_seq)) {
+                        wiphy_err(wiphy, "Pattern not supported\n");
+                        kfree(mef_entry);
+                        return -EOPNOTSUPP;
+                }
+
+                if (!wowlan->patterns[i].pkt_offset) {
+                        if (!(byte_seq[0] & 0x01) &&
+                            (byte_seq[MAX_BYTESEQ] == 1)) {
+                                mef_cfg.criteria |= MWIFIEX_CRITERIA_UNICAST;
+                                continue;
+                        } else if (is_broadcast_ether_addr(byte_seq)) {
+                                mef_cfg.criteria |= MWIFIEX_CRITERIA_BROADCAST;
+                                continue;
+                        } else if ((!memcmp(byte_seq, ipv4_mc_mac, 2) &&
+                                    (byte_seq[MAX_BYTESEQ] == 2)) ||
+                                   (!memcmp(byte_seq, ipv6_mc_mac, 3) &&
+                                    (byte_seq[MAX_BYTESEQ] == 3))) {
+                                mef_cfg.criteria |= MWIFIEX_CRITERIA_MULTICAST;
+                                continue;
+                        }
+                }
+
+                mef_entry->filter[filt_num].repeat = 1;
+                mef_entry->filter[filt_num].offset =
+                                                wowlan->patterns[i].pkt_offset;
+                memcpy(mef_entry->filter[filt_num].byte_seq, byte_seq,
+                       sizeof(byte_seq));
+                mef_entry->filter[filt_num].filt_type = TYPE_EQ;
+
+                if (first_pat)
+                        first_pat = false;
+                else
+                        mef_entry->filter[filt_num].filt_action = TYPE_AND;
+
+                filt_num++;
+        }
+
+        if (wowlan->magic_pkt) {
+                mef_cfg.criteria |= MWIFIEX_CRITERIA_UNICAST;
+                mef_entry->filter[filt_num].repeat = 16;
+                memcpy(mef_entry->filter[filt_num].byte_seq, priv->curr_addr,
+                       ETH_ALEN);
+                mef_entry->filter[filt_num].byte_seq[MAX_BYTESEQ] = ETH_ALEN;
+                mef_entry->filter[filt_num].offset = 14;
+                mef_entry->filter[filt_num].filt_type = TYPE_EQ;
+                if (filt_num)
+                        mef_entry->filter[filt_num].filt_action = TYPE_OR;
+        }
+
+        if (!mef_cfg.criteria)
+                mef_cfg.criteria = MWIFIEX_CRITERIA_BROADCAST |
+                                   MWIFIEX_CRITERIA_UNICAST |
+                                   MWIFIEX_CRITERIA_MULTICAST;
+
+        ret =  mwifiex_send_cmd_sync(priv, HostCmd_CMD_MEF_CFG,
+                                     HostCmd_ACT_GEN_SET, 0,
+                                     &mef_cfg);
+
+        kfree(mef_entry);
+        return ret;
+}
+
+static int mwifiex_cfg80211_resume(struct wiphy *wiphy)
+{
+        return 0;
+}
+
+static void mwifiex_cfg80211_set_wakeup(struct wiphy *wiphy,
+                                       bool enabled)
+{
+        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
+
+        device_set_wakeup_enable(adapter->dev, enabled);
+}
+#endif
+
 /* station cfg80211 operations */
 static struct cfg80211_ops mwifiex_cfg80211_ops = {
         .add_virtual_intf = mwifiex_add_virtual_intf,
@@ -2321,6 +2425,11 @@ static struct cfg80211_ops mwifiex_cfg80211_ops = {
         .change_beacon = mwifiex_cfg80211_change_beacon,
         .set_cqm_rssi_config = mwifiex_cfg80211_set_cqm_rssi_config,
         .set_antenna = mwifiex_cfg80211_set_antenna,
+#ifdef CONFIG_PM
+        .suspend = mwifiex_cfg80211_suspend,
+        .resume = mwifiex_cfg80211_resume,
+        .set_wakeup = mwifiex_cfg80211_set_wakeup,
+#endif
 };
 
 /*
@@ -2379,6 +2488,14 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
 
         wiphy_apply_custom_regulatory(wiphy, &mwifiex_world_regdom_custom);
 
+#ifdef CONFIG_PM
+        wiphy->wowlan.flags = WIPHY_WOWLAN_MAGIC_PKT;
+        wiphy->wowlan.n_patterns = MWIFIEX_MAX_FILTERS;
+        wiphy->wowlan.pattern_min_len = 1;
+        wiphy->wowlan.pattern_max_len = MWIFIEX_MAX_PATTERN_LEN;
+        wiphy->wowlan.max_pkt_offset = MWIFIEX_MAX_OFFSET_LEN;
+#endif
+
         wiphy->probe_resp_offload = NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
                                     NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
                                     NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 20a6c5555873..da469c336aa1 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -153,7 +153,21 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
                         " or cmd size is 0, not sending\n");
                 if (cmd_node->wait_q_enabled)
                         adapter->cmd_wait_q.status = -1;
-                mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+                mwifiex_recycle_cmd_node(adapter, cmd_node);
+                return -1;
+        }
+
+        cmd_code = le16_to_cpu(host_cmd->command);
+        cmd_size = le16_to_cpu(host_cmd->size);
+
+        if (adapter->hw_status == MWIFIEX_HW_STATUS_RESET &&
+            cmd_code != HostCmd_CMD_FUNC_SHUTDOWN &&
+            cmd_code != HostCmd_CMD_FUNC_INIT) {
+                dev_err(adapter->dev,
+                        "DNLD_CMD: FW in reset state, ignore cmd %#x\n",
+                        cmd_code);
+                mwifiex_complete_cmd(adapter, cmd_node);
+                mwifiex_recycle_cmd_node(adapter, cmd_node);
                 return -1;
         }
 
@@ -168,9 +182,6 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
         adapter->curr_cmd = cmd_node;
         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
 
-        cmd_code = le16_to_cpu(host_cmd->command);
-        cmd_size = le16_to_cpu(host_cmd->size);
-
         /* Adjust skb length */
         if (cmd_node->cmd_skb->len > cmd_size)
                 /*
@@ -217,7 +228,7 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
                         adapter->cmd_sent = false;
                 if (cmd_node->wait_q_enabled)
                         adapter->cmd_wait_q.status = -1;
-                mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
+                mwifiex_recycle_cmd_node(adapter, adapter->curr_cmd);
 
                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
                 adapter->curr_cmd = NULL;
@@ -484,8 +495,6 @@ int mwifiex_send_cmd_sync(struct mwifiex_private *priv, uint16_t cmd_no,
 
         ret = mwifiex_send_cmd_async(priv, cmd_no, cmd_action, cmd_oid,
                                      data_buf);
-        if (!ret)
-                ret = mwifiex_wait_queue_complete(adapter);
 
         return ret;
 }
@@ -588,9 +597,10 @@ int mwifiex_send_cmd_async(struct mwifiex_private *priv, uint16_t cmd_no,
         if (cmd_no == HostCmd_CMD_802_11_SCAN) {
                 mwifiex_queue_scan_cmd(priv, cmd_node);
         } else {
-                adapter->cmd_queued = cmd_node;
                 mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
                 queue_work(adapter->workqueue, &adapter->main_work);
+                if (cmd_node->wait_q_enabled)
+                        ret = mwifiex_wait_queue_complete(adapter, cmd_node);
         }
 
         return ret;
@@ -622,6 +632,20 @@ mwifiex_insert_cmd_to_free_q(struct mwifiex_adapter *adapter,
         spin_unlock_irqrestore(&adapter->cmd_free_q_lock, flags);
 }
 
+/* This function reuses a command node. */
+void mwifiex_recycle_cmd_node(struct mwifiex_adapter *adapter,
+                              struct cmd_ctrl_node *cmd_node)
+{
+        struct host_cmd_ds_command *host_cmd = (void *)cmd_node->cmd_skb->data;
+
+        mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+
+        atomic_dec(&adapter->cmd_pending);
+        dev_dbg(adapter->dev, "cmd: FREE_CMD: cmd=%#x, cmd_pending=%d\n",
+                le16_to_cpu(host_cmd->command),
+                atomic_read(&adapter->cmd_pending));
+}
+
 /*
  * This function queues a command to the command pending queue.
  *
@@ -663,7 +687,9 @@ mwifiex_insert_cmd_to_pending_q(struct mwifiex_adapter *adapter,
                 list_add(&cmd_node->list, &adapter->cmd_pending_q);
         spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, flags);
 
-        dev_dbg(adapter->dev, "cmd: QUEUE_CMD: cmd=%#x is queued\n", command);
+        atomic_inc(&adapter->cmd_pending);
+        dev_dbg(adapter->dev, "cmd: QUEUE_CMD: cmd=%#x, cmd_pending=%d\n",
+                command, atomic_read(&adapter->cmd_pending));
 }
 
 /*
@@ -773,7 +799,7 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
         if (adapter->curr_cmd->cmd_flag & CMD_F_CANCELED) {
                 dev_err(adapter->dev, "CMD_RESP: %#x been canceled\n",
                         le16_to_cpu(resp->command));
-                mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
+                mwifiex_recycle_cmd_node(adapter, adapter->curr_cmd);
                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
                 adapter->curr_cmd = NULL;
                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
@@ -823,7 +849,7 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
                 if (adapter->curr_cmd->wait_q_enabled)
                         adapter->cmd_wait_q.status = -1;
 
-                mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
+                mwifiex_recycle_cmd_node(adapter, adapter->curr_cmd);
                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
                 adapter->curr_cmd = NULL;
                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
@@ -855,8 +881,7 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
                 if (adapter->curr_cmd->wait_q_enabled)
                         adapter->cmd_wait_q.status = ret;
 
-                /* Clean up and put current command back to cmd_free_q */
-                mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
+                mwifiex_recycle_cmd_node(adapter, adapter->curr_cmd);
 
                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
                 adapter->curr_cmd = NULL;
@@ -983,7 +1008,7 @@ mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter)
                         mwifiex_complete_cmd(adapter, cmd_node);
                         cmd_node->wait_q_enabled = false;
                 }
-                mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+                mwifiex_recycle_cmd_node(adapter, cmd_node);
                 spin_lock_irqsave(&adapter->cmd_pending_q_lock, flags);
         }
         spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, flags);
@@ -1030,7 +1055,7 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
                 cmd_node = adapter->curr_cmd;
                 cmd_node->wait_q_enabled = false;
                 cmd_node->cmd_flag |= CMD_F_CANCELED;
-                mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+                mwifiex_recycle_cmd_node(adapter, cmd_node);
                 mwifiex_complete_cmd(adapter, adapter->curr_cmd);
                 adapter->curr_cmd = NULL;
                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags);
@@ -1139,7 +1164,7 @@ int mwifiex_ret_802_11_hs_cfg(struct mwifiex_private *priv,
                         phs_cfg->params.hs_config.gpio,
                         phs_cfg->params.hs_config.gap);
         }
-        if (conditions != HOST_SLEEP_CFG_CANCEL) {
+        if (conditions != HS_CFG_CANCEL) {
                 adapter->is_hs_configured = true;
                 if (adapter->iface_type == MWIFIEX_USB ||
                     adapter->iface_type == MWIFIEX_PCIE)
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index e8a569aaa2e8..94cc09d48444 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -41,8 +41,15 @@
 #define MWIFIEX_MAX_TX_BASTREAM_SUPPORTED       2
 #define MWIFIEX_MAX_RX_BASTREAM_SUPPORTED       16
 
-#define MWIFIEX_AMPDU_DEF_TXWINSIZE        32
-#define MWIFIEX_AMPDU_DEF_RXWINSIZE        16
+#define MWIFIEX_STA_AMPDU_DEF_TXWINSIZE        16
+#define MWIFIEX_STA_AMPDU_DEF_RXWINSIZE        32
+#define MWIFIEX_UAP_AMPDU_DEF_TXWINSIZE        32
+#define MWIFIEX_UAP_AMPDU_DEF_RXWINSIZE        16
+#define MWIFIEX_11AC_STA_AMPDU_DEF_TXWINSIZE   32
+#define MWIFIEX_11AC_STA_AMPDU_DEF_RXWINSIZE   48
+#define MWIFIEX_11AC_UAP_AMPDU_DEF_TXWINSIZE   48
+#define MWIFIEX_11AC_UAP_AMPDU_DEF_RXWINSIZE   32
+
 #define MWIFIEX_DEFAULT_BLOCK_ACK_TIMEOUT  0xffff
 
 #define MWIFIEX_RATE_BITMAP_MCS0   32
diff --git a/drivers/net/wireless/mwifiex/ethtool.c b/drivers/net/wireless/mwifiex/ethtool.c
new file mode 100644
index 000000000000..bfb39908b2c6
--- /dev/null
+++ b/drivers/net/wireless/mwifiex/ethtool.c
@@ -0,0 +1,70 @@
+/*
+ * Marvell Wireless LAN device driver: ethtool
+ *
+ * Copyright (C) 2013, Marvell International Ltd.
+ *
+ * This software file (the "File") is distributed by Marvell International
+ * Ltd. under the terms of the GNU General Public License Version 2, June 1991
+ * (the "License").  You may use, redistribute and/or modify this File in
+ * accordance with the terms and conditions of the License, a copy of which
+ * is available by writing to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
+ * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
+ * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
+ * this warranty disclaimer.
+ */
+
+#include "main.h"
+
+static void mwifiex_ethtool_get_wol(struct net_device *dev,
+                                    struct ethtool_wolinfo *wol)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        u32 conditions = le32_to_cpu(priv->adapter->hs_cfg.conditions);
+
+        wol->supported = WAKE_UCAST|WAKE_MCAST|WAKE_BCAST|WAKE_PHY;
+
+        if (conditions == HS_CFG_COND_DEF)
+                return;
+
+        if (conditions & HS_CFG_COND_UNICAST_DATA)
+                wol->wolopts |= WAKE_UCAST;
+        if (conditions & HS_CFG_COND_MULTICAST_DATA)
+                wol->wolopts |= WAKE_MCAST;
+        if (conditions & HS_CFG_COND_BROADCAST_DATA)
+                wol->wolopts |= WAKE_BCAST;
+        if (conditions & HS_CFG_COND_MAC_EVENT)
+                wol->wolopts |= WAKE_PHY;
+}
+
+static int mwifiex_ethtool_set_wol(struct net_device *dev,
+                                   struct ethtool_wolinfo *wol)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        u32 conditions = 0;
+
+        if (wol->wolopts & ~(WAKE_UCAST|WAKE_MCAST|WAKE_BCAST|WAKE_PHY))
+                return -EOPNOTSUPP;
+
+        if (wol->wolopts & WAKE_UCAST)
+                conditions |= HS_CFG_COND_UNICAST_DATA;
+        if (wol->wolopts & WAKE_MCAST)
+                conditions |= HS_CFG_COND_MULTICAST_DATA;
+        if (wol->wolopts & WAKE_BCAST)
+                conditions |= HS_CFG_COND_BROADCAST_DATA;
+        if (wol->wolopts & WAKE_PHY)
+                conditions |= HS_CFG_COND_MAC_EVENT;
+        if (wol->wolopts == 0)
+                conditions |= HS_CFG_COND_DEF;
+        priv->adapter->hs_cfg.conditions = cpu_to_le32(conditions);
+
+        return 0;
+}
+
+const struct ethtool_ops mwifiex_ethtool_ops = {
+        .get_wol = mwifiex_ethtool_get_wol,
+        .set_wol = mwifiex_ethtool_set_wol,
+};
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 25acb0682c56..1f7578d553ec 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -230,40 +230,12 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 
 #define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14)))
 
-#define GET_VHTCAP_MAXMPDULEN(vht_cap_info) (vht_cap_info & 0x3)
 #define GET_VHTCAP_CHWDSET(vht_cap_info)    ((vht_cap_info >> 2) & 0x3)
 #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3)
 #define SET_VHTNSSMCS(mcs_mapset, nss, value) (mcs_mapset |= (value & 0x3) << \
                                               (2 * (nss - 1)))
 #define NO_NSS_SUPPORT          0x3
 
-/* HW_SPEC: HTC-VHT supported */
-#define ISSUPP_11ACVHTHTCVHT(Dot11acDevCap) (Dot11acDevCap & BIT(22))
-/* HW_SPEC: VHT TXOP PS support */
-#define ISSUPP_11ACVHTTXOPPS(Dot11acDevCap) (Dot11acDevCap & BIT(21))
-/* HW_SPEC: MU RX beamformee support */
-#define ISSUPP_11ACMURXBEAMFORMEE(Dot11acDevCap) (Dot11acDevCap & BIT(20))
-/* HW_SPEC: MU TX beamformee support */
-#define ISSUPP_11ACMUTXBEAMFORMEE(Dot11acDevCap) (Dot11acDevCap & BIT(19))
-/* HW_SPEC: SU Beamformee support */
-#define ISSUPP_11ACSUBEAMFORMEE(Dot11acDevCap) (Dot11acDevCap & BIT(10))
-/* HW_SPEC: SU Beamformer support */
-#define ISSUPP_11ACSUBEAMFORMER(Dot11acDevCap) (Dot11acDevCap & BIT(9))
-/* HW_SPEC: Rx STBC support */
-#define ISSUPP_11ACRXSTBC(Dot11acDevCap) (Dot11acDevCap & BIT(8))
-/* HW_SPEC: Tx STBC support */
-#define ISSUPP_11ACTXSTBC(Dot11acDevCap) (Dot11acDevCap & BIT(7))
-/* HW_SPEC: Short GI support for 160MHz BW */
-#define ISSUPP_11ACSGI160(Dot11acDevCap) (Dot11acDevCap & BIT(6))
-/* HW_SPEC: Short GI support for 80MHz BW */
-#define ISSUPP_11ACSGI80(Dot11acDevCap) (Dot11acDevCap & BIT(5))
-/* HW_SPEC: LDPC coding support */
-#define ISSUPP_11ACLDPC(Dot11acDevCap) (Dot11acDevCap & BIT(4))
-/* HW_SPEC: Channel BW 20/40/80/160/80+80 MHz support */
-#define ISSUPP_11ACBW8080(Dot11acDevCap) (Dot11acDevCap & BIT(3))
-/* HW_SPEC: Channel BW 20/40/80/160 MHz support */
-#define ISSUPP_11ACBW160(Dot11acDevCap) (Dot11acDevCap & BIT(2))
-
 #define GET_DEVTXMCSMAP(dev_mcs_map)      (dev_mcs_map >> 16)
 #define GET_DEVRXMCSMAP(dev_mcs_map)      (dev_mcs_map & 0xFFFF)
 
@@ -300,6 +272,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define HostCmd_CMD_802_11_TX_RATE_QUERY              0x007f
 #define HostCmd_CMD_802_11_IBSS_COALESCING_STATUS     0x0083
 #define HostCmd_CMD_VERSION_EXT                       0x0097
+#define HostCmd_CMD_MEF_CFG                           0x009a
 #define HostCmd_CMD_RSSI_INFO                         0x00a4
 #define HostCmd_CMD_FUNC_INIT                         0x00a9
 #define HostCmd_CMD_FUNC_SHUTDOWN                     0x00aa
@@ -322,6 +295,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define HostCmd_CMD_PCIE_DESC_DETAILS                 0x00fa
 #define HostCmd_CMD_MGMT_FRAME_REG                    0x010c
 #define HostCmd_CMD_REMAIN_ON_CHAN                    0x010d
+#define HostCmd_CMD_11AC_CFG                          0x0112
 
 #define PROTOCOL_NO_SECURITY        0x01
 #define PROTOCOL_STATIC_WEP         0x02
@@ -376,10 +350,14 @@ enum P2P_MODES {
 #define HostCmd_SCAN_RADIO_TYPE_BG          0
 #define HostCmd_SCAN_RADIO_TYPE_A           1
 
-#define HOST_SLEEP_CFG_CANCEL           0xffffffff
-#define HOST_SLEEP_CFG_COND_DEF         0x00000000
-#define HOST_SLEEP_CFG_GPIO_DEF         0xff
-#define HOST_SLEEP_CFG_GAP_DEF          0
+#define HS_CFG_CANCEL                   0xffffffff
+#define HS_CFG_COND_DEF                 0x00000000
+#define HS_CFG_GPIO_DEF                 0xff
+#define HS_CFG_GAP_DEF                  0
+#define HS_CFG_COND_BROADCAST_DATA      0x00000001
+#define HS_CFG_COND_UNICAST_DATA        0x00000002
+#define HS_CFG_COND_MAC_EVENT           0x00000004
+#define HS_CFG_COND_MULTICAST_DATA      0x00000008
 
 #define MWIFIEX_TIMEOUT_FOR_AP_RESP             0xfffc
 #define MWIFIEX_STATUS_CODE_AUTH_TIMEOUT        2
@@ -469,6 +447,23 @@ enum P2P_MODES {
 #define EVENT_GET_BSS_TYPE(event_cause)         \
         (((event_cause) >> 24) & 0x00ff)
 
+#define MWIFIEX_MAX_PATTERN_LEN         20
+#define MWIFIEX_MAX_OFFSET_LEN          50
+#define STACK_NBYTES                    100
+#define TYPE_DNUM                       1
+#define TYPE_BYTESEQ                    2
+#define MAX_OPERAND                     0x40
+#define TYPE_EQ                         (MAX_OPERAND+1)
+#define TYPE_EQ_DNUM                    (MAX_OPERAND+2)
+#define TYPE_EQ_BIT                     (MAX_OPERAND+3)
+#define TYPE_AND                        (MAX_OPERAND+4)
+#define TYPE_OR                         (MAX_OPERAND+5)
+#define MEF_MODE_HOST_SLEEP                     1
+#define MEF_ACTION_ALLOW_AND_WAKEUP_HOST        3
+#define MWIFIEX_CRITERIA_BROADCAST      BIT(0)
+#define MWIFIEX_CRITERIA_UNICAST        BIT(1)
+#define MWIFIEX_CRITERIA_MULTICAST      BIT(3)
+
 struct mwifiex_ie_types_header {
         __le16 type;
         __le16 len;
@@ -1369,6 +1364,15 @@ struct host_cmd_ds_sys_config {
         u8 tlv[0];
 };
 
+struct host_cmd_11ac_vht_cfg {
+        __le16 action;
+        u8 band_config;
+        u8 misc_config;
+        __le32 cap_info;
+        __le32 mcs_tx_set;
+        __le32 mcs_rx_set;
+} __packed;
+
 struct host_cmd_tlv_akmp {
         struct host_cmd_tlv tlv;
         __le16 key_mgmt;
@@ -1499,6 +1503,19 @@ struct host_cmd_ds_802_11_ibss_status {
         __le16 use_g_rate_protect;
 } __packed;
 
+struct mwifiex_fw_mef_entry {
+        u8 mode;
+        u8 action;
+        __le16 exprsize;
+        u8 expr[0];
+} __packed;
+
+struct host_cmd_ds_mef_cfg {
+        __le32 criteria;
+        __le16 num_entries;
+        struct mwifiex_fw_mef_entry mef_entry[0];
+} __packed;
+
 #define CONNECTION_TYPE_INFRA   0
 #define CONNECTION_TYPE_ADHOC   1
 #define CONNECTION_TYPE_AP      2
@@ -1603,6 +1620,7 @@ struct host_cmd_ds_command {
                 struct host_cmd_ds_remain_on_chan roc_cfg;
                 struct host_cmd_ds_p2p_mode_cfg mode_cfg;
                 struct host_cmd_ds_802_11_ibss_status ibss_coalescing;
+                struct host_cmd_ds_mef_cfg mef_cfg;
                 struct host_cmd_ds_mac_reg_access mac_reg;
                 struct host_cmd_ds_bbp_reg_access bbp_reg;
                 struct host_cmd_ds_rf_reg_access rf_reg;
@@ -1612,6 +1630,7 @@ struct host_cmd_ds_command {
                 struct host_cmd_ds_802_11_eeprom_access eeprom;
                 struct host_cmd_ds_802_11_subsc_evt subsc_evt;
                 struct host_cmd_ds_sys_config uap_sys_config;
+                struct host_cmd_11ac_vht_cfg vht_cfg;
         } params;
 } __packed;
 
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index e38aa9b3663d..42d7f0adf9bd 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -318,9 +318,9 @@ static void mwifiex_init_adapter(struct mwifiex_adapter *adapter)
         adapter->curr_tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
 
         adapter->is_hs_configured = false;
-        adapter->hs_cfg.conditions = cpu_to_le32(HOST_SLEEP_CFG_COND_DEF);
-        adapter->hs_cfg.gpio = HOST_SLEEP_CFG_GPIO_DEF;
-        adapter->hs_cfg.gap = HOST_SLEEP_CFG_GAP_DEF;
+        adapter->hs_cfg.conditions = cpu_to_le32(HS_CFG_COND_DEF);
+        adapter->hs_cfg.gpio = HS_CFG_GPIO_DEF;
+        adapter->hs_cfg.gap = HS_CFG_GAP_DEF;
         adapter->hs_activated = false;
 
         memset(adapter->event_body, 0, sizeof(adapter->event_body));
@@ -533,10 +533,8 @@ int mwifiex_init_lock_list(struct mwifiex_adapter *adapter)
                 if (!adapter->priv[i])
                         continue;
                 priv = adapter->priv[i];
-                for (j = 0; j < MAX_NUM_TID; ++j) {
+                for (j = 0; j < MAX_NUM_TID; ++j)
                         INIT_LIST_HEAD(&priv->wmm.tid_tbl_ptr[j].ra_list);
-                        spin_lock_init(&priv->wmm.tid_tbl_ptr[j].tid_tbl_lock);
-                }
                 INIT_LIST_HEAD(&priv->tx_ba_stream_tbl_ptr);
                 INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
                 INIT_LIST_HEAD(&priv->sta_list);
@@ -709,6 +707,14 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
                 return ret;
         }
 
+        /* cancel current command */
+        if (adapter->curr_cmd) {
+                dev_warn(adapter->dev, "curr_cmd is still in processing\n");
+                del_timer(&adapter->cmd_timer);
+                mwifiex_recycle_cmd_node(adapter, adapter->curr_cmd);
+                adapter->curr_cmd = NULL;
+        }
+
         /* shut down mwifiex */
         dev_dbg(adapter->dev, "info: shutdown mwifiex...\n");
 
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index d85e6eb1f58a..7f27e45680b5 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -272,6 +272,14 @@ struct mwifiex_ds_pm_cfg {
         } param;
 };
 
+struct mwifiex_11ac_vht_cfg {
+        u8 band_config;
+        u8 misc_config;
+        u32 cap_info;
+        u32 mcs_tx_set;
+        u32 mcs_rx_set;
+};
+
 struct mwifiex_ds_11n_tx_cfg {
         u16 tx_htcap;
         u16 tx_htinfo;
@@ -354,6 +362,29 @@ struct mwifiex_ds_misc_subsc_evt {
         struct subsc_evt_cfg bcn_h_rssi_cfg;
 };
 
+#define MAX_BYTESEQ             6       /* non-adjustable */
+#define MWIFIEX_MAX_FILTERS     10
+
+struct mwifiex_mef_filter {
+        u16 repeat;
+        u16 offset;
+        s8 byte_seq[MAX_BYTESEQ + 1];
+        u8 filt_type;
+        u8 filt_action;
+};
+
+struct mwifiex_mef_entry {
+        u8 mode;
+        u8 action;
+        struct mwifiex_mef_filter filter[MWIFIEX_MAX_FILTERS];
+};
+
+struct mwifiex_ds_mef_cfg {
+        u32 criteria;
+        u16 num_entries;
+        struct mwifiex_mef_entry *mef_entry;
+};
+
 #define MWIFIEX_MAX_VSIE_LEN       (256)
 #define MWIFIEX_MAX_VSIE_NUM       (8)
 #define MWIFIEX_VSIE_MASK_CLEAR    0x00
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 246aa62a4817..6bcb66e6e97c 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1117,10 +1117,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
                 adhoc_join->bss_descriptor.bssid,
                 adhoc_join->bss_descriptor.ssid);
 
-        for (i = 0; bss_desc->supported_rates[i] &&
-                        i < MWIFIEX_SUPPORTED_RATES;
-                        i++)
-                        ;
+        for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
+                    bss_desc->supported_rates[i]; i++)
+                ;
         rates_size = i;
 
         /* Copy Data Rates from the Rates recorded in scan response */
@@ -1296,6 +1295,14 @@ int mwifiex_associate(struct mwifiex_private *priv,
             (bss_desc->bss_mode != NL80211_IFTYPE_STATION))
                 return -1;
 
+        if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info) &&
+            !bss_desc->disable_11n && !bss_desc->disable_11ac &&
+            (priv->adapter->config_bands & BAND_GAC ||
+             priv->adapter->config_bands & BAND_AAC))
+                mwifiex_set_11ac_ba_params(priv);
+        else
+                mwifiex_set_ba_params(priv);
+
         memcpy(&current_bssid,
                &priv->curr_bss_params.bss_descriptor.mac_address,
                sizeof(current_bssid));
@@ -1324,6 +1331,13 @@ mwifiex_adhoc_start(struct mwifiex_private *priv,
         dev_dbg(priv->adapter->dev, "info: curr_bss_params.band = %d\n",
                 priv->curr_bss_params.band);
 
+        if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info) &&
+            (priv->adapter->config_bands & BAND_GAC ||
+             priv->adapter->config_bands & BAND_AAC))
+                mwifiex_set_11ac_ba_params(priv);
+        else
+                mwifiex_set_ba_params(priv);
+
         return mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_AD_HOC_START,
                                     HostCmd_ACT_GEN_SET, 0, adhoc_ssid);
 }
@@ -1357,6 +1371,14 @@ int mwifiex_adhoc_join(struct mwifiex_private *priv,
                 return -1;
         }
 
+        if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info) &&
+            !bss_desc->disable_11n && !bss_desc->disable_11ac &&
+            (priv->adapter->config_bands & BAND_GAC ||
+             priv->adapter->config_bands & BAND_AAC))
+                mwifiex_set_11ac_ba_params(priv);
+        else
+                mwifiex_set_ba_params(priv);
+
         dev_dbg(priv->adapter->dev, "info: curr_bss_params.channel = %d\n",
                 priv->curr_bss_params.bss_descriptor.channel);
         dev_dbg(priv->adapter->dev, "info: curr_bss_params.band = %c\n",
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 9c802ede9c3b..121443a0f2a1 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -588,10 +588,19 @@ mwifiex_tx_timeout(struct net_device *dev)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
-        dev_err(priv->adapter->dev, "%lu : Tx timeout, bss_type-num = %d-%d\n",
-                jiffies, priv->bss_type, priv->bss_num);
-        mwifiex_set_trans_start(dev);
         priv->num_tx_timeout++;
+        priv->tx_timeout_cnt++;
+        dev_err(priv->adapter->dev,
+                "%lu : Tx timeout(#%d), bss_type-num = %d-%d\n",
+                jiffies, priv->tx_timeout_cnt, priv->bss_type, priv->bss_num);
+        mwifiex_set_trans_start(dev);
+
+        if (priv->tx_timeout_cnt > TX_TIMEOUT_THRESHOLD &&
+            priv->adapter->if_ops.card_reset) {
+                dev_err(priv->adapter->dev,
+                        "tx_timeout_cnt exceeds threshold. Triggering card reset!\n");
+                priv->adapter->if_ops.card_reset(priv->adapter);
+        }
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 553adfb0aa81..b7484efc9443 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -130,6 +130,9 @@ enum {
 #define MWIFIEX_USB_TYPE_DATA                   0xBEADC0DE
 #define MWIFIEX_USB_TYPE_EVENT                  0xBEEFFACE
 
+/* Threshold for tx_timeout_cnt before we trigger a card reset */
+#define TX_TIMEOUT_THRESHOLD    6
+
 struct mwifiex_dbg {
         u32 num_cmd_host_to_card_failure;
         u32 num_cmd_sleep_cfm_host_to_card_failure;
@@ -210,15 +213,12 @@ struct mwifiex_ra_list_tbl {
 
 struct mwifiex_tid_tbl {
         struct list_head ra_list;
-        /* spin lock for tid table */
-        spinlock_t tid_tbl_lock;
         struct mwifiex_ra_list_tbl *ra_list_curr;
 };
 
 #define WMM_HIGHEST_PRIORITY            7
 #define HIGH_PRIO_TID                           7
 #define LOW_PRIO_TID                            0
-#define NO_PKT_PRIO_TID                         (-1)
 
 struct mwifiex_wmm_desc {
         struct mwifiex_tid_tbl tid_tbl_ptr[MAX_NUM_TID];
@@ -394,6 +394,8 @@ struct mwifiex_private {
         u8 curr_addr[ETH_ALEN];
         u8 media_connected;
         u32 num_tx_timeout;
+        /* track consecutive timeout */
+        u8 tx_timeout_cnt;
         struct net_device *netdev;
         struct net_device_stats stats;
         u16 curr_pkt_filter;
@@ -723,7 +725,6 @@ struct mwifiex_adapter {
         u16 cmd_wait_q_required;
         struct mwifiex_wait_queue cmd_wait_q;
         u8 scan_wait_q_woken;
-        struct cmd_ctrl_node *cmd_queued;
         spinlock_t queue_lock;          /* lock for tx queues */
         struct completion fw_load;
         u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
@@ -794,6 +795,8 @@ void mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter);
 
 void mwifiex_insert_cmd_to_free_q(struct mwifiex_adapter *adapter,
                                   struct cmd_ctrl_node *cmd_node);
+void mwifiex_recycle_cmd_node(struct mwifiex_adapter *adapter,
+                              struct cmd_ctrl_node *cmd_node);
 
 void mwifiex_insert_cmd_to_pending_q(struct mwifiex_adapter *adapter,
                                      struct cmd_ctrl_node *cmd_node,
@@ -908,12 +911,20 @@ int mwifiex_set_secure_params(struct mwifiex_private *priv,
 void mwifiex_set_ht_params(struct mwifiex_private *priv,
                            struct mwifiex_uap_bss_param *bss_cfg,
                            struct cfg80211_ap_settings *params);
+void mwifiex_set_vht_params(struct mwifiex_private *priv,
+                            struct mwifiex_uap_bss_param *bss_cfg,
+                            struct cfg80211_ap_settings *params);
 void mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg,
                            struct cfg80211_ap_settings *params);
+void mwifiex_set_vht_width(struct mwifiex_private *priv,
+                           enum nl80211_chan_width width,
+                           bool ap_11ac_disable);
 void
 mwifiex_set_wmm_params(struct mwifiex_private *priv,
                        struct mwifiex_uap_bss_param *bss_cfg,
                        struct cfg80211_ap_settings *params);
+void mwifiex_set_ba_params(struct mwifiex_private *priv);
+void mwifiex_set_11ac_ba_params(struct mwifiex_private *priv);
 
 /*
  * This function checks if the queuing is RA based or not.
@@ -1018,7 +1029,8 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
                         struct mwifiex_multicast_list *mcast_list);
 int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
                             struct net_device *dev);
-int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter);
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
+                                struct cmd_ctrl_node *cmd_queued);
 int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                       struct cfg80211_ssid *req_ssid);
 int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type);
@@ -1098,11 +1110,15 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev);
 
 void mwifiex_set_sys_config_invalid_data(struct mwifiex_uap_bss_param *config);
 
+int mwifiex_add_wowlan_magic_pkt_filter(struct mwifiex_adapter *adapter);
+
 int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
                          struct cfg80211_beacon_data *data);
 int mwifiex_del_mgmt_ies(struct mwifiex_private *priv);
 u8 *mwifiex_11d_code_2_region(u8 code);
 
+extern const struct ethtool_ops mwifiex_ethtool_ops;
+
 #ifdef CONFIG_DEBUG_FS
 void mwifiex_debugfs_init(void);
 void mwifiex_debugfs_remove(void);
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 35c79722c361..856959b64bc7 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -36,8 +36,6 @@ static u8 user_rmmod;
 static struct mwifiex_if_ops pcie_ops;
 
 static struct semaphore add_remove_card_sem;
-static int mwifiex_pcie_enable_host_int(struct mwifiex_adapter *adapter);
-static int mwifiex_pcie_resume(struct pci_dev *pdev);
 
 static int
 mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
@@ -78,6 +76,82 @@ static bool mwifiex_pcie_ok_to_access_hw(struct mwifiex_adapter *adapter)
         return false;
 }
 
+#ifdef CONFIG_PM
+/*
+ * Kernel needs to suspend all functions separately. Therefore all
+ * registered functions must have drivers with suspend and resume
+ * methods. Failing that the kernel simply removes the whole card.
+ *
+ * If already not suspended, this function allocates and sends a host
+ * sleep activate request to the firmware and turns off the traffic.
+ */
+static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct mwifiex_adapter *adapter;
+        struct pcie_service_card *card;
+        int hs_actived;
+
+        if (pdev) {
+                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+                if (!card || !card->adapter) {
+                        pr_err("Card or adapter structure is not valid\n");
+                        return 0;
+                }
+        } else {
+                pr_err("PCIE device is not specified\n");
+                return 0;
+        }
+
+        adapter = card->adapter;
+
+        hs_actived = mwifiex_enable_hs(adapter);
+
+        /* Indicate device suspended */
+        adapter->is_suspended = true;
+
+        return 0;
+}
+
+/*
+ * Kernel needs to suspend all functions separately. Therefore all
+ * registered functions must have drivers with suspend and resume
+ * methods. Failing that the kernel simply removes the whole card.
+ *
+ * If already not resumed, this function turns on the traffic and
+ * sends a host sleep cancel request to the firmware.
+ */
+static int mwifiex_pcie_resume(struct pci_dev *pdev)
+{
+        struct mwifiex_adapter *adapter;
+        struct pcie_service_card *card;
+
+        if (pdev) {
+                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+                if (!card || !card->adapter) {
+                        pr_err("Card or adapter structure is not valid\n");
+                        return 0;
+                }
+        } else {
+                pr_err("PCIE device is not specified\n");
+                return 0;
+        }
+
+        adapter = card->adapter;
+
+        if (!adapter->is_suspended) {
+                dev_warn(adapter->dev, "Device already resumed\n");
+                return 0;
+        }
+
+        adapter->is_suspended = false;
+
+        mwifiex_cancel_hs(mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA),
+                          MWIFIEX_ASYNC_CMD);
+
+        return 0;
+}
+#endif
+
 /*
  * This function probes an mwifiex device and registers it. It allocates
  * the card structure, enables PCIE function number and initiates the
@@ -159,80 +233,6 @@ static void mwifiex_pcie_remove(struct pci_dev *pdev)
         kfree(card);
 }
 
-/*
- * Kernel needs to suspend all functions separately. Therefore all
- * registered functions must have drivers with suspend and resume
- * methods. Failing that the kernel simply removes the whole card.
- *
- * If already not suspended, this function allocates and sends a host
- * sleep activate request to the firmware and turns off the traffic.
- */
-static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-        struct mwifiex_adapter *adapter;
-        struct pcie_service_card *card;
-        int hs_actived;
-
-        if (pdev) {
-                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
-                if (!card || !card->adapter) {
-                        pr_err("Card or adapter structure is not valid\n");
-                        return 0;
-                }
-        } else {
-                pr_err("PCIE device is not specified\n");
-                return 0;
-        }
-
-        adapter = card->adapter;
-
-        hs_actived = mwifiex_enable_hs(adapter);
-
-        /* Indicate device suspended */
-        adapter->is_suspended = true;
-
-        return 0;
-}
-
-/*
- * Kernel needs to suspend all functions separately. Therefore all
- * registered functions must have drivers with suspend and resume
- * methods. Failing that the kernel simply removes the whole card.
- *
- * If already not resumed, this function turns on the traffic and
- * sends a host sleep cancel request to the firmware.
- */
-static int mwifiex_pcie_resume(struct pci_dev *pdev)
-{
-        struct mwifiex_adapter *adapter;
-        struct pcie_service_card *card;
-
-        if (pdev) {
-                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
-                if (!card || !card->adapter) {
-                        pr_err("Card or adapter structure is not valid\n");
-                        return 0;
-                }
-        } else {
-                pr_err("PCIE device is not specified\n");
-                return 0;
-        }
-
-        adapter = card->adapter;
-
-        if (!adapter->is_suspended) {
-                dev_warn(adapter->dev, "Device already resumed\n");
-                return 0;
-        }
-
-        adapter->is_suspended = false;
-
-        mwifiex_cancel_hs(mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA),
-                          MWIFIEX_ASYNC_CMD);
-
-        return 0;
-}
-
 static DEFINE_PCI_DEVICE_TABLE(mwifiex_ids) = {
         {
                 PCIE_VENDOR_ID_MARVELL, PCIE_DEVICE_ID_MARVELL_88W8766P,
@@ -287,35 +287,46 @@ static int mwifiex_read_reg(struct mwifiex_adapter *adapter, int reg, u32 *data)
 }
 
 /*
- * This function wakes up the card.
- *
- * A host power up command is written to the card configuration
- * register to wake up the card.
+ * This function adds delay loop to ensure FW is awake before proceeding.
  */
-static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
+static void mwifiex_pcie_dev_wakeup_delay(struct mwifiex_adapter *adapter)
 {
         int i = 0;
-        struct pcie_service_card *card = adapter->card;
-        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
-        while (reg->sleep_cookie && mwifiex_pcie_ok_to_access_hw(adapter)) {
+        while (mwifiex_pcie_ok_to_access_hw(adapter)) {
                 i++;
                 usleep_range(10, 20);
                 /* 50ms max wait */
-                if (i == 50000)
+                if (i == 5000)
                         break;
         }
 
+        return;
+}
+
+/* This function wakes up the card by reading fw_status register. */
+static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
+{
+        u32 fw_status;
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
         dev_dbg(adapter->dev, "event: Wakeup device...\n");
 
-        /* Enable interrupts or any chip access will wakeup device */
-        if (mwifiex_write_reg(adapter, PCIE_HOST_INT_MASK, HOST_INTR_MASK)) {
-                dev_warn(adapter->dev, "Enable host interrupt failed\n");
+        if (reg->sleep_cookie)
+                mwifiex_pcie_dev_wakeup_delay(adapter);
+
+        /* Reading fw_status register will wakeup device */
+        if (mwifiex_read_reg(adapter, reg->fw_status, &fw_status)) {
+                dev_warn(adapter->dev, "Reading fw_status register failed\n");
                 return -1;
         }
 
-        dev_dbg(adapter->dev, "PCIE wakeup: Setting PS_STATE_AWAKE\n");
-        adapter->ps_state = PS_STATE_AWAKE;
+        if (reg->sleep_cookie) {
+                mwifiex_pcie_dev_wakeup_delay(adapter);
+                dev_dbg(adapter->dev, "PCIE wakeup: Setting PS_STATE_AWAKE\n");
+                adapter->ps_state = PS_STATE_AWAKE;
+        }
 
         return 0;
 }
@@ -1030,8 +1041,8 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
         u32 wrindx, num_tx_buffs, rx_val;
         int ret;
         dma_addr_t buf_pa;
-        struct mwifiex_pcie_buf_desc *desc;
-        struct mwifiex_pfu_buf_desc *desc2;
+        struct mwifiex_pcie_buf_desc *desc = NULL;
+        struct mwifiex_pfu_buf_desc *desc2 = NULL;
         __le16 *tmp;
 
         if (!(skb->data && skb->len)) {
@@ -1508,6 +1519,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 }
                 memcpy(adapter->upld_buf, skb->data,
                        min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len));
+                skb_push(skb, INTF_HEADER_LEN);
                 if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
                                            PCI_DMA_FROMDEVICE))
                         return -1;
@@ -1983,12 +1995,13 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
                                 }
                         }
                 } else if (!adapter->pps_uapsd_mode &&
-                           adapter->ps_state == PS_STATE_SLEEP) {
+                           adapter->ps_state == PS_STATE_SLEEP &&
+                           mwifiex_pcie_ok_to_access_hw(adapter)) {
                                 /* Potentially for PCIe we could get other
                                  * interrupts like shared. Don't change power
                                  * state until cookie is set */
-                                if (mwifiex_pcie_ok_to_access_hw(adapter))
-                                        adapter->ps_state = PS_STATE_AWAKE;
+                                adapter->ps_state = PS_STATE_AWAKE;
+                                adapter->pm_wakeup_fw_try = false;
                 }
         }
 }
@@ -2111,7 +2124,8 @@ static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
         }
         dev_dbg(adapter->dev, "info: cmd_sent=%d data_sent=%d\n",
                 adapter->cmd_sent, adapter->data_sent);
-        mwifiex_pcie_enable_host_int(adapter);
+        if (adapter->ps_state != PS_STATE_SLEEP)
+                mwifiex_pcie_enable_host_int(adapter);
 
         return 0;
 }
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index bb60c2754a97..e7f6deaf715e 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1388,10 +1388,15 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                         list_del(&cmd_node->list);
                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                                flags);
-                        adapter->cmd_queued = cmd_node;
                         mwifiex_insert_cmd_to_pending_q(adapter, cmd_node,
                                                         true);
                         queue_work(adapter->workqueue, &adapter->main_work);
+
+                        /* Perform internal scan synchronously */
+                        if (!priv->scan_request) {
+                                dev_dbg(adapter->dev, "wait internal scan\n");
+                                mwifiex_wait_queue_complete(adapter, cmd_node);
+                        }
                 } else {
                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                                flags);
@@ -1790,7 +1795,12 @@ check_next_scan:
                 /* Need to indicate IOCTL complete */
                 if (adapter->curr_cmd->wait_q_enabled) {
                         adapter->cmd_wait_q.status = 0;
-                        mwifiex_complete_cmd(adapter, adapter->curr_cmd);
+                        if (!priv->scan_request) {
+                                dev_dbg(adapter->dev,
+                                        "complete internal scan\n");
+                                mwifiex_complete_cmd(adapter,
+                                                     adapter->curr_cmd);
+                        }
                 }
                 if (priv->report_scan_result)
                         priv->report_scan_result = false;
@@ -1946,9 +1956,6 @@ int mwifiex_request_scan(struct mwifiex_private *priv,
                 /* Normal scan */
                 ret = mwifiex_scan_networks(priv, NULL);
 
-        if (!ret)
-                ret = mwifiex_wait_queue_complete(priv->adapter);
-
         up(&priv->async_sem);
 
         return ret;
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index c55c5bb93134..b193e25977d2 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -24,6 +24,7 @@
 #include "main.h"
 #include "wmm.h"
 #include "11n.h"
+#include "11ac.h"
 
 /*
  * This function prepares command to set/get RSSI information.
@@ -334,7 +335,7 @@ mwifiex_cmd_802_11_hs_cfg(struct mwifiex_private *priv,
         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_HS_CFG_ENH);
 
         if (!hs_activate &&
-            (hscfg_param->conditions != cpu_to_le32(HOST_SLEEP_CFG_CANCEL)) &&
+            (hscfg_param->conditions != cpu_to_le32(HS_CFG_CANCEL)) &&
             ((adapter->arp_filter_size > 0) &&
              (adapter->arp_filter_size <= ARP_FILTER_MAX_BUF_SIZE))) {
                 dev_dbg(adapter->dev,
@@ -1059,6 +1060,80 @@ mwifiex_cmd_802_11_subsc_evt(struct mwifiex_private *priv,
         return 0;
 }
 
+static int
+mwifiex_cmd_append_rpn_expression(struct mwifiex_private *priv,
+                                  struct mwifiex_mef_entry *mef_entry,
+                                  u8 **buffer)
+{
+        struct mwifiex_mef_filter *filter = mef_entry->filter;
+        int i, byte_len;
+        u8 *stack_ptr = *buffer;
+
+        for (i = 0; i < MWIFIEX_MAX_FILTERS; i++) {
+                filter = &mef_entry->filter[i];
+                if (!filter->filt_type)
+                        break;
+                *(__le32 *)stack_ptr = cpu_to_le32((u32)filter->repeat);
+                stack_ptr += 4;
+                *stack_ptr = TYPE_DNUM;
+                stack_ptr += 1;
+
+                byte_len = filter->byte_seq[MAX_BYTESEQ];
+                memcpy(stack_ptr, filter->byte_seq, byte_len);
+                stack_ptr += byte_len;
+                *stack_ptr = byte_len;
+                stack_ptr += 1;
+                *stack_ptr = TYPE_BYTESEQ;
+                stack_ptr += 1;
+
+                *(__le32 *)stack_ptr = cpu_to_le32((u32)filter->offset);
+                stack_ptr += 4;
+                *stack_ptr = TYPE_DNUM;
+                stack_ptr += 1;
+
+                *stack_ptr = filter->filt_type;
+                stack_ptr += 1;
+
+                if (filter->filt_action) {
+                        *stack_ptr = filter->filt_action;
+                        stack_ptr += 1;
+                }
+
+                if (stack_ptr - *buffer > STACK_NBYTES)
+                        return -1;
+        }
+
+        *buffer = stack_ptr;
+        return 0;
+}
+
+static int
+mwifiex_cmd_mef_cfg(struct mwifiex_private *priv,
+                    struct host_cmd_ds_command *cmd,
+                    struct mwifiex_ds_mef_cfg *mef)
+{
+        struct host_cmd_ds_mef_cfg *mef_cfg = &cmd->params.mef_cfg;
+        u8 *pos = (u8 *)mef_cfg;
+
+        cmd->command = cpu_to_le16(HostCmd_CMD_MEF_CFG);
+
+        mef_cfg->criteria = cpu_to_le32(mef->criteria);
+        mef_cfg->num_entries = cpu_to_le16(mef->num_entries);
+        pos += sizeof(*mef_cfg);
+        mef_cfg->mef_entry->mode = mef->mef_entry->mode;
+        mef_cfg->mef_entry->action = mef->mef_entry->action;
+        pos += sizeof(*(mef_cfg->mef_entry));
+
+        if (mwifiex_cmd_append_rpn_expression(priv, mef->mef_entry, &pos))
+                return -1;
+
+        mef_cfg->mef_entry->exprsize =
+                        cpu_to_le16(pos - mef_cfg->mef_entry->expr);
+        cmd->size = cpu_to_le16((u16) (pos - (u8 *)mef_cfg) + S_DS_GEN);
+
+        return 0;
+}
+
 /*
  * This function prepares the commands before sending them to the firmware.
  *
@@ -1184,6 +1259,9 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                       cpu_to_le16(sizeof(struct host_cmd_ds_remain_on_chan) +
                                   S_DS_GEN);
                 break;
+        case HostCmd_CMD_11AC_CFG:
+                ret = mwifiex_cmd_11ac_cfg(priv, cmd_ptr, cmd_action, data_buf);
+                break;
         case HostCmd_CMD_P2P_MODE_CFG:
                 cmd_ptr->command = cpu_to_le16(cmd_no);
                 cmd_ptr->params.mode_cfg.action = cpu_to_le16(cmd_action);
@@ -1273,6 +1351,9 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
         case HostCmd_CMD_802_11_SUBSCRIBE_EVENT:
                 ret = mwifiex_cmd_802_11_subsc_evt(priv, cmd_ptr, data_buf);
                 break;
+        case HostCmd_CMD_MEF_CFG:
+                ret = mwifiex_cmd_mef_cfg(priv, cmd_ptr, data_buf);
+                break;
         default:
                 dev_err(priv->adapter->dev,
                         "PREP_CMD: unknown cmd- %#x\n", cmd_no);
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 4669f8d9389f..9f990e14966e 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -95,7 +95,7 @@ mwifiex_process_cmdresp_error(struct mwifiex_private *priv,
                 break;
         }
         /* Handling errors here */
-        mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
+        mwifiex_recycle_cmd_node(adapter, adapter->curr_cmd);
 
         spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
         adapter->curr_cmd = NULL;
@@ -907,6 +907,8 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
         case HostCmd_CMD_REMAIN_ON_CHAN:
                 ret = mwifiex_ret_remain_on_chan(priv, resp, data_buf);
                 break;
+        case HostCmd_CMD_11AC_CFG:
+                break;
         case HostCmd_CMD_P2P_MODE_CFG:
                 ret = mwifiex_ret_p2p_mode_cfg(priv, resp, data_buf);
                 break;
@@ -976,6 +978,8 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
         case HostCmd_CMD_UAP_BSS_STOP:
                 priv->bss_started = 0;
                 break;
+        case HostCmd_CMD_MEF_CFG:
+                break;
         default:
                 dev_err(adapter->dev, "CMD_RESP: unknown cmd response %#x\n",
                         resp->command);
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 9f33c92c90f5..e6c9b2ae22ed 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -54,19 +54,10 @@ int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
  * This function waits on a cmd wait queue. It also cancels the pending
  * request after waking up, in case of errors.
  */
-int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
+                                struct cmd_ctrl_node *cmd_queued)
 {
         int status;
-        struct cmd_ctrl_node *cmd_queued;
-
-        if (!adapter->cmd_queued)
-                return 0;
-
-        cmd_queued = adapter->cmd_queued;
-        adapter->cmd_queued = NULL;
-
-        dev_dbg(adapter->dev, "cmd pending\n");
-        atomic_inc(&adapter->cmd_pending);
 
         /* Wait for completion */
         status = wait_event_interruptible(adapter->cmd_wait_q.wait,
@@ -388,7 +379,7 @@ static int mwifiex_set_hs_params(struct mwifiex_private *priv, u16 action,
                         break;
                 }
                 if (hs_cfg->is_invoke_hostcmd) {
-                        if (hs_cfg->conditions == HOST_SLEEP_CFG_CANCEL) {
+                        if (hs_cfg->conditions == HS_CFG_CANCEL) {
                                 if (!adapter->is_hs_configured)
                                         /* Already cancelled */
                                         break;
@@ -403,8 +394,8 @@ static int mwifiex_set_hs_params(struct mwifiex_private *priv, u16 action,
                                 adapter->hs_cfg.gpio = (u8)hs_cfg->gpio;
                                 if (hs_cfg->gap)
                                         adapter->hs_cfg.gap = (u8)hs_cfg->gap;
-                        } else if (adapter->hs_cfg.conditions
-                                   == cpu_to_le32(HOST_SLEEP_CFG_CANCEL)) {
+                        } else if (adapter->hs_cfg.conditions ==
+                                   cpu_to_le32(HS_CFG_CANCEL)) {
                                 /* Return failure if no parameters for HS
                                    enable */
                                 status = -1;
@@ -420,7 +411,7 @@ static int mwifiex_set_hs_params(struct mwifiex_private *priv, u16 action,
                                                 HostCmd_CMD_802_11_HS_CFG_ENH,
                                                 HostCmd_ACT_GEN_SET, 0,
                                                 &adapter->hs_cfg);
-                        if (hs_cfg->conditions == HOST_SLEEP_CFG_CANCEL)
+                        if (hs_cfg->conditions == HS_CFG_CANCEL)
                                 /* Restore previous condition */
                                 adapter->hs_cfg.conditions =
                                                 cpu_to_le32(prev_cond);
@@ -454,7 +445,7 @@ int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type)
 {
         struct mwifiex_ds_hs_cfg hscfg;
 
-        hscfg.conditions = HOST_SLEEP_CFG_CANCEL;
+        hscfg.conditions = HS_CFG_CANCEL;
         hscfg.is_invoke_hostcmd = true;
 
         return mwifiex_set_hs_params(priv, HostCmd_ACT_GEN_SET,
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index 296faec14365..8f923d0d2ba6 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -169,6 +169,8 @@ int mwifiex_write_data_complete(struct mwifiex_adapter *adapter,
         if (!status) {
                 priv->stats.tx_packets++;
                 priv->stats.tx_bytes += skb->len;
+                if (priv->tx_timeout_cnt)
+                        priv->tx_timeout_cnt = 0;
         } else {
                 priv->stats.tx_errors++;
         }
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 6e76a15a8950..b04b1db29100 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -18,6 +18,7 @@
  */
 
 #include "main.h"
+#include "11ac.h"
 
 /* This function parses security related parameters from cfg80211_ap_settings
  * and sets into FW understandable bss_config structure.
@@ -177,6 +178,60 @@ mwifiex_set_ht_params(struct mwifiex_private *priv,
         return;
 }
 
+/* This function updates 11ac related parameters from IE
+ * and sets them into bss_config structure.
+ */
+void mwifiex_set_vht_params(struct mwifiex_private *priv,
+                            struct mwifiex_uap_bss_param *bss_cfg,
+                            struct cfg80211_ap_settings *params)
+{
+        const u8 *vht_ie;
+
+        vht_ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, params->beacon.tail,
+                                  params->beacon.tail_len);
+        if (vht_ie) {
+                memcpy(&bss_cfg->vht_cap, vht_ie + 2,
+                       sizeof(struct ieee80211_vht_cap));
+                priv->ap_11ac_enabled = 1;
+        } else {
+                priv->ap_11ac_enabled = 0;
+        }
+
+        return;
+}
+
+/* Enable VHT only when cfg80211_ap_settings has VHT IE.
+ * Otherwise disable VHT.
+ */
+void mwifiex_set_vht_width(struct mwifiex_private *priv,
+                           enum nl80211_chan_width width,
+                           bool ap_11ac_enable)
+{
+        struct mwifiex_adapter *adapter = priv->adapter;
+        struct mwifiex_11ac_vht_cfg vht_cfg;
+
+        vht_cfg.band_config = VHT_CFG_5GHZ;
+        vht_cfg.cap_info = adapter->hw_dot_11ac_dev_cap;
+
+        if (!ap_11ac_enable) {
+                vht_cfg.mcs_tx_set = DISABLE_VHT_MCS_SET;
+                vht_cfg.mcs_rx_set = DISABLE_VHT_MCS_SET;
+        } else {
+                vht_cfg.mcs_tx_set = DEFAULT_VHT_MCS_SET;
+                vht_cfg.mcs_rx_set = DEFAULT_VHT_MCS_SET;
+        }
+
+        vht_cfg.misc_config  = VHT_CAP_UAP_ONLY;
+
+        if (ap_11ac_enable && width >= NL80211_CHAN_WIDTH_80)
+                vht_cfg.misc_config |= VHT_BW_80_160_80P80;
+
+        mwifiex_send_cmd_sync(priv, HostCmd_CMD_11AC_CFG,
+                              HostCmd_ACT_GEN_SET, 0, &vht_cfg);
+
+        return;
+}
+
 /* This function finds supported rates IE from beacon parameter and sets
  * these rates into bss_config structure.
  */
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index 21553976b550..e57ac0dd3ab5 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -195,7 +195,7 @@ int mwifiex_recv_packet(struct mwifiex_private *priv, struct sk_buff *skb)
         skb->protocol = eth_type_trans(skb, priv->netdev);
         skb->ip_summed = CHECKSUM_NONE;
 
-        /* This is required only in case of 11n and USB as we alloc
+        /* This is required only in case of 11n and USB/PCIE as we alloc
          * a buffer of 4K only if its 11N (to be able to receive 4K
          * AMSDU packets). In case of SD we allocate buffers based
          * on the size of packet and hence this is not needed.
@@ -212,7 +212,8 @@ int mwifiex_recv_packet(struct mwifiex_private *priv, struct sk_buff *skb)
          * fragments. Currently we fail the Filesndl-ht.scr script
          * for UDP, hence this fix
          */
-        if ((priv->adapter->iface_type == MWIFIEX_USB) &&
+        if ((priv->adapter->iface_type == MWIFIEX_USB ||
+             priv->adapter->iface_type == MWIFIEX_PCIE) &&
             (skb->truesize > MWIFIEX_RX_DATA_BUF_SIZE))
                 skb->truesize += (skb->len - MWIFIEX_RX_DATA_BUF_SIZE);
 
@@ -238,7 +239,6 @@ int mwifiex_recv_packet(struct mwifiex_private *priv, struct sk_buff *skb)
 int mwifiex_complete_cmd(struct mwifiex_adapter *adapter,
                          struct cmd_ctrl_node *cmd_node)
 {
-        atomic_dec(&adapter->cmd_pending);
         dev_dbg(adapter->dev, "cmd completed: status=%d\n",
                 adapter->cmd_wait_q.status);
 
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 32adc878041d..2cc81ba590e3 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -436,10 +436,7 @@ mwifiex_wmm_init(struct mwifiex_adapter *adapter)
                                         = priv->aggr_prio_tbl[7].ampdu_user
                                         = BA_STREAM_NOT_ALLOWED;
 
-                priv->add_ba_param.timeout = MWIFIEX_DEFAULT_BLOCK_ACK_TIMEOUT;
-                priv->add_ba_param.tx_win_size = MWIFIEX_AMPDU_DEF_TXWINSIZE;
-                priv->add_ba_param.rx_win_size = MWIFIEX_AMPDU_DEF_RXWINSIZE;
-
+                mwifiex_set_ba_params(priv);
                 mwifiex_reset_11n_rx_seq_num(priv);
 
                 atomic_set(&priv->wmm.tx_pkts_queued, 0);
@@ -688,13 +685,13 @@ mwifiex_wmm_add_buf_txqueue(struct mwifiex_private *priv,
         ra_list->total_pkts_size += skb->len;
         ra_list->pkt_count++;
 
-        atomic_inc(&priv->wmm.tx_pkts_queued);
-
         if (atomic_read(&priv->wmm.highest_queued_prio) <
                                                 tos_to_tid_inv[tid_down])
                 atomic_set(&priv->wmm.highest_queued_prio,
                            tos_to_tid_inv[tid_down]);
 
+        atomic_inc(&priv->wmm.tx_pkts_queued);
+
         spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags);
 }
 
@@ -890,19 +887,15 @@ mwifiex_wmm_get_highest_priolist_ptr(struct mwifiex_adapter *adapter,
         struct mwifiex_bss_prio_node *bssprio_node, *bssprio_head;
         struct mwifiex_tid_tbl *tid_ptr;
         atomic_t *hqp;
-        int is_list_empty;
-        unsigned long flags;
+        unsigned long flags_bss, flags_ra;
         int i, j;
 
         for (j = adapter->priv_num - 1; j >= 0; --j) {
                 spin_lock_irqsave(&adapter->bss_prio_tbl[j].bss_prio_lock,
-                                  flags);
-                is_list_empty = list_empty(&adapter->bss_prio_tbl[j]
-                                           .bss_prio_head);
-                spin_unlock_irqrestore(&adapter->bss_prio_tbl[j].bss_prio_lock,
-                                       flags);
-                if (is_list_empty)
-                        continue;
+                                  flags_bss);
+
+                if (list_empty(&adapter->bss_prio_tbl[j].bss_prio_head))
+                        goto skip_prio_tbl;
 
                 if (adapter->bss_prio_tbl[j].bss_prio_cur ==
                     (struct mwifiex_bss_prio_node *)
@@ -919,26 +912,26 @@ mwifiex_wmm_get_highest_priolist_ptr(struct mwifiex_adapter *adapter,
 
                 do {
                         priv_tmp = bssprio_node->priv;
-                        hqp = &priv_tmp->wmm.highest_queued_prio;
 
+                        if (atomic_read(&priv_tmp->wmm.tx_pkts_queued) == 0)
+                                goto skip_bss;
+
+                        /* iterate over the WMM queues of the BSS */
+                        hqp = &priv_tmp->wmm.highest_queued_prio;
                         for (i = atomic_read(hqp); i >= LOW_PRIO_TID; --i) {
 
+                                spin_lock_irqsave(&priv_tmp->wmm.
+                                                  ra_list_spinlock, flags_ra);
+
                                 tid_ptr = &(priv_tmp)->wmm.
                                         tid_tbl_ptr[tos_to_tid[i]];
 
                                 /* For non-STA ra_list_curr may be NULL */
                                 if (!tid_ptr->ra_list_curr)
-                                        continue;
-
-                                spin_lock_irqsave(&tid_ptr->tid_tbl_lock,
-                                                  flags);
-                                is_list_empty =
-                                        list_empty(&adapter->bss_prio_tbl[j]
-                                                   .bss_prio_head);
-                                spin_unlock_irqrestore(&tid_ptr->tid_tbl_lock,
-                                                       flags);
-                                if (is_list_empty)
-                                        continue;
+                                        goto skip_wmm_queue;
+
+                                if (list_empty(&tid_ptr->ra_list))
+                                        goto skip_wmm_queue;
 
                                 /*
                                  * Always choose the next ra we transmitted
@@ -960,10 +953,8 @@ mwifiex_wmm_get_highest_priolist_ptr(struct mwifiex_adapter *adapter,
                                 }
 
                                 do {
-                                        is_list_empty =
-                                                skb_queue_empty(&ptr->skb_head);
-
-                                        if (!is_list_empty)
+                                        if (!skb_queue_empty(&ptr->skb_head))
+                                                /* holds both locks */
                                                 goto found;
 
                                         /* Get next ra */
@@ -978,14 +969,14 @@ mwifiex_wmm_get_highest_priolist_ptr(struct mwifiex_adapter *adapter,
                                                     struct mwifiex_ra_list_tbl,
                                                     list);
                                 } while (ptr != head);
-                        }
 
-                        /* No packet at any TID for this priv. Mark as such
-                         * to skip checking TIDs for this priv (until pkt is
-                         * added).
-                         */
-                        atomic_set(hqp, NO_PKT_PRIO_TID);
+skip_wmm_queue:
+                                spin_unlock_irqrestore(&priv_tmp->wmm.
+                                                       ra_list_spinlock,
+                                                       flags_ra);
+                        }
 
+skip_bss:
                         /* Get next bss priority node */
                         bssprio_node = list_first_entry(&bssprio_node->list,
                                                 struct mwifiex_bss_prio_node,
@@ -1000,14 +991,21 @@ mwifiex_wmm_get_highest_priolist_ptr(struct mwifiex_adapter *adapter,
                                                 struct mwifiex_bss_prio_node,
                                                 list);
                 } while (bssprio_node != bssprio_head);
+
+skip_prio_tbl:
+                spin_unlock_irqrestore(&adapter->bss_prio_tbl[j].bss_prio_lock,
+                                       flags_bss);
         }
+
         return NULL;
 
 found:
-        spin_lock_irqsave(&priv_tmp->wmm.ra_list_spinlock, flags);
+        /* holds bss_prio_lock / ra_list_spinlock */
         if (atomic_read(hqp) > i)
                 atomic_set(hqp, i);
-        spin_unlock_irqrestore(&priv_tmp->wmm.ra_list_spinlock, flags);
+        spin_unlock_irqrestore(&priv_tmp->wmm.ra_list_spinlock, flags_ra);
+        spin_unlock_irqrestore(&adapter->bss_prio_tbl[j].bss_prio_lock,
+                               flags_bss);
 
         *priv = priv_tmp;
         *tid = tos_to_tid[i];
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 9f9a1449e812..ee1778cf270f 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -232,6 +232,7 @@ struct mwl8k_priv {
         u16 num_mcaddrs;
         u8 hw_rev;
         u32 fw_rev;
+        u32 caps;
 
         /*
          * Running count of TX packets in flight, to avoid
@@ -284,6 +285,7 @@ struct mwl8k_priv {
         unsigned fw_state;
         char *fw_pref;
         char *fw_alt;
+        bool is_8764;
         struct completion firmware_loading_complete;
 
         /* bitmap of running BSSes */
@@ -600,13 +602,18 @@ mwl8k_send_fw_load_cmd(struct mwl8k_priv *priv, void *data, int length)
         loops = 1000;
         do {
                 u32 int_code;
-
-                int_code = ioread32(regs + MWL8K_HIU_INT_CODE);
-                if (int_code == MWL8K_INT_CODE_CMD_FINISHED) {
-                        iowrite32(0, regs + MWL8K_HIU_INT_CODE);
-                        break;
+                if (priv->is_8764) {
+                        int_code = ioread32(regs +
+                                            MWL8K_HIU_H2A_INTERRUPT_STATUS);
+                        if (int_code == 0)
+                                break;
+                } else {
+                        int_code = ioread32(regs + MWL8K_HIU_INT_CODE);
+                        if (int_code == MWL8K_INT_CODE_CMD_FINISHED) {
+                                iowrite32(0, regs + MWL8K_HIU_INT_CODE);
+                                break;
+                        }
                 }
-
                 cond_resched();
                 udelay(1);
         } while (--loops);
@@ -724,7 +731,7 @@ static int mwl8k_load_firmware(struct ieee80211_hw *hw)
         int rc;
         int loops;
 
-        if (!memcmp(fw->data, "\x01\x00\x00\x00", 4)) {
+        if (!memcmp(fw->data, "\x01\x00\x00\x00", 4) && !priv->is_8764) {
                 const struct firmware *helper = priv->fw_helper;
 
                 if (helper == NULL) {
@@ -743,7 +750,10 @@ static int mwl8k_load_firmware(struct ieee80211_hw *hw)
 
                 rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
         } else {
-                rc = mwl8k_load_fw_image(priv, fw->data, fw->size);
+                if (priv->is_8764)
+                        rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
+                else
+                        rc = mwl8k_load_fw_image(priv, fw->data, fw->size);
         }
 
         if (rc) {
@@ -908,9 +918,9 @@ static void mwl8k_encapsulate_tx_frame(struct mwl8k_priv *priv,
 }
 
 /*
- * Packet reception for 88w8366 AP firmware.
+ * Packet reception for 88w8366/88w8764 AP firmware.
  */
-struct mwl8k_rxd_8366_ap {
+struct mwl8k_rxd_ap {
         __le16 pkt_len;
         __u8 sq2;
         __u8 rate;
@@ -928,30 +938,30 @@ struct mwl8k_rxd_8366_ap {
         __u8 rx_ctrl;
 } __packed;
 
-#define MWL8K_8366_AP_RATE_INFO_MCS_FORMAT      0x80
-#define MWL8K_8366_AP_RATE_INFO_40MHZ           0x40
-#define MWL8K_8366_AP_RATE_INFO_RATEID(x)       ((x) & 0x3f)
+#define MWL8K_AP_RATE_INFO_MCS_FORMAT           0x80
+#define MWL8K_AP_RATE_INFO_40MHZ                0x40
+#define MWL8K_AP_RATE_INFO_RATEID(x)            ((x) & 0x3f)
 
-#define MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST     0x80
+#define MWL8K_AP_RX_CTRL_OWNED_BY_HOST          0x80
 
-/* 8366 AP rx_status bits */
-#define MWL8K_8366_AP_RXSTAT_DECRYPT_ERR_MASK           0x80
-#define MWL8K_8366_AP_RXSTAT_GENERAL_DECRYPT_ERR        0xFF
-#define MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR       0x02
-#define MWL8K_8366_AP_RXSTAT_WEP_DECRYPT_ICV_ERR        0x04
-#define MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_ICV_ERR       0x08
+/* 8366/8764 AP rx_status bits */
+#define MWL8K_AP_RXSTAT_DECRYPT_ERR_MASK                0x80
+#define MWL8K_AP_RXSTAT_GENERAL_DECRYPT_ERR             0xFF
+#define MWL8K_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR            0x02
+#define MWL8K_AP_RXSTAT_WEP_DECRYPT_ICV_ERR             0x04
+#define MWL8K_AP_RXSTAT_TKIP_DECRYPT_ICV_ERR            0x08
 
-static void mwl8k_rxd_8366_ap_init(void *_rxd, dma_addr_t next_dma_addr)
+static void mwl8k_rxd_ap_init(void *_rxd, dma_addr_t next_dma_addr)
 {
-        struct mwl8k_rxd_8366_ap *rxd = _rxd;
+        struct mwl8k_rxd_ap *rxd = _rxd;
 
         rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
-        rxd->rx_ctrl = MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST;
+        rxd->rx_ctrl = MWL8K_AP_RX_CTRL_OWNED_BY_HOST;
 }
 
-static void mwl8k_rxd_8366_ap_refill(void *_rxd, dma_addr_t addr, int len)
+static void mwl8k_rxd_ap_refill(void *_rxd, dma_addr_t addr, int len)
 {
-        struct mwl8k_rxd_8366_ap *rxd = _rxd;
+        struct mwl8k_rxd_ap *rxd = _rxd;
 
         rxd->pkt_len = cpu_to_le16(len);
         rxd->pkt_phys_addr = cpu_to_le32(addr);
@@ -960,12 +970,12 @@ static void mwl8k_rxd_8366_ap_refill(void *_rxd, dma_addr_t addr, int len)
 }
 
 static int
-mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
-                          __le16 *qos, s8 *noise)
+mwl8k_rxd_ap_process(void *_rxd, struct ieee80211_rx_status *status,
+                     __le16 *qos, s8 *noise)
 {
-        struct mwl8k_rxd_8366_ap *rxd = _rxd;
+        struct mwl8k_rxd_ap *rxd = _rxd;
 
-        if (!(rxd->rx_ctrl & MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST))
+        if (!(rxd->rx_ctrl & MWL8K_AP_RX_CTRL_OWNED_BY_HOST))
                 return -1;
         rmb();
 
@@ -974,11 +984,11 @@ mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
         status->signal = -rxd->rssi;
         *noise = -rxd->noise_floor;
 
-        if (rxd->rate & MWL8K_8366_AP_RATE_INFO_MCS_FORMAT) {
+        if (rxd->rate & MWL8K_AP_RATE_INFO_MCS_FORMAT) {
                 status->flag |= RX_FLAG_HT;
-                if (rxd->rate & MWL8K_8366_AP_RATE_INFO_40MHZ)
+                if (rxd->rate & MWL8K_AP_RATE_INFO_40MHZ)
                         status->flag |= RX_FLAG_40MHZ;
-                status->rate_idx = MWL8K_8366_AP_RATE_INFO_RATEID(rxd->rate);
+                status->rate_idx = MWL8K_AP_RATE_INFO_RATEID(rxd->rate);
         } else {
                 int i;
 
@@ -1002,19 +1012,19 @@ mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
 
         *qos = rxd->qos_control;
 
-        if ((rxd->rx_status != MWL8K_8366_AP_RXSTAT_GENERAL_DECRYPT_ERR) &&
-            (rxd->rx_status & MWL8K_8366_AP_RXSTAT_DECRYPT_ERR_MASK) &&
-            (rxd->rx_status & MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR))
+        if ((rxd->rx_status != MWL8K_AP_RXSTAT_GENERAL_DECRYPT_ERR) &&
+            (rxd->rx_status & MWL8K_AP_RXSTAT_DECRYPT_ERR_MASK) &&
+            (rxd->rx_status & MWL8K_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR))
                 status->flag |= RX_FLAG_MMIC_ERROR;
 
         return le16_to_cpu(rxd->pkt_len);
 }
 
-static struct rxd_ops rxd_8366_ap_ops = {
-        .rxd_size       = sizeof(struct mwl8k_rxd_8366_ap),
-        .rxd_init       = mwl8k_rxd_8366_ap_init,
-        .rxd_refill     = mwl8k_rxd_8366_ap_refill,
-        .rxd_process    = mwl8k_rxd_8366_ap_process,
+static struct rxd_ops rxd_ap_ops = {
+        .rxd_size       = sizeof(struct mwl8k_rxd_ap),
+        .rxd_init       = mwl8k_rxd_ap_init,
+        .rxd_refill     = mwl8k_rxd_ap_refill,
+        .rxd_process    = mwl8k_rxd_ap_process,
 };
 
 /*
@@ -2401,6 +2411,9 @@ mwl8k_set_caps(struct ieee80211_hw *hw, u32 caps)
 {
         struct mwl8k_priv *priv = hw->priv;
 
+        if (priv->caps)
+                return;
+
         if ((caps & MWL8K_CAP_2GHZ4) || !(caps & MWL8K_CAP_BAND_MASK)) {
                 mwl8k_setup_2ghz_band(hw);
                 if (caps & MWL8K_CAP_MIMO)
@@ -2412,6 +2425,8 @@ mwl8k_set_caps(struct ieee80211_hw *hw, u32 caps)
                 if (caps & MWL8K_CAP_MIMO)
                         mwl8k_set_ht_caps(hw, &priv->band_50, caps);
         }
+
+        priv->caps = caps;
 }
 
 static int mwl8k_cmd_get_hw_spec_sta(struct ieee80211_hw *hw)
@@ -4796,16 +4811,14 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
         struct mwl8k_priv *priv = hw->priv;
         int rc;
 
-        if (conf->flags & IEEE80211_CONF_IDLE) {
-                mwl8k_cmd_radio_disable(hw);
-                return 0;
-        }
-
         rc = mwl8k_fw_lock(hw);
         if (rc)
                 return rc;
 
-        rc = mwl8k_cmd_radio_enable(hw);
+        if (conf->flags & IEEE80211_CONF_IDLE)
+                rc = mwl8k_cmd_radio_disable(hw);
+        else
+                rc = mwl8k_cmd_radio_enable(hw);
         if (rc)
                 goto out;
 
@@ -5433,12 +5446,17 @@ enum {
         MWL8363 = 0,
         MWL8687,
         MWL8366,
+        MWL8764,
 };
 
 #define MWL8K_8366_AP_FW_API 3
 #define _MWL8K_8366_AP_FW(api) "mwl8k/fmimage_8366_ap-" #api ".fw"
 #define MWL8K_8366_AP_FW(api) _MWL8K_8366_AP_FW(api)
 
+#define MWL8K_8764_AP_FW_API 1
+#define _MWL8K_8764_AP_FW(api) "mwl8k/fmimage_8764_ap-" #api ".fw"
+#define MWL8K_8764_AP_FW(api) _MWL8K_8764_AP_FW(api)
+
 static struct mwl8k_device_info mwl8k_info_tbl[] = {
         [MWL8363] = {
                 .part_name      = "88w8363",
@@ -5456,7 +5474,13 @@ static struct mwl8k_device_info mwl8k_info_tbl[] = {
                 .fw_image_sta   = "mwl8k/fmimage_8366.fw",
                 .fw_image_ap    = MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API),
                 .fw_api_ap      = MWL8K_8366_AP_FW_API,
-                .ap_rxd_ops     = &rxd_8366_ap_ops,
+                .ap_rxd_ops     = &rxd_ap_ops,
+        },
+        [MWL8764] = {
+                .part_name      = "88w8764",
+                .fw_image_ap    = MWL8K_8764_AP_FW(MWL8K_8764_AP_FW_API),
+                .fw_api_ap      = MWL8K_8764_AP_FW_API,
+                .ap_rxd_ops     = &rxd_ap_ops,
         },
 };
 
@@ -5478,6 +5502,7 @@ static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
         { PCI_VDEVICE(MARVELL, 0x2a41), .driver_data = MWL8366, },
         { PCI_VDEVICE(MARVELL, 0x2a42), .driver_data = MWL8366, },
         { PCI_VDEVICE(MARVELL, 0x2a43), .driver_data = MWL8366, },
+        { PCI_VDEVICE(MARVELL, 0x2b36), .driver_data = MWL8764, },
         { },
 };
 MODULE_DEVICE_TABLE(pci, mwl8k_pci_id_table);
@@ -5999,6 +6024,8 @@ static int mwl8k_probe(struct pci_dev *pdev,
         priv->pdev = pdev;
         priv->device_info = &mwl8k_info_tbl[id->driver_data];
 
+        if (id->driver_data == MWL8764)
+                priv->is_8764 = true;
 
         priv->sram = pci_iomap(pdev, 0, 0x10000);
         if (priv->sram == NULL) {
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index 7744f42de1ea..1f9cb55c3360 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -1584,7 +1584,7 @@ static int ezusb_probe(struct usb_interface *interface,
         struct ezusb_priv *upriv = NULL;
         struct usb_interface_descriptor *iface_desc;
         struct usb_endpoint_descriptor *ep;
-        const struct firmware *fw_entry;
+        const struct firmware *fw_entry = NULL;
         int retval = 0;
         int i;
 
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 3109c0db66e1..4775b5d172d5 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -144,7 +144,7 @@ static int psm;
 static char *essid;
 
 /* Default to encapsulation unless translation requested */
-static int translate = 1;
+static bool translate = 1;
 
 static int country = USA;
 
@@ -178,7 +178,7 @@ module_param(hop_dwell, int, 0);
 module_param(beacon_period, int, 0);
 module_param(psm, int, 0);
 module_param(essid, charp, 0);
-module_param(translate, int, 0);
+module_param(translate, bool, 0);
 module_param(country, int, 0);
 module_param(sniffer, int, 0);
 module_param(bc, int, 0);
@@ -1353,7 +1353,7 @@ static int ray_get_range(struct net_device *dev, struct iw_request_info *info,
 static int ray_set_framing(struct net_device *dev, struct iw_request_info *info,
                            union iwreq_data *wrqu, char *extra)
 {
-        translate = *(extra);   /* Set framing mode */
+        translate = !!*(extra); /* Set framing mode */
 
         return 0;
 }
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 525fd7521dff..8169a85c4498 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2,7 +2,7 @@
  * Driver for RNDIS based wireless USB devices.
  *
  * Copyright (C) 2007 by Bjorge Dijkstra <bjd@jooz.net>
- * Copyright (C) 2008-2009 by Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+ * Copyright (C) 2008-2009 by Jussi Kivilinna <jussi.kivilinna@iki.fi>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -2839,8 +2839,7 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
         } else if (priv->infra_mode == NDIS_80211_INFRA_ADHOC)
                 cfg80211_ibss_joined(usbdev->net, bssid, GFP_KERNEL);
 
-        if (info != NULL)
-                kfree(info);
+        kfree(info);
 
         priv->connected = true;
         memcpy(priv->bssid, bssid, ETH_ALEN);
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 44d6ead43341..9b915d3a44be 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -20,6 +20,7 @@ if RT2X00
 config RT2400PCI
         tristate "Ralink rt2400 (PCI/PCMCIA) support"
         depends on PCI
+        select RT2X00_LIB_MMIO
         select RT2X00_LIB_PCI
         select EEPROM_93CX6
         ---help---
@@ -31,6 +32,7 @@ config RT2400PCI
 config RT2500PCI
         tristate "Ralink rt2500 (PCI/PCMCIA) support"
         depends on PCI
+        select RT2X00_LIB_MMIO
         select RT2X00_LIB_PCI
         select EEPROM_93CX6
         ---help---
@@ -43,6 +45,7 @@ config RT61PCI
         tristate "Ralink rt2501/rt61 (PCI/PCMCIA) support"
         depends on PCI
         select RT2X00_LIB_PCI
+        select RT2X00_LIB_MMIO
         select RT2X00_LIB_FIRMWARE
         select RT2X00_LIB_CRYPTO
         select CRC_ITU_T
@@ -55,10 +58,11 @@ config RT61PCI
 
 config RT2800PCI
         tristate "Ralink rt27xx/rt28xx/rt30xx (PCI/PCIe/PCMCIA) support"
-        depends on PCI || RALINK_RT288X || RALINK_RT305X
+        depends on PCI || SOC_RT288X || SOC_RT305X
         select RT2800_LIB
+        select RT2X00_LIB_MMIO
         select RT2X00_LIB_PCI if PCI
-        select RT2X00_LIB_SOC if RALINK_RT288X || RALINK_RT305X
+        select RT2X00_LIB_SOC if SOC_RT288X || SOC_RT305X
         select RT2X00_LIB_FIRMWARE
         select RT2X00_LIB_CRYPTO
         select CRC_CCITT
@@ -169,6 +173,13 @@ config RT2800USB_RT53XX
          rt2800usb driver.
          Supported chips: RT5370
 
+config RT2800USB_RT55XX
+       bool "rt2800usb - Include support for rt55xx devices (EXPERIMENTAL)"
+       ---help---
+         This adds support for rt55xx wireless chipset family to the
+         rt2800usb driver.
+         Supported chips: RT5572
+
 config RT2800USB_UNKNOWN
         bool "rt2800usb - Include support for unknown (USB) devices"
         default n
@@ -185,6 +196,9 @@ endif
 config RT2800_LIB
         tristate
 
+config RT2X00_LIB_MMIO
+        tristate
+
 config RT2X00_LIB_PCI
         tristate
         select RT2X00_LIB
diff --git a/drivers/net/wireless/rt2x00/Makefile b/drivers/net/wireless/rt2x00/Makefile
index 349d5b8284a4..f069d8bc5b67 100644
--- a/drivers/net/wireless/rt2x00/Makefile
+++ b/drivers/net/wireless/rt2x00/Makefile
@@ -9,6 +9,7 @@ rt2x00lib-$(CONFIG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
 rt2x00lib-$(CONFIG_RT2X00_LIB_LEDS)     += rt2x00leds.o
 
 obj-$(CONFIG_RT2X00_LIB)                += rt2x00lib.o
+obj-$(CONFIG_RT2X00_LIB_MMIO)           += rt2x00mmio.o
 obj-$(CONFIG_RT2X00_LIB_PCI)            += rt2x00pci.o
 obj-$(CONFIG_RT2X00_LIB_SOC)            += rt2x00soc.o
 obj-$(CONFIG_RT2X00_LIB_USB)            += rt2x00usb.o
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 221beaaa83f1..d1b10d457230 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -34,13 +34,14 @@
 #include <linux/slab.h>
 
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt2400pci.h"
 
 /*
  * Register access.
  * All access to the CSR registers will go through the methods
- * rt2x00pci_register_read and rt2x00pci_register_write.
+ * rt2x00mmio_register_read and rt2x00mmio_register_write.
  * BBP and RF register require indirect register access,
  * and use the CSR registers BBPCSR and RFCSR to achieve this.
  * These indirect registers work with busy bits,
@@ -51,9 +52,9 @@
  * and we will print an error.
  */
 #define WAIT_FOR_BBP(__dev, __reg) \
-        rt2x00pci_regbusy_read((__dev), BBPCSR, BBPCSR_BUSY, (__reg))
+        rt2x00mmio_regbusy_read((__dev), BBPCSR, BBPCSR_BUSY, (__reg))
 #define WAIT_FOR_RF(__dev, __reg) \
-        rt2x00pci_regbusy_read((__dev), RFCSR, RFCSR_BUSY, (__reg))
+        rt2x00mmio_regbusy_read((__dev), RFCSR, RFCSR_BUSY, (__reg))
 
 static void rt2400pci_bbp_write(struct rt2x00_dev *rt2x00dev,
                                 const unsigned int word, const u8 value)
@@ -73,7 +74,7 @@ static void rt2400pci_bbp_write(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, BBPCSR_BUSY, 1);
                 rt2x00_set_field32(&reg, BBPCSR_WRITE_CONTROL, 1);
 
-                rt2x00pci_register_write(rt2x00dev, BBPCSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, BBPCSR, reg);
         }
 
         mutex_unlock(&rt2x00dev->csr_mutex);
@@ -100,7 +101,7 @@ static void rt2400pci_bbp_read(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, BBPCSR_BUSY, 1);
                 rt2x00_set_field32(&reg, BBPCSR_WRITE_CONTROL, 0);
 
-                rt2x00pci_register_write(rt2x00dev, BBPCSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, BBPCSR, reg);
 
                 WAIT_FOR_BBP(rt2x00dev, &reg);
         }
@@ -128,7 +129,7 @@ static void rt2400pci_rf_write(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, RFCSR_IF_SELECT, 0);
                 rt2x00_set_field32(&reg, RFCSR_BUSY, 1);
 
-                rt2x00pci_register_write(rt2x00dev, RFCSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, RFCSR, reg);
                 rt2x00_rf_write(rt2x00dev, word, value);
         }
 
@@ -140,7 +141,7 @@ static void rt2400pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
         struct rt2x00_dev *rt2x00dev = eeprom->data;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, CSR21, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR21, &reg);
 
         eeprom->reg_data_in = !!rt2x00_get_field32(reg, CSR21_EEPROM_DATA_IN);
         eeprom->reg_data_out = !!rt2x00_get_field32(reg, CSR21_EEPROM_DATA_OUT);
@@ -162,15 +163,15 @@ static void rt2400pci_eepromregister_write(struct eeprom_93cx6 *eeprom)
         rt2x00_set_field32(&reg, CSR21_EEPROM_CHIP_SELECT,
                            !!eeprom->reg_chip_select);
 
-        rt2x00pci_register_write(rt2x00dev, CSR21, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR21, reg);
 }
 
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
 static const struct rt2x00debug rt2400pci_rt2x00debug = {
         .owner  = THIS_MODULE,
         .csr    = {
-                .read           = rt2x00pci_register_read,
-                .write          = rt2x00pci_register_write,
+                .read           = rt2x00mmio_register_read,
+                .write          = rt2x00mmio_register_write,
                 .flags          = RT2X00DEBUGFS_OFFSET,
                 .word_base      = CSR_REG_BASE,
                 .word_size      = sizeof(u32),
@@ -204,7 +205,7 @@ static int rt2400pci_rfkill_poll(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, GPIOCSR, &reg);
         return rt2x00_get_field32(reg, GPIOCSR_VAL0);
 }
 
@@ -217,14 +218,14 @@ static void rt2400pci_brightness_set(struct led_classdev *led_cdev,
         unsigned int enabled = brightness != LED_OFF;
         u32 reg;
 
-        rt2x00pci_register_read(led->rt2x00dev, LEDCSR, &reg);
+        rt2x00mmio_register_read(led->rt2x00dev, LEDCSR, &reg);
 
         if (led->type == LED_TYPE_RADIO || led->type == LED_TYPE_ASSOC)
                 rt2x00_set_field32(&reg, LEDCSR_LINK, enabled);
         else if (led->type == LED_TYPE_ACTIVITY)
                 rt2x00_set_field32(&reg, LEDCSR_ACTIVITY, enabled);
 
-        rt2x00pci_register_write(led->rt2x00dev, LEDCSR, reg);
+        rt2x00mmio_register_write(led->rt2x00dev, LEDCSR, reg);
 }
 
 static int rt2400pci_blink_set(struct led_classdev *led_cdev,
@@ -235,10 +236,10 @@ static int rt2400pci_blink_set(struct led_classdev *led_cdev,
             container_of(led_cdev, struct rt2x00_led, led_dev);
         u32 reg;
 
-        rt2x00pci_register_read(led->rt2x00dev, LEDCSR, &reg);
+        rt2x00mmio_register_read(led->rt2x00dev, LEDCSR, &reg);
         rt2x00_set_field32(&reg, LEDCSR_ON_PERIOD, *delay_on);
         rt2x00_set_field32(&reg, LEDCSR_OFF_PERIOD, *delay_off);
-        rt2x00pci_register_write(led->rt2x00dev, LEDCSR, reg);
+        rt2x00mmio_register_write(led->rt2x00dev, LEDCSR, reg);
 
         return 0;
 }
@@ -268,7 +269,7 @@ static void rt2400pci_config_filter(struct rt2x00_dev *rt2x00dev,
          * Note that the version error will always be dropped
          * since there is no filter for it at this time.
          */
-        rt2x00pci_register_read(rt2x00dev, RXCSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RXCSR0, &reg);
         rt2x00_set_field32(&reg, RXCSR0_DROP_CRC,
                            !(filter_flags & FIF_FCSFAIL));
         rt2x00_set_field32(&reg, RXCSR0_DROP_PHYSICAL,
@@ -281,7 +282,7 @@ static void rt2400pci_config_filter(struct rt2x00_dev *rt2x00dev,
                            !(filter_flags & FIF_PROMISC_IN_BSS) &&
                            !rt2x00dev->intf_ap_count);
         rt2x00_set_field32(&reg, RXCSR0_DROP_VERSION_ERROR, 1);
-        rt2x00pci_register_write(rt2x00dev, RXCSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, RXCSR0, reg);
 }
 
 static void rt2400pci_config_intf(struct rt2x00_dev *rt2x00dev,
@@ -297,25 +298,26 @@ static void rt2400pci_config_intf(struct rt2x00_dev *rt2x00dev,
                  * Enable beacon config
                  */
                 bcn_preload = PREAMBLE + GET_DURATION(IEEE80211_HEADER, 20);
-                rt2x00pci_register_read(rt2x00dev, BCNCSR1, &reg);
+                rt2x00mmio_register_read(rt2x00dev, BCNCSR1, &reg);
                 rt2x00_set_field32(&reg, BCNCSR1_PRELOAD, bcn_preload);
-                rt2x00pci_register_write(rt2x00dev, BCNCSR1, reg);
+                rt2x00mmio_register_write(rt2x00dev, BCNCSR1, reg);
 
                 /*
                  * Enable synchronisation.
                  */
-                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
                 rt2x00_set_field32(&reg, CSR14_TSF_SYNC, conf->sync);
-                rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
         }
 
         if (flags & CONFIG_UPDATE_MAC)
-                rt2x00pci_register_multiwrite(rt2x00dev, CSR3,
-                                              conf->mac, sizeof(conf->mac));
+                rt2x00mmio_register_multiwrite(rt2x00dev, CSR3,
+                                               conf->mac, sizeof(conf->mac));
 
         if (flags & CONFIG_UPDATE_BSSID)
-                rt2x00pci_register_multiwrite(rt2x00dev, CSR5,
-                                              conf->bssid, sizeof(conf->bssid));
+                rt2x00mmio_register_multiwrite(rt2x00dev, CSR5,
+                                               conf->bssid,
+                                               sizeof(conf->bssid));
 }
 
 static void rt2400pci_config_erp(struct rt2x00_dev *rt2x00dev,
@@ -331,68 +333,68 @@ static void rt2400pci_config_erp(struct rt2x00_dev *rt2x00dev,
         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
                 preamble_mask = erp->short_preamble << 3;
 
-                rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR1, &reg);
                 rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x1ff);
                 rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0x13a);
                 rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
                 rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR1, reg);
 
-                rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
+                rt2x00mmio_register_read(rt2x00dev, ARCSR2, &reg);
                 rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
                 rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
                 rt2x00_set_field32(&reg, ARCSR2_LENGTH,
                                    GET_DURATION(ACK_SIZE, 10));
-                rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR2, reg);
 
-                rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
+                rt2x00mmio_register_read(rt2x00dev, ARCSR3, &reg);
                 rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
                 rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
                 rt2x00_set_field32(&reg, ARCSR2_LENGTH,
                                    GET_DURATION(ACK_SIZE, 20));
-                rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR3, reg);
 
-                rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
+                rt2x00mmio_register_read(rt2x00dev, ARCSR4, &reg);
                 rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
                 rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
                 rt2x00_set_field32(&reg, ARCSR2_LENGTH,
                                    GET_DURATION(ACK_SIZE, 55));
-                rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR4, reg);
 
-                rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
+                rt2x00mmio_register_read(rt2x00dev, ARCSR5, &reg);
                 rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
                 rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
                 rt2x00_set_field32(&reg, ARCSR2_LENGTH,
                                    GET_DURATION(ACK_SIZE, 110));
-                rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR5, reg);
         }
 
         if (changed & BSS_CHANGED_BASIC_RATES)
-                rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
 
         if (changed & BSS_CHANGED_ERP_SLOT) {
-                rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR11, &reg);
                 rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
-                rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR11, reg);
 
-                rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR18, &reg);
                 rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
                 rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
-                rt2x00pci_register_write(rt2x00dev, CSR18, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR18, reg);
 
-                rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR19, &reg);
                 rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
                 rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
-                rt2x00pci_register_write(rt2x00dev, CSR19, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR19, reg);
         }
 
         if (changed & BSS_CHANGED_BEACON_INT) {
-                rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR12, &reg);
                 rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL,
                                    erp->beacon_int * 16);
                 rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION,
                                    erp->beacon_int * 16);
-                rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR12, reg);
         }
 }
 
@@ -496,7 +498,7 @@ static void rt2400pci_config_channel(struct rt2x00_dev *rt2x00dev,
         /*
          * Clear false CRC during channel switch.
          */
-        rt2x00pci_register_read(rt2x00dev, CNT0, &rf->rf1);
+        rt2x00mmio_register_read(rt2x00dev, CNT0, &rf->rf1);
 }
 
 static void rt2400pci_config_txpower(struct rt2x00_dev *rt2x00dev, int txpower)
@@ -509,12 +511,12 @@ static void rt2400pci_config_retry_limit(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR11, &reg);
         rt2x00_set_field32(&reg, CSR11_LONG_RETRY,
                            libconf->conf->long_frame_max_tx_count);
         rt2x00_set_field32(&reg, CSR11_SHORT_RETRY,
                            libconf->conf->short_frame_max_tx_count);
-        rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR11, reg);
 }
 
 static void rt2400pci_config_ps(struct rt2x00_dev *rt2x00dev,
@@ -526,7 +528,7 @@ static void rt2400pci_config_ps(struct rt2x00_dev *rt2x00dev,
         u32 reg;
 
         if (state == STATE_SLEEP) {
-                rt2x00pci_register_read(rt2x00dev, CSR20, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR20, &reg);
                 rt2x00_set_field32(&reg, CSR20_DELAY_AFTER_TBCN,
                                    (rt2x00dev->beacon_int - 20) * 16);
                 rt2x00_set_field32(&reg, CSR20_TBCN_BEFORE_WAKEUP,
@@ -534,14 +536,14 @@ static void rt2400pci_config_ps(struct rt2x00_dev *rt2x00dev,
 
                 /* We must first disable autowake before it can be enabled */
                 rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 0);
-                rt2x00pci_register_write(rt2x00dev, CSR20, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR20, reg);
 
                 rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 1);
-                rt2x00pci_register_write(rt2x00dev, CSR20, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR20, reg);
         } else {
-                rt2x00pci_register_read(rt2x00dev, CSR20, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR20, &reg);
                 rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 0);
-                rt2x00pci_register_write(rt2x00dev, CSR20, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR20, reg);
         }
 
         rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
@@ -567,10 +569,10 @@ static void rt2400pci_config_cw(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR11, &reg);
         rt2x00_set_field32(&reg, CSR11_CWMIN, cw_min);
         rt2x00_set_field32(&reg, CSR11_CWMAX, cw_max);
-        rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR11, reg);
 }
 
 /*
@@ -585,7 +587,7 @@ static void rt2400pci_link_stats(struct rt2x00_dev *rt2x00dev,
         /*
          * Update FCS error count from register.
          */
-        rt2x00pci_register_read(rt2x00dev, CNT0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CNT0, &reg);
         qual->rx_failed = rt2x00_get_field32(reg, CNT0_FCS_ERROR);
 
         /*
@@ -640,16 +642,16 @@ static void rt2400pci_start_queue(struct data_queue *queue)
 
         switch (queue->qid) {
         case QID_RX:
-                rt2x00pci_register_read(rt2x00dev, RXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, RXCSR0, &reg);
                 rt2x00_set_field32(&reg, RXCSR0_DISABLE_RX, 0);
-                rt2x00pci_register_write(rt2x00dev, RXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, RXCSR0, reg);
                 break;
         case QID_BEACON:
-                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
                 rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
                 rt2x00_set_field32(&reg, CSR14_TBCN, 1);
                 rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
-                rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
                 break;
         default:
                 break;
@@ -663,19 +665,19 @@ static void rt2400pci_kick_queue(struct data_queue *queue)
 
         switch (queue->qid) {
         case QID_AC_VO:
-                rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR0, &reg);
                 rt2x00_set_field32(&reg, TXCSR0_KICK_PRIO, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR0, reg);
                 break;
         case QID_AC_VI:
-                rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR0, &reg);
                 rt2x00_set_field32(&reg, TXCSR0_KICK_TX, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR0, reg);
                 break;
         case QID_ATIM:
-                rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR0, &reg);
                 rt2x00_set_field32(&reg, TXCSR0_KICK_ATIM, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR0, reg);
                 break;
         default:
                 break;
@@ -691,21 +693,21 @@ static void rt2400pci_stop_queue(struct data_queue *queue)
         case QID_AC_VO:
         case QID_AC_VI:
         case QID_ATIM:
-                rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR0, &reg);
                 rt2x00_set_field32(&reg, TXCSR0_ABORT, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR0, reg);
                 break;
         case QID_RX:
-                rt2x00pci_register_read(rt2x00dev, RXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, RXCSR0, &reg);
                 rt2x00_set_field32(&reg, RXCSR0_DISABLE_RX, 1);
-                rt2x00pci_register_write(rt2x00dev, RXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, RXCSR0, reg);
                 break;
         case QID_BEACON:
-                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
                 rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 0);
                 rt2x00_set_field32(&reg, CSR14_TBCN, 0);
                 rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
-                rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
 
                 /*
                  * Wait for possibly running tbtt tasklets.
@@ -722,7 +724,7 @@ static void rt2400pci_stop_queue(struct data_queue *queue)
  */
 static bool rt2400pci_get_entry_state(struct queue_entry *entry)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         u32 word;
 
         if (entry->queue->qid == QID_RX) {
@@ -739,7 +741,7 @@ static bool rt2400pci_get_entry_state(struct queue_entry *entry)
 
 static void rt2400pci_clear_entry(struct queue_entry *entry)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         u32 word;
 
@@ -765,53 +767,53 @@ static void rt2400pci_clear_entry(struct queue_entry *entry)
 
 static int rt2400pci_init_queues(struct rt2x00_dev *rt2x00dev)
 {
-        struct queue_entry_priv_pci *entry_priv;
+        struct queue_entry_priv_mmio *entry_priv;
         u32 reg;
 
         /*
          * Initialize registers.
          */
-        rt2x00pci_register_read(rt2x00dev, TXCSR2, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR2, &reg);
         rt2x00_set_field32(&reg, TXCSR2_TXD_SIZE, rt2x00dev->tx[0].desc_size);
         rt2x00_set_field32(&reg, TXCSR2_NUM_TXD, rt2x00dev->tx[1].limit);
         rt2x00_set_field32(&reg, TXCSR2_NUM_ATIM, rt2x00dev->atim->limit);
         rt2x00_set_field32(&reg, TXCSR2_NUM_PRIO, rt2x00dev->tx[0].limit);
-        rt2x00pci_register_write(rt2x00dev, TXCSR2, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR2, reg);
 
         entry_priv = rt2x00dev->tx[1].entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, TXCSR3, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR3, &reg);
         rt2x00_set_field32(&reg, TXCSR3_TX_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TXCSR3, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR3, reg);
 
         entry_priv = rt2x00dev->tx[0].entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, TXCSR5, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR5, &reg);
         rt2x00_set_field32(&reg, TXCSR5_PRIO_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TXCSR5, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR5, reg);
 
         entry_priv = rt2x00dev->atim->entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, TXCSR4, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR4, &reg);
         rt2x00_set_field32(&reg, TXCSR4_ATIM_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TXCSR4, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR4, reg);
 
         entry_priv = rt2x00dev->bcn->entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, TXCSR6, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR6, &reg);
         rt2x00_set_field32(&reg, TXCSR6_BEACON_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TXCSR6, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR6, reg);
 
-        rt2x00pci_register_read(rt2x00dev, RXCSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RXCSR1, &reg);
         rt2x00_set_field32(&reg, RXCSR1_RXD_SIZE, rt2x00dev->rx->desc_size);
         rt2x00_set_field32(&reg, RXCSR1_NUM_RXD, rt2x00dev->rx->limit);
-        rt2x00pci_register_write(rt2x00dev, RXCSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, RXCSR1, reg);
 
         entry_priv = rt2x00dev->rx->entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, RXCSR2, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RXCSR2, &reg);
         rt2x00_set_field32(&reg, RXCSR2_RX_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, RXCSR2, reg);
+        rt2x00mmio_register_write(rt2x00dev, RXCSR2, reg);
 
         return 0;
 }
@@ -820,23 +822,23 @@ static int rt2400pci_init_registers(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        rt2x00pci_register_write(rt2x00dev, PSCSR0, 0x00020002);
-        rt2x00pci_register_write(rt2x00dev, PSCSR1, 0x00000002);
-        rt2x00pci_register_write(rt2x00dev, PSCSR2, 0x00023f20);
-        rt2x00pci_register_write(rt2x00dev, PSCSR3, 0x00000002);
+        rt2x00mmio_register_write(rt2x00dev, PSCSR0, 0x00020002);
+        rt2x00mmio_register_write(rt2x00dev, PSCSR1, 0x00000002);
+        rt2x00mmio_register_write(rt2x00dev, PSCSR2, 0x00023f20);
+        rt2x00mmio_register_write(rt2x00dev, PSCSR3, 0x00000002);
 
-        rt2x00pci_register_read(rt2x00dev, TIMECSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TIMECSR, &reg);
         rt2x00_set_field32(&reg, TIMECSR_US_COUNT, 33);
         rt2x00_set_field32(&reg, TIMECSR_US_64_COUNT, 63);
         rt2x00_set_field32(&reg, TIMECSR_BEACON_EXPECT, 0);
-        rt2x00pci_register_write(rt2x00dev, TIMECSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, TIMECSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR9, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR9, &reg);
         rt2x00_set_field32(&reg, CSR9_MAX_FRAME_UNIT,
                            (rt2x00dev->rx->data_size / 128));
-        rt2x00pci_register_write(rt2x00dev, CSR9, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR9, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
         rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 0);
         rt2x00_set_field32(&reg, CSR14_TSF_SYNC, 0);
         rt2x00_set_field32(&reg, CSR14_TBCN, 0);
@@ -845,63 +847,63 @@ static int rt2400pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00_set_field32(&reg, CSR14_CFP_COUNT_PRELOAD, 0);
         rt2x00_set_field32(&reg, CSR14_TBCM_PRELOAD, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
 
-        rt2x00pci_register_write(rt2x00dev, CNT3, 0x3f080000);
+        rt2x00mmio_register_write(rt2x00dev, CNT3, 0x3f080000);
 
-        rt2x00pci_register_read(rt2x00dev, ARCSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, ARCSR0, &reg);
         rt2x00_set_field32(&reg, ARCSR0_AR_BBP_DATA0, 133);
         rt2x00_set_field32(&reg, ARCSR0_AR_BBP_ID0, 134);
         rt2x00_set_field32(&reg, ARCSR0_AR_BBP_DATA1, 136);
         rt2x00_set_field32(&reg, ARCSR0_AR_BBP_ID1, 135);
-        rt2x00pci_register_write(rt2x00dev, ARCSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, ARCSR0, reg);
 
-        rt2x00pci_register_read(rt2x00dev, RXCSR3, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RXCSR3, &reg);
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID0, 3); /* Tx power.*/
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID0_VALID, 1);
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID1, 32); /* Signal */
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID1_VALID, 1);
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID2, 36); /* Rssi */
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID2_VALID, 1);
-        rt2x00pci_register_write(rt2x00dev, RXCSR3, reg);
+        rt2x00mmio_register_write(rt2x00dev, RXCSR3, reg);
 
-        rt2x00pci_register_write(rt2x00dev, PWRCSR0, 0x3f3b3100);
+        rt2x00mmio_register_write(rt2x00dev, PWRCSR0, 0x3f3b3100);
 
         if (rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_AWAKE))
                 return -EBUSY;
 
-        rt2x00pci_register_write(rt2x00dev, MACCSR0, 0x00217223);
-        rt2x00pci_register_write(rt2x00dev, MACCSR1, 0x00235518);
+        rt2x00mmio_register_write(rt2x00dev, MACCSR0, 0x00217223);
+        rt2x00mmio_register_write(rt2x00dev, MACCSR1, 0x00235518);
 
-        rt2x00pci_register_read(rt2x00dev, MACCSR2, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MACCSR2, &reg);
         rt2x00_set_field32(&reg, MACCSR2_DELAY, 64);
-        rt2x00pci_register_write(rt2x00dev, MACCSR2, reg);
+        rt2x00mmio_register_write(rt2x00dev, MACCSR2, reg);
 
-        rt2x00pci_register_read(rt2x00dev, RALINKCSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RALINKCSR, &reg);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_DATA0, 17);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_ID0, 154);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_DATA1, 0);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_ID1, 154);
-        rt2x00pci_register_write(rt2x00dev, RALINKCSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, RALINKCSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR1, &reg);
         rt2x00_set_field32(&reg, CSR1_SOFT_RESET, 1);
         rt2x00_set_field32(&reg, CSR1_BBP_RESET, 0);
         rt2x00_set_field32(&reg, CSR1_HOST_READY, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR1, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR1, &reg);
         rt2x00_set_field32(&reg, CSR1_SOFT_RESET, 0);
         rt2x00_set_field32(&reg, CSR1_HOST_READY, 1);
-        rt2x00pci_register_write(rt2x00dev, CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR1, reg);
 
         /*
          * We must clear the FCS and FIFO error count.
          * These registers are cleared on read,
          * so we may pass a useless variable to store the value.
          */
-        rt2x00pci_register_read(rt2x00dev, CNT0, &reg);
-        rt2x00pci_register_read(rt2x00dev, CNT4, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CNT0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CNT4, &reg);
 
         return 0;
 }
@@ -975,8 +977,8 @@ static void rt2400pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
          * should clear the register to assure a clean state.
          */
         if (state == STATE_RADIO_IRQ_ON) {
-                rt2x00pci_register_read(rt2x00dev, CSR7, &reg);
-                rt2x00pci_register_write(rt2x00dev, CSR7, reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR7, &reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR7, reg);
         }
 
         /*
@@ -985,13 +987,13 @@ static void rt2400pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
          */
         spin_lock_irqsave(&rt2x00dev->irqmask_lock, flags);
 
-        rt2x00pci_register_read(rt2x00dev, CSR8, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR8, &reg);
         rt2x00_set_field32(&reg, CSR8_TBCN_EXPIRE, mask);
         rt2x00_set_field32(&reg, CSR8_TXDONE_TXRING, mask);
         rt2x00_set_field32(&reg, CSR8_TXDONE_ATIMRING, mask);
         rt2x00_set_field32(&reg, CSR8_TXDONE_PRIORING, mask);
         rt2x00_set_field32(&reg, CSR8_RXDONE, mask);
-        rt2x00pci_register_write(rt2x00dev, CSR8, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR8, reg);
 
         spin_unlock_irqrestore(&rt2x00dev->irqmask_lock, flags);
 
@@ -1024,7 +1026,7 @@ static void rt2400pci_disable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Disable power
          */
-        rt2x00pci_register_write(rt2x00dev, PWRCSR0, 0);
+        rt2x00mmio_register_write(rt2x00dev, PWRCSR0, 0);
 }
 
 static int rt2400pci_set_state(struct rt2x00_dev *rt2x00dev,
@@ -1038,12 +1040,12 @@ static int rt2400pci_set_state(struct rt2x00_dev *rt2x00dev,
 
         put_to_sleep = (state != STATE_AWAKE);
 
-        rt2x00pci_register_read(rt2x00dev, PWRCSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, PWRCSR1, &reg);
         rt2x00_set_field32(&reg, PWRCSR1_SET_STATE, 1);
         rt2x00_set_field32(&reg, PWRCSR1_BBP_DESIRE_STATE, state);
         rt2x00_set_field32(&reg, PWRCSR1_RF_DESIRE_STATE, state);
         rt2x00_set_field32(&reg, PWRCSR1_PUT_TO_SLEEP, put_to_sleep);
-        rt2x00pci_register_write(rt2x00dev, PWRCSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, PWRCSR1, reg);
 
         /*
          * Device is not guaranteed to be in the requested state yet.
@@ -1051,12 +1053,12 @@ static int rt2400pci_set_state(struct rt2x00_dev *rt2x00dev,
          * device has entered the correct state.
          */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00pci_register_read(rt2x00dev, PWRCSR1, &reg2);
+                rt2x00mmio_register_read(rt2x00dev, PWRCSR1, &reg2);
                 bbp_state = rt2x00_get_field32(reg2, PWRCSR1_BBP_CURR_STATE);
                 rf_state = rt2x00_get_field32(reg2, PWRCSR1_RF_CURR_STATE);
                 if (bbp_state == state && rf_state == state)
                         return 0;
-                rt2x00pci_register_write(rt2x00dev, PWRCSR1, reg);
+                rt2x00mmio_register_write(rt2x00dev, PWRCSR1, reg);
                 msleep(10);
         }
 
@@ -1104,7 +1106,7 @@ static void rt2400pci_write_tx_desc(struct queue_entry *entry,
                                     struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         __le32 *txd = entry_priv->desc;
         u32 word;
 
@@ -1181,9 +1183,9 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
-        rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
 
         if (rt2x00queue_map_txskb(entry)) {
                 ERROR(rt2x00dev, "Fail to map beacon, aborting\n");
@@ -1207,7 +1209,7 @@ out:
          * Enable beaconing again.
          */
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
-        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
 }
 
 /*
@@ -1217,7 +1219,7 @@ static void rt2400pci_fill_rxdone(struct queue_entry *entry,
                                   struct rxdone_entry_desc *rxdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         u32 word0;
         u32 word2;
         u32 word3;
@@ -1275,7 +1277,7 @@ static void rt2400pci_txdone(struct rt2x00_dev *rt2x00dev,
                              const enum data_queue_qid queue_idx)
 {
         struct data_queue *queue = rt2x00queue_get_tx_queue(rt2x00dev, queue_idx);
-        struct queue_entry_priv_pci *entry_priv;
+        struct queue_entry_priv_mmio *entry_priv;
         struct queue_entry *entry;
         struct txdone_entry_desc txdesc;
         u32 word;
@@ -1321,9 +1323,9 @@ static inline void rt2400pci_enable_interrupt(struct rt2x00_dev *rt2x00dev,
          */
         spin_lock_irq(&rt2x00dev->irqmask_lock);
 
-        rt2x00pci_register_read(rt2x00dev, CSR8, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR8, &reg);
         rt2x00_set_field32(&reg, irq_field, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR8, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR8, reg);
 
         spin_unlock_irq(&rt2x00dev->irqmask_lock);
 }
@@ -1346,11 +1348,11 @@ static void rt2400pci_txstatus_tasklet(unsigned long data)
         if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) {
                 spin_lock_irq(&rt2x00dev->irqmask_lock);
 
-                rt2x00pci_register_read(rt2x00dev, CSR8, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR8, &reg);
                 rt2x00_set_field32(&reg, CSR8_TXDONE_TXRING, 0);
                 rt2x00_set_field32(&reg, CSR8_TXDONE_ATIMRING, 0);
                 rt2x00_set_field32(&reg, CSR8_TXDONE_PRIORING, 0);
-                rt2x00pci_register_write(rt2x00dev, CSR8, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR8, reg);
 
                 spin_unlock_irq(&rt2x00dev->irqmask_lock);
         }
@@ -1367,7 +1369,7 @@ static void rt2400pci_tbtt_tasklet(unsigned long data)
 static void rt2400pci_rxdone_tasklet(unsigned long data)
 {
         struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
-        if (rt2x00pci_rxdone(rt2x00dev))
+        if (rt2x00mmio_rxdone(rt2x00dev))
                 tasklet_schedule(&rt2x00dev->rxdone_tasklet);
         else if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
                 rt2400pci_enable_interrupt(rt2x00dev, CSR8_RXDONE);
@@ -1382,8 +1384,8 @@ static irqreturn_t rt2400pci_interrupt(int irq, void *dev_instance)
          * Get the interrupt sources & saved to local variable.
          * Write register value back to clear pending interrupts.
          */
-        rt2x00pci_register_read(rt2x00dev, CSR7, &reg);
-        rt2x00pci_register_write(rt2x00dev, CSR7, reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR7, &reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR7, reg);
 
         if (!reg)
                 return IRQ_NONE;
@@ -1420,9 +1422,9 @@ static irqreturn_t rt2400pci_interrupt(int irq, void *dev_instance)
          */
         spin_lock(&rt2x00dev->irqmask_lock);
 
-        rt2x00pci_register_read(rt2x00dev, CSR8, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR8, &reg);
         reg |= mask;
-        rt2x00pci_register_write(rt2x00dev, CSR8, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR8, reg);
 
         spin_unlock(&rt2x00dev->irqmask_lock);
 
@@ -1441,7 +1443,7 @@ static int rt2400pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
         u16 word;
         u8 *mac;
 
-        rt2x00pci_register_read(rt2x00dev, CSR21, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR21, &reg);
 
         eeprom.data = rt2x00dev;
         eeprom.register_read = rt2400pci_eepromregister_read;
@@ -1489,7 +1491,7 @@ static int rt2400pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
          * Identify RF chipset.
          */
         value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
-        rt2x00pci_register_read(rt2x00dev, CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR0, &reg);
         rt2x00_set_chip(rt2x00dev, RT2460, value,
                         rt2x00_get_field32(reg, CSR0_REVISION));
 
@@ -1634,9 +1636,9 @@ static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
          * Enable rfkill polling by setting GPIO direction of the
          * rfkill switch GPIO pin correctly.
          */
-        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, GPIOCSR, &reg);
         rt2x00_set_field32(&reg, GPIOCSR_DIR0, 1);
-        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, GPIOCSR, reg);
 
         /*
          * Initialize hw specifications.
@@ -1696,9 +1698,9 @@ static u64 rt2400pci_get_tsf(struct ieee80211_hw *hw,
         u64 tsf;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, CSR17, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR17, &reg);
         tsf = (u64) rt2x00_get_field32(reg, CSR17_HIGH_TSFTIMER) << 32;
-        rt2x00pci_register_read(rt2x00dev, CSR16, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR16, &reg);
         tsf |= rt2x00_get_field32(reg, CSR16_LOW_TSFTIMER);
 
         return tsf;
@@ -1709,7 +1711,7 @@ static int rt2400pci_tx_last_beacon(struct ieee80211_hw *hw)
         struct rt2x00_dev *rt2x00dev = hw->priv;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, CSR15, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR15, &reg);
         return rt2x00_get_field32(reg, CSR15_BEACON_SENT);
 }
 
@@ -1742,8 +1744,8 @@ static const struct rt2x00lib_ops rt2400pci_rt2x00_ops = {
         .tbtt_tasklet           = rt2400pci_tbtt_tasklet,
         .rxdone_tasklet         = rt2400pci_rxdone_tasklet,
         .probe_hw               = rt2400pci_probe_hw,
-        .initialize             = rt2x00pci_initialize,
-        .uninitialize           = rt2x00pci_uninitialize,
+        .initialize             = rt2x00mmio_initialize,
+        .uninitialize           = rt2x00mmio_uninitialize,
         .get_entry_state        = rt2400pci_get_entry_state,
         .clear_entry            = rt2400pci_clear_entry,
         .set_device_state       = rt2400pci_set_device_state,
@@ -1754,7 +1756,7 @@ static const struct rt2x00lib_ops rt2400pci_rt2x00_ops = {
         .start_queue            = rt2400pci_start_queue,
         .kick_queue             = rt2400pci_kick_queue,
         .stop_queue             = rt2400pci_stop_queue,
-        .flush_queue            = rt2x00pci_flush_queue,
+        .flush_queue            = rt2x00mmio_flush_queue,
         .write_tx_desc          = rt2400pci_write_tx_desc,
         .write_beacon           = rt2400pci_write_beacon,
         .fill_rxdone            = rt2400pci_fill_rxdone,
@@ -1769,28 +1771,28 @@ static const struct data_queue_desc rt2400pci_queue_rx = {
         .entry_num              = 24,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = RXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt2400pci_queue_tx = {
         .entry_num              = 24,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt2400pci_queue_bcn = {
         .entry_num              = 1,
         .data_size              = MGMT_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt2400pci_queue_atim = {
         .entry_num              = 8,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct rt2x00_ops rt2400pci_ops = {
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 39edc59e8d03..9ba14570fcfd 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -34,13 +34,14 @@
 #include <linux/slab.h>
 
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt2500pci.h"
 
 /*
  * Register access.
  * All access to the CSR registers will go through the methods
- * rt2x00pci_register_read and rt2x00pci_register_write.
+ * rt2x00mmio_register_read and rt2x00mmio_register_write.
  * BBP and RF register require indirect register access,
  * and use the CSR registers BBPCSR and RFCSR to achieve this.
  * These indirect registers work with busy bits,
@@ -51,9 +52,9 @@
  * and we will print an error.
  */
 #define WAIT_FOR_BBP(__dev, __reg) \
-        rt2x00pci_regbusy_read((__dev), BBPCSR, BBPCSR_BUSY, (__reg))
+        rt2x00mmio_regbusy_read((__dev), BBPCSR, BBPCSR_BUSY, (__reg))
 #define WAIT_FOR_RF(__dev, __reg) \
-        rt2x00pci_regbusy_read((__dev), RFCSR, RFCSR_BUSY, (__reg))
+        rt2x00mmio_regbusy_read((__dev), RFCSR, RFCSR_BUSY, (__reg))
 
 static void rt2500pci_bbp_write(struct rt2x00_dev *rt2x00dev,
                                 const unsigned int word, const u8 value)
@@ -73,7 +74,7 @@ static void rt2500pci_bbp_write(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, BBPCSR_BUSY, 1);
                 rt2x00_set_field32(&reg, BBPCSR_WRITE_CONTROL, 1);
 
-                rt2x00pci_register_write(rt2x00dev, BBPCSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, BBPCSR, reg);
         }
 
         mutex_unlock(&rt2x00dev->csr_mutex);
@@ -100,7 +101,7 @@ static void rt2500pci_bbp_read(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, BBPCSR_BUSY, 1);
                 rt2x00_set_field32(&reg, BBPCSR_WRITE_CONTROL, 0);
 
-                rt2x00pci_register_write(rt2x00dev, BBPCSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, BBPCSR, reg);
 
                 WAIT_FOR_BBP(rt2x00dev, &reg);
         }
@@ -128,7 +129,7 @@ static void rt2500pci_rf_write(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, RFCSR_IF_SELECT, 0);
                 rt2x00_set_field32(&reg, RFCSR_BUSY, 1);
 
-                rt2x00pci_register_write(rt2x00dev, RFCSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, RFCSR, reg);
                 rt2x00_rf_write(rt2x00dev, word, value);
         }
 
@@ -140,7 +141,7 @@ static void rt2500pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
         struct rt2x00_dev *rt2x00dev = eeprom->data;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, CSR21, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR21, &reg);
 
         eeprom->reg_data_in = !!rt2x00_get_field32(reg, CSR21_EEPROM_DATA_IN);
         eeprom->reg_data_out = !!rt2x00_get_field32(reg, CSR21_EEPROM_DATA_OUT);
@@ -162,15 +163,15 @@ static void rt2500pci_eepromregister_write(struct eeprom_93cx6 *eeprom)
         rt2x00_set_field32(&reg, CSR21_EEPROM_CHIP_SELECT,
                            !!eeprom->reg_chip_select);
 
-        rt2x00pci_register_write(rt2x00dev, CSR21, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR21, reg);
 }
 
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
 static const struct rt2x00debug rt2500pci_rt2x00debug = {
         .owner  = THIS_MODULE,
         .csr    = {
-                .read           = rt2x00pci_register_read,
-                .write          = rt2x00pci_register_write,
+                .read           = rt2x00mmio_register_read,
+                .write          = rt2x00mmio_register_write,
                 .flags          = RT2X00DEBUGFS_OFFSET,
                 .word_base      = CSR_REG_BASE,
                 .word_size      = sizeof(u32),
@@ -204,7 +205,7 @@ static int rt2500pci_rfkill_poll(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, GPIOCSR, &reg);
         return rt2x00_get_field32(reg, GPIOCSR_VAL0);
 }
 
@@ -217,14 +218,14 @@ static void rt2500pci_brightness_set(struct led_classdev *led_cdev,
         unsigned int enabled = brightness != LED_OFF;
         u32 reg;
 
-        rt2x00pci_register_read(led->rt2x00dev, LEDCSR, &reg);
+        rt2x00mmio_register_read(led->rt2x00dev, LEDCSR, &reg);
 
         if (led->type == LED_TYPE_RADIO || led->type == LED_TYPE_ASSOC)
                 rt2x00_set_field32(&reg, LEDCSR_LINK, enabled);
         else if (led->type == LED_TYPE_ACTIVITY)
                 rt2x00_set_field32(&reg, LEDCSR_ACTIVITY, enabled);
 
-        rt2x00pci_register_write(led->rt2x00dev, LEDCSR, reg);
+        rt2x00mmio_register_write(led->rt2x00dev, LEDCSR, reg);
 }
 
 static int rt2500pci_blink_set(struct led_classdev *led_cdev,
@@ -235,10 +236,10 @@ static int rt2500pci_blink_set(struct led_classdev *led_cdev,
             container_of(led_cdev, struct rt2x00_led, led_dev);
         u32 reg;
 
-        rt2x00pci_register_read(led->rt2x00dev, LEDCSR, &reg);
+        rt2x00mmio_register_read(led->rt2x00dev, LEDCSR, &reg);
         rt2x00_set_field32(&reg, LEDCSR_ON_PERIOD, *delay_on);
         rt2x00_set_field32(&reg, LEDCSR_OFF_PERIOD, *delay_off);
-        rt2x00pci_register_write(led->rt2x00dev, LEDCSR, reg);
+        rt2x00mmio_register_write(led->rt2x00dev, LEDCSR, reg);
 
         return 0;
 }
@@ -269,7 +270,7 @@ static void rt2500pci_config_filter(struct rt2x00_dev *rt2x00dev,
          * and broadcast frames will always be accepted since
          * there is no filter for it at this time.
          */
-        rt2x00pci_register_read(rt2x00dev, RXCSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RXCSR0, &reg);
         rt2x00_set_field32(&reg, RXCSR0_DROP_CRC,
                            !(filter_flags & FIF_FCSFAIL));
         rt2x00_set_field32(&reg, RXCSR0_DROP_PHYSICAL,
@@ -285,7 +286,7 @@ static void rt2500pci_config_filter(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, RXCSR0_DROP_MCAST,
                            !(filter_flags & FIF_ALLMULTI));
         rt2x00_set_field32(&reg, RXCSR0_DROP_BCAST, 0);
-        rt2x00pci_register_write(rt2x00dev, RXCSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, RXCSR0, reg);
 }
 
 static void rt2500pci_config_intf(struct rt2x00_dev *rt2x00dev,
@@ -302,25 +303,25 @@ static void rt2500pci_config_intf(struct rt2x00_dev *rt2x00dev,
                  * Enable beacon config
                  */
                 bcn_preload = PREAMBLE + GET_DURATION(IEEE80211_HEADER, 20);
-                rt2x00pci_register_read(rt2x00dev, BCNCSR1, &reg);
+                rt2x00mmio_register_read(rt2x00dev, BCNCSR1, &reg);
                 rt2x00_set_field32(&reg, BCNCSR1_PRELOAD, bcn_preload);
                 rt2x00_set_field32(&reg, BCNCSR1_BEACON_CWMIN, queue->cw_min);
-                rt2x00pci_register_write(rt2x00dev, BCNCSR1, reg);
+                rt2x00mmio_register_write(rt2x00dev, BCNCSR1, reg);
 
                 /*
                  * Enable synchronisation.
                  */
-                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
                 rt2x00_set_field32(&reg, CSR14_TSF_SYNC, conf->sync);
-                rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
         }
 
         if (flags & CONFIG_UPDATE_MAC)
-                rt2x00pci_register_multiwrite(rt2x00dev, CSR3,
+                rt2x00mmio_register_multiwrite(rt2x00dev, CSR3,
                                               conf->mac, sizeof(conf->mac));
 
         if (flags & CONFIG_UPDATE_BSSID)
-                rt2x00pci_register_multiwrite(rt2x00dev, CSR5,
+                rt2x00mmio_register_multiwrite(rt2x00dev, CSR5,
                                               conf->bssid, sizeof(conf->bssid));
 }
 
@@ -337,68 +338,68 @@ static void rt2500pci_config_erp(struct rt2x00_dev *rt2x00dev,
         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
                 preamble_mask = erp->short_preamble << 3;
 
-                rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR1, &reg);
                 rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x162);
                 rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0xa2);
                 rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
                 rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR1, reg);
 
-                rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
+                rt2x00mmio_register_read(rt2x00dev, ARCSR2, &reg);
                 rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
                 rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
                 rt2x00_set_field32(&reg, ARCSR2_LENGTH,
                                    GET_DURATION(ACK_SIZE, 10));
-                rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR2, reg);
 
-                rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
+                rt2x00mmio_register_read(rt2x00dev, ARCSR3, &reg);
                 rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
                 rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
                 rt2x00_set_field32(&reg, ARCSR2_LENGTH,
                                    GET_DURATION(ACK_SIZE, 20));
-                rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR3, reg);
 
-                rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
+                rt2x00mmio_register_read(rt2x00dev, ARCSR4, &reg);
                 rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
                 rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
                 rt2x00_set_field32(&reg, ARCSR2_LENGTH,
                                    GET_DURATION(ACK_SIZE, 55));
-                rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR4, reg);
 
-                rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
+                rt2x00mmio_register_read(rt2x00dev, ARCSR5, &reg);
                 rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
                 rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
                 rt2x00_set_field32(&reg, ARCSR2_LENGTH,
                                    GET_DURATION(ACK_SIZE, 110));
-                rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR5, reg);
         }
 
         if (changed & BSS_CHANGED_BASIC_RATES)
-                rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
+                rt2x00mmio_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
 
         if (changed & BSS_CHANGED_ERP_SLOT) {
-                rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR11, &reg);
                 rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
-                rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR11, reg);
 
-                rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR18, &reg);
                 rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
                 rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
-                rt2x00pci_register_write(rt2x00dev, CSR18, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR18, reg);
 
-                rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR19, &reg);
                 rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
                 rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
-                rt2x00pci_register_write(rt2x00dev, CSR19, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR19, reg);
         }
 
         if (changed & BSS_CHANGED_BEACON_INT) {
-                rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR12, &reg);
                 rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL,
                                    erp->beacon_int * 16);
                 rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION,
                                    erp->beacon_int * 16);
-                rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR12, reg);
         }
 
 }
@@ -417,7 +418,7 @@ static void rt2500pci_config_ant(struct rt2x00_dev *rt2x00dev,
         BUG_ON(ant->rx == ANTENNA_SW_DIVERSITY ||
                ant->tx == ANTENNA_SW_DIVERSITY);
 
-        rt2x00pci_register_read(rt2x00dev, BBPCSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, BBPCSR1, &reg);
         rt2500pci_bbp_read(rt2x00dev, 14, &r14);
         rt2500pci_bbp_read(rt2x00dev, 2, &r2);
 
@@ -469,7 +470,7 @@ static void rt2500pci_config_ant(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, BBPCSR1_OFDM_FLIP, 0);
         }
 
-        rt2x00pci_register_write(rt2x00dev, BBPCSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, BBPCSR1, reg);
         rt2500pci_bbp_write(rt2x00dev, 14, r14);
         rt2500pci_bbp_write(rt2x00dev, 2, r2);
 }
@@ -540,7 +541,7 @@ static void rt2500pci_config_channel(struct rt2x00_dev *rt2x00dev,
         /*
          * Clear false CRC during channel switch.
          */
-        rt2x00pci_register_read(rt2x00dev, CNT0, &rf->rf1);
+        rt2x00mmio_register_read(rt2x00dev, CNT0, &rf->rf1);
 }
 
 static void rt2500pci_config_txpower(struct rt2x00_dev *rt2x00dev,
@@ -558,12 +559,12 @@ static void rt2500pci_config_retry_limit(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR11, &reg);
         rt2x00_set_field32(&reg, CSR11_LONG_RETRY,
                            libconf->conf->long_frame_max_tx_count);
         rt2x00_set_field32(&reg, CSR11_SHORT_RETRY,
                            libconf->conf->short_frame_max_tx_count);
-        rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR11, reg);
 }
 
 static void rt2500pci_config_ps(struct rt2x00_dev *rt2x00dev,
@@ -575,7 +576,7 @@ static void rt2500pci_config_ps(struct rt2x00_dev *rt2x00dev,
         u32 reg;
 
         if (state == STATE_SLEEP) {
-                rt2x00pci_register_read(rt2x00dev, CSR20, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR20, &reg);
                 rt2x00_set_field32(&reg, CSR20_DELAY_AFTER_TBCN,
                                    (rt2x00dev->beacon_int - 20) * 16);
                 rt2x00_set_field32(&reg, CSR20_TBCN_BEFORE_WAKEUP,
@@ -583,14 +584,14 @@ static void rt2500pci_config_ps(struct rt2x00_dev *rt2x00dev,
 
                 /* We must first disable autowake before it can be enabled */
                 rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 0);
-                rt2x00pci_register_write(rt2x00dev, CSR20, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR20, reg);
 
                 rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 1);
-                rt2x00pci_register_write(rt2x00dev, CSR20, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR20, reg);
         } else {
-                rt2x00pci_register_read(rt2x00dev, CSR20, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR20, &reg);
                 rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 0);
-                rt2x00pci_register_write(rt2x00dev, CSR20, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR20, reg);
         }
 
         rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
@@ -624,13 +625,13 @@ static void rt2500pci_link_stats(struct rt2x00_dev *rt2x00dev,
         /*
          * Update FCS error count from register.
          */
-        rt2x00pci_register_read(rt2x00dev, CNT0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CNT0, &reg);
         qual->rx_failed = rt2x00_get_field32(reg, CNT0_FCS_ERROR);
 
         /*
          * Update False CCA count from register.
          */
-        rt2x00pci_register_read(rt2x00dev, CNT3, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CNT3, &reg);
         qual->false_cca = rt2x00_get_field32(reg, CNT3_FALSE_CCA);
 }
 
@@ -730,16 +731,16 @@ static void rt2500pci_start_queue(struct data_queue *queue)
 
         switch (queue->qid) {
         case QID_RX:
-                rt2x00pci_register_read(rt2x00dev, RXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, RXCSR0, &reg);
                 rt2x00_set_field32(&reg, RXCSR0_DISABLE_RX, 0);
-                rt2x00pci_register_write(rt2x00dev, RXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, RXCSR0, reg);
                 break;
         case QID_BEACON:
-                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
                 rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
                 rt2x00_set_field32(&reg, CSR14_TBCN, 1);
                 rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
-                rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
                 break;
         default:
                 break;
@@ -753,19 +754,19 @@ static void rt2500pci_kick_queue(struct data_queue *queue)
 
         switch (queue->qid) {
         case QID_AC_VO:
-                rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR0, &reg);
                 rt2x00_set_field32(&reg, TXCSR0_KICK_PRIO, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR0, reg);
                 break;
         case QID_AC_VI:
-                rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR0, &reg);
                 rt2x00_set_field32(&reg, TXCSR0_KICK_TX, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR0, reg);
                 break;
         case QID_ATIM:
-                rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR0, &reg);
                 rt2x00_set_field32(&reg, TXCSR0_KICK_ATIM, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR0, reg);
                 break;
         default:
                 break;
@@ -781,21 +782,21 @@ static void rt2500pci_stop_queue(struct data_queue *queue)
         case QID_AC_VO:
         case QID_AC_VI:
         case QID_ATIM:
-                rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXCSR0, &reg);
                 rt2x00_set_field32(&reg, TXCSR0_ABORT, 1);
-                rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXCSR0, reg);
                 break;
         case QID_RX:
-                rt2x00pci_register_read(rt2x00dev, RXCSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, RXCSR0, &reg);
                 rt2x00_set_field32(&reg, RXCSR0_DISABLE_RX, 1);
-                rt2x00pci_register_write(rt2x00dev, RXCSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, RXCSR0, reg);
                 break;
         case QID_BEACON:
-                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
                 rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 0);
                 rt2x00_set_field32(&reg, CSR14_TBCN, 0);
                 rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
-                rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
 
                 /*
                  * Wait for possibly running tbtt tasklets.
@@ -812,7 +813,7 @@ static void rt2500pci_stop_queue(struct data_queue *queue)
  */
 static bool rt2500pci_get_entry_state(struct queue_entry *entry)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         u32 word;
 
         if (entry->queue->qid == QID_RX) {
@@ -829,7 +830,7 @@ static bool rt2500pci_get_entry_state(struct queue_entry *entry)
 
 static void rt2500pci_clear_entry(struct queue_entry *entry)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         u32 word;
 
@@ -851,53 +852,53 @@ static void rt2500pci_clear_entry(struct queue_entry *entry)
 
 static int rt2500pci_init_queues(struct rt2x00_dev *rt2x00dev)
 {
-        struct queue_entry_priv_pci *entry_priv;
+        struct queue_entry_priv_mmio *entry_priv;
         u32 reg;
 
         /*
          * Initialize registers.
          */
-        rt2x00pci_register_read(rt2x00dev, TXCSR2, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR2, &reg);
         rt2x00_set_field32(&reg, TXCSR2_TXD_SIZE, rt2x00dev->tx[0].desc_size);
         rt2x00_set_field32(&reg, TXCSR2_NUM_TXD, rt2x00dev->tx[1].limit);
         rt2x00_set_field32(&reg, TXCSR2_NUM_ATIM, rt2x00dev->atim->limit);
         rt2x00_set_field32(&reg, TXCSR2_NUM_PRIO, rt2x00dev->tx[0].limit);
-        rt2x00pci_register_write(rt2x00dev, TXCSR2, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR2, reg);
 
         entry_priv = rt2x00dev->tx[1].entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, TXCSR3, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR3, &reg);
         rt2x00_set_field32(&reg, TXCSR3_TX_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TXCSR3, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR3, reg);
 
         entry_priv = rt2x00dev->tx[0].entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, TXCSR5, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR5, &reg);
         rt2x00_set_field32(&reg, TXCSR5_PRIO_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TXCSR5, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR5, reg);
 
         entry_priv = rt2x00dev->atim->entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, TXCSR4, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR4, &reg);
         rt2x00_set_field32(&reg, TXCSR4_ATIM_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TXCSR4, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR4, reg);
 
         entry_priv = rt2x00dev->bcn->entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, TXCSR6, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR6, &reg);
         rt2x00_set_field32(&reg, TXCSR6_BEACON_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TXCSR6, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR6, reg);
 
-        rt2x00pci_register_read(rt2x00dev, RXCSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RXCSR1, &reg);
         rt2x00_set_field32(&reg, RXCSR1_RXD_SIZE, rt2x00dev->rx->desc_size);
         rt2x00_set_field32(&reg, RXCSR1_NUM_RXD, rt2x00dev->rx->limit);
-        rt2x00pci_register_write(rt2x00dev, RXCSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, RXCSR1, reg);
 
         entry_priv = rt2x00dev->rx->entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, RXCSR2, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RXCSR2, &reg);
         rt2x00_set_field32(&reg, RXCSR2_RX_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, RXCSR2, reg);
+        rt2x00mmio_register_write(rt2x00dev, RXCSR2, reg);
 
         return 0;
 }
@@ -906,30 +907,30 @@ static int rt2500pci_init_registers(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        rt2x00pci_register_write(rt2x00dev, PSCSR0, 0x00020002);
-        rt2x00pci_register_write(rt2x00dev, PSCSR1, 0x00000002);
-        rt2x00pci_register_write(rt2x00dev, PSCSR2, 0x00020002);
-        rt2x00pci_register_write(rt2x00dev, PSCSR3, 0x00000002);
+        rt2x00mmio_register_write(rt2x00dev, PSCSR0, 0x00020002);
+        rt2x00mmio_register_write(rt2x00dev, PSCSR1, 0x00000002);
+        rt2x00mmio_register_write(rt2x00dev, PSCSR2, 0x00020002);
+        rt2x00mmio_register_write(rt2x00dev, PSCSR3, 0x00000002);
 
-        rt2x00pci_register_read(rt2x00dev, TIMECSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TIMECSR, &reg);
         rt2x00_set_field32(&reg, TIMECSR_US_COUNT, 33);
         rt2x00_set_field32(&reg, TIMECSR_US_64_COUNT, 63);
         rt2x00_set_field32(&reg, TIMECSR_BEACON_EXPECT, 0);
-        rt2x00pci_register_write(rt2x00dev, TIMECSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, TIMECSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR9, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR9, &reg);
         rt2x00_set_field32(&reg, CSR9_MAX_FRAME_UNIT,
                            rt2x00dev->rx->data_size / 128);
-        rt2x00pci_register_write(rt2x00dev, CSR9, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR9, reg);
 
         /*
          * Always use CWmin and CWmax set in descriptor.
          */
-        rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR11, &reg);
         rt2x00_set_field32(&reg, CSR11_CW_SELECT, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR11, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
         rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 0);
         rt2x00_set_field32(&reg, CSR14_TSF_SYNC, 0);
         rt2x00_set_field32(&reg, CSR14_TBCN, 0);
@@ -938,11 +939,11 @@ static int rt2500pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00_set_field32(&reg, CSR14_CFP_COUNT_PRELOAD, 0);
         rt2x00_set_field32(&reg, CSR14_TBCM_PRELOAD, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
 
-        rt2x00pci_register_write(rt2x00dev, CNT3, 0);
+        rt2x00mmio_register_write(rt2x00dev, CNT3, 0);
 
-        rt2x00pci_register_read(rt2x00dev, TXCSR8, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXCSR8, &reg);
         rt2x00_set_field32(&reg, TXCSR8_BBP_ID0, 10);
         rt2x00_set_field32(&reg, TXCSR8_BBP_ID0_VALID, 1);
         rt2x00_set_field32(&reg, TXCSR8_BBP_ID1, 11);
@@ -951,30 +952,30 @@ static int rt2500pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, TXCSR8_BBP_ID2_VALID, 1);
         rt2x00_set_field32(&reg, TXCSR8_BBP_ID3, 12);
         rt2x00_set_field32(&reg, TXCSR8_BBP_ID3_VALID, 1);
-        rt2x00pci_register_write(rt2x00dev, TXCSR8, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXCSR8, reg);
 
-        rt2x00pci_register_read(rt2x00dev, ARTCSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, ARTCSR0, &reg);
         rt2x00_set_field32(&reg, ARTCSR0_ACK_CTS_1MBS, 112);
         rt2x00_set_field32(&reg, ARTCSR0_ACK_CTS_2MBS, 56);
         rt2x00_set_field32(&reg, ARTCSR0_ACK_CTS_5_5MBS, 20);
         rt2x00_set_field32(&reg, ARTCSR0_ACK_CTS_11MBS, 10);
-        rt2x00pci_register_write(rt2x00dev, ARTCSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, ARTCSR0, reg);
 
-        rt2x00pci_register_read(rt2x00dev, ARTCSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, ARTCSR1, &reg);
         rt2x00_set_field32(&reg, ARTCSR1_ACK_CTS_6MBS, 45);
         rt2x00_set_field32(&reg, ARTCSR1_ACK_CTS_9MBS, 37);
         rt2x00_set_field32(&reg, ARTCSR1_ACK_CTS_12MBS, 33);
         rt2x00_set_field32(&reg, ARTCSR1_ACK_CTS_18MBS, 29);
-        rt2x00pci_register_write(rt2x00dev, ARTCSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, ARTCSR1, reg);
 
-        rt2x00pci_register_read(rt2x00dev, ARTCSR2, &reg);
+        rt2x00mmio_register_read(rt2x00dev, ARTCSR2, &reg);
         rt2x00_set_field32(&reg, ARTCSR2_ACK_CTS_24MBS, 29);
         rt2x00_set_field32(&reg, ARTCSR2_ACK_CTS_36MBS, 25);
         rt2x00_set_field32(&reg, ARTCSR2_ACK_CTS_48MBS, 25);
         rt2x00_set_field32(&reg, ARTCSR2_ACK_CTS_54MBS, 25);
-        rt2x00pci_register_write(rt2x00dev, ARTCSR2, reg);
+        rt2x00mmio_register_write(rt2x00dev, ARTCSR2, reg);
 
-        rt2x00pci_register_read(rt2x00dev, RXCSR3, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RXCSR3, &reg);
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID0, 47); /* CCK Signal */
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID0_VALID, 1);
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID1, 51); /* Rssi */
@@ -983,9 +984,9 @@ static int rt2500pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID2_VALID, 1);
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID3, 51); /* RSSI */
         rt2x00_set_field32(&reg, RXCSR3_BBP_ID3_VALID, 1);
-        rt2x00pci_register_write(rt2x00dev, RXCSR3, reg);
+        rt2x00mmio_register_write(rt2x00dev, RXCSR3, reg);
 
-        rt2x00pci_register_read(rt2x00dev, PCICSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, PCICSR, &reg);
         rt2x00_set_field32(&reg, PCICSR_BIG_ENDIAN, 0);
         rt2x00_set_field32(&reg, PCICSR_RX_TRESHOLD, 0);
         rt2x00_set_field32(&reg, PCICSR_TX_TRESHOLD, 3);
@@ -993,54 +994,54 @@ static int rt2500pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, PCICSR_ENABLE_CLK, 1);
         rt2x00_set_field32(&reg, PCICSR_READ_MULTIPLE, 1);
         rt2x00_set_field32(&reg, PCICSR_WRITE_INVALID, 1);
-        rt2x00pci_register_write(rt2x00dev, PCICSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, PCICSR, reg);
 
-        rt2x00pci_register_write(rt2x00dev, PWRCSR0, 0x3f3b3100);
+        rt2x00mmio_register_write(rt2x00dev, PWRCSR0, 0x3f3b3100);
 
-        rt2x00pci_register_write(rt2x00dev, GPIOCSR, 0x0000ff00);
-        rt2x00pci_register_write(rt2x00dev, TESTCSR, 0x000000f0);
+        rt2x00mmio_register_write(rt2x00dev, GPIOCSR, 0x0000ff00);
+        rt2x00mmio_register_write(rt2x00dev, TESTCSR, 0x000000f0);
 
         if (rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_AWAKE))
                 return -EBUSY;
 
-        rt2x00pci_register_write(rt2x00dev, MACCSR0, 0x00213223);
-        rt2x00pci_register_write(rt2x00dev, MACCSR1, 0x00235518);
+        rt2x00mmio_register_write(rt2x00dev, MACCSR0, 0x00213223);
+        rt2x00mmio_register_write(rt2x00dev, MACCSR1, 0x00235518);
 
-        rt2x00pci_register_read(rt2x00dev, MACCSR2, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MACCSR2, &reg);
         rt2x00_set_field32(&reg, MACCSR2_DELAY, 64);
-        rt2x00pci_register_write(rt2x00dev, MACCSR2, reg);
+        rt2x00mmio_register_write(rt2x00dev, MACCSR2, reg);
 
-        rt2x00pci_register_read(rt2x00dev, RALINKCSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RALINKCSR, &reg);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_DATA0, 17);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_ID0, 26);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_VALID0, 1);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_DATA1, 0);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_ID1, 26);
         rt2x00_set_field32(&reg, RALINKCSR_AR_BBP_VALID1, 1);
-        rt2x00pci_register_write(rt2x00dev, RALINKCSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, RALINKCSR, reg);
 
-        rt2x00pci_register_write(rt2x00dev, BBPCSR1, 0x82188200);
+        rt2x00mmio_register_write(rt2x00dev, BBPCSR1, 0x82188200);
 
-        rt2x00pci_register_write(rt2x00dev, TXACKCSR0, 0x00000020);
+        rt2x00mmio_register_write(rt2x00dev, TXACKCSR0, 0x00000020);
 
-        rt2x00pci_register_read(rt2x00dev, CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR1, &reg);
         rt2x00_set_field32(&reg, CSR1_SOFT_RESET, 1);
         rt2x00_set_field32(&reg, CSR1_BBP_RESET, 0);
         rt2x00_set_field32(&reg, CSR1_HOST_READY, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR1, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR1, &reg);
         rt2x00_set_field32(&reg, CSR1_SOFT_RESET, 0);
         rt2x00_set_field32(&reg, CSR1_HOST_READY, 1);
-        rt2x00pci_register_write(rt2x00dev, CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR1, reg);
 
         /*
          * We must clear the FCS and FIFO error count.
          * These registers are cleared on read,
          * so we may pass a useless variable to store the value.
          */
-        rt2x00pci_register_read(rt2x00dev, CNT0, &reg);
-        rt2x00pci_register_read(rt2x00dev, CNT4, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CNT0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CNT4, &reg);
 
         return 0;
 }
@@ -1130,8 +1131,8 @@ static void rt2500pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
          * should clear the register to assure a clean state.
          */
         if (state == STATE_RADIO_IRQ_ON) {
-                rt2x00pci_register_read(rt2x00dev, CSR7, &reg);
-                rt2x00pci_register_write(rt2x00dev, CSR7, reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR7, &reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR7, reg);
         }
 
         /*
@@ -1140,13 +1141,13 @@ static void rt2500pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
          */
         spin_lock_irqsave(&rt2x00dev->irqmask_lock, flags);
 
-        rt2x00pci_register_read(rt2x00dev, CSR8, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR8, &reg);
         rt2x00_set_field32(&reg, CSR8_TBCN_EXPIRE, mask);
         rt2x00_set_field32(&reg, CSR8_TXDONE_TXRING, mask);
         rt2x00_set_field32(&reg, CSR8_TXDONE_ATIMRING, mask);
         rt2x00_set_field32(&reg, CSR8_TXDONE_PRIORING, mask);
         rt2x00_set_field32(&reg, CSR8_RXDONE, mask);
-        rt2x00pci_register_write(rt2x00dev, CSR8, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR8, reg);
 
         spin_unlock_irqrestore(&rt2x00dev->irqmask_lock, flags);
 
@@ -1178,7 +1179,7 @@ static void rt2500pci_disable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Disable power
          */
-        rt2x00pci_register_write(rt2x00dev, PWRCSR0, 0);
+        rt2x00mmio_register_write(rt2x00dev, PWRCSR0, 0);
 }
 
 static int rt2500pci_set_state(struct rt2x00_dev *rt2x00dev,
@@ -1192,12 +1193,12 @@ static int rt2500pci_set_state(struct rt2x00_dev *rt2x00dev,
 
         put_to_sleep = (state != STATE_AWAKE);
 
-        rt2x00pci_register_read(rt2x00dev, PWRCSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, PWRCSR1, &reg);
         rt2x00_set_field32(&reg, PWRCSR1_SET_STATE, 1);
         rt2x00_set_field32(&reg, PWRCSR1_BBP_DESIRE_STATE, state);
         rt2x00_set_field32(&reg, PWRCSR1_RF_DESIRE_STATE, state);
         rt2x00_set_field32(&reg, PWRCSR1_PUT_TO_SLEEP, put_to_sleep);
-        rt2x00pci_register_write(rt2x00dev, PWRCSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, PWRCSR1, reg);
 
         /*
          * Device is not guaranteed to be in the requested state yet.
@@ -1205,12 +1206,12 @@ static int rt2500pci_set_state(struct rt2x00_dev *rt2x00dev,
          * device has entered the correct state.
          */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00pci_register_read(rt2x00dev, PWRCSR1, &reg2);
+                rt2x00mmio_register_read(rt2x00dev, PWRCSR1, &reg2);
                 bbp_state = rt2x00_get_field32(reg2, PWRCSR1_BBP_CURR_STATE);
                 rf_state = rt2x00_get_field32(reg2, PWRCSR1_RF_CURR_STATE);
                 if (bbp_state == state && rf_state == state)
                         return 0;
-                rt2x00pci_register_write(rt2x00dev, PWRCSR1, reg);
+                rt2x00mmio_register_write(rt2x00dev, PWRCSR1, reg);
                 msleep(10);
         }
 
@@ -1258,7 +1259,7 @@ static void rt2500pci_write_tx_desc(struct queue_entry *entry,
                                     struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         __le32 *txd = entry_priv->desc;
         u32 word;
 
@@ -1334,9 +1335,9 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
-        rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR14, &reg);
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
 
         if (rt2x00queue_map_txskb(entry)) {
                 ERROR(rt2x00dev, "Fail to map beacon, aborting\n");
@@ -1357,7 +1358,7 @@ out:
          * Enable beaconing again.
          */
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
-        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR14, reg);
 }
 
 /*
@@ -1366,7 +1367,7 @@ out:
 static void rt2500pci_fill_rxdone(struct queue_entry *entry,
                                   struct rxdone_entry_desc *rxdesc)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         u32 word0;
         u32 word2;
 
@@ -1404,7 +1405,7 @@ static void rt2500pci_txdone(struct rt2x00_dev *rt2x00dev,
                              const enum data_queue_qid queue_idx)
 {
         struct data_queue *queue = rt2x00queue_get_tx_queue(rt2x00dev, queue_idx);
-        struct queue_entry_priv_pci *entry_priv;
+        struct queue_entry_priv_mmio *entry_priv;
         struct queue_entry *entry;
         struct txdone_entry_desc txdesc;
         u32 word;
@@ -1450,9 +1451,9 @@ static inline void rt2500pci_enable_interrupt(struct rt2x00_dev *rt2x00dev,
          */
         spin_lock_irq(&rt2x00dev->irqmask_lock);
 
-        rt2x00pci_register_read(rt2x00dev, CSR8, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR8, &reg);
         rt2x00_set_field32(&reg, irq_field, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR8, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR8, reg);
 
         spin_unlock_irq(&rt2x00dev->irqmask_lock);
 }
@@ -1475,11 +1476,11 @@ static void rt2500pci_txstatus_tasklet(unsigned long data)
         if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) {
                 spin_lock_irq(&rt2x00dev->irqmask_lock);
 
-                rt2x00pci_register_read(rt2x00dev, CSR8, &reg);
+                rt2x00mmio_register_read(rt2x00dev, CSR8, &reg);
                 rt2x00_set_field32(&reg, CSR8_TXDONE_TXRING, 0);
                 rt2x00_set_field32(&reg, CSR8_TXDONE_ATIMRING, 0);
                 rt2x00_set_field32(&reg, CSR8_TXDONE_PRIORING, 0);
-                rt2x00pci_register_write(rt2x00dev, CSR8, reg);
+                rt2x00mmio_register_write(rt2x00dev, CSR8, reg);
 
                 spin_unlock_irq(&rt2x00dev->irqmask_lock);
         }
@@ -1496,7 +1497,7 @@ static void rt2500pci_tbtt_tasklet(unsigned long data)
 static void rt2500pci_rxdone_tasklet(unsigned long data)
 {
         struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
-        if (rt2x00pci_rxdone(rt2x00dev))
+        if (rt2x00mmio_rxdone(rt2x00dev))
                 tasklet_schedule(&rt2x00dev->rxdone_tasklet);
         else if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
                 rt2500pci_enable_interrupt(rt2x00dev, CSR8_RXDONE);
@@ -1511,8 +1512,8 @@ static irqreturn_t rt2500pci_interrupt(int irq, void *dev_instance)
          * Get the interrupt sources & saved to local variable.
          * Write register value back to clear pending interrupts.
          */
-        rt2x00pci_register_read(rt2x00dev, CSR7, &reg);
-        rt2x00pci_register_write(rt2x00dev, CSR7, reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR7, &reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR7, reg);
 
         if (!reg)
                 return IRQ_NONE;
@@ -1549,9 +1550,9 @@ static irqreturn_t rt2500pci_interrupt(int irq, void *dev_instance)
          */
         spin_lock(&rt2x00dev->irqmask_lock);
 
-        rt2x00pci_register_read(rt2x00dev, CSR8, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR8, &reg);
         reg |= mask;
-        rt2x00pci_register_write(rt2x00dev, CSR8, reg);
+        rt2x00mmio_register_write(rt2x00dev, CSR8, reg);
 
         spin_unlock(&rt2x00dev->irqmask_lock);
 
@@ -1568,7 +1569,7 @@ static int rt2500pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
         u16 word;
         u8 *mac;
 
-        rt2x00pci_register_read(rt2x00dev, CSR21, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR21, &reg);
 
         eeprom.data = rt2x00dev;
         eeprom.register_read = rt2500pci_eepromregister_read;
@@ -1643,7 +1644,7 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
          * Identify RF chipset.
          */
         value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
-        rt2x00pci_register_read(rt2x00dev, CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR0, &reg);
         rt2x00_set_chip(rt2x00dev, RT2560, value,
                         rt2x00_get_field32(reg, CSR0_REVISION));
 
@@ -1949,9 +1950,9 @@ static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
          * Enable rfkill polling by setting GPIO direction of the
          * rfkill switch GPIO pin correctly.
          */
-        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, GPIOCSR, &reg);
         rt2x00_set_field32(&reg, GPIOCSR_DIR0, 1);
-        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, GPIOCSR, reg);
 
         /*
          * Initialize hw specifications.
@@ -1985,9 +1986,9 @@ static u64 rt2500pci_get_tsf(struct ieee80211_hw *hw,
         u64 tsf;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, CSR17, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR17, &reg);
         tsf = (u64) rt2x00_get_field32(reg, CSR17_HIGH_TSFTIMER) << 32;
-        rt2x00pci_register_read(rt2x00dev, CSR16, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR16, &reg);
         tsf |= rt2x00_get_field32(reg, CSR16_LOW_TSFTIMER);
 
         return tsf;
@@ -1998,7 +1999,7 @@ static int rt2500pci_tx_last_beacon(struct ieee80211_hw *hw)
         struct rt2x00_dev *rt2x00dev = hw->priv;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, CSR15, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CSR15, &reg);
         return rt2x00_get_field32(reg, CSR15_BEACON_SENT);
 }
 
@@ -2031,8 +2032,8 @@ static const struct rt2x00lib_ops rt2500pci_rt2x00_ops = {
         .tbtt_tasklet           = rt2500pci_tbtt_tasklet,
         .rxdone_tasklet         = rt2500pci_rxdone_tasklet,
         .probe_hw               = rt2500pci_probe_hw,
-        .initialize             = rt2x00pci_initialize,
-        .uninitialize           = rt2x00pci_uninitialize,
+        .initialize             = rt2x00mmio_initialize,
+        .uninitialize           = rt2x00mmio_uninitialize,
         .get_entry_state        = rt2500pci_get_entry_state,
         .clear_entry            = rt2500pci_clear_entry,
         .set_device_state       = rt2500pci_set_device_state,
@@ -2043,7 +2044,7 @@ static const struct rt2x00lib_ops rt2500pci_rt2x00_ops = {
         .start_queue            = rt2500pci_start_queue,
         .kick_queue             = rt2500pci_kick_queue,
         .stop_queue             = rt2500pci_stop_queue,
-        .flush_queue            = rt2x00pci_flush_queue,
+        .flush_queue            = rt2x00mmio_flush_queue,
         .write_tx_desc          = rt2500pci_write_tx_desc,
         .write_beacon           = rt2500pci_write_beacon,
         .fill_rxdone            = rt2500pci_fill_rxdone,
@@ -2058,28 +2059,28 @@ static const struct data_queue_desc rt2500pci_queue_rx = {
         .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = RXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt2500pci_queue_tx = {
         .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt2500pci_queue_bcn = {
         .entry_num              = 1,
         .data_size              = MGMT_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt2500pci_queue_atim = {
         .entry_num              = 8,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct rt2x00_ops rt2500pci_ops = {
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index 4db1088a847f..a7630d5ec892 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -51,6 +51,7 @@
  * RF3320 2.4G 1T1R(RT3350/RT3370/RT3390)
  * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392)
  * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662)
+ * RF5592 2.4G/5G 2T2R
  * RF5360 2.4G 1T1R
  * RF5370 2.4G 1T1R
  * RF5390 2.4G 1T1R
@@ -68,6 +69,7 @@
 #define RF3320                          0x000b
 #define RF3322                          0x000c
 #define RF3053                          0x000d
+#define RF5592                          0x000f
 #define RF3290                          0x3290
 #define RF5360                          0x5360
 #define RF5370                          0x5370
@@ -88,11 +90,8 @@
 #define REV_RT3390E                     0x0211
 #define REV_RT5390F                     0x0502
 #define REV_RT5390R                     0x1502
+#define REV_RT5592C                     0x0221
 
-/*
- * Signal information.
- * Default offset is required for RSSI <-> dBm conversion.
- */
 #define DEFAULT_RSSI_OFFSET             120
 
 /*
@@ -690,6 +689,12 @@
 #define GPIO_SWITCH_7                   FIELD32(0x00000080)
 
 /*
+ * FIXME: where the DEBUG_INDEX name come from?
+ */
+#define MAC_DEBUG_INDEX                 0x05e8
+#define MAC_DEBUG_INDEX_XTAL            FIELD32(0x80000000)
+
+/*
  * MAC Control/Status Registers(CSR).
  * Some values are set in TU, whereas 1 TU == 1024 us.
  */
@@ -1934,6 +1939,9 @@ struct mac_iveiv_entry {
 #define BBP4_BANDWIDTH                  FIELD8(0x18)
 #define BBP4_MAC_IF_CTRL                FIELD8(0x40)
 
+/* BBP27 */
+#define BBP27_RX_CHAIN_SEL              FIELD8(0x60)
+
 /*
  * BBP 47: Bandwidth
  */
@@ -1948,6 +1956,20 @@ struct mac_iveiv_entry {
 #define BBP49_UPDATE_FLAG               FIELD8(0x01)
 
 /*
+ * BBP 105:
+ * - bit0: detect SIG on primary channel only (on 40MHz bandwidth)
+ * - bit1: FEQ (Feed Forward Compensation) for independend streams
+ * - bit2: MLD (Maximum Likehood Detection) for 2 streams (reserved on single
+ *         stream)
+ * - bit4: channel estimation updates based on remodulation of
+ *         L-SIG and HT-SIG symbols
+ */
+#define BBP105_DETECT_SIG_ON_PRIMARY    FIELD8(0x01)
+#define BBP105_FEQ                      FIELD8(0x02)
+#define BBP105_MLD                      FIELD8(0x04)
+#define BBP105_SIG_REMODULATION         FIELD8(0x08)
+
+/*
  * BBP 109
  */
 #define BBP109_TX0_POWER                FIELD8(0x0f)
@@ -1967,6 +1989,11 @@ struct mac_iveiv_entry {
 #define BBP152_RX_DEFAULT_ANT           FIELD8(0x80)
 
 /*
+ * BBP 254: unknown
+ */
+#define BBP254_BIT7                     FIELD8(0x80)
+
+/*
  * RFCSR registers
  * The wordsize of the RFCSR is 8 bits.
  */
@@ -2022,9 +2049,18 @@ struct mac_iveiv_entry {
 #define RFCSR7_BITS67                   FIELD8(0xc0)
 
 /*
+ * RFCSR 9:
+ */
+#define RFCSR9_K                        FIELD8(0x0f)
+#define RFCSR9_N                        FIELD8(0x10)
+#define RFCSR9_UNKNOWN                  FIELD8(0x60)
+#define RFCSR9_MOD                      FIELD8(0x80)
+
+/*
  * RFCSR 11:
  */
 #define RFCSR11_R                       FIELD8(0x03)
+#define RFCSR11_MOD                     FIELD8(0xc0)
 
 /*
  * RFCSR 12:
@@ -2130,11 +2166,13 @@ struct mac_iveiv_entry {
  * RFCSR 49:
  */
 #define RFCSR49_TX                      FIELD8(0x3f)
+#define RFCSR49_EP                      FIELD8(0xc0)
 
 /*
  * RFCSR 50:
  */
 #define RFCSR50_TX                      FIELD8(0x3f)
+#define RFCSR50_EP                      FIELD8(0xc0)
 
 /*
  * RF registers
@@ -2497,6 +2535,61 @@ struct mac_iveiv_entry {
 #define EEPROM_BBP_REG_ID               FIELD16(0xff00)
 
 /*
+ * EEPROM IQ Calibration, unlike other entries those are byte addresses.
+ */
+
+#define EEPROM_IQ_GAIN_CAL_TX0_2G                       0x130
+#define EEPROM_IQ_PHASE_CAL_TX0_2G                      0x131
+#define EEPROM_IQ_GROUPDELAY_CAL_TX0_2G                 0x132
+#define EEPROM_IQ_GAIN_CAL_TX1_2G                       0x133
+#define EEPROM_IQ_PHASE_CAL_TX1_2G                      0x134
+#define EEPROM_IQ_GROUPDELAY_CAL_TX1_2G                 0x135
+#define EEPROM_IQ_GAIN_CAL_RX0_2G                       0x136
+#define EEPROM_IQ_PHASE_CAL_RX0_2G                      0x137
+#define EEPROM_IQ_GROUPDELAY_CAL_RX0_2G                 0x138
+#define EEPROM_IQ_GAIN_CAL_RX1_2G                       0x139
+#define EEPROM_IQ_PHASE_CAL_RX1_2G                      0x13A
+#define EEPROM_IQ_GROUPDELAY_CAL_RX1_2G                 0x13B
+#define EEPROM_RF_IQ_COMPENSATION_CONTROL               0x13C
+#define EEPROM_RF_IQ_IMBALANCE_COMPENSATION_CONTROL     0x13D
+#define EEPROM_IQ_GAIN_CAL_TX0_CH36_TO_CH64_5G          0x144
+#define EEPROM_IQ_PHASE_CAL_TX0_CH36_TO_CH64_5G         0x145
+#define EEPROM_IQ_GAIN_CAL_TX0_CH100_TO_CH138_5G        0X146
+#define EEPROM_IQ_PHASE_CAL_TX0_CH100_TO_CH138_5G       0x147
+#define EEPROM_IQ_GAIN_CAL_TX0_CH140_TO_CH165_5G        0x148
+#define EEPROM_IQ_PHASE_CAL_TX0_CH140_TO_CH165_5G       0x149
+#define EEPROM_IQ_GAIN_CAL_TX1_CH36_TO_CH64_5G          0x14A
+#define EEPROM_IQ_PHASE_CAL_TX1_CH36_TO_CH64_5G         0x14B
+#define EEPROM_IQ_GAIN_CAL_TX1_CH100_TO_CH138_5G        0X14C
+#define EEPROM_IQ_PHASE_CAL_TX1_CH100_TO_CH138_5G       0x14D
+#define EEPROM_IQ_GAIN_CAL_TX1_CH140_TO_CH165_5G        0x14E
+#define EEPROM_IQ_PHASE_CAL_TX1_CH140_TO_CH165_5G       0x14F
+#define EEPROM_IQ_GROUPDELAY_CAL_TX0_CH36_TO_CH64_5G    0x150
+#define EEPROM_IQ_GROUPDELAY_CAL_TX1_CH36_TO_CH64_5G    0x151
+#define EEPROM_IQ_GROUPDELAY_CAL_TX0_CH100_TO_CH138_5G  0x152
+#define EEPROM_IQ_GROUPDELAY_CAL_TX1_CH100_TO_CH138_5G  0x153
+#define EEPROM_IQ_GROUPDELAY_CAL_TX0_CH140_TO_CH165_5G  0x154
+#define EEPROM_IQ_GROUPDELAY_CAL_TX1_CH140_TO_CH165_5G  0x155
+#define EEPROM_IQ_GAIN_CAL_RX0_CH36_TO_CH64_5G          0x156
+#define EEPROM_IQ_PHASE_CAL_RX0_CH36_TO_CH64_5G         0x157
+#define EEPROM_IQ_GAIN_CAL_RX0_CH100_TO_CH138_5G        0X158
+#define EEPROM_IQ_PHASE_CAL_RX0_CH100_TO_CH138_5G       0x159
+#define EEPROM_IQ_GAIN_CAL_RX0_CH140_TO_CH165_5G        0x15A
+#define EEPROM_IQ_PHASE_CAL_RX0_CH140_TO_CH165_5G       0x15B
+#define EEPROM_IQ_GAIN_CAL_RX1_CH36_TO_CH64_5G          0x15C
+#define EEPROM_IQ_PHASE_CAL_RX1_CH36_TO_CH64_5G         0x15D
+#define EEPROM_IQ_GAIN_CAL_RX1_CH100_TO_CH138_5G        0X15E
+#define EEPROM_IQ_PHASE_CAL_RX1_CH100_TO_CH138_5G       0x15F
+#define EEPROM_IQ_GAIN_CAL_RX1_CH140_TO_CH165_5G        0x160
+#define EEPROM_IQ_PHASE_CAL_RX1_CH140_TO_CH165_5G       0x161
+#define EEPROM_IQ_GROUPDELAY_CAL_RX0_CH36_TO_CH64_5G    0x162
+#define EEPROM_IQ_GROUPDELAY_CAL_RX1_CH36_TO_CH64_5G    0x163
+#define EEPROM_IQ_GROUPDELAY_CAL_RX0_CH100_TO_CH138_5G  0x164
+#define EEPROM_IQ_GROUPDELAY_CAL_RX1_CH100_TO_CH138_5G  0x165
+#define EEPROM_IQ_GROUPDELAY_CAL_RX0_CH140_TO_CH165_5G  0x166
+#define EEPROM_IQ_GROUPDELAY_CAL_RX1_CH140_TO_CH165_5G  0x167
+
+/*
  * MCU mailbox commands.
  * MCU_SLEEP - go to power-save mode.
  *             arg1: 1: save as much power as possible, 0: save less power.
@@ -2535,6 +2628,8 @@ struct mac_iveiv_entry {
 #define TXWI_DESC_SIZE                  (4 * sizeof(__le32))
 #define RXWI_DESC_SIZE                  (4 * sizeof(__le32))
 
+#define TXWI_DESC_SIZE_5592             (5 * sizeof(__le32))
+#define RXWI_DESC_SIZE_5592             (6 * sizeof(__le32))
 /*
  * TX WI structure
  */
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 34456b45acbb..72bbb962579f 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -527,8 +527,10 @@ int rt2800_load_firmware(struct rt2x00_dev *rt2x00dev,
          */
         rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
         rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
-        if (rt2x00_is_usb(rt2x00dev))
+        if (rt2x00_is_usb(rt2x00dev)) {
                 rt2800_register_write(rt2x00dev, H2M_INT_SRC, 0);
+                rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+        }
         msleep(1);
 
         return 0;
@@ -674,11 +676,6 @@ void rt2800_process_rxwi(struct queue_entry *entry,
          * Convert descriptor AGC value to RSSI value.
          */
         rxdesc->rssi = rt2800_agc_to_rssi(entry->queue->rt2x00dev, word);
-
-        /*
-         * Remove RXWI descriptor from start of buffer.
-         */
-        skb_pull(entry->skb, RXWI_DESC_SIZE);
 }
 EXPORT_SYMBOL_GPL(rt2800_process_rxwi);
 
@@ -1988,8 +1985,21 @@ static void rt2800_config_channel_rf3052(struct rt2x00_dev *rt2x00dev,
 }
 
 #define POWER_BOUND             0x27
+#define POWER_BOUND_5G          0x2b
 #define FREQ_OFFSET_BOUND       0x5f
 
+static void rt2800_adjust_freq_offset(struct rt2x00_dev *rt2x00dev)
+{
+        u8 rfcsr;
+
+        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
+        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
+                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
+        else
+                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
+        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+}
+
 static void rt2800_config_channel_rf3290(struct rt2x00_dev *rt2x00dev,
                                          struct ieee80211_conf *conf,
                                          struct rf_channel *rf,
@@ -2010,12 +2020,7 @@ static void rt2800_config_channel_rf3290(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field8(&rfcsr, RFCSR49_TX, info->default_power1);
         rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
 
-        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
-        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
-        else
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
-        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+        rt2800_adjust_freq_offset(rt2x00dev);
 
         if (rf->channel <= 14) {
                 if (rf->channel == 6)
@@ -2056,13 +2061,7 @@ static void rt2800_config_channel_rf3322(struct rt2x00_dev *rt2x00dev,
         else
                 rt2800_rfcsr_write(rt2x00dev, 48, info->default_power2);
 
-        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
-        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
-        else
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
-
-        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+        rt2800_adjust_freq_offset(rt2x00dev);
 
         rt2800_rfcsr_read(rt2x00dev, 1, &rfcsr);
         rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 1);
@@ -2127,12 +2126,7 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 1);
         rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
 
-        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
-        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
-        else
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
-        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+        rt2800_adjust_freq_offset(rt2x00dev);
 
         if (rf->channel <= 14) {
                 int idx = rf->channel-1;
@@ -2184,6 +2178,382 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
         }
 }
 
+static void rt2800_config_channel_rf55xx(struct rt2x00_dev *rt2x00dev,
+                                         struct ieee80211_conf *conf,
+                                         struct rf_channel *rf,
+                                         struct channel_info *info)
+{
+        u8 rfcsr, ep_reg;
+        u32 reg;
+        int power_bound;
+
+        /* TODO */
+        const bool is_11b = false;
+        const bool is_type_ep = false;
+
+        rt2800_register_read(rt2x00dev, LDO_CFG0, &reg);
+        rt2x00_set_field32(&reg, LDO_CFG0_LDO_CORE_VLEVEL,
+                           (rf->channel > 14 || conf_is_ht40(conf)) ? 5 : 0);
+        rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
+
+        /* Order of values on rf_channel entry: N, K, mod, R */
+        rt2800_rfcsr_write(rt2x00dev, 8, rf->rf1 & 0xff);
+
+        rt2800_rfcsr_read(rt2x00dev,  9, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR9_K, rf->rf2 & 0xf);
+        rt2x00_set_field8(&rfcsr, RFCSR9_N, (rf->rf1 & 0x100) >> 8);
+        rt2x00_set_field8(&rfcsr, RFCSR9_MOD, ((rf->rf3 - 8) & 0x4) >> 2);
+        rt2800_rfcsr_write(rt2x00dev, 9, rfcsr);
+
+        rt2800_rfcsr_read(rt2x00dev, 11, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR11_R, rf->rf4 - 1);
+        rt2x00_set_field8(&rfcsr, RFCSR11_MOD, (rf->rf3 - 8) & 0x3);
+        rt2800_rfcsr_write(rt2x00dev, 11, rfcsr);
+
+        if (rf->channel <= 14) {
+                rt2800_rfcsr_write(rt2x00dev, 10, 0x90);
+                /* FIXME: RF11 owerwrite ? */
+                rt2800_rfcsr_write(rt2x00dev, 11, 0x4A);
+                rt2800_rfcsr_write(rt2x00dev, 12, 0x52);
+                rt2800_rfcsr_write(rt2x00dev, 13, 0x42);
+                rt2800_rfcsr_write(rt2x00dev, 22, 0x40);
+                rt2800_rfcsr_write(rt2x00dev, 24, 0x4A);
+                rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
+                rt2800_rfcsr_write(rt2x00dev, 27, 0x42);
+                rt2800_rfcsr_write(rt2x00dev, 36, 0x80);
+                rt2800_rfcsr_write(rt2x00dev, 37, 0x08);
+                rt2800_rfcsr_write(rt2x00dev, 38, 0x89);
+                rt2800_rfcsr_write(rt2x00dev, 39, 0x1B);
+                rt2800_rfcsr_write(rt2x00dev, 40, 0x0D);
+                rt2800_rfcsr_write(rt2x00dev, 41, 0x9B);
+                rt2800_rfcsr_write(rt2x00dev, 42, 0xD5);
+                rt2800_rfcsr_write(rt2x00dev, 43, 0x72);
+                rt2800_rfcsr_write(rt2x00dev, 44, 0x0E);
+                rt2800_rfcsr_write(rt2x00dev, 45, 0xA2);
+                rt2800_rfcsr_write(rt2x00dev, 46, 0x6B);
+                rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
+                rt2800_rfcsr_write(rt2x00dev, 51, 0x3E);
+                rt2800_rfcsr_write(rt2x00dev, 52, 0x48);
+                rt2800_rfcsr_write(rt2x00dev, 54, 0x38);
+                rt2800_rfcsr_write(rt2x00dev, 56, 0xA1);
+                rt2800_rfcsr_write(rt2x00dev, 57, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 58, 0x39);
+                rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
+                rt2800_rfcsr_write(rt2x00dev, 61, 0x91);
+                rt2800_rfcsr_write(rt2x00dev, 62, 0x39);
+
+                /* TODO RF27 <- tssi */
+
+                rfcsr = rf->channel <= 10 ? 0x07 : 0x06;
+                rt2800_rfcsr_write(rt2x00dev, 23, rfcsr);
+                rt2800_rfcsr_write(rt2x00dev, 59, rfcsr);
+
+                if (is_11b) {
+                        /* CCK */
+                        rt2800_rfcsr_write(rt2x00dev, 31, 0xF8);
+                        rt2800_rfcsr_write(rt2x00dev, 32, 0xC0);
+                        if (is_type_ep)
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x06);
+                        else
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x47);
+                } else {
+                        /* OFDM */
+                        if (is_type_ep)
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x03);
+                        else
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x43);
+                }
+
+                power_bound = POWER_BOUND;
+                ep_reg = 0x2;
+        } else {
+                rt2800_rfcsr_write(rt2x00dev, 10, 0x97);
+                /* FIMXE: RF11 overwrite */
+                rt2800_rfcsr_write(rt2x00dev, 11, 0x40);
+                rt2800_rfcsr_write(rt2x00dev, 25, 0xBF);
+                rt2800_rfcsr_write(rt2x00dev, 27, 0x42);
+                rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 37, 0x04);
+                rt2800_rfcsr_write(rt2x00dev, 38, 0x85);
+                rt2800_rfcsr_write(rt2x00dev, 40, 0x42);
+                rt2800_rfcsr_write(rt2x00dev, 41, 0xBB);
+                rt2800_rfcsr_write(rt2x00dev, 42, 0xD7);
+                rt2800_rfcsr_write(rt2x00dev, 45, 0x41);
+                rt2800_rfcsr_write(rt2x00dev, 48, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 57, 0x77);
+                rt2800_rfcsr_write(rt2x00dev, 60, 0x05);
+                rt2800_rfcsr_write(rt2x00dev, 61, 0x01);
+
+                /* TODO RF27 <- tssi */
+
+                if (rf->channel >= 36 && rf->channel <= 64) {
+
+                        rt2800_rfcsr_write(rt2x00dev, 12, 0x2E);
+                        rt2800_rfcsr_write(rt2x00dev, 13, 0x22);
+                        rt2800_rfcsr_write(rt2x00dev, 22, 0x60);
+                        rt2800_rfcsr_write(rt2x00dev, 23, 0x7F);
+                        if (rf->channel <= 50)
+                                rt2800_rfcsr_write(rt2x00dev, 24, 0x09);
+                        else if (rf->channel >= 52)
+                                rt2800_rfcsr_write(rt2x00dev, 24, 0x07);
+                        rt2800_rfcsr_write(rt2x00dev, 39, 0x1C);
+                        rt2800_rfcsr_write(rt2x00dev, 43, 0x5B);
+                        rt2800_rfcsr_write(rt2x00dev, 44, 0X40);
+                        rt2800_rfcsr_write(rt2x00dev, 46, 0X00);
+                        rt2800_rfcsr_write(rt2x00dev, 51, 0xFE);
+                        rt2800_rfcsr_write(rt2x00dev, 52, 0x0C);
+                        rt2800_rfcsr_write(rt2x00dev, 54, 0xF8);
+                        if (rf->channel <= 50) {
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x06),
+                                rt2800_rfcsr_write(rt2x00dev, 56, 0xD3);
+                        } else if (rf->channel >= 52) {
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x04);
+                                rt2800_rfcsr_write(rt2x00dev, 56, 0xBB);
+                        }
+
+                        rt2800_rfcsr_write(rt2x00dev, 58, 0x15);
+                        rt2800_rfcsr_write(rt2x00dev, 59, 0x7F);
+                        rt2800_rfcsr_write(rt2x00dev, 62, 0x15);
+
+                } else if (rf->channel >= 100 && rf->channel <= 165) {
+
+                        rt2800_rfcsr_write(rt2x00dev, 12, 0x0E);
+                        rt2800_rfcsr_write(rt2x00dev, 13, 0x42);
+                        rt2800_rfcsr_write(rt2x00dev, 22, 0x40);
+                        if (rf->channel <= 153) {
+                                rt2800_rfcsr_write(rt2x00dev, 23, 0x3C);
+                                rt2800_rfcsr_write(rt2x00dev, 24, 0x06);
+                        } else if (rf->channel >= 155) {
+                                rt2800_rfcsr_write(rt2x00dev, 23, 0x38);
+                                rt2800_rfcsr_write(rt2x00dev, 24, 0x05);
+                        }
+                        if (rf->channel <= 138) {
+                                rt2800_rfcsr_write(rt2x00dev, 39, 0x1A);
+                                rt2800_rfcsr_write(rt2x00dev, 43, 0x3B);
+                                rt2800_rfcsr_write(rt2x00dev, 44, 0x20);
+                                rt2800_rfcsr_write(rt2x00dev, 46, 0x18);
+                        } else if (rf->channel >= 140) {
+                                rt2800_rfcsr_write(rt2x00dev, 39, 0x18);
+                                rt2800_rfcsr_write(rt2x00dev, 43, 0x1B);
+                                rt2800_rfcsr_write(rt2x00dev, 44, 0x10);
+                                rt2800_rfcsr_write(rt2x00dev, 46, 0X08);
+                        }
+                        if (rf->channel <= 124)
+                                rt2800_rfcsr_write(rt2x00dev, 51, 0xFC);
+                        else if (rf->channel >= 126)
+                                rt2800_rfcsr_write(rt2x00dev, 51, 0xEC);
+                        if (rf->channel <= 138)
+                                rt2800_rfcsr_write(rt2x00dev, 52, 0x06);
+                        else if (rf->channel >= 140)
+                                rt2800_rfcsr_write(rt2x00dev, 52, 0x06);
+                        rt2800_rfcsr_write(rt2x00dev, 54, 0xEB);
+                        if (rf->channel <= 138)
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x01);
+                        else if (rf->channel >= 140)
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x00);
+                        if (rf->channel <= 128)
+                                rt2800_rfcsr_write(rt2x00dev, 56, 0xBB);
+                        else if (rf->channel >= 130)
+                                rt2800_rfcsr_write(rt2x00dev, 56, 0xAB);
+                        if (rf->channel <= 116)
+                                rt2800_rfcsr_write(rt2x00dev, 58, 0x1D);
+                        else if (rf->channel >= 118)
+                                rt2800_rfcsr_write(rt2x00dev, 58, 0x15);
+                        if (rf->channel <= 138)
+                                rt2800_rfcsr_write(rt2x00dev, 59, 0x3F);
+                        else if (rf->channel >= 140)
+                                rt2800_rfcsr_write(rt2x00dev, 59, 0x7C);
+                        if (rf->channel <= 116)
+                                rt2800_rfcsr_write(rt2x00dev, 62, 0x1D);
+                        else if (rf->channel >= 118)
+                                rt2800_rfcsr_write(rt2x00dev, 62, 0x15);
+                }
+
+                power_bound = POWER_BOUND_5G;
+                ep_reg = 0x3;
+        }
+
+        rt2800_rfcsr_read(rt2x00dev, 49, &rfcsr);
+        if (info->default_power1 > power_bound)
+                rt2x00_set_field8(&rfcsr, RFCSR49_TX, power_bound);
+        else
+                rt2x00_set_field8(&rfcsr, RFCSR49_TX, info->default_power1);
+        if (is_type_ep)
+                rt2x00_set_field8(&rfcsr, RFCSR49_EP, ep_reg);
+        rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
+
+        rt2800_rfcsr_read(rt2x00dev, 50, &rfcsr);
+        if (info->default_power1 > power_bound)
+                rt2x00_set_field8(&rfcsr, RFCSR50_TX, power_bound);
+        else
+                rt2x00_set_field8(&rfcsr, RFCSR50_TX, info->default_power2);
+        if (is_type_ep)
+                rt2x00_set_field8(&rfcsr, RFCSR50_EP, ep_reg);
+        rt2800_rfcsr_write(rt2x00dev, 50, rfcsr);
+
+        rt2800_rfcsr_read(rt2x00dev, 1, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR1_RF_BLOCK_EN, 1);
+        rt2x00_set_field8(&rfcsr, RFCSR1_PLL_PD, 1);
+
+        rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD,
+                          rt2x00dev->default_ant.tx_chain_num >= 1);
+        rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD,
+                          rt2x00dev->default_ant.tx_chain_num == 2);
+        rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 0);
+
+        rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD,
+                          rt2x00dev->default_ant.rx_chain_num >= 1);
+        rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD,
+                          rt2x00dev->default_ant.rx_chain_num == 2);
+        rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 0);
+
+        rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0xe4);
+
+        if (conf_is_ht40(conf))
+                rt2800_rfcsr_write(rt2x00dev, 30, 0x16);
+        else
+                rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
+
+        if (!is_11b) {
+                rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
+                rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
+        }
+
+        /* TODO proper frequency adjustment */
+        rt2800_adjust_freq_offset(rt2x00dev);
+
+        /* TODO merge with others */
+        rt2800_rfcsr_read(rt2x00dev, 3, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
+        rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
+
+        /* BBP settings */
+        rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+        rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+        rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+
+        rt2800_bbp_write(rt2x00dev, 79, (rf->channel <= 14) ? 0x1C : 0x18);
+        rt2800_bbp_write(rt2x00dev, 80, (rf->channel <= 14) ? 0x0E : 0x08);
+        rt2800_bbp_write(rt2x00dev, 81, (rf->channel <= 14) ? 0x3A : 0x38);
+        rt2800_bbp_write(rt2x00dev, 82, (rf->channel <= 14) ? 0x62 : 0x92);
+
+        /* GLRT band configuration */
+        rt2800_bbp_write(rt2x00dev, 195, 128);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0xE0 : 0xF0);
+        rt2800_bbp_write(rt2x00dev, 195, 129);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x1F : 0x1E);
+        rt2800_bbp_write(rt2x00dev, 195, 130);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x38 : 0x28);
+        rt2800_bbp_write(rt2x00dev, 195, 131);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x32 : 0x20);
+        rt2800_bbp_write(rt2x00dev, 195, 133);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x28 : 0x7F);
+        rt2800_bbp_write(rt2x00dev, 195, 124);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x19 : 0x7F);
+}
+
+static void rt2800_bbp_write_with_rx_chain(struct rt2x00_dev *rt2x00dev,
+                                           const unsigned int word,
+                                           const u8 value)
+{
+        u8 chain, reg;
+
+        for (chain = 0; chain < rt2x00dev->default_ant.rx_chain_num; chain++) {
+                rt2800_bbp_read(rt2x00dev, 27, &reg);
+                rt2x00_set_field8(&reg,  BBP27_RX_CHAIN_SEL, chain);
+                rt2800_bbp_write(rt2x00dev, 27, reg);
+
+                rt2800_bbp_write(rt2x00dev, word, value);
+        }
+}
+
+static void rt2800_iq_calibrate(struct rt2x00_dev *rt2x00dev, int channel)
+{
+        u8 cal;
+
+        /* TX0 IQ Gain */
+        rt2800_bbp_write(rt2x00dev, 158, 0x2c);
+        if (channel <= 14)
+                cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_IQ_GAIN_CAL_TX0_2G);
+        else if (channel >= 36 && channel <= 64)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX0_CH36_TO_CH64_5G);
+        else if (channel >= 100 && channel <= 138)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX0_CH100_TO_CH138_5G);
+        else if (channel >= 140 && channel <= 165)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX0_CH140_TO_CH165_5G);
+        else
+                cal = 0;
+        rt2800_bbp_write(rt2x00dev, 159, cal);
+
+        /* TX0 IQ Phase */
+        rt2800_bbp_write(rt2x00dev, 158, 0x2d);
+        if (channel <= 14)
+                cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_IQ_PHASE_CAL_TX0_2G);
+        else if (channel >= 36 && channel <= 64)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX0_CH36_TO_CH64_5G);
+        else if (channel >= 100 && channel <= 138)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX0_CH100_TO_CH138_5G);
+        else if (channel >= 140 && channel <= 165)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX0_CH140_TO_CH165_5G);
+        else
+                cal = 0;
+        rt2800_bbp_write(rt2x00dev, 159, cal);
+
+        /* TX1 IQ Gain */
+        rt2800_bbp_write(rt2x00dev, 158, 0x4a);
+        if (channel <= 14)
+                cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_IQ_GAIN_CAL_TX1_2G);
+        else if (channel >= 36 && channel <= 64)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX1_CH36_TO_CH64_5G);
+        else if (channel >= 100 && channel <= 138)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX1_CH100_TO_CH138_5G);
+        else if (channel >= 140 && channel <= 165)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX1_CH140_TO_CH165_5G);
+        else
+                cal = 0;
+        rt2800_bbp_write(rt2x00dev, 159, cal);
+
+        /* TX1 IQ Phase */
+        rt2800_bbp_write(rt2x00dev, 158, 0x4b);
+        if (channel <= 14)
+                cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_IQ_PHASE_CAL_TX1_2G);
+        else if (channel >= 36 && channel <= 64)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX1_CH36_TO_CH64_5G);
+        else if (channel >= 100 && channel <= 138)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX1_CH100_TO_CH138_5G);
+        else if (channel >= 140 && channel <= 165)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX1_CH140_TO_CH165_5G);
+        else
+                cal = 0;
+        rt2800_bbp_write(rt2x00dev, 159, cal);
+
+        /* FIXME: possible RX0, RX1 callibration ? */
+
+        /* RF IQ compensation control */
+        rt2800_bbp_write(rt2x00dev, 158, 0x04);
+        cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_RF_IQ_COMPENSATION_CONTROL);
+        rt2800_bbp_write(rt2x00dev, 159, cal != 0xff ? cal : 0);
+
+        /* RF IQ imbalance compensation control */
+        rt2800_bbp_write(rt2x00dev, 158, 0x03);
+        cal = rt2x00_eeprom_byte(rt2x00dev,
+                                 EEPROM_RF_IQ_IMBALANCE_COMPENSATION_CONTROL);
+        rt2800_bbp_write(rt2x00dev, 159, cal != 0xff ? cal : 0);
+}
+
 static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
                                   struct ieee80211_conf *conf,
                                   struct rf_channel *rf,
@@ -2225,6 +2595,9 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         case RF5392:
                 rt2800_config_channel_rf53xx(rt2x00dev, conf, rf, info);
                 break;
+        case RF5592:
+                rt2800_config_channel_rf55xx(rt2x00dev, conf, rf, info);
+                break;
         default:
                 rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
         }
@@ -2326,6 +2699,17 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         if (rt2x00_rt(rt2x00dev, RT3572))
                 rt2800_rfcsr_write(rt2x00dev, 8, 0x80);
 
+        if (rt2x00_rt(rt2x00dev, RT5592)) {
+                rt2800_bbp_write(rt2x00dev, 195, 141);
+                rt2800_bbp_write(rt2x00dev, 196, conf_is_ht40(conf) ? 0x10 : 0x1a);
+
+                /* AGC init */
+                reg = (rf->channel <= 14 ? 0x1c : 0x24) + 2 * rt2x00dev->lna_gain;
+                rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+
+                rt2800_iq_calibrate(rt2x00dev, rf->channel);
+        }
+
         rt2800_bbp_read(rt2x00dev, 4, &bbp);
         rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
         rt2800_bbp_write(rt2x00dev, 4, bbp);
@@ -2938,13 +3322,16 @@ static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
                     rt2x00_rt(rt2x00dev, RT3390) ||
                     rt2x00_rt(rt2x00dev, RT3572) ||
                     rt2x00_rt(rt2x00dev, RT5390) ||
-                    rt2x00_rt(rt2x00dev, RT5392))
+                    rt2x00_rt(rt2x00dev, RT5392) ||
+                    rt2x00_rt(rt2x00dev, RT5592))
                         vgc = 0x1c + (2 * rt2x00dev->lna_gain);
                 else
                         vgc = 0x2e + rt2x00dev->lna_gain;
         } else { /* 5GHZ band */
                 if (rt2x00_rt(rt2x00dev, RT3572))
                         vgc = 0x22 + (rt2x00dev->lna_gain * 5) / 3;
+                else if (rt2x00_rt(rt2x00dev, RT5592))
+                        vgc = 0x24 + (2 * rt2x00dev->lna_gain);
                 else {
                         if (!test_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags))
                                 vgc = 0x32 + (rt2x00dev->lna_gain * 5) / 3;
@@ -2960,7 +3347,11 @@ static inline void rt2800_set_vgc(struct rt2x00_dev *rt2x00dev,
                                   struct link_qual *qual, u8 vgc_level)
 {
         if (qual->vgc_level != vgc_level) {
-                rt2800_bbp_write(rt2x00dev, 66, vgc_level);
+                if (rt2x00_rt(rt2x00dev, RT5592)) {
+                        rt2800_bbp_write(rt2x00dev, 83, qual->rssi > -65 ? 0x4a : 0x7a);
+                        rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, vgc_level);
+                } else
+                        rt2800_bbp_write(rt2x00dev, 66, vgc_level);
                 qual->vgc_level = vgc_level;
                 qual->vgc_level_reg = vgc_level;
         }
@@ -2975,15 +3366,23 @@ EXPORT_SYMBOL_GPL(rt2800_reset_tuner);
 void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
                        const u32 count)
 {
+        u8 vgc;
+
         if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C))
                 return;
-
         /*
-         * When RSSI is better then -80 increase VGC level with 0x10
+         * When RSSI is better then -80 increase VGC level with 0x10, except
+         * for rt5592 chip.
          */
-        rt2800_set_vgc(rt2x00dev, qual,
-                       rt2800_get_default_vgc(rt2x00dev) +
-                       ((qual->rssi > -80) * 0x10));
+
+        vgc = rt2800_get_default_vgc(rt2x00dev);
+
+        if (rt2x00_rt(rt2x00dev, RT5592) && qual->rssi > -65)
+                vgc += 0x20;
+        else if (qual->rssi > -80)
+                vgc += 0x10;
+
+        rt2800_set_vgc(rt2x00dev, qual, vgc);
 }
 EXPORT_SYMBOL_GPL(rt2800_link_tuner);
 
@@ -3122,7 +3521,8 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
                 rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
                 rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
         } else if (rt2x00_rt(rt2x00dev, RT5390) ||
-                   rt2x00_rt(rt2x00dev, RT5392)) {
+                   rt2x00_rt(rt2x00dev, RT5392) ||
+                   rt2x00_rt(rt2x00dev, RT5592)) {
                 rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
                 rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
                 rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
@@ -3302,7 +3702,8 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, TXOP_CTRL_CFG_EXT_CWMIN, 0);
         rt2800_register_write(rt2x00dev, TXOP_CTRL_CFG, reg);
 
-        rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, 0x00000002);
+        reg = rt2x00_rt(rt2x00dev, RT5592) ? 0x00000082 : 0x00000002;
+        rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, reg);
 
         rt2800_register_read(rt2x00dev, TX_RTS_CFG, &reg);
         rt2x00_set_field32(&reg, TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT, 32);
@@ -3487,6 +3888,136 @@ static int rt2800_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
         return -EACCES;
 }
 
+static void rt2800_bbp4_mac_if_ctrl(struct rt2x00_dev *rt2x00dev)
+{
+        u8 value;
+
+        rt2800_bbp_read(rt2x00dev, 4, &value);
+        rt2x00_set_field8(&value, BBP4_MAC_IF_CTRL, 1);
+        rt2800_bbp_write(rt2x00dev, 4, value);
+}
+
+static void rt2800_init_freq_calibration(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_bbp_write(rt2x00dev, 142, 1);
+        rt2800_bbp_write(rt2x00dev, 143, 57);
+}
+
+static void rt2800_init_bbp_5592_glrt(struct rt2x00_dev *rt2x00dev)
+{
+        const u8 glrt_table[] = {
+                0xE0, 0x1F, 0X38, 0x32, 0x08, 0x28, 0x19, 0x0A, 0xFF, 0x00, /* 128 ~ 137 */
+                0x16, 0x10, 0x10, 0x0B, 0x36, 0x2C, 0x26, 0x24, 0x42, 0x36, /* 138 ~ 147 */
+                0x30, 0x2D, 0x4C, 0x46, 0x3D, 0x40, 0x3E, 0x42, 0x3D, 0x40, /* 148 ~ 157 */
+                0X3C, 0x34, 0x2C, 0x2F, 0x3C, 0x35, 0x2E, 0x2A, 0x49, 0x41, /* 158 ~ 167 */
+                0x36, 0x31, 0x30, 0x30, 0x0E, 0x0D, 0x28, 0x21, 0x1C, 0x16, /* 168 ~ 177 */
+                0x50, 0x4A, 0x43, 0x40, 0x10, 0x10, 0x10, 0x10, 0x00, 0x00, /* 178 ~ 187 */
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 188 ~ 197 */
+                0x00, 0x00, 0x7D, 0x14, 0x32, 0x2C, 0x36, 0x4C, 0x43, 0x2C, /* 198 ~ 207 */
+                0x2E, 0x36, 0x30, 0x6E,                                     /* 208 ~ 211 */
+        };
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(glrt_table); i++) {
+                rt2800_bbp_write(rt2x00dev, 195, 128 + i);
+                rt2800_bbp_write(rt2x00dev, 196, glrt_table[i]);
+        }
+};
+
+static void rt2800_init_bbb_early(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_bbp_write(rt2x00dev, 65, 0x2C);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
+        rt2800_bbp_write(rt2x00dev, 68, 0x0B);
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+        rt2800_bbp_write(rt2x00dev, 73, 0x10);
+        rt2800_bbp_write(rt2x00dev, 81, 0x37);
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+        rt2800_bbp_write(rt2x00dev, 83, 0x6A);
+        rt2800_bbp_write(rt2x00dev, 84, 0x99);
+        rt2800_bbp_write(rt2x00dev, 86, 0x00);
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+        rt2800_bbp_write(rt2x00dev, 92, 0x00);
+        rt2800_bbp_write(rt2x00dev, 103, 0x00);
+        rt2800_bbp_write(rt2x00dev, 105, 0x05);
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+}
+
+static void rt2800_init_bbp_5592(struct rt2x00_dev *rt2x00dev)
+{
+        int ant, div_mode;
+        u16 eeprom;
+        u8 value;
+
+        rt2800_init_bbb_early(rt2x00dev);
+
+        rt2800_bbp_read(rt2x00dev, 105, &value);
+        rt2x00_set_field8(&value, BBP105_MLD,
+                          rt2x00dev->default_ant.rx_chain_num == 2);
+        rt2800_bbp_write(rt2x00dev, 105, value);
+
+        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+
+        rt2800_bbp_write(rt2x00dev, 20, 0x06);
+        rt2800_bbp_write(rt2x00dev, 31, 0x08);
+        rt2800_bbp_write(rt2x00dev, 65, 0x2C);
+        rt2800_bbp_write(rt2x00dev, 68, 0xDD);
+        rt2800_bbp_write(rt2x00dev, 69, 0x1A);
+        rt2800_bbp_write(rt2x00dev, 70, 0x05);
+        rt2800_bbp_write(rt2x00dev, 73, 0x13);
+        rt2800_bbp_write(rt2x00dev, 74, 0x0F);
+        rt2800_bbp_write(rt2x00dev, 75, 0x4F);
+        rt2800_bbp_write(rt2x00dev, 76, 0x28);
+        rt2800_bbp_write(rt2x00dev, 77, 0x59);
+        rt2800_bbp_write(rt2x00dev, 84, 0x9A);
+        rt2800_bbp_write(rt2x00dev, 86, 0x38);
+        rt2800_bbp_write(rt2x00dev, 88, 0x90);
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+        rt2800_bbp_write(rt2x00dev, 92, 0x02);
+        rt2800_bbp_write(rt2x00dev, 95, 0x9a);
+        rt2800_bbp_write(rt2x00dev, 98, 0x12);
+        rt2800_bbp_write(rt2x00dev, 103, 0xC0);
+        rt2800_bbp_write(rt2x00dev, 104, 0x92);
+        /* FIXME BBP105 owerwrite */
+        rt2800_bbp_write(rt2x00dev, 105, 0x3C);
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+        rt2800_bbp_write(rt2x00dev, 128, 0x12);
+        rt2800_bbp_write(rt2x00dev, 134, 0xD0);
+        rt2800_bbp_write(rt2x00dev, 135, 0xF6);
+        rt2800_bbp_write(rt2x00dev, 137, 0x0F);
+
+        /* Initialize GLRT (Generalized Likehood Radio Test) */
+        rt2800_init_bbp_5592_glrt(rt2x00dev);
+
+        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom);
+        div_mode = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF1_ANT_DIVERSITY);
+        ant = (div_mode == 3) ? 1 : 0;
+        rt2800_bbp_read(rt2x00dev, 152, &value);
+        if (ant == 0) {
+                /* Main antenna */
+                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 1);
+        } else {
+                /* Auxiliary antenna */
+                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 0);
+        }
+        rt2800_bbp_write(rt2x00dev, 152, value);
+
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C)) {
+                rt2800_bbp_read(rt2x00dev, 254, &value);
+                rt2x00_set_field8(&value, BBP254_BIT7, 1);
+                rt2800_bbp_write(rt2x00dev, 254, value);
+        }
+
+        rt2800_init_freq_calibration(rt2x00dev);
+
+        rt2800_bbp_write(rt2x00dev, 84, 0x19);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C))
+                rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+}
+
 static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
 {
         unsigned int i;
@@ -3498,6 +4029,11 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
                      rt2800_wait_bbp_ready(rt2x00dev)))
                 return -EACCES;
 
+        if (rt2x00_rt(rt2x00dev, RT5592)) {
+                rt2800_init_bbp_5592(rt2x00dev);
+                return 0;
+        }
+
         if (rt2x00_rt(rt2x00dev, RT3352)) {
                 rt2800_bbp_write(rt2x00dev, 3, 0x00);
                 rt2800_bbp_write(rt2x00dev, 4, 0x50);
@@ -3505,11 +4041,8 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
 
         if (rt2x00_rt(rt2x00dev, RT3290) ||
             rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392)) {
-                rt2800_bbp_read(rt2x00dev, 4, &value);
-                rt2x00_set_field8(&value, BBP4_MAC_IF_CTRL, 1);
-                rt2800_bbp_write(rt2x00dev, 4, value);
-        }
+            rt2x00_rt(rt2x00dev, RT5392))
+                rt2800_bbp4_mac_if_ctrl(rt2x00dev);
 
         if (rt2800_is_305x_soc(rt2x00dev) ||
             rt2x00_rt(rt2x00dev, RT3290) ||
@@ -3783,9 +4316,7 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
                         rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 0);
                 rt2800_bbp_write(rt2x00dev, 152, value);
 
-                /* Init frequency calibration */
-                rt2800_bbp_write(rt2x00dev, 142, 1);
-                rt2800_bbp_write(rt2x00dev, 143, 57);
+                rt2800_init_freq_calibration(rt2x00dev);
         }
 
         for (i = 0; i < EEPROM_BBP_SIZE; i++) {
@@ -4259,6 +4790,69 @@ static void rt2800_init_rfcsr_5392(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 63, 0x07);
 }
 
+static void rt2800_init_rfcsr_5592(struct rt2x00_dev *rt2x00dev)
+{
+        u8 reg;
+        u16 eeprom;
+
+        rt2800_rfcsr_write(rt2x00dev, 1, 0x3F);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x08);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x08);
+        rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0xE4);
+        rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0x03);
+        rt2800_rfcsr_write(rt2x00dev, 19, 0x4D);
+        rt2800_rfcsr_write(rt2x00dev, 20, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 21, 0x8D);
+        rt2800_rfcsr_write(rt2x00dev, 26, 0x82);
+        rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 33, 0xC0);
+        rt2800_rfcsr_write(rt2x00dev, 34, 0x07);
+        rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
+        rt2800_rfcsr_write(rt2x00dev, 47, 0x0C);
+        rt2800_rfcsr_write(rt2x00dev, 53, 0x22);
+        rt2800_rfcsr_write(rt2x00dev, 63, 0x07);
+
+        rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
+        msleep(1);
+
+        rt2800_adjust_freq_offset(rt2x00dev);
+
+        rt2800_bbp_read(rt2x00dev, 138, &reg);
+
+        /*  Turn off unused DAC1 and ADC1 to reduce power consumption */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF0, &eeprom);
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RXPATH) == 1)
+                rt2x00_set_field8(&reg, BBP138_RX_ADC1, 0);
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_TXPATH) == 1)
+                rt2x00_set_field8(&reg, BBP138_TX_DAC1, 1);
+
+        rt2800_bbp_write(rt2x00dev, 138, reg);
+
+        /* Enable DC filter */
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C))
+                rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+
+        rt2800_rfcsr_read(rt2x00dev, 38, &reg);
+        rt2x00_set_field8(&reg, RFCSR38_RX_LO1_EN, 0);
+        rt2800_rfcsr_write(rt2x00dev, 38, reg);
+
+        rt2800_rfcsr_read(rt2x00dev, 39, &reg);
+        rt2x00_set_field8(&reg, RFCSR39_RX_LO2_EN, 0);
+        rt2800_rfcsr_write(rt2x00dev, 39, reg);
+
+        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+
+        rt2800_rfcsr_read(rt2x00dev, 30, &reg);
+        rt2x00_set_field8(&reg, RFCSR30_RX_VCM, 2);
+        rt2800_rfcsr_write(rt2x00dev, 30, reg);
+}
+
 static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
 {
         struct rt2800_drv_data *drv_data = rt2x00dev->drv_data;
@@ -4276,6 +4870,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
             !rt2x00_rt(rt2x00dev, RT3572) &&
             !rt2x00_rt(rt2x00dev, RT5390) &&
             !rt2x00_rt(rt2x00dev, RT5392) &&
+            !rt2x00_rt(rt2x00dev, RT5392) &&
+            !rt2x00_rt(rt2x00dev, RT5592) &&
             !rt2800_is_305x_soc(rt2x00dev))
                 return 0;
 
@@ -4330,6 +4926,9 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
         case RT5392:
                 rt2800_init_rfcsr_5392(rt2x00dev);
                 break;
+        case RT5592:
+                rt2800_init_rfcsr_5592(rt2x00dev);
+                return 0;
         }
 
         if (rt2x00_rt_rev_lt(rt2x00dev, RT3070, REV_RT3070F)) {
@@ -4427,7 +5026,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
         if (rt2x00_rt_rev_lt(rt2x00dev, RT3070, REV_RT3070F) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3071, REV_RT3071E) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3090, REV_RT3090E) ||
-            rt2x00_rt_rev_lt(rt2x00dev, RT3390, REV_RT3390E))
+            rt2x00_rt_rev_lt(rt2x00dev, RT3390, REV_RT3390E) ||
+            rt2x00_rt_rev_lt(rt2x00dev, RT5592, REV_RT5592C))
                 rt2800_rfcsr_write(rt2x00dev, 27, 0x03);
 
         rt2800_register_read(rt2x00dev, OPT_14_CSR, &reg);
@@ -4451,7 +5051,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
                 rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
         }
 
-        if (rt2x00_rt(rt2x00dev, RT3090)) {
+        if (rt2x00_rt(rt2x00dev, RT3090) ||
+            rt2x00_rt(rt2x00dev, RT5592)) {
                 rt2800_bbp_read(rt2x00dev, 138, &bbp);
 
                 /*  Turn off unused DAC1 and ADC1 to reduce power consumption */
@@ -4507,7 +5108,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
         }
 
         if (rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392)) {
+            rt2x00_rt(rt2x00dev, RT5392) ||
+            rt2x00_rt(rt2x00dev, RT5592)) {
                 rt2800_rfcsr_read(rt2x00dev, 38, &rfcsr);
                 rt2x00_set_field8(&rfcsr, RFCSR38_RX_LO1_EN, 0);
                 rt2800_rfcsr_write(rt2x00dev, 38, rfcsr);
@@ -4533,15 +5135,23 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev)
          * Initialize all registers.
          */
         if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
-                     rt2800_init_registers(rt2x00dev) ||
-                     rt2800_init_bbp(rt2x00dev) ||
-                     rt2800_init_rfcsr(rt2x00dev)))
+                     rt2800_init_registers(rt2x00dev)))
                 return -EIO;
 
         /*
          * Send signal to firmware during boot time.
          */
-        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+        rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        if (rt2x00_is_usb(rt2x00dev)) {
+                rt2800_register_write(rt2x00dev, H2M_INT_SRC, 0);
+                rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+        }
+        msleep(1);
+
+        if (unlikely(rt2800_init_bbp(rt2x00dev) ||
+                     rt2800_init_rfcsr(rt2x00dev)))
+                return -EIO;
 
         if (rt2x00_is_usb(rt2x00dev) &&
             (rt2x00_rt(rt2x00dev, RT3070) ||
@@ -4821,9 +5431,9 @@ static int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 
 static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
 {
-        u32 reg;
         u16 value;
         u16 eeprom;
+        u16 rf;
 
         /*
          * Read EEPROM word for configuration.
@@ -4835,41 +5445,14 @@ static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
          * RT28xx/RT30xx: defined in "EEPROM_NIC_CONF0_RF_TYPE" field
          * RT53xx: defined in "EEPROM_CHIP_ID" field
          */
-        if (rt2x00_rt(rt2x00dev, RT3290))
-                rt2800_register_read(rt2x00dev, MAC_CSR0_3290, &reg);
-        else
-                rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
-
-        if (rt2x00_get_field32(reg, MAC_CSR0_CHIPSET) == RT3290 ||
-            rt2x00_get_field32(reg, MAC_CSR0_CHIPSET) == RT5390 ||
-            rt2x00_get_field32(reg, MAC_CSR0_CHIPSET) == RT5392)
-                rt2x00_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &value);
+        if (rt2x00_rt(rt2x00dev, RT3290) ||
+            rt2x00_rt(rt2x00dev, RT5390) ||
+            rt2x00_rt(rt2x00dev, RT5392))
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
         else
-                value = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
-
-        rt2x00_set_chip(rt2x00dev, rt2x00_get_field32(reg, MAC_CSR0_CHIPSET),
-                        value, rt2x00_get_field32(reg, MAC_CSR0_REVISION));
-
-        switch (rt2x00dev->chip.rt) {
-        case RT2860:
-        case RT2872:
-        case RT2883:
-        case RT3070:
-        case RT3071:
-        case RT3090:
-        case RT3290:
-        case RT3352:
-        case RT3390:
-        case RT3572:
-        case RT5390:
-        case RT5392:
-                break;
-        default:
-                ERROR(rt2x00dev, "Invalid RT chipset 0x%04x detected.\n", rt2x00dev->chip.rt);
-                return -ENODEV;
-        }
+                rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
 
-        switch (rt2x00dev->chip.rf) {
+        switch (rf) {
         case RF2820:
         case RF2850:
         case RF2720:
@@ -4887,13 +5470,15 @@ static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
         case RF5372:
         case RF5390:
         case RF5392:
+        case RF5592:
                 break;
         default:
-                ERROR(rt2x00dev, "Invalid RF chipset 0x%04x detected.\n",
-                      rt2x00dev->chip.rf);
+                ERROR(rt2x00dev, "Invalid RF chipset 0x%04x detected.\n", rf);
                 return -ENODEV;
         }
 
+        rt2x00_set_rf(rt2x00dev, rf);
+
         /*
          * Identify default antenna configuration.
          */
@@ -5122,6 +5707,138 @@ static const struct rf_channel rf_vals_3x[] = {
         {173, 0x61, 0, 9},
 };
 
+static const struct rf_channel rf_vals_5592_xtal20[] = {
+        /* Channel, N, K, mod, R */
+        {1, 482, 4, 10, 3},
+        {2, 483, 4, 10, 3},
+        {3, 484, 4, 10, 3},
+        {4, 485, 4, 10, 3},
+        {5, 486, 4, 10, 3},
+        {6, 487, 4, 10, 3},
+        {7, 488, 4, 10, 3},
+        {8, 489, 4, 10, 3},
+        {9, 490, 4, 10, 3},
+        {10, 491, 4, 10, 3},
+        {11, 492, 4, 10, 3},
+        {12, 493, 4, 10, 3},
+        {13, 494, 4, 10, 3},
+        {14, 496, 8, 10, 3},
+        {36, 172, 8, 12, 1},
+        {38, 173, 0, 12, 1},
+        {40, 173, 4, 12, 1},
+        {42, 173, 8, 12, 1},
+        {44, 174, 0, 12, 1},
+        {46, 174, 4, 12, 1},
+        {48, 174, 8, 12, 1},
+        {50, 175, 0, 12, 1},
+        {52, 175, 4, 12, 1},
+        {54, 175, 8, 12, 1},
+        {56, 176, 0, 12, 1},
+        {58, 176, 4, 12, 1},
+        {60, 176, 8, 12, 1},
+        {62, 177, 0, 12, 1},
+        {64, 177, 4, 12, 1},
+        {100, 183, 4, 12, 1},
+        {102, 183, 8, 12, 1},
+        {104, 184, 0, 12, 1},
+        {106, 184, 4, 12, 1},
+        {108, 184, 8, 12, 1},
+        {110, 185, 0, 12, 1},
+        {112, 185, 4, 12, 1},
+        {114, 185, 8, 12, 1},
+        {116, 186, 0, 12, 1},
+        {118, 186, 4, 12, 1},
+        {120, 186, 8, 12, 1},
+        {122, 187, 0, 12, 1},
+        {124, 187, 4, 12, 1},
+        {126, 187, 8, 12, 1},
+        {128, 188, 0, 12, 1},
+        {130, 188, 4, 12, 1},
+        {132, 188, 8, 12, 1},
+        {134, 189, 0, 12, 1},
+        {136, 189, 4, 12, 1},
+        {138, 189, 8, 12, 1},
+        {140, 190, 0, 12, 1},
+        {149, 191, 6, 12, 1},
+        {151, 191, 10, 12, 1},
+        {153, 192, 2, 12, 1},
+        {155, 192, 6, 12, 1},
+        {157, 192, 10, 12, 1},
+        {159, 193, 2, 12, 1},
+        {161, 193, 6, 12, 1},
+        {165, 194, 2, 12, 1},
+        {184, 164, 0, 12, 1},
+        {188, 164, 4, 12, 1},
+        {192, 165, 8, 12, 1},
+        {196, 166, 0, 12, 1},
+};
+
+static const struct rf_channel rf_vals_5592_xtal40[] = {
+        /* Channel, N, K, mod, R */
+        {1, 241, 2, 10, 3},
+        {2, 241, 7, 10, 3},
+        {3, 242, 2, 10, 3},
+        {4, 242, 7, 10, 3},
+        {5, 243, 2, 10, 3},
+        {6, 243, 7, 10, 3},
+        {7, 244, 2, 10, 3},
+        {8, 244, 7, 10, 3},
+        {9, 245, 2, 10, 3},
+        {10, 245, 7, 10, 3},
+        {11, 246, 2, 10, 3},
+        {12, 246, 7, 10, 3},
+        {13, 247, 2, 10, 3},
+        {14, 248, 4, 10, 3},
+        {36, 86, 4, 12, 1},
+        {38, 86, 6, 12, 1},
+        {40, 86, 8, 12, 1},
+        {42, 86, 10, 12, 1},
+        {44, 87, 0, 12, 1},
+        {46, 87, 2, 12, 1},
+        {48, 87, 4, 12, 1},
+        {50, 87, 6, 12, 1},
+        {52, 87, 8, 12, 1},
+        {54, 87, 10, 12, 1},
+        {56, 88, 0, 12, 1},
+        {58, 88, 2, 12, 1},
+        {60, 88, 4, 12, 1},
+        {62, 88, 6, 12, 1},
+        {64, 88, 8, 12, 1},
+        {100, 91, 8, 12, 1},
+        {102, 91, 10, 12, 1},
+        {104, 92, 0, 12, 1},
+        {106, 92, 2, 12, 1},
+        {108, 92, 4, 12, 1},
+        {110, 92, 6, 12, 1},
+        {112, 92, 8, 12, 1},
+        {114, 92, 10, 12, 1},
+        {116, 93, 0, 12, 1},
+        {118, 93, 2, 12, 1},
+        {120, 93, 4, 12, 1},
+        {122, 93, 6, 12, 1},
+        {124, 93, 8, 12, 1},
+        {126, 93, 10, 12, 1},
+        {128, 94, 0, 12, 1},
+        {130, 94, 2, 12, 1},
+        {132, 94, 4, 12, 1},
+        {134, 94, 6, 12, 1},
+        {136, 94, 8, 12, 1},
+        {138, 94, 10, 12, 1},
+        {140, 95, 0, 12, 1},
+        {149, 95, 9, 12, 1},
+        {151, 95, 11, 12, 1},
+        {153, 96, 1, 12, 1},
+        {155, 96, 3, 12, 1},
+        {157, 96, 5, 12, 1},
+        {159, 96, 7, 12, 1},
+        {161, 96, 9, 12, 1},
+        {165, 97, 1, 12, 1},
+        {184, 82, 0, 12, 1},
+        {188, 82, 4, 12, 1},
+        {192, 82, 8, 12, 1},
+        {196, 83, 0, 12, 1},
+};
+
 static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 {
         struct hw_mode_spec *spec = &rt2x00dev->spec;
@@ -5130,6 +5847,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         char *default_power2;
         unsigned int i;
         u16 eeprom;
+        u32 reg;
 
         /*
          * Disable powersaving as default on PCI devices.
@@ -5211,8 +5929,22 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_3x);
                 spec->channels = rf_vals_3x;
+        } else if (rt2x00_rf(rt2x00dev, RF5592)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
+
+                rt2800_register_read(rt2x00dev, MAC_DEBUG_INDEX, &reg);
+                if (rt2x00_get_field32(reg, MAC_DEBUG_INDEX_XTAL)) {
+                        spec->num_channels = ARRAY_SIZE(rf_vals_5592_xtal40);
+                        spec->channels = rf_vals_5592_xtal40;
+                } else {
+                        spec->num_channels = ARRAY_SIZE(rf_vals_5592_xtal20);
+                        spec->channels = rf_vals_5592_xtal20;
+                }
         }
 
+        if (WARN_ON_ONCE(!spec->channels))
+                return -ENODEV;
+
         /*
          * Initialize HT information.
          */
@@ -5300,11 +6032,56 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         return 0;
 }
 
+static int rt2800_probe_rt(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        u32 rt;
+        u32 rev;
+
+        if (rt2x00_rt(rt2x00dev, RT3290))
+                rt2800_register_read(rt2x00dev, MAC_CSR0_3290, &reg);
+        else
+                rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
+
+        rt = rt2x00_get_field32(reg, MAC_CSR0_CHIPSET);
+        rev = rt2x00_get_field32(reg, MAC_CSR0_REVISION);
+
+        switch (rt) {
+        case RT2860:
+        case RT2872:
+        case RT2883:
+        case RT3070:
+        case RT3071:
+        case RT3090:
+        case RT3290:
+        case RT3352:
+        case RT3390:
+        case RT3572:
+        case RT5390:
+        case RT5392:
+        case RT5592:
+                break;
+        default:
+                ERROR(rt2x00dev,
+                      "Invalid RT chipset 0x%04x, rev %04x detected.\n",
+                      rt, rev);
+                return -ENODEV;
+        }
+
+        rt2x00_set_rt(rt2x00dev, rt, rev);
+
+        return 0;
+}
+
 int rt2800_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
         u32 reg;
 
+        retval = rt2800_probe_rt(rt2x00dev);
+        if (retval)
+                return retval;
+
         /*
          * Allocate eeprom data.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 48a01aa21f1c..def357eb0586 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -41,6 +41,7 @@
 #include <linux/eeprom_93cx6.h>
 
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt2x00soc.h"
 #include "rt2800lib.h"
@@ -71,7 +72,7 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
                 return;
 
         for (i = 0; i < 200; i++) {
-                rt2x00pci_register_read(rt2x00dev, H2M_MAILBOX_CID, &reg);
+                rt2x00mmio_register_read(rt2x00dev, H2M_MAILBOX_CID, &reg);
 
                 if ((rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD0) == token) ||
                     (rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD1) == token) ||
@@ -85,11 +86,11 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
         if (i == 200)
                 ERROR(rt2x00dev, "MCU request failed, no response from hardware\n");
 
-        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
-        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
+        rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
+        rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
 }
 
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
         void __iomem *base_addr = ioremap(0x1F040000, EEPROM_SIZE);
@@ -107,7 +108,7 @@ static inline int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
         return -ENOMEM;
 }
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 
 #ifdef CONFIG_PCI
 static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
@@ -115,7 +116,7 @@ static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
         struct rt2x00_dev *rt2x00dev = eeprom->data;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, E2PROM_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, E2PROM_CSR, &reg);
 
         eeprom->reg_data_in = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_IN);
         eeprom->reg_data_out = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_OUT);
@@ -137,7 +138,7 @@ static void rt2800pci_eepromregister_write(struct eeprom_93cx6 *eeprom)
         rt2x00_set_field32(&reg, E2PROM_CSR_CHIP_SELECT,
                            !!eeprom->reg_chip_select);
 
-        rt2x00pci_register_write(rt2x00dev, E2PROM_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, E2PROM_CSR, reg);
 }
 
 static int rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
@@ -145,7 +146,7 @@ static int rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
         struct eeprom_93cx6 eeprom;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, E2PROM_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, E2PROM_CSR, &reg);
 
         eeprom.data = rt2x00dev;
         eeprom.register_read = rt2800pci_eepromregister_read;
@@ -209,20 +210,20 @@ static void rt2800pci_start_queue(struct data_queue *queue)
 
         switch (queue->qid) {
         case QID_RX:
-                rt2x00pci_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+                rt2x00mmio_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
                 rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 1);
-                rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+                rt2x00mmio_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
                 break;
         case QID_BEACON:
-                rt2x00pci_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                rt2x00mmio_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
                 rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
                 rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
                 rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
-                rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+                rt2x00mmio_register_write(rt2x00dev, BCN_TIME_CFG, reg);
 
-                rt2x00pci_register_read(rt2x00dev, INT_TIMER_EN, &reg);
+                rt2x00mmio_register_read(rt2x00dev, INT_TIMER_EN, &reg);
                 rt2x00_set_field32(&reg, INT_TIMER_EN_PRE_TBTT_TIMER, 1);
-                rt2x00pci_register_write(rt2x00dev, INT_TIMER_EN, reg);
+                rt2x00mmio_register_write(rt2x00dev, INT_TIMER_EN, reg);
                 break;
         default:
                 break;
@@ -240,13 +241,13 @@ static void rt2800pci_kick_queue(struct data_queue *queue)
         case QID_AC_BE:
         case QID_AC_BK:
                 entry = rt2x00queue_get_entry(queue, Q_INDEX);
-                rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX(queue->qid),
-                                         entry->entry_idx);
+                rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX(queue->qid),
+                                          entry->entry_idx);
                 break;
         case QID_MGMT:
                 entry = rt2x00queue_get_entry(queue, Q_INDEX);
-                rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX(5),
-                                         entry->entry_idx);
+                rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX(5),
+                                          entry->entry_idx);
                 break;
         default:
                 break;
@@ -260,20 +261,20 @@ static void rt2800pci_stop_queue(struct data_queue *queue)
 
         switch (queue->qid) {
         case QID_RX:
-                rt2x00pci_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+                rt2x00mmio_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
                 rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 0);
-                rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+                rt2x00mmio_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
                 break;
         case QID_BEACON:
-                rt2x00pci_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                rt2x00mmio_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
                 rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 0);
                 rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 0);
                 rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
-                rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+                rt2x00mmio_register_write(rt2x00dev, BCN_TIME_CFG, reg);
 
-                rt2x00pci_register_read(rt2x00dev, INT_TIMER_EN, &reg);
+                rt2x00mmio_register_read(rt2x00dev, INT_TIMER_EN, &reg);
                 rt2x00_set_field32(&reg, INT_TIMER_EN_PRE_TBTT_TIMER, 0);
-                rt2x00pci_register_write(rt2x00dev, INT_TIMER_EN, reg);
+                rt2x00mmio_register_write(rt2x00dev, INT_TIMER_EN, reg);
 
                 /*
                  * Wait for current invocation to finish. The tasklet
@@ -313,19 +314,19 @@ static int rt2800pci_write_firmware(struct rt2x00_dev *rt2x00dev,
          */
         reg = 0;
         rt2x00_set_field32(&reg, PBF_SYS_CTRL_HOST_RAM_WRITE, 1);
-        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, reg);
+        rt2x00mmio_register_write(rt2x00dev, PBF_SYS_CTRL, reg);
 
         /*
          * Write firmware to device.
          */
-        rt2x00pci_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
-                                      data, len);
+        rt2x00mmio_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+                                       data, len);
 
-        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000);
-        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00001);
+        rt2x00mmio_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000);
+        rt2x00mmio_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00001);
 
-        rt2x00pci_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
-        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        rt2x00mmio_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
 
         return 0;
 }
@@ -335,7 +336,7 @@ static int rt2800pci_write_firmware(struct rt2x00_dev *rt2x00dev,
  */
 static bool rt2800pci_get_entry_state(struct queue_entry *entry)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         u32 word;
 
         if (entry->queue->qid == QID_RX) {
@@ -351,7 +352,7 @@ static bool rt2800pci_get_entry_state(struct queue_entry *entry)
 
 static void rt2800pci_clear_entry(struct queue_entry *entry)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         u32 word;
@@ -369,8 +370,8 @@ static void rt2800pci_clear_entry(struct queue_entry *entry)
                  * Set RX IDX in register to inform hardware that we have
                  * handled this entry and it is available for reuse again.
                  */
-                rt2x00pci_register_write(rt2x00dev, RX_CRX_IDX,
-                                      entry->entry_idx);
+                rt2x00mmio_register_write(rt2x00dev, RX_CRX_IDX,
+                                          entry->entry_idx);
         } else {
                 rt2x00_desc_read(entry_priv->desc, 1, &word);
                 rt2x00_set_field32(&word, TXD_W1_DMA_DONE, 1);
@@ -380,60 +381,65 @@ static void rt2800pci_clear_entry(struct queue_entry *entry)
 
 static int rt2800pci_init_queues(struct rt2x00_dev *rt2x00dev)
 {
-        struct queue_entry_priv_pci *entry_priv;
+        struct queue_entry_priv_mmio *entry_priv;
 
         /*
          * Initialize registers.
          */
         entry_priv = rt2x00dev->tx[0].entries[0].priv_data;
-        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR0, entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT0,
-                                 rt2x00dev->tx[0].limit);
-        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX0, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX0, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR0,
+                                  entry_priv->desc_dma);
+        rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT0,
+                                  rt2x00dev->tx[0].limit);
+        rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX0, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX0, 0);
 
         entry_priv = rt2x00dev->tx[1].entries[0].priv_data;
-        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR1, entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT1,
-                                 rt2x00dev->tx[1].limit);
-        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX1, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX1, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR1,
+                                  entry_priv->desc_dma);
+        rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT1,
+                                  rt2x00dev->tx[1].limit);
+        rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX1, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX1, 0);
 
         entry_priv = rt2x00dev->tx[2].entries[0].priv_data;
-        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR2, entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT2,
-                                 rt2x00dev->tx[2].limit);
-        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX2, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX2, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR2,
+                                  entry_priv->desc_dma);
+        rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT2,
+                                  rt2x00dev->tx[2].limit);
+        rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX2, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX2, 0);
 
         entry_priv = rt2x00dev->tx[3].entries[0].priv_data;
-        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR3, entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT3,
-                                 rt2x00dev->tx[3].limit);
-        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX3, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX3, 0);
-
-        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR4, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT4, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX4, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX4, 0);
-
-        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR5, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT5, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX5, 0);
-        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX5, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR3,
+                                  entry_priv->desc_dma);
+        rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT3,
+                                  rt2x00dev->tx[3].limit);
+        rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX3, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX3, 0);
+
+        rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR4, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT4, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX4, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX4, 0);
+
+        rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR5, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT5, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX5, 0);
+        rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX5, 0);
 
         entry_priv = rt2x00dev->rx->entries[0].priv_data;
-        rt2x00pci_register_write(rt2x00dev, RX_BASE_PTR, entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, RX_MAX_CNT,
-                                 rt2x00dev->rx[0].limit);
-        rt2x00pci_register_write(rt2x00dev, RX_CRX_IDX,
-                                 rt2x00dev->rx[0].limit - 1);
-        rt2x00pci_register_write(rt2x00dev, RX_DRX_IDX, 0);
+        rt2x00mmio_register_write(rt2x00dev, RX_BASE_PTR,
+                                  entry_priv->desc_dma);
+        rt2x00mmio_register_write(rt2x00dev, RX_MAX_CNT,
+                                  rt2x00dev->rx[0].limit);
+        rt2x00mmio_register_write(rt2x00dev, RX_CRX_IDX,
+                                  rt2x00dev->rx[0].limit - 1);
+        rt2x00mmio_register_write(rt2x00dev, RX_DRX_IDX, 0);
 
         rt2800_disable_wpdma(rt2x00dev);
 
-        rt2x00pci_register_write(rt2x00dev, DELAY_INT_CFG, 0);
+        rt2x00mmio_register_write(rt2x00dev, DELAY_INT_CFG, 0);
 
         return 0;
 }
@@ -452,8 +458,8 @@ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
          * should clear the register to assure a clean state.
          */
         if (state == STATE_RADIO_IRQ_ON) {
-                rt2x00pci_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
-                rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+                rt2x00mmio_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
+                rt2x00mmio_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
         }
 
         spin_lock_irqsave(&rt2x00dev->irqmask_lock, flags);
@@ -465,7 +471,7 @@ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, INT_MASK_CSR_TX_FIFO_STATUS, 1);
                 rt2x00_set_field32(&reg, INT_MASK_CSR_AUTO_WAKEUP, 1);
         }
-        rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, INT_MASK_CSR, reg);
         spin_unlock_irqrestore(&rt2x00dev->irqmask_lock, flags);
 
         if (state == STATE_RADIO_IRQ_OFF) {
@@ -487,7 +493,7 @@ static int rt2800pci_init_registers(struct rt2x00_dev *rt2x00dev)
         /*
          * Reset DMA indexes
          */
-        rt2x00pci_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
+        rt2x00mmio_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
         rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, 1);
         rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, 1);
         rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, 1);
@@ -495,29 +501,29 @@ static int rt2800pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX4, 1);
         rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX5, 1);
         rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
-        rt2x00pci_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
+        rt2x00mmio_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
 
-        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
-        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
+        rt2x00mmio_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
+        rt2x00mmio_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
 
         if (rt2x00_is_pcie(rt2x00dev) &&
             (rt2x00_rt(rt2x00dev, RT3572) ||
              rt2x00_rt(rt2x00dev, RT5390) ||
              rt2x00_rt(rt2x00dev, RT5392))) {
-                rt2x00pci_register_read(rt2x00dev, AUX_CTRL, &reg);
+                rt2x00mmio_register_read(rt2x00dev, AUX_CTRL, &reg);
                 rt2x00_set_field32(&reg, AUX_CTRL_FORCE_PCIE_CLK, 1);
                 rt2x00_set_field32(&reg, AUX_CTRL_WAKE_PCIE_EN, 1);
-                rt2x00pci_register_write(rt2x00dev, AUX_CTRL, reg);
+                rt2x00mmio_register_write(rt2x00dev, AUX_CTRL, reg);
         }
 
-        rt2x00pci_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
+        rt2x00mmio_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
 
         reg = 0;
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
-        rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
 
-        rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+        rt2x00mmio_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
 
         return 0;
 }
@@ -537,8 +543,8 @@ static int rt2800pci_enable_radio(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /* After resume MCU_BOOT_SIGNAL will trash these. */
-        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
-        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
+        rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
+        rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
 
         rt2800_mcu_request(rt2x00dev, MCU_SLEEP, TOKEN_RADIO_OFF, 0xff, 0x02);
         rt2800pci_mcu_status(rt2x00dev, TOKEN_RADIO_OFF);
@@ -553,8 +559,8 @@ static void rt2800pci_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
         if (rt2x00_is_soc(rt2x00dev)) {
                 rt2800_disable_radio(rt2x00dev);
-                rt2x00pci_register_write(rt2x00dev, PWR_PIN_CFG, 0);
-                rt2x00pci_register_write(rt2x00dev, TX_PIN_CFG, 0);
+                rt2x00mmio_register_write(rt2x00dev, PWR_PIN_CFG, 0);
+                rt2x00mmio_register_write(rt2x00dev, TX_PIN_CFG, 0);
         }
 }
 
@@ -566,10 +572,10 @@ static int rt2800pci_set_state(struct rt2x00_dev *rt2x00dev,
                                    0, 0x02);
                 rt2800pci_mcu_status(rt2x00dev, TOKEN_WAKEUP);
         } else if (state == STATE_SLEEP) {
-                rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_STATUS,
-                                         0xffffffff);
-                rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID,
-                                         0xffffffff);
+                rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_STATUS,
+                                          0xffffffff);
+                rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CID,
+                                          0xffffffff);
                 rt2800_mcu_request(rt2x00dev, MCU_SLEEP, TOKEN_SLEEP,
                                    0xff, 0x01);
         }
@@ -628,7 +634,7 @@ static void rt2800pci_write_tx_desc(struct queue_entry *entry,
                                     struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         __le32 *txd = entry_priv->desc;
         u32 word;
 
@@ -682,7 +688,7 @@ static void rt2800pci_write_tx_desc(struct queue_entry *entry,
 static void rt2800pci_fill_rxdone(struct queue_entry *entry,
                                   struct rxdone_entry_desc *rxdesc)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         __le32 *rxd = entry_priv->desc;
         u32 word;
 
@@ -729,6 +735,11 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
          * Process the RXWI structure that is at the start of the buffer.
          */
         rt2800_process_rxwi(entry, rxdesc);
+
+        /*
+         * Remove RXWI descriptor from start of buffer.
+         */
+        skb_pull(entry->skb, RXWI_DESC_SIZE);
 }
 
 /*
@@ -742,10 +753,90 @@ static void rt2800pci_wakeup(struct rt2x00_dev *rt2x00dev)
         rt2800_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
 }
 
+static bool rt2800pci_txdone_entry_check(struct queue_entry *entry, u32 status)
+{
+        __le32 *txwi;
+        u32 word;
+        int wcid, tx_wcid;
+
+        wcid = rt2x00_get_field32(status, TX_STA_FIFO_WCID);
+
+        txwi = rt2800_drv_get_txwi(entry);
+        rt2x00_desc_read(txwi, 1, &word);
+        tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
+
+        return (tx_wcid == wcid);
+}
+
+static bool rt2800pci_txdone_find_entry(struct queue_entry *entry, void *data)
+{
+        u32 status = *(u32 *)data;
+
+        /*
+         * rt2800pci hardware might reorder frames when exchanging traffic
+         * with multiple BA enabled STAs.
+         *
+         * For example, a tx queue
+         *    [ STA1 | STA2 | STA1 | STA2 ]
+         * can result in tx status reports
+         *    [ STA1 | STA1 | STA2 | STA2 ]
+         * when the hw decides to aggregate the frames for STA1 into one AMPDU.
+         *
+         * To mitigate this effect, associate the tx status to the first frame
+         * in the tx queue with a matching wcid.
+         */
+        if (rt2800pci_txdone_entry_check(entry, status) &&
+            !test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+                /*
+                 * Got a matching frame, associate the tx status with
+                 * the frame
+                 */
+                entry->status = status;
+                set_bit(ENTRY_DATA_STATUS_SET, &entry->flags);
+                return true;
+        }
+
+        /* Check the next frame */
+        return false;
+}
+
+static bool rt2800pci_txdone_match_first(struct queue_entry *entry, void *data)
+{
+        u32 status = *(u32 *)data;
+
+        /*
+         * Find the first frame without tx status and assign this status to it
+         * regardless if it matches or not.
+         */
+        if (!test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+                /*
+                 * Got a matching frame, associate the tx status with
+                 * the frame
+                 */
+                entry->status = status;
+                set_bit(ENTRY_DATA_STATUS_SET, &entry->flags);
+                return true;
+        }
+
+        /* Check the next frame */
+        return false;
+}
+static bool rt2800pci_txdone_release_entries(struct queue_entry *entry,
+                                             void *data)
+{
+        if (test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+                rt2800_txdone_entry(entry, entry->status,
+                                    rt2800pci_get_txwi(entry));
+                return false;
+        }
+
+        /* No more frames to release */
+        return true;
+}
+
 static bool rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
 {
         struct data_queue *queue;
-        struct queue_entry *entry;
         u32 status;
         u8 qid;
         int max_tx_done = 16;
@@ -783,8 +874,33 @@ static bool rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
                         break;
                 }
 
-                entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
-                rt2800_txdone_entry(entry, status, rt2800pci_get_txwi(entry));
+                /*
+                 * Let's associate this tx status with the first
+                 * matching frame.
+                 */
+                if (!rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+                                                Q_INDEX, &status,
+                                                rt2800pci_txdone_find_entry)) {
+                        /*
+                         * We cannot match the tx status to any frame, so just
+                         * use the first one.
+                         */
+                        if (!rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+                                                        Q_INDEX, &status,
+                                                        rt2800pci_txdone_match_first)) {
+                                WARNING(rt2x00dev, "No frame found for TX "
+                                                   "status on queue %u, dropping\n",
+                                                   qid);
+                                break;
+                        }
+                }
+
+                /*
+                 * Release all frames with a valid tx status.
+                 */
+                rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+                                           Q_INDEX, NULL,
+                                           rt2800pci_txdone_release_entries);
 
                 if (--max_tx_done == 0)
                         break;
@@ -803,9 +919,9 @@ static inline void rt2800pci_enable_interrupt(struct rt2x00_dev *rt2x00dev,
          * access needs locking.
          */
         spin_lock_irq(&rt2x00dev->irqmask_lock);
-        rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, INT_MASK_CSR, &reg);
         rt2x00_set_field32(&reg, irq_field, 1);
-        rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, INT_MASK_CSR, reg);
         spin_unlock_irq(&rt2x00dev->irqmask_lock);
 }
 
@@ -846,15 +962,15 @@ static void rt2800pci_tbtt_tasklet(unsigned long data)
                  * interval every 64 beacons by 64us to mitigate this effect.
                  */
                 if (drv_data->tbtt_tick == (BCN_TBTT_OFFSET - 2)) {
-                        rt2x00pci_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                        rt2x00mmio_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
                         rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
                                            (rt2x00dev->beacon_int * 16) - 1);
-                        rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+                        rt2x00mmio_register_write(rt2x00dev, BCN_TIME_CFG, reg);
                 } else if (drv_data->tbtt_tick == (BCN_TBTT_OFFSET - 1)) {
-                        rt2x00pci_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                        rt2x00mmio_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
                         rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
                                            (rt2x00dev->beacon_int * 16));
-                        rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+                        rt2x00mmio_register_write(rt2x00dev, BCN_TIME_CFG, reg);
                 }
                 drv_data->tbtt_tick++;
                 drv_data->tbtt_tick %= BCN_TBTT_OFFSET;
@@ -867,7 +983,7 @@ static void rt2800pci_tbtt_tasklet(unsigned long data)
 static void rt2800pci_rxdone_tasklet(unsigned long data)
 {
         struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
-        if (rt2x00pci_rxdone(rt2x00dev))
+        if (rt2x00mmio_rxdone(rt2x00dev))
                 tasklet_schedule(&rt2x00dev->rxdone_tasklet);
         else if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
                 rt2800pci_enable_interrupt(rt2x00dev, INT_MASK_CSR_RX_DONE);
@@ -905,7 +1021,7 @@ static void rt2800pci_txstatus_interrupt(struct rt2x00_dev *rt2x00dev)
          * need to lock the kfifo.
          */
         for (i = 0; i < rt2x00dev->ops->tx->entry_num; i++) {
-                rt2x00pci_register_read(rt2x00dev, TX_STA_FIFO, &status);
+                rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO, &status);
 
                 if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
                         break;
@@ -927,8 +1043,8 @@ static irqreturn_t rt2800pci_interrupt(int irq, void *dev_instance)
         u32 reg, mask;
 
         /* Read status and ACK all interrupts */
-        rt2x00pci_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
-        rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+        rt2x00mmio_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
+        rt2x00mmio_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
 
         if (!reg)
                 return IRQ_NONE;
@@ -968,9 +1084,9 @@ static irqreturn_t rt2800pci_interrupt(int irq, void *dev_instance)
          * the tasklet will reenable the appropriate interrupts.
          */
         spin_lock(&rt2x00dev->irqmask_lock);
-        rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, INT_MASK_CSR, &reg);
         reg &= mask;
-        rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, INT_MASK_CSR, reg);
         spin_unlock(&rt2x00dev->irqmask_lock);
 
         return IRQ_HANDLED;
@@ -1021,13 +1137,13 @@ static const struct ieee80211_ops rt2800pci_mac80211_ops = {
 };
 
 static const struct rt2800_ops rt2800pci_rt2800_ops = {
-        .register_read          = rt2x00pci_register_read,
-        .register_read_lock     = rt2x00pci_register_read, /* same for PCI */
-        .register_write         = rt2x00pci_register_write,
-        .register_write_lock    = rt2x00pci_register_write, /* same for PCI */
-        .register_multiread     = rt2x00pci_register_multiread,
-        .register_multiwrite    = rt2x00pci_register_multiwrite,
-        .regbusy_read           = rt2x00pci_regbusy_read,
+        .register_read          = rt2x00mmio_register_read,
+        .register_read_lock     = rt2x00mmio_register_read, /* same for PCI */
+        .register_write         = rt2x00mmio_register_write,
+        .register_write_lock    = rt2x00mmio_register_write, /* same for PCI */
+        .register_multiread     = rt2x00mmio_register_multiread,
+        .register_multiwrite    = rt2x00mmio_register_multiwrite,
+        .regbusy_read           = rt2x00mmio_regbusy_read,
         .read_eeprom            = rt2800pci_read_eeprom,
         .hwcrypt_disabled       = rt2800pci_hwcrypt_disabled,
         .drv_write_firmware     = rt2800pci_write_firmware,
@@ -1046,8 +1162,8 @@ static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
         .get_firmware_name      = rt2800pci_get_firmware_name,
         .check_firmware         = rt2800_check_firmware,
         .load_firmware          = rt2800_load_firmware,
-        .initialize             = rt2x00pci_initialize,
-        .uninitialize           = rt2x00pci_uninitialize,
+        .initialize             = rt2x00mmio_initialize,
+        .uninitialize           = rt2x00mmio_uninitialize,
         .get_entry_state        = rt2800pci_get_entry_state,
         .clear_entry            = rt2800pci_clear_entry,
         .set_device_state       = rt2800pci_set_device_state,
@@ -1060,7 +1176,7 @@ static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
         .start_queue            = rt2800pci_start_queue,
         .kick_queue             = rt2800pci_kick_queue,
         .stop_queue             = rt2800pci_stop_queue,
-        .flush_queue            = rt2x00pci_flush_queue,
+        .flush_queue            = rt2x00mmio_flush_queue,
         .write_tx_desc          = rt2800pci_write_tx_desc,
         .write_tx_data          = rt2800_write_tx_data,
         .write_beacon           = rt2800_write_beacon,
@@ -1081,21 +1197,21 @@ static const struct data_queue_desc rt2800pci_queue_rx = {
         .entry_num              = 128,
         .data_size              = AGGREGATION_SIZE,
         .desc_size              = RXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt2800pci_queue_tx = {
         .entry_num              = 64,
         .data_size              = AGGREGATION_SIZE,
         .desc_size              = TXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt2800pci_queue_bcn = {
         .entry_num              = 8,
         .data_size              = 0, /* No DMA required for beacons */
         .desc_size              = TXWI_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct rt2x00_ops rt2800pci_ops = {
@@ -1177,7 +1293,7 @@ MODULE_DEVICE_TABLE(pci, rt2800pci_device_table);
 #endif /* CONFIG_PCI */
 MODULE_LICENSE("GPL");
 
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800soc_probe(struct platform_device *pdev)
 {
         return rt2x00soc_probe(pdev, &rt2800pci_ops);
@@ -1194,7 +1310,7 @@ static struct platform_driver rt2800soc_driver = {
         .suspend        = rt2x00soc_suspend,
         .resume         = rt2x00soc_resume,
 };
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 
 #ifdef CONFIG_PCI
 static int rt2800pci_probe(struct pci_dev *pci_dev,
@@ -1217,7 +1333,7 @@ static int __init rt2800pci_init(void)
 {
         int ret = 0;
 
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
         ret = platform_driver_register(&rt2800soc_driver);
         if (ret)
                 return ret;
@@ -1225,7 +1341,7 @@ static int __init rt2800pci_init(void)
 #ifdef CONFIG_PCI
         ret = pci_register_driver(&rt2800pci_driver);
         if (ret) {
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
                 platform_driver_unregister(&rt2800soc_driver);
 #endif
                 return ret;
@@ -1240,7 +1356,7 @@ static void __exit rt2800pci_exit(void)
 #ifdef CONFIG_PCI
         pci_unregister_driver(&rt2800pci_driver);
 #endif
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
         platform_driver_unregister(&rt2800soc_driver);
 #endif
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 098613ed93fb..f32282009146 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -485,7 +485,7 @@ static void rt2800usb_write_tx_desc(struct queue_entry *entry,
          */
         skbdesc->flags |= SKBDESC_DESC_IN_SKB;
         skbdesc->desc = txi;
-        skbdesc->desc_len = TXINFO_DESC_SIZE + TXWI_DESC_SIZE;
+        skbdesc->desc_len = entry->queue->desc_size;
 }
 
 /*
@@ -730,6 +730,11 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
          * Process the RXWI structure.
          */
         rt2800_process_rxwi(entry, rxdesc);
+
+        /*
+         * Remove RXWI descriptor from start of buffer.
+         */
+        skb_pull(entry->skb, entry->queue->desc_size - RXINFO_DESC_SIZE);
 }
 
 /*
@@ -890,6 +895,47 @@ static const struct rt2x00_ops rt2800usb_ops = {
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 };
 
+static const struct data_queue_desc rt2800usb_queue_rx_5592 = {
+        .entry_num              = 128,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = RXINFO_DESC_SIZE + RXWI_DESC_SIZE_5592,
+        .priv_size              = sizeof(struct queue_entry_priv_usb),
+};
+
+static const struct data_queue_desc rt2800usb_queue_tx_5592 = {
+        .entry_num              = 16,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = TXINFO_DESC_SIZE + TXWI_DESC_SIZE_5592,
+        .priv_size              = sizeof(struct queue_entry_priv_usb),
+};
+
+static const struct data_queue_desc rt2800usb_queue_bcn_5592 = {
+        .entry_num              = 8,
+        .data_size              = MGMT_FRAME_SIZE,
+        .desc_size              = TXINFO_DESC_SIZE + TXWI_DESC_SIZE_5592,
+        .priv_size              = sizeof(struct queue_entry_priv_usb),
+};
+
+
+static const struct rt2x00_ops rt2800usb_ops_5592 = {
+        .name                   = KBUILD_MODNAME,
+        .drv_data_size          = sizeof(struct rt2800_drv_data),
+        .max_ap_intf            = 8,
+        .eeprom_size            = EEPROM_SIZE,
+        .rf_size                = RF_SIZE,
+        .tx_queues              = NUM_TX_QUEUES,
+        .extra_tx_headroom      = TXINFO_DESC_SIZE + TXWI_DESC_SIZE_5592,
+        .rx                     = &rt2800usb_queue_rx_5592,
+        .tx                     = &rt2800usb_queue_tx_5592,
+        .bcn                    = &rt2800usb_queue_bcn_5592,
+        .lib                    = &rt2800usb_rt2x00_ops,
+        .drv                    = &rt2800usb_rt2800_ops,
+        .hw                     = &rt2800usb_mac80211_ops,
+#ifdef CONFIG_RT2X00_LIB_DEBUGFS
+        .debugfs                = &rt2800_rt2x00debug,
+#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
+};
+
 /*
  * rt2800usb module information.
  */
@@ -1200,6 +1246,18 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x148f, 0x5370) },
         { USB_DEVICE(0x148f, 0x5372) },
 #endif
+#ifdef CONFIG_RT2800USB_RT55XX
+        /* Arcadyan */
+        { USB_DEVICE(0x043e, 0x7a32), .driver_info = 5592 },
+        /* AVM GmbH */
+        { USB_DEVICE(0x057c, 0x8501), .driver_info = 5592 },
+        /* D-Link DWA-160-B2 */
+        { USB_DEVICE(0x2001, 0x3c1a), .driver_info = 5592 },
+        /* Proware */
+        { USB_DEVICE(0x043e, 0x7a13), .driver_info = 5592 },
+        /* Ralink */
+        { USB_DEVICE(0x148f, 0x5572), .driver_info = 5592 },
+#endif
 #ifdef CONFIG_RT2800USB_UNKNOWN
         /*
          * Unclear what kind of devices these are (they aren't supported by the
@@ -1303,6 +1361,9 @@ MODULE_LICENSE("GPL");
 static int rt2800usb_probe(struct usb_interface *usb_intf,
                            const struct usb_device_id *id)
 {
+        if (id->driver_info == 5592)
+                return rt2x00usb_probe(usb_intf, &rt2800usb_ops_5592);
+
         return rt2x00usb_probe(usb_intf, &rt2800usb_ops);
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 041b392f4f47..0d02d16ca166 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -193,6 +193,7 @@ struct rt2x00_chip {
 #define RT3883          0x3883  /* WSOC */
 #define RT5390          0x5390  /* 2.4GHz */
 #define RT5392          0x5392  /* 2.4GHz */
+#define RT5592          0x5592
 
         u16 rf;
         u16 rev;
@@ -1064,8 +1065,7 @@ static inline void rt2x00_rf_write(struct rt2x00_dev *rt2x00dev,
 }
 
 /*
- *  Generic EEPROM access.
- * The EEPROM is being accessed by word index.
+ * Generic EEPROM access. The EEPROM is being accessed by word or byte index.
  */
 static inline void *rt2x00_eeprom_addr(struct rt2x00_dev *rt2x00dev,
                                        const unsigned int word)
@@ -1085,6 +1085,12 @@ static inline void rt2x00_eeprom_write(struct rt2x00_dev *rt2x00dev,
         rt2x00dev->eeprom[word] = cpu_to_le16(data);
 }
 
+static inline u8 rt2x00_eeprom_byte(struct rt2x00_dev *rt2x00dev,
+                                    const unsigned int byte)
+{
+        return *(((u8 *)rt2x00dev->eeprom) + byte);
+}
+
 /*
  * Chipset handlers
  */
@@ -1100,6 +1106,23 @@ static inline void rt2x00_set_chip(struct rt2x00_dev *rt2x00dev,
              rt2x00dev->chip.rt, rt2x00dev->chip.rf, rt2x00dev->chip.rev);
 }
 
+static inline void rt2x00_set_rt(struct rt2x00_dev *rt2x00dev,
+                                 const u16 rt, const u16 rev)
+{
+        rt2x00dev->chip.rt = rt;
+        rt2x00dev->chip.rev = rev;
+
+        INFO(rt2x00dev, "RT chipset %04x, rev %04x detected\n",
+             rt2x00dev->chip.rt, rt2x00dev->chip.rev);
+}
+
+static inline void rt2x00_set_rf(struct rt2x00_dev *rt2x00dev, const u16 rf)
+{
+        rt2x00dev->chip.rf = rf;
+
+        INFO(rt2x00dev, "RF chipset %04x detected\n", rt2x00dev->chip.rf);
+}
+
 static inline bool rt2x00_rt(struct rt2x00_dev *rt2x00dev, const u16 rt)
 {
         return (rt2x00dev->chip.rt == rt);
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 1031db66474a..189744db65e0 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1236,8 +1236,10 @@ static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
          */
         if_limit = &rt2x00dev->if_limits_ap;
         if_limit->max = rt2x00dev->ops->max_ap_intf;
-        if_limit->types = BIT(NL80211_IFTYPE_AP) |
-                        BIT(NL80211_IFTYPE_MESH_POINT);
+        if_limit->types = BIT(NL80211_IFTYPE_AP);
+#ifdef CONFIG_MAC80211_MESH
+        if_limit->types |= BIT(NL80211_IFTYPE_MESH_POINT);
+#endif
 
         /*
          * Build up AP interface combinations structure.
@@ -1309,7 +1311,9 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
                 rt2x00dev->hw->wiphy->interface_modes |=
                     BIT(NL80211_IFTYPE_ADHOC) |
                     BIT(NL80211_IFTYPE_AP) |
+#ifdef CONFIG_MAC80211_MESH
                     BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
                     BIT(NL80211_IFTYPE_WDS);
 
         rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
diff --git a/drivers/net/wireless/rt2x00/rt2x00mmio.c b/drivers/net/wireless/rt2x00/rt2x00mmio.c
new file mode 100644
index 000000000000..06c766930b15
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00mmio.c
@@ -0,0 +1,216 @@
+/*
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00mmio
+        Abstract: rt2x00 generic mmio device routines.
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+
+#include "rt2x00.h"
+#include "rt2x00mmio.h"
+
+/*
+ * Register access.
+ */
+int rt2x00mmio_regbusy_read(struct rt2x00_dev *rt2x00dev,
+                            const unsigned int offset,
+                            const struct rt2x00_field32 field,
+                            u32 *reg)
+{
+        unsigned int i;
+
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                return 0;
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00mmio_register_read(rt2x00dev, offset, reg);
+                if (!rt2x00_get_field32(*reg, field))
+                        return 1;
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        printk_once(KERN_ERR "%s() Indirect register access failed: "
+              "offset=0x%.08x, value=0x%.08x\n", __func__, offset, *reg);
+        *reg = ~0;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2x00mmio_regbusy_read);
+
+bool rt2x00mmio_rxdone(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue = rt2x00dev->rx;
+        struct queue_entry *entry;
+        struct queue_entry_priv_mmio *entry_priv;
+        struct skb_frame_desc *skbdesc;
+        int max_rx = 16;
+
+        while (--max_rx) {
+                entry = rt2x00queue_get_entry(queue, Q_INDEX);
+                entry_priv = entry->priv_data;
+
+                if (rt2x00dev->ops->lib->get_entry_state(entry))
+                        break;
+
+                /*
+                 * Fill in desc fields of the skb descriptor
+                 */
+                skbdesc = get_skb_frame_desc(entry->skb);
+                skbdesc->desc = entry_priv->desc;
+                skbdesc->desc_len = entry->queue->desc_size;
+
+                /*
+                 * DMA is already done, notify rt2x00lib that
+                 * it finished successfully.
+                 */
+                rt2x00lib_dmastart(entry);
+                rt2x00lib_dmadone(entry);
+
+                /*
+                 * Send the frame to rt2x00lib for further processing.
+                 */
+                rt2x00lib_rxdone(entry, GFP_ATOMIC);
+        }
+
+        return !max_rx;
+}
+EXPORT_SYMBOL_GPL(rt2x00mmio_rxdone);
+
+void rt2x00mmio_flush_queue(struct data_queue *queue, bool drop)
+{
+        unsigned int i;
+
+        for (i = 0; !rt2x00queue_empty(queue) && i < 10; i++)
+                msleep(10);
+}
+EXPORT_SYMBOL_GPL(rt2x00mmio_flush_queue);
+
+/*
+ * Device initialization handlers.
+ */
+static int rt2x00mmio_alloc_queue_dma(struct rt2x00_dev *rt2x00dev,
+                                      struct data_queue *queue)
+{
+        struct queue_entry_priv_mmio *entry_priv;
+        void *addr;
+        dma_addr_t dma;
+        unsigned int i;
+
+        /*
+         * Allocate DMA memory for descriptor and buffer.
+         */
+        addr = dma_alloc_coherent(rt2x00dev->dev,
+                                  queue->limit * queue->desc_size,
+                                  &dma, GFP_KERNEL);
+        if (!addr)
+                return -ENOMEM;
+
+        memset(addr, 0, queue->limit * queue->desc_size);
+
+        /*
+         * Initialize all queue entries to contain valid addresses.
+         */
+        for (i = 0; i < queue->limit; i++) {
+                entry_priv = queue->entries[i].priv_data;
+                entry_priv->desc = addr + i * queue->desc_size;
+                entry_priv->desc_dma = dma + i * queue->desc_size;
+        }
+
+        return 0;
+}
+
+static void rt2x00mmio_free_queue_dma(struct rt2x00_dev *rt2x00dev,
+                                      struct data_queue *queue)
+{
+        struct queue_entry_priv_mmio *entry_priv =
+            queue->entries[0].priv_data;
+
+        if (entry_priv->desc)
+                dma_free_coherent(rt2x00dev->dev,
+                                  queue->limit * queue->desc_size,
+                                  entry_priv->desc, entry_priv->desc_dma);
+        entry_priv->desc = NULL;
+}
+
+int rt2x00mmio_initialize(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        int status;
+
+        /*
+         * Allocate DMA
+         */
+        queue_for_each(rt2x00dev, queue) {
+                status = rt2x00mmio_alloc_queue_dma(rt2x00dev, queue);
+                if (status)
+                        goto exit;
+        }
+
+        /*
+         * Register interrupt handler.
+         */
+        status = request_irq(rt2x00dev->irq,
+                             rt2x00dev->ops->lib->irq_handler,
+                             IRQF_SHARED, rt2x00dev->name, rt2x00dev);
+        if (status) {
+                ERROR(rt2x00dev, "IRQ %d allocation failed (error %d).\n",
+                      rt2x00dev->irq, status);
+                goto exit;
+        }
+
+        return 0;
+
+exit:
+        queue_for_each(rt2x00dev, queue)
+                rt2x00mmio_free_queue_dma(rt2x00dev, queue);
+
+        return status;
+}
+EXPORT_SYMBOL_GPL(rt2x00mmio_initialize);
+
+void rt2x00mmio_uninitialize(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+
+        /*
+         * Free irq line.
+         */
+        free_irq(rt2x00dev->irq, rt2x00dev);
+
+        /*
+         * Free DMA
+         */
+        queue_for_each(rt2x00dev, queue)
+                rt2x00mmio_free_queue_dma(rt2x00dev, queue);
+}
+EXPORT_SYMBOL_GPL(rt2x00mmio_uninitialize);
+
+/*
+ * rt2x00mmio module information.
+ */
+MODULE_AUTHOR(DRV_PROJECT);
+MODULE_VERSION(DRV_VERSION);
+MODULE_DESCRIPTION("rt2x00 mmio library");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/rt2x00/rt2x00mmio.h b/drivers/net/wireless/rt2x00/rt2x00mmio.h
new file mode 100644
index 000000000000..cda3dbcf7ead
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00mmio.h
@@ -0,0 +1,119 @@
+/*
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00mmio
+        Abstract: Data structures for the rt2x00mmio module.
+ */
+
+#ifndef RT2X00MMIO_H
+#define RT2X00MMIO_H
+
+#include <linux/io.h>
+
+/*
+ * Register access.
+ */
+static inline void rt2x00mmio_register_read(struct rt2x00_dev *rt2x00dev,
+                                            const unsigned int offset,
+                                            u32 *value)
+{
+        *value = readl(rt2x00dev->csr.base + offset);
+}
+
+static inline void rt2x00mmio_register_multiread(struct rt2x00_dev *rt2x00dev,
+                                                 const unsigned int offset,
+                                                 void *value, const u32 length)
+{
+        memcpy_fromio(value, rt2x00dev->csr.base + offset, length);
+}
+
+static inline void rt2x00mmio_register_write(struct rt2x00_dev *rt2x00dev,
+                                             const unsigned int offset,
+                                             u32 value)
+{
+        writel(value, rt2x00dev->csr.base + offset);
+}
+
+static inline void rt2x00mmio_register_multiwrite(struct rt2x00_dev *rt2x00dev,
+                                                  const unsigned int offset,
+                                                  const void *value,
+                                                  const u32 length)
+{
+        __iowrite32_copy(rt2x00dev->csr.base + offset, value, length >> 2);
+}
+
+/**
+ * rt2x00mmio_regbusy_read - Read from register with busy check
+ * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
+ * @offset: Register offset
+ * @field: Field to check if register is busy
+ * @reg: Pointer to where register contents should be stored
+ *
+ * This function will read the given register, and checks if the
+ * register is busy. If it is, it will sleep for a couple of
+ * microseconds before reading the register again. If the register
+ * is not read after a certain timeout, this function will return
+ * FALSE.
+ */
+int rt2x00mmio_regbusy_read(struct rt2x00_dev *rt2x00dev,
+                            const unsigned int offset,
+                            const struct rt2x00_field32 field,
+                            u32 *reg);
+
+/**
+ * struct queue_entry_priv_mmio: Per entry PCI specific information
+ *
+ * @desc: Pointer to device descriptor
+ * @desc_dma: DMA pointer to &desc.
+ * @data: Pointer to device's entry memory.
+ * @data_dma: DMA pointer to &data.
+ */
+struct queue_entry_priv_mmio {
+        __le32 *desc;
+        dma_addr_t desc_dma;
+};
+
+/**
+ * rt2x00mmio_rxdone - Handle RX done events
+ * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
+ *
+ * Returns true if there are still rx frames pending and false if all
+ * pending rx frames were processed.
+ */
+bool rt2x00mmio_rxdone(struct rt2x00_dev *rt2x00dev);
+
+/**
+ * rt2x00mmio_flush_queue - Flush data queue
+ * @queue: Data queue to stop
+ * @drop: True to drop all pending frames.
+ *
+ * This will wait for a maximum of 100ms, waiting for the queues
+ * to become empty.
+ */
+void rt2x00mmio_flush_queue(struct data_queue *queue, bool drop);
+
+/*
+ * Device initialization handlers.
+ */
+int rt2x00mmio_initialize(struct rt2x00_dev *rt2x00dev);
+void rt2x00mmio_uninitialize(struct rt2x00_dev *rt2x00dev);
+
+#endif /* RT2X00MMIO_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index a0c8caef3b0a..e87865e33113 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -33,182 +33,6 @@
 #include "rt2x00pci.h"
 
 /*
- * Register access.
- */
-int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
-                           const unsigned int offset,
-                           const struct rt2x00_field32 field,
-                           u32 *reg)
-{
-        unsigned int i;
-
-        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
-                return 0;
-
-        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00pci_register_read(rt2x00dev, offset, reg);
-                if (!rt2x00_get_field32(*reg, field))
-                        return 1;
-                udelay(REGISTER_BUSY_DELAY);
-        }
-
-        ERROR(rt2x00dev, "Indirect register access failed: "
-              "offset=0x%.08x, value=0x%.08x\n", offset, *reg);
-        *reg = ~0;
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_regbusy_read);
-
-bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue = rt2x00dev->rx;
-        struct queue_entry *entry;
-        struct queue_entry_priv_pci *entry_priv;
-        struct skb_frame_desc *skbdesc;
-        int max_rx = 16;
-
-        while (--max_rx) {
-                entry = rt2x00queue_get_entry(queue, Q_INDEX);
-                entry_priv = entry->priv_data;
-
-                if (rt2x00dev->ops->lib->get_entry_state(entry))
-                        break;
-
-                /*
-                 * Fill in desc fields of the skb descriptor
-                 */
-                skbdesc = get_skb_frame_desc(entry->skb);
-                skbdesc->desc = entry_priv->desc;
-                skbdesc->desc_len = entry->queue->desc_size;
-
-                /*
-                 * DMA is already done, notify rt2x00lib that
-                 * it finished successfully.
-                 */
-                rt2x00lib_dmastart(entry);
-                rt2x00lib_dmadone(entry);
-
-                /*
-                 * Send the frame to rt2x00lib for further processing.
-                 */
-                rt2x00lib_rxdone(entry, GFP_ATOMIC);
-        }
-
-        return !max_rx;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_rxdone);
-
-void rt2x00pci_flush_queue(struct data_queue *queue, bool drop)
-{
-        unsigned int i;
-
-        for (i = 0; !rt2x00queue_empty(queue) && i < 10; i++)
-                msleep(10);
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_flush_queue);
-
-/*
- * Device initialization handlers.
- */
-static int rt2x00pci_alloc_queue_dma(struct rt2x00_dev *rt2x00dev,
-                                     struct data_queue *queue)
-{
-        struct queue_entry_priv_pci *entry_priv;
-        void *addr;
-        dma_addr_t dma;
-        unsigned int i;
-
-        /*
-         * Allocate DMA memory for descriptor and buffer.
-         */
-        addr = dma_alloc_coherent(rt2x00dev->dev,
-                                  queue->limit * queue->desc_size,
-                                  &dma, GFP_KERNEL);
-        if (!addr)
-                return -ENOMEM;
-
-        memset(addr, 0, queue->limit * queue->desc_size);
-
-        /*
-         * Initialize all queue entries to contain valid addresses.
-         */
-        for (i = 0; i < queue->limit; i++) {
-                entry_priv = queue->entries[i].priv_data;
-                entry_priv->desc = addr + i * queue->desc_size;
-                entry_priv->desc_dma = dma + i * queue->desc_size;
-        }
-
-        return 0;
-}
-
-static void rt2x00pci_free_queue_dma(struct rt2x00_dev *rt2x00dev,
-                                     struct data_queue *queue)
-{
-        struct queue_entry_priv_pci *entry_priv =
-            queue->entries[0].priv_data;
-
-        if (entry_priv->desc)
-                dma_free_coherent(rt2x00dev->dev,
-                                  queue->limit * queue->desc_size,
-                                  entry_priv->desc, entry_priv->desc_dma);
-        entry_priv->desc = NULL;
-}
-
-int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue;
-        int status;
-
-        /*
-         * Allocate DMA
-         */
-        queue_for_each(rt2x00dev, queue) {
-                status = rt2x00pci_alloc_queue_dma(rt2x00dev, queue);
-                if (status)
-                        goto exit;
-        }
-
-        /*
-         * Register interrupt handler.
-         */
-        status = request_irq(rt2x00dev->irq,
-                             rt2x00dev->ops->lib->irq_handler,
-                             IRQF_SHARED, rt2x00dev->name, rt2x00dev);
-        if (status) {
-                ERROR(rt2x00dev, "IRQ %d allocation failed (error %d).\n",
-                      rt2x00dev->irq, status);
-                goto exit;
-        }
-
-        return 0;
-
-exit:
-        queue_for_each(rt2x00dev, queue)
-                rt2x00pci_free_queue_dma(rt2x00dev, queue);
-
-        return status;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_initialize);
-
-void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue;
-
-        /*
-         * Free irq line.
-         */
-        free_irq(rt2x00dev->irq, rt2x00dev);
-
-        /*
-         * Free DMA
-         */
-        queue_for_each(rt2x00dev, queue)
-                rt2x00pci_free_queue_dma(rt2x00dev, queue);
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_uninitialize);
-
-/*
  * PCI driver handlers.
  */
 static void rt2x00pci_free_reg(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.h b/drivers/net/wireless/rt2x00/rt2x00pci.h
index e2c99f2b9a14..60d90b20f8b9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.h
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.h
@@ -36,94 +36,6 @@
 #define PCI_DEVICE_DATA(__ops)  .driver_data = (kernel_ulong_t)(__ops)
 
 /*
- * Register access.
- */
-static inline void rt2x00pci_register_read(struct rt2x00_dev *rt2x00dev,
-                                           const unsigned int offset,
-                                           u32 *value)
-{
-        *value = readl(rt2x00dev->csr.base + offset);
-}
-
-static inline void rt2x00pci_register_multiread(struct rt2x00_dev *rt2x00dev,
-                                                const unsigned int offset,
-                                                void *value, const u32 length)
-{
-        memcpy_fromio(value, rt2x00dev->csr.base + offset, length);
-}
-
-static inline void rt2x00pci_register_write(struct rt2x00_dev *rt2x00dev,
-                                            const unsigned int offset,
-                                            u32 value)
-{
-        writel(value, rt2x00dev->csr.base + offset);
-}
-
-static inline void rt2x00pci_register_multiwrite(struct rt2x00_dev *rt2x00dev,
-                                                 const unsigned int offset,
-                                                 const void *value,
-                                                 const u32 length)
-{
-        __iowrite32_copy(rt2x00dev->csr.base + offset, value, length >> 2);
-}
-
-/**
- * rt2x00pci_regbusy_read - Read from register with busy check
- * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
- * @offset: Register offset
- * @field: Field to check if register is busy
- * @reg: Pointer to where register contents should be stored
- *
- * This function will read the given register, and checks if the
- * register is busy. If it is, it will sleep for a couple of
- * microseconds before reading the register again. If the register
- * is not read after a certain timeout, this function will return
- * FALSE.
- */
-int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
-                           const unsigned int offset,
-                           const struct rt2x00_field32 field,
-                           u32 *reg);
-
-/**
- * struct queue_entry_priv_pci: Per entry PCI specific information
- *
- * @desc: Pointer to device descriptor
- * @desc_dma: DMA pointer to &desc.
- * @data: Pointer to device's entry memory.
- * @data_dma: DMA pointer to &data.
- */
-struct queue_entry_priv_pci {
-        __le32 *desc;
-        dma_addr_t desc_dma;
-};
-
-/**
- * rt2x00pci_rxdone - Handle RX done events
- * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
- *
- * Returns true if there are still rx frames pending and false if all
- * pending rx frames were processed.
- */
-bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev);
-
-/**
- * rt2x00pci_flush_queue - Flush data queue
- * @queue: Data queue to stop
- * @drop: True to drop all pending frames.
- *
- * This will wait for a maximum of 100ms, waiting for the queues
- * to become empty.
- */
-void rt2x00pci_flush_queue(struct data_queue *queue, bool drop);
-
-/*
- * Device initialization handlers.
- */
-int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev);
-void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev);
-
-/*
  * PCI driver handlers.
  */
 int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 4d91795dc6a2..952a0490eb17 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -832,7 +832,9 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
 bool rt2x00queue_for_each_entry(struct data_queue *queue,
                                 enum queue_index start,
                                 enum queue_index end,
-                                bool (*fn)(struct queue_entry *entry))
+                                void *data,
+                                bool (*fn)(struct queue_entry *entry,
+                                           void *data))
 {
         unsigned long irqflags;
         unsigned int index_start;
@@ -863,17 +865,17 @@ bool rt2x00queue_for_each_entry(struct data_queue *queue,
          */
         if (index_start < index_end) {
                 for (i = index_start; i < index_end; i++) {
-                        if (fn(&queue->entries[i]))
+                        if (fn(&queue->entries[i], data))
                                 return true;
                 }
         } else {
                 for (i = index_start; i < queue->limit; i++) {
-                        if (fn(&queue->entries[i]))
+                        if (fn(&queue->entries[i], data))
                                 return true;
                 }
 
                 for (i = 0; i < index_end; i++) {
-                        if (fn(&queue->entries[i]))
+                        if (fn(&queue->entries[i], data))
                                 return true;
                 }
         }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index 9b8c10a86dee..3d0137193da0 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -359,6 +359,7 @@ enum queue_entry_flags {
         ENTRY_DATA_PENDING,
         ENTRY_DATA_IO_FAILED,
         ENTRY_DATA_STATUS_PENDING,
+        ENTRY_DATA_STATUS_SET,
 };
 
 /**
@@ -372,6 +373,7 @@ enum queue_entry_flags {
  * @entry_idx: The entry index number.
  * @priv_data: Private data belonging to this queue entry. The pointer
  *      points to data specific to a particular driver and queue type.
+ * @status: Device specific status
  */
 struct queue_entry {
         unsigned long flags;
@@ -383,6 +385,8 @@ struct queue_entry {
 
         unsigned int entry_idx;
 
+        u32 status;
+
         void *priv_data;
 };
 
@@ -584,6 +588,7 @@ struct data_queue_desc {
  * @queue: Pointer to @data_queue
  * @start: &enum queue_index Pointer to start index
  * @end: &enum queue_index Pointer to end index
+ * @data: Data to pass to the callback function
  * @fn: The function to call for each &struct queue_entry
  *
  * This will walk through all entries in the queue, in chronological
@@ -596,7 +601,9 @@ struct data_queue_desc {
 bool rt2x00queue_for_each_entry(struct data_queue *queue,
                                 enum queue_index start,
                                 enum queue_index end,
-                                bool (*fn)(struct queue_entry *entry));
+                                void *data,
+                                bool (*fn)(struct queue_entry *entry,
+                                           void *data));
 
 /**
  * rt2x00queue_empty - Check if the queue is empty.
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 40ea80725a96..5e50d4ff9d21 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -285,7 +285,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
                 queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
 }
 
-static bool rt2x00usb_kick_tx_entry(struct queue_entry *entry)
+static bool rt2x00usb_kick_tx_entry(struct queue_entry *entry, void *data)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
@@ -390,7 +390,7 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
         queue_work(rt2x00dev->workqueue, &rt2x00dev->rxdone_work);
 }
 
-static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry)
+static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry, void *data)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
@@ -427,12 +427,18 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
         case QID_AC_BE:
         case QID_AC_BK:
                 if (!rt2x00queue_empty(queue))
-                        rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX,
+                        rt2x00queue_for_each_entry(queue,
+                                                   Q_INDEX_DONE,
+                                                   Q_INDEX,
+                                                   NULL,
                                                    rt2x00usb_kick_tx_entry);
                 break;
         case QID_RX:
                 if (!rt2x00queue_full(queue))
-                        rt2x00queue_for_each_entry(queue, Q_INDEX, Q_INDEX_DONE,
+                        rt2x00queue_for_each_entry(queue,
+                                                   Q_INDEX,
+                                                   Q_INDEX_DONE,
+                                                   NULL,
                                                    rt2x00usb_kick_rx_entry);
                 break;
         default:
@@ -441,7 +447,7 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_kick_queue);
 
-static bool rt2x00usb_flush_entry(struct queue_entry *entry)
+static bool rt2x00usb_flush_entry(struct queue_entry *entry, void *data)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct queue_entry_priv_usb *entry_priv = entry->priv_data;
@@ -468,7 +474,7 @@ void rt2x00usb_flush_queue(struct data_queue *queue, bool drop)
         unsigned int i;
 
         if (drop)
-                rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX,
+                rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX, NULL,
                                            rt2x00usb_flush_entry);
 
         /*
@@ -559,7 +565,7 @@ void rt2x00usb_clear_entry(struct queue_entry *entry)
         entry->flags = 0;
 
         if (entry->queue->qid == QID_RX)
-                rt2x00usb_kick_rx_entry(entry);
+                rt2x00usb_kick_rx_entry(entry, NULL);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_clear_entry);
 
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index f85035cc836f..fc99258ae777 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -35,6 +35,7 @@
 #include <linux/eeprom_93cx6.h>
 
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt61pci.h"
 
@@ -57,12 +58,12 @@ MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  * and we will print an error.
  */
 #define WAIT_FOR_BBP(__dev, __reg) \
-        rt2x00pci_regbusy_read((__dev), PHY_CSR3, PHY_CSR3_BUSY, (__reg))
+        rt2x00mmio_regbusy_read((__dev), PHY_CSR3, PHY_CSR3_BUSY, (__reg))
 #define WAIT_FOR_RF(__dev, __reg) \
-        rt2x00pci_regbusy_read((__dev), PHY_CSR4, PHY_CSR4_BUSY, (__reg))
+        rt2x00mmio_regbusy_read((__dev), PHY_CSR4, PHY_CSR4_BUSY, (__reg))
 #define WAIT_FOR_MCU(__dev, __reg) \
-        rt2x00pci_regbusy_read((__dev), H2M_MAILBOX_CSR, \
-                               H2M_MAILBOX_CSR_OWNER, (__reg))
+        rt2x00mmio_regbusy_read((__dev), H2M_MAILBOX_CSR, \
+                                H2M_MAILBOX_CSR_OWNER, (__reg))
 
 static void rt61pci_bbp_write(struct rt2x00_dev *rt2x00dev,
                               const unsigned int word, const u8 value)
@@ -82,7 +83,7 @@ static void rt61pci_bbp_write(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, PHY_CSR3_BUSY, 1);
                 rt2x00_set_field32(&reg, PHY_CSR3_READ_CONTROL, 0);
 
-                rt2x00pci_register_write(rt2x00dev, PHY_CSR3, reg);
+                rt2x00mmio_register_write(rt2x00dev, PHY_CSR3, reg);
         }
 
         mutex_unlock(&rt2x00dev->csr_mutex);
@@ -109,7 +110,7 @@ static void rt61pci_bbp_read(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, PHY_CSR3_BUSY, 1);
                 rt2x00_set_field32(&reg, PHY_CSR3_READ_CONTROL, 1);
 
-                rt2x00pci_register_write(rt2x00dev, PHY_CSR3, reg);
+                rt2x00mmio_register_write(rt2x00dev, PHY_CSR3, reg);
 
                 WAIT_FOR_BBP(rt2x00dev, &reg);
         }
@@ -137,7 +138,7 @@ static void rt61pci_rf_write(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, PHY_CSR4_IF_SELECT, 0);
                 rt2x00_set_field32(&reg, PHY_CSR4_BUSY, 1);
 
-                rt2x00pci_register_write(rt2x00dev, PHY_CSR4, reg);
+                rt2x00mmio_register_write(rt2x00dev, PHY_CSR4, reg);
                 rt2x00_rf_write(rt2x00dev, word, value);
         }
 
@@ -161,12 +162,12 @@ static void rt61pci_mcu_request(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_CMD_TOKEN, token);
                 rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG0, arg0);
                 rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG1, arg1);
-                rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CSR, reg);
 
-                rt2x00pci_register_read(rt2x00dev, HOST_CMD_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, HOST_CMD_CSR, &reg);
                 rt2x00_set_field32(&reg, HOST_CMD_CSR_HOST_COMMAND, command);
                 rt2x00_set_field32(&reg, HOST_CMD_CSR_INTERRUPT_MCU, 1);
-                rt2x00pci_register_write(rt2x00dev, HOST_CMD_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, HOST_CMD_CSR, reg);
         }
 
         mutex_unlock(&rt2x00dev->csr_mutex);
@@ -178,7 +179,7 @@ static void rt61pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
         struct rt2x00_dev *rt2x00dev = eeprom->data;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, E2PROM_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, E2PROM_CSR, &reg);
 
         eeprom->reg_data_in = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_IN);
         eeprom->reg_data_out = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_OUT);
@@ -200,15 +201,15 @@ static void rt61pci_eepromregister_write(struct eeprom_93cx6 *eeprom)
         rt2x00_set_field32(&reg, E2PROM_CSR_CHIP_SELECT,
                            !!eeprom->reg_chip_select);
 
-        rt2x00pci_register_write(rt2x00dev, E2PROM_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, E2PROM_CSR, reg);
 }
 
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
 static const struct rt2x00debug rt61pci_rt2x00debug = {
         .owner  = THIS_MODULE,
         .csr    = {
-                .read           = rt2x00pci_register_read,
-                .write          = rt2x00pci_register_write,
+                .read           = rt2x00mmio_register_read,
+                .write          = rt2x00mmio_register_write,
                 .flags          = RT2X00DEBUGFS_OFFSET,
                 .word_base      = CSR_REG_BASE,
                 .word_size      = sizeof(u32),
@@ -242,7 +243,7 @@ static int rt61pci_rfkill_poll(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR13, &reg);
         return rt2x00_get_field32(reg, MAC_CSR13_VAL5);
 }
 
@@ -293,10 +294,10 @@ static int rt61pci_blink_set(struct led_classdev *led_cdev,
             container_of(led_cdev, struct rt2x00_led, led_dev);
         u32 reg;
 
-        rt2x00pci_register_read(led->rt2x00dev, MAC_CSR14, &reg);
+        rt2x00mmio_register_read(led->rt2x00dev, MAC_CSR14, &reg);
         rt2x00_set_field32(&reg, MAC_CSR14_ON_PERIOD, *delay_on);
         rt2x00_set_field32(&reg, MAC_CSR14_OFF_PERIOD, *delay_off);
-        rt2x00pci_register_write(led->rt2x00dev, MAC_CSR14, reg);
+        rt2x00mmio_register_write(led->rt2x00dev, MAC_CSR14, reg);
 
         return 0;
 }
@@ -338,7 +339,7 @@ static int rt61pci_config_shared_key(struct rt2x00_dev *rt2x00dev,
                  */
                 mask = (0xf << crypto->bssidx);
 
-                rt2x00pci_register_read(rt2x00dev, SEC_CSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, SEC_CSR0, &reg);
                 reg &= mask;
 
                 if (reg && reg == mask)
@@ -357,8 +358,8 @@ static int rt61pci_config_shared_key(struct rt2x00_dev *rt2x00dev,
                        sizeof(key_entry.rx_mic));
 
                 reg = SHARED_KEY_ENTRY(key->hw_key_idx);
-                rt2x00pci_register_multiwrite(rt2x00dev, reg,
-                                              &key_entry, sizeof(key_entry));
+                rt2x00mmio_register_multiwrite(rt2x00dev, reg,
+                                               &key_entry, sizeof(key_entry));
 
                 /*
                  * The cipher types are stored over 2 registers.
@@ -371,16 +372,16 @@ static int rt61pci_config_shared_key(struct rt2x00_dev *rt2x00dev,
                         field.bit_offset = (3 * key->hw_key_idx);
                         field.bit_mask = 0x7 << field.bit_offset;
 
-                        rt2x00pci_register_read(rt2x00dev, SEC_CSR1, &reg);
+                        rt2x00mmio_register_read(rt2x00dev, SEC_CSR1, &reg);
                         rt2x00_set_field32(&reg, field, crypto->cipher);
-                        rt2x00pci_register_write(rt2x00dev, SEC_CSR1, reg);
+                        rt2x00mmio_register_write(rt2x00dev, SEC_CSR1, reg);
                 } else {
                         field.bit_offset = (3 * (key->hw_key_idx - 8));
                         field.bit_mask = 0x7 << field.bit_offset;
 
-                        rt2x00pci_register_read(rt2x00dev, SEC_CSR5, &reg);
+                        rt2x00mmio_register_read(rt2x00dev, SEC_CSR5, &reg);
                         rt2x00_set_field32(&reg, field, crypto->cipher);
-                        rt2x00pci_register_write(rt2x00dev, SEC_CSR5, reg);
+                        rt2x00mmio_register_write(rt2x00dev, SEC_CSR5, reg);
                 }
 
                 /*
@@ -403,12 +404,12 @@ static int rt61pci_config_shared_key(struct rt2x00_dev *rt2x00dev,
          */
         mask = 1 << key->hw_key_idx;
 
-        rt2x00pci_register_read(rt2x00dev, SEC_CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, SEC_CSR0, &reg);
         if (crypto->cmd == SET_KEY)
                 reg |= mask;
         else if (crypto->cmd == DISABLE_KEY)
                 reg &= ~mask;
-        rt2x00pci_register_write(rt2x00dev, SEC_CSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, SEC_CSR0, reg);
 
         return 0;
 }
@@ -432,10 +433,10 @@ static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                  * When both registers are full, we drop the key.
                  * Otherwise, we use the first invalid entry.
                  */
-                rt2x00pci_register_read(rt2x00dev, SEC_CSR2, &reg);
+                rt2x00mmio_register_read(rt2x00dev, SEC_CSR2, &reg);
                 if (reg && reg == ~0) {
                         key->hw_key_idx = 32;
-                        rt2x00pci_register_read(rt2x00dev, SEC_CSR3, &reg);
+                        rt2x00mmio_register_read(rt2x00dev, SEC_CSR3, &reg);
                         if (reg && reg == ~0)
                                 return -ENOSPC;
                 }
@@ -457,21 +458,21 @@ static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                 addr_entry.cipher = crypto->cipher;
 
                 reg = PAIRWISE_KEY_ENTRY(key->hw_key_idx);
-                rt2x00pci_register_multiwrite(rt2x00dev, reg,
-                                              &key_entry, sizeof(key_entry));
+                rt2x00mmio_register_multiwrite(rt2x00dev, reg,
+                                               &key_entry, sizeof(key_entry));
 
                 reg = PAIRWISE_TA_ENTRY(key->hw_key_idx);
-                rt2x00pci_register_multiwrite(rt2x00dev, reg,
-                                              &addr_entry, sizeof(addr_entry));
+                rt2x00mmio_register_multiwrite(rt2x00dev, reg,
+                                               &addr_entry, sizeof(addr_entry));
 
                 /*
                  * Enable pairwise lookup table for given BSS idx.
                  * Without this, received frames will not be decrypted
                  * by the hardware.
                  */
-                rt2x00pci_register_read(rt2x00dev, SEC_CSR4, &reg);
+                rt2x00mmio_register_read(rt2x00dev, SEC_CSR4, &reg);
                 reg |= (1 << crypto->bssidx);
-                rt2x00pci_register_write(rt2x00dev, SEC_CSR4, reg);
+                rt2x00mmio_register_write(rt2x00dev, SEC_CSR4, reg);
 
                 /*
                  * The driver does not support the IV/EIV generation
@@ -494,21 +495,21 @@ static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
         if (key->hw_key_idx < 32) {
                 mask = 1 << key->hw_key_idx;
 
-                rt2x00pci_register_read(rt2x00dev, SEC_CSR2, &reg);
+                rt2x00mmio_register_read(rt2x00dev, SEC_CSR2, &reg);
                 if (crypto->cmd == SET_KEY)
                         reg |= mask;
                 else if (crypto->cmd == DISABLE_KEY)
                         reg &= ~mask;
-                rt2x00pci_register_write(rt2x00dev, SEC_CSR2, reg);
+                rt2x00mmio_register_write(rt2x00dev, SEC_CSR2, reg);
         } else {
                 mask = 1 << (key->hw_key_idx - 32);
 
-                rt2x00pci_register_read(rt2x00dev, SEC_CSR3, &reg);
+                rt2x00mmio_register_read(rt2x00dev, SEC_CSR3, &reg);
                 if (crypto->cmd == SET_KEY)
                         reg |= mask;
                 else if (crypto->cmd == DISABLE_KEY)
                         reg &= ~mask;
-                rt2x00pci_register_write(rt2x00dev, SEC_CSR3, reg);
+                rt2x00mmio_register_write(rt2x00dev, SEC_CSR3, reg);
         }
 
         return 0;
@@ -525,7 +526,7 @@ static void rt61pci_config_filter(struct rt2x00_dev *rt2x00dev,
          * and broadcast frames will always be accepted since
          * there is no filter for it at this time.
          */
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CRC,
                            !(filter_flags & FIF_FCSFAIL));
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_PHYSICAL,
@@ -543,7 +544,7 @@ static void rt61pci_config_filter(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_BROADCAST, 0);
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_ACK_CTS,
                            !(filter_flags & FIF_CONTROL));
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
 }
 
 static void rt61pci_config_intf(struct rt2x00_dev *rt2x00dev,
@@ -557,9 +558,9 @@ static void rt61pci_config_intf(struct rt2x00_dev *rt2x00dev,
                 /*
                  * Enable synchronisation.
                  */
-                rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9, &reg);
                 rt2x00_set_field32(&reg, TXRX_CSR9_TSF_SYNC, conf->sync);
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
         }
 
         if (flags & CONFIG_UPDATE_MAC) {
@@ -567,8 +568,8 @@ static void rt61pci_config_intf(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, MAC_CSR3_UNICAST_TO_ME_MASK, 0xff);
                 conf->mac[1] = cpu_to_le32(reg);
 
-                rt2x00pci_register_multiwrite(rt2x00dev, MAC_CSR2,
-                                              conf->mac, sizeof(conf->mac));
+                rt2x00mmio_register_multiwrite(rt2x00dev, MAC_CSR2,
+                                               conf->mac, sizeof(conf->mac));
         }
 
         if (flags & CONFIG_UPDATE_BSSID) {
@@ -576,8 +577,9 @@ static void rt61pci_config_intf(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field32(&reg, MAC_CSR5_BSS_ID_MASK, 3);
                 conf->bssid[1] = cpu_to_le32(reg);
 
-                rt2x00pci_register_multiwrite(rt2x00dev, MAC_CSR4,
-                                              conf->bssid, sizeof(conf->bssid));
+                rt2x00mmio_register_multiwrite(rt2x00dev, MAC_CSR4,
+                                               conf->bssid,
+                                               sizeof(conf->bssid));
         }
 }
 
@@ -587,40 +589,40 @@ static void rt61pci_config_erp(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR0_RX_ACK_TIMEOUT, 0x32);
         rt2x00_set_field32(&reg, TXRX_CSR0_TSF_OFFSET, IEEE80211_HEADER);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
 
         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
-                rt2x00pci_register_read(rt2x00dev, TXRX_CSR4, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXRX_CSR4, &reg);
                 rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
                 rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
                                    !!erp->short_preamble);
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR4, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXRX_CSR4, reg);
         }
 
         if (changed & BSS_CHANGED_BASIC_RATES)
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR5,
-                                         erp->basic_rates);
+                rt2x00mmio_register_write(rt2x00dev, TXRX_CSR5,
+                                          erp->basic_rates);
 
         if (changed & BSS_CHANGED_BEACON_INT) {
-                rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9, &reg);
                 rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
                                    erp->beacon_int * 16);
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
         }
 
         if (changed & BSS_CHANGED_ERP_SLOT) {
-                rt2x00pci_register_read(rt2x00dev, MAC_CSR9, &reg);
+                rt2x00mmio_register_read(rt2x00dev, MAC_CSR9, &reg);
                 rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
-                rt2x00pci_register_write(rt2x00dev, MAC_CSR9, reg);
+                rt2x00mmio_register_write(rt2x00dev, MAC_CSR9, reg);
 
-                rt2x00pci_register_read(rt2x00dev, MAC_CSR8, &reg);
+                rt2x00mmio_register_read(rt2x00dev, MAC_CSR8, &reg);
                 rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
                 rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
                 rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
-                rt2x00pci_register_write(rt2x00dev, MAC_CSR8, reg);
+                rt2x00mmio_register_write(rt2x00dev, MAC_CSR8, reg);
         }
 }
 
@@ -713,7 +715,7 @@ static void rt61pci_config_antenna_2529_rx(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR13, &reg);
 
         rt2x00_set_field32(&reg, MAC_CSR13_DIR4, 0);
         rt2x00_set_field32(&reg, MAC_CSR13_VAL4, p1);
@@ -721,7 +723,7 @@ static void rt61pci_config_antenna_2529_rx(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, MAC_CSR13_DIR3, 0);
         rt2x00_set_field32(&reg, MAC_CSR13_VAL3, !p2);
 
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR13, reg);
 }
 
 static void rt61pci_config_antenna_2529(struct rt2x00_dev *rt2x00dev,
@@ -820,14 +822,14 @@ static void rt61pci_config_ant(struct rt2x00_dev *rt2x00dev,
         for (i = 0; i < ARRAY_SIZE(antenna_sel_a); i++)
                 rt61pci_bbp_write(rt2x00dev, sel[i].word, sel[i].value[lna]);
 
-        rt2x00pci_register_read(rt2x00dev, PHY_CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, PHY_CSR0, &reg);
 
         rt2x00_set_field32(&reg, PHY_CSR0_PA_PE_BG,
                            rt2x00dev->curr_band == IEEE80211_BAND_2GHZ);
         rt2x00_set_field32(&reg, PHY_CSR0_PA_PE_A,
                            rt2x00dev->curr_band == IEEE80211_BAND_5GHZ);
 
-        rt2x00pci_register_write(rt2x00dev, PHY_CSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, PHY_CSR0, reg);
 
         if (rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF5325))
                 rt61pci_config_antenna_5x(rt2x00dev, ant);
@@ -927,7 +929,7 @@ static void rt61pci_config_retry_limit(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR4, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR4, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_RATE_DOWN, 1);
         rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_RATE_STEP, 0);
         rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_FALLBACK_CCK, 0);
@@ -935,7 +937,7 @@ static void rt61pci_config_retry_limit(struct rt2x00_dev *rt2x00dev,
                            libconf->conf->long_frame_max_tx_count);
         rt2x00_set_field32(&reg, TXRX_CSR4_SHORT_RETRY_LIMIT,
                            libconf->conf->short_frame_max_tx_count);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR4, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR4, reg);
 }
 
 static void rt61pci_config_ps(struct rt2x00_dev *rt2x00dev,
@@ -947,7 +949,7 @@ static void rt61pci_config_ps(struct rt2x00_dev *rt2x00dev,
         u32 reg;
 
         if (state == STATE_SLEEP) {
-                rt2x00pci_register_read(rt2x00dev, MAC_CSR11, &reg);
+                rt2x00mmio_register_read(rt2x00dev, MAC_CSR11, &reg);
                 rt2x00_set_field32(&reg, MAC_CSR11_DELAY_AFTER_TBCN,
                                    rt2x00dev->beacon_int - 10);
                 rt2x00_set_field32(&reg, MAC_CSR11_TBCN_BEFORE_WAKEUP,
@@ -956,27 +958,29 @@ static void rt61pci_config_ps(struct rt2x00_dev *rt2x00dev,
 
                 /* We must first disable autowake before it can be enabled */
                 rt2x00_set_field32(&reg, MAC_CSR11_AUTOWAKE, 0);
-                rt2x00pci_register_write(rt2x00dev, MAC_CSR11, reg);
+                rt2x00mmio_register_write(rt2x00dev, MAC_CSR11, reg);
 
                 rt2x00_set_field32(&reg, MAC_CSR11_AUTOWAKE, 1);
-                rt2x00pci_register_write(rt2x00dev, MAC_CSR11, reg);
+                rt2x00mmio_register_write(rt2x00dev, MAC_CSR11, reg);
 
-                rt2x00pci_register_write(rt2x00dev, SOFT_RESET_CSR, 0x00000005);
-                rt2x00pci_register_write(rt2x00dev, IO_CNTL_CSR, 0x0000001c);
-                rt2x00pci_register_write(rt2x00dev, PCI_USEC_CSR, 0x00000060);
+                rt2x00mmio_register_write(rt2x00dev, SOFT_RESET_CSR,
+                                          0x00000005);
+                rt2x00mmio_register_write(rt2x00dev, IO_CNTL_CSR, 0x0000001c);
+                rt2x00mmio_register_write(rt2x00dev, PCI_USEC_CSR, 0x00000060);
 
                 rt61pci_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0, 0);
         } else {
-                rt2x00pci_register_read(rt2x00dev, MAC_CSR11, &reg);
+                rt2x00mmio_register_read(rt2x00dev, MAC_CSR11, &reg);
                 rt2x00_set_field32(&reg, MAC_CSR11_DELAY_AFTER_TBCN, 0);
                 rt2x00_set_field32(&reg, MAC_CSR11_TBCN_BEFORE_WAKEUP, 0);
                 rt2x00_set_field32(&reg, MAC_CSR11_AUTOWAKE, 0);
                 rt2x00_set_field32(&reg, MAC_CSR11_WAKEUP_LATENCY, 0);
-                rt2x00pci_register_write(rt2x00dev, MAC_CSR11, reg);
+                rt2x00mmio_register_write(rt2x00dev, MAC_CSR11, reg);
 
-                rt2x00pci_register_write(rt2x00dev, SOFT_RESET_CSR, 0x00000007);
-                rt2x00pci_register_write(rt2x00dev, IO_CNTL_CSR, 0x00000018);
-                rt2x00pci_register_write(rt2x00dev, PCI_USEC_CSR, 0x00000020);
+                rt2x00mmio_register_write(rt2x00dev, SOFT_RESET_CSR,
+                                          0x00000007);
+                rt2x00mmio_register_write(rt2x00dev, IO_CNTL_CSR, 0x00000018);
+                rt2x00mmio_register_write(rt2x00dev, PCI_USEC_CSR, 0x00000020);
 
                 rt61pci_mcu_request(rt2x00dev, MCU_WAKEUP, 0xff, 0, 0);
         }
@@ -1012,13 +1016,13 @@ static void rt61pci_link_stats(struct rt2x00_dev *rt2x00dev,
         /*
          * Update FCS error count from register.
          */
-        rt2x00pci_register_read(rt2x00dev, STA_CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, STA_CSR0, &reg);
         qual->rx_failed = rt2x00_get_field32(reg, STA_CSR0_FCS_ERROR);
 
         /*
          * Update False CCA count from register.
          */
-        rt2x00pci_register_read(rt2x00dev, STA_CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, STA_CSR1, &reg);
         qual->false_cca = rt2x00_get_field32(reg, STA_CSR1_FALSE_CCA_ERROR);
 }
 
@@ -1137,16 +1141,16 @@ static void rt61pci_start_queue(struct data_queue *queue)
 
         switch (queue->qid) {
         case QID_RX:
-                rt2x00pci_register_read(rt2x00dev, TXRX_CSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0, &reg);
                 rt2x00_set_field32(&reg, TXRX_CSR0_DISABLE_RX, 0);
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
                 break;
         case QID_BEACON:
-                rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9, &reg);
                 rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
                 rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 1);
                 rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
                 break;
         default:
                 break;
@@ -1160,24 +1164,24 @@ static void rt61pci_kick_queue(struct data_queue *queue)
 
         switch (queue->qid) {
         case QID_AC_VO:
-                rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
                 rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC0, 1);
-                rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
                 break;
         case QID_AC_VI:
-                rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
                 rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC1, 1);
-                rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
                 break;
         case QID_AC_BE:
-                rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
                 rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC2, 1);
-                rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
                 break;
         case QID_AC_BK:
-                rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
                 rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC3, 1);
-                rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
                 break;
         default:
                 break;
@@ -1191,36 +1195,36 @@ static void rt61pci_stop_queue(struct data_queue *queue)
 
         switch (queue->qid) {
         case QID_AC_VO:
-                rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
                 rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC0, 1);
-                rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
                 break;
         case QID_AC_VI:
-                rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
                 rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC1, 1);
-                rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
                 break;
         case QID_AC_BE:
-                rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
                 rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC2, 1);
-                rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
                 break;
         case QID_AC_BK:
-                rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
                 rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC3, 1);
-                rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
+                rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
                 break;
         case QID_RX:
-                rt2x00pci_register_read(rt2x00dev, TXRX_CSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0, &reg);
                 rt2x00_set_field32(&reg, TXRX_CSR0_DISABLE_RX, 1);
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR0, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
                 break;
         case QID_BEACON:
-                rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9, &reg);
                 rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 0);
                 rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 0);
                 rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+                rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
 
                 /*
                  * Wait for possibly running tbtt tasklets.
@@ -1298,7 +1302,7 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev,
          * Wait for stable hardware.
          */
         for (i = 0; i < 100; i++) {
-                rt2x00pci_register_read(rt2x00dev, MAC_CSR0, &reg);
+                rt2x00mmio_register_read(rt2x00dev, MAC_CSR0, &reg);
                 if (reg)
                         break;
                 msleep(1);
@@ -1314,10 +1318,10 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev,
          */
         reg = 0;
         rt2x00_set_field32(&reg, MCU_CNTL_CSR_RESET, 1);
-        rt2x00pci_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
-        rt2x00pci_register_write(rt2x00dev, M2H_CMD_DONE_CSR, 0xffffffff);
-        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
-        rt2x00pci_register_write(rt2x00dev, HOST_CMD_CSR, 0);
+        rt2x00mmio_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, M2H_CMD_DONE_CSR, 0xffffffff);
+        rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        rt2x00mmio_register_write(rt2x00dev, HOST_CMD_CSR, 0);
 
         /*
          * Write firmware to device.
@@ -1325,19 +1329,19 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev,
         reg = 0;
         rt2x00_set_field32(&reg, MCU_CNTL_CSR_RESET, 1);
         rt2x00_set_field32(&reg, MCU_CNTL_CSR_SELECT_BANK, 1);
-        rt2x00pci_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
 
-        rt2x00pci_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
-                                      data, len);
+        rt2x00mmio_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+                                       data, len);
 
         rt2x00_set_field32(&reg, MCU_CNTL_CSR_SELECT_BANK, 0);
-        rt2x00pci_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
 
         rt2x00_set_field32(&reg, MCU_CNTL_CSR_RESET, 0);
-        rt2x00pci_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
 
         for (i = 0; i < 100; i++) {
-                rt2x00pci_register_read(rt2x00dev, MCU_CNTL_CSR, &reg);
+                rt2x00mmio_register_read(rt2x00dev, MCU_CNTL_CSR, &reg);
                 if (rt2x00_get_field32(reg, MCU_CNTL_CSR_READY))
                         break;
                 msleep(1);
@@ -1359,16 +1363,16 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev,
         reg = 0;
         rt2x00_set_field32(&reg, MAC_CSR1_SOFT_RESET, 1);
         rt2x00_set_field32(&reg, MAC_CSR1_BBP_RESET, 1);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR1, &reg);
         rt2x00_set_field32(&reg, MAC_CSR1_SOFT_RESET, 0);
         rt2x00_set_field32(&reg, MAC_CSR1_BBP_RESET, 0);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR1, &reg);
         rt2x00_set_field32(&reg, MAC_CSR1_HOST_READY, 1);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
 
         return 0;
 }
@@ -1378,7 +1382,7 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev,
  */
 static bool rt61pci_get_entry_state(struct queue_entry *entry)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         u32 word;
 
         if (entry->queue->qid == QID_RX) {
@@ -1395,7 +1399,7 @@ static bool rt61pci_get_entry_state(struct queue_entry *entry)
 
 static void rt61pci_clear_entry(struct queue_entry *entry)
 {
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         u32 word;
 
@@ -1418,13 +1422,13 @@ static void rt61pci_clear_entry(struct queue_entry *entry)
 
 static int rt61pci_init_queues(struct rt2x00_dev *rt2x00dev)
 {
-        struct queue_entry_priv_pci *entry_priv;
+        struct queue_entry_priv_mmio *entry_priv;
         u32 reg;
 
         /*
          * Initialize registers.
          */
-        rt2x00pci_register_read(rt2x00dev, TX_RING_CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TX_RING_CSR0, &reg);
         rt2x00_set_field32(&reg, TX_RING_CSR0_AC0_RING_SIZE,
                            rt2x00dev->tx[0].limit);
         rt2x00_set_field32(&reg, TX_RING_CSR0_AC1_RING_SIZE,
@@ -1433,67 +1437,67 @@ static int rt61pci_init_queues(struct rt2x00_dev *rt2x00dev)
                            rt2x00dev->tx[2].limit);
         rt2x00_set_field32(&reg, TX_RING_CSR0_AC3_RING_SIZE,
                            rt2x00dev->tx[3].limit);
-        rt2x00pci_register_write(rt2x00dev, TX_RING_CSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, TX_RING_CSR0, reg);
 
-        rt2x00pci_register_read(rt2x00dev, TX_RING_CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TX_RING_CSR1, &reg);
         rt2x00_set_field32(&reg, TX_RING_CSR1_TXD_SIZE,
                            rt2x00dev->tx[0].desc_size / 4);
-        rt2x00pci_register_write(rt2x00dev, TX_RING_CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, TX_RING_CSR1, reg);
 
         entry_priv = rt2x00dev->tx[0].entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, AC0_BASE_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, AC0_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, AC0_BASE_CSR_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, AC0_BASE_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, AC0_BASE_CSR, reg);
 
         entry_priv = rt2x00dev->tx[1].entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, AC1_BASE_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, AC1_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, AC1_BASE_CSR_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, AC1_BASE_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, AC1_BASE_CSR, reg);
 
         entry_priv = rt2x00dev->tx[2].entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, AC2_BASE_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, AC2_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, AC2_BASE_CSR_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, AC2_BASE_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, AC2_BASE_CSR, reg);
 
         entry_priv = rt2x00dev->tx[3].entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, AC3_BASE_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, AC3_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, AC3_BASE_CSR_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, AC3_BASE_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, AC3_BASE_CSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, RX_RING_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RX_RING_CSR, &reg);
         rt2x00_set_field32(&reg, RX_RING_CSR_RING_SIZE, rt2x00dev->rx->limit);
         rt2x00_set_field32(&reg, RX_RING_CSR_RXD_SIZE,
                            rt2x00dev->rx->desc_size / 4);
         rt2x00_set_field32(&reg, RX_RING_CSR_RXD_WRITEBACK_SIZE, 4);
-        rt2x00pci_register_write(rt2x00dev, RX_RING_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, RX_RING_CSR, reg);
 
         entry_priv = rt2x00dev->rx->entries[0].priv_data;
-        rt2x00pci_register_read(rt2x00dev, RX_BASE_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RX_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, RX_BASE_CSR_RING_REGISTER,
                            entry_priv->desc_dma);
-        rt2x00pci_register_write(rt2x00dev, RX_BASE_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, RX_BASE_CSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, TX_DMA_DST_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TX_DMA_DST_CSR, &reg);
         rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC0, 2);
         rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC1, 2);
         rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC2, 2);
         rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC3, 2);
-        rt2x00pci_register_write(rt2x00dev, TX_DMA_DST_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, TX_DMA_DST_CSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, LOAD_TX_RING_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, LOAD_TX_RING_CSR, &reg);
         rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC0, 1);
         rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC1, 1);
         rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC2, 1);
         rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC3, 1);
-        rt2x00pci_register_write(rt2x00dev, LOAD_TX_RING_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, LOAD_TX_RING_CSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, RX_CNTL_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RX_CNTL_CSR, &reg);
         rt2x00_set_field32(&reg, RX_CNTL_CSR_LOAD_RXD, 1);
-        rt2x00pci_register_write(rt2x00dev, RX_CNTL_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, RX_CNTL_CSR, reg);
 
         return 0;
 }
@@ -1502,13 +1506,13 @@ static int rt61pci_init_registers(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR0_AUTO_TX_SEQ, 1);
         rt2x00_set_field32(&reg, TXRX_CSR0_DISABLE_RX, 0);
         rt2x00_set_field32(&reg, TXRX_CSR0_TX_WITHOUT_WAITING, 0);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR0, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR1, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID0, 47); /* CCK Signal */
         rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID0_VALID, 1);
         rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID1, 30); /* Rssi */
@@ -1517,12 +1521,12 @@ static int rt61pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID2_VALID, 1);
         rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID3, 30); /* Rssi */
         rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID3_VALID, 1);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR1, reg);
 
         /*
          * CCK TXD BBP registers
          */
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR2, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR2, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID0, 13);
         rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID0_VALID, 1);
         rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID1, 12);
@@ -1531,76 +1535,76 @@ static int rt61pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID2_VALID, 1);
         rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID3, 10);
         rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID3_VALID, 1);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR2, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR2, reg);
 
         /*
          * OFDM TXD BBP registers
          */
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR3, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR3, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID0, 7);
         rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID0_VALID, 1);
         rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID1, 6);
         rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID1_VALID, 1);
         rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID2, 5);
         rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID2_VALID, 1);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR3, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR3, reg);
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR7, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR7, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR7_ACK_CTS_6MBS, 59);
         rt2x00_set_field32(&reg, TXRX_CSR7_ACK_CTS_9MBS, 53);
         rt2x00_set_field32(&reg, TXRX_CSR7_ACK_CTS_12MBS, 49);
         rt2x00_set_field32(&reg, TXRX_CSR7_ACK_CTS_18MBS, 46);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR7, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR7, reg);
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR8, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR8, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR8_ACK_CTS_24MBS, 44);
         rt2x00_set_field32(&reg, TXRX_CSR8_ACK_CTS_36MBS, 42);
         rt2x00_set_field32(&reg, TXRX_CSR8_ACK_CTS_48MBS, 42);
         rt2x00_set_field32(&reg, TXRX_CSR8_ACK_CTS_54MBS, 42);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR8, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR8, reg);
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL, 0);
         rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 0);
         rt2x00_set_field32(&reg, TXRX_CSR9_TSF_SYNC, 0);
         rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 0);
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
         rt2x00_set_field32(&reg, TXRX_CSR9_TIMESTAMP_COMPENSATE, 0);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
 
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR15, 0x0000000f);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR15, 0x0000000f);
 
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR6, 0x00000fff);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR6, 0x00000fff);
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR9, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR9, &reg);
         rt2x00_set_field32(&reg, MAC_CSR9_CW_SELECT, 0);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR9, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR9, reg);
 
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR10, 0x0000071c);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR10, 0x0000071c);
 
         if (rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_AWAKE))
                 return -EBUSY;
 
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR13, 0x0000e000);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR13, 0x0000e000);
 
         /*
          * Invalidate all Shared Keys (SEC_CSR0),
          * and clear the Shared key Cipher algorithms (SEC_CSR1 & SEC_CSR5)
          */
-        rt2x00pci_register_write(rt2x00dev, SEC_CSR0, 0x00000000);
-        rt2x00pci_register_write(rt2x00dev, SEC_CSR1, 0x00000000);
-        rt2x00pci_register_write(rt2x00dev, SEC_CSR5, 0x00000000);
+        rt2x00mmio_register_write(rt2x00dev, SEC_CSR0, 0x00000000);
+        rt2x00mmio_register_write(rt2x00dev, SEC_CSR1, 0x00000000);
+        rt2x00mmio_register_write(rt2x00dev, SEC_CSR5, 0x00000000);
 
-        rt2x00pci_register_write(rt2x00dev, PHY_CSR1, 0x000023b0);
-        rt2x00pci_register_write(rt2x00dev, PHY_CSR5, 0x060a100c);
-        rt2x00pci_register_write(rt2x00dev, PHY_CSR6, 0x00080606);
-        rt2x00pci_register_write(rt2x00dev, PHY_CSR7, 0x00000a08);
+        rt2x00mmio_register_write(rt2x00dev, PHY_CSR1, 0x000023b0);
+        rt2x00mmio_register_write(rt2x00dev, PHY_CSR5, 0x060a100c);
+        rt2x00mmio_register_write(rt2x00dev, PHY_CSR6, 0x00080606);
+        rt2x00mmio_register_write(rt2x00dev, PHY_CSR7, 0x00000a08);
 
-        rt2x00pci_register_write(rt2x00dev, PCI_CFG_CSR, 0x28ca4404);
+        rt2x00mmio_register_write(rt2x00dev, PCI_CFG_CSR, 0x28ca4404);
 
-        rt2x00pci_register_write(rt2x00dev, TEST_MODE_CSR, 0x00000200);
+        rt2x00mmio_register_write(rt2x00dev, TEST_MODE_CSR, 0x00000200);
 
-        rt2x00pci_register_write(rt2x00dev, M2H_CMD_DONE_CSR, 0xffffffff);
+        rt2x00mmio_register_write(rt2x00dev, M2H_CMD_DONE_CSR, 0xffffffff);
 
         /*
          * Clear all beacons
@@ -1608,36 +1612,36 @@ static int rt61pci_init_registers(struct rt2x00_dev *rt2x00dev)
          * the first byte since that byte contains the VALID and OWNER
          * bits which (when set to 0) will invalidate the entire beacon.
          */
-        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
-        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
-        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
-        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
+        rt2x00mmio_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
+        rt2x00mmio_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
+        rt2x00mmio_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
+        rt2x00mmio_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
 
         /*
          * We must clear the error counters.
          * These registers are cleared on read,
          * so we may pass a useless variable to store the value.
          */
-        rt2x00pci_register_read(rt2x00dev, STA_CSR0, &reg);
-        rt2x00pci_register_read(rt2x00dev, STA_CSR1, &reg);
-        rt2x00pci_register_read(rt2x00dev, STA_CSR2, &reg);
+        rt2x00mmio_register_read(rt2x00dev, STA_CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, STA_CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, STA_CSR2, &reg);
 
         /*
          * Reset MAC and BBP registers.
          */
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR1, &reg);
         rt2x00_set_field32(&reg, MAC_CSR1_SOFT_RESET, 1);
         rt2x00_set_field32(&reg, MAC_CSR1_BBP_RESET, 1);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR1, &reg);
         rt2x00_set_field32(&reg, MAC_CSR1_SOFT_RESET, 0);
         rt2x00_set_field32(&reg, MAC_CSR1_BBP_RESET, 0);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR1, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR1, &reg);
         rt2x00_set_field32(&reg, MAC_CSR1_HOST_READY, 1);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR1, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
 
         return 0;
 }
@@ -1721,11 +1725,11 @@ static void rt61pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
          * should clear the register to assure a clean state.
          */
         if (state == STATE_RADIO_IRQ_ON) {
-                rt2x00pci_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
-                rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+                rt2x00mmio_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
+                rt2x00mmio_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
 
-                rt2x00pci_register_read(rt2x00dev, MCU_INT_SOURCE_CSR, &reg);
-                rt2x00pci_register_write(rt2x00dev, MCU_INT_SOURCE_CSR, reg);
+                rt2x00mmio_register_read(rt2x00dev, MCU_INT_SOURCE_CSR, &reg);
+                rt2x00mmio_register_write(rt2x00dev, MCU_INT_SOURCE_CSR, reg);
         }
 
         /*
@@ -1734,15 +1738,15 @@ static void rt61pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
          */
         spin_lock_irqsave(&rt2x00dev->irqmask_lock, flags);
 
-        rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, INT_MASK_CSR, &reg);
         rt2x00_set_field32(&reg, INT_MASK_CSR_TXDONE, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_RXDONE, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_BEACON_DONE, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_ENABLE_MITIGATION, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_MITIGATION_PERIOD, 0xff);
-        rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, INT_MASK_CSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, MCU_INT_MASK_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MCU_INT_MASK_CSR, &reg);
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_0, mask);
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_1, mask);
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_2, mask);
@@ -1752,7 +1756,7 @@ static void rt61pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_6, mask);
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_7, mask);
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_TWAKEUP, mask);
-        rt2x00pci_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
 
         spin_unlock_irqrestore(&rt2x00dev->irqmask_lock, flags);
 
@@ -1782,9 +1786,9 @@ static int rt61pci_enable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Enable RX.
          */
-        rt2x00pci_register_read(rt2x00dev, RX_CNTL_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, RX_CNTL_CSR, &reg);
         rt2x00_set_field32(&reg, RX_CNTL_CSR_ENABLE_RX_DMA, 1);
-        rt2x00pci_register_write(rt2x00dev, RX_CNTL_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, RX_CNTL_CSR, reg);
 
         return 0;
 }
@@ -1794,7 +1798,7 @@ static void rt61pci_disable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Disable power
          */
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR10, 0x00001818);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR10, 0x00001818);
 }
 
 static int rt61pci_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state)
@@ -1805,10 +1809,10 @@ static int rt61pci_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state)
 
         put_to_sleep = (state != STATE_AWAKE);
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR12, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR12, &reg);
         rt2x00_set_field32(&reg, MAC_CSR12_FORCE_WAKEUP, !put_to_sleep);
         rt2x00_set_field32(&reg, MAC_CSR12_PUT_TO_SLEEP, put_to_sleep);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR12, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR12, reg);
 
         /*
          * Device is not guaranteed to be in the requested state yet.
@@ -1816,11 +1820,11 @@ static int rt61pci_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state)
          * device has entered the correct state.
          */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00pci_register_read(rt2x00dev, MAC_CSR12, &reg2);
+                rt2x00mmio_register_read(rt2x00dev, MAC_CSR12, &reg2);
                 state = rt2x00_get_field32(reg2, MAC_CSR12_BBP_CURRENT_STATE);
                 if (state == !put_to_sleep)
                         return 0;
-                rt2x00pci_register_write(rt2x00dev, MAC_CSR12, reg);
+                rt2x00mmio_register_write(rt2x00dev, MAC_CSR12, reg);
                 msleep(10);
         }
 
@@ -1868,7 +1872,7 @@ static void rt61pci_write_tx_desc(struct queue_entry *entry,
                                   struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         __le32 *txd = entry_priv->desc;
         u32 word;
 
@@ -1966,7 +1970,7 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
                                  struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         unsigned int beacon_base;
         unsigned int padding_len;
         u32 orig_reg, reg;
@@ -1975,10 +1979,10 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9, &reg);
         orig_reg = reg;
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
 
         /*
          * Write the TX descriptor for the beacon.
@@ -1998,16 +2002,16 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
                 ERROR(rt2x00dev, "Failure padding beacon, aborting\n");
                 /* skb freed by skb_pad() on failure */
                 entry->skb = NULL;
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, orig_reg);
+                rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, orig_reg);
                 return;
         }
 
         beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
-        rt2x00pci_register_multiwrite(rt2x00dev, beacon_base,
-                                      entry_priv->desc, TXINFO_SIZE);
-        rt2x00pci_register_multiwrite(rt2x00dev, beacon_base + TXINFO_SIZE,
-                                      entry->skb->data,
-                                      entry->skb->len + padding_len);
+        rt2x00mmio_register_multiwrite(rt2x00dev, beacon_base,
+                                       entry_priv->desc, TXINFO_SIZE);
+        rt2x00mmio_register_multiwrite(rt2x00dev, beacon_base + TXINFO_SIZE,
+                                       entry->skb->data,
+                                       entry->skb->len + padding_len);
 
         /*
          * Enable beaconing again.
@@ -2015,10 +2019,10 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
          * For Wi-Fi faily generated beacons between participating
          * stations. Set TBTT phase adaptive adjustment step to 8us.
          */
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR10, 0x00001008);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR10, 0x00001008);
 
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
 
         /*
          * Clean up beacon skb.
@@ -2036,21 +2040,21 @@ static void rt61pci_clear_beacon(struct queue_entry *entry)
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
 
         /*
          * Clear beacon.
          */
-        rt2x00pci_register_write(rt2x00dev,
-                                 HW_BEACON_OFFSET(entry->entry_idx), 0);
+        rt2x00mmio_register_write(rt2x00dev,
+                                  HW_BEACON_OFFSET(entry->entry_idx), 0);
 
         /*
          * Enable beaconing again.
          */
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
 }
 
 /*
@@ -2088,7 +2092,7 @@ static void rt61pci_fill_rxdone(struct queue_entry *entry,
                                 struct rxdone_entry_desc *rxdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         u32 word0;
         u32 word1;
 
@@ -2154,7 +2158,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
         struct data_queue *queue;
         struct queue_entry *entry;
         struct queue_entry *entry_done;
-        struct queue_entry_priv_pci *entry_priv;
+        struct queue_entry_priv_mmio *entry_priv;
         struct txdone_entry_desc txdesc;
         u32 word;
         u32 reg;
@@ -2172,7 +2176,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
          * tx ring size for now.
          */
         for (i = 0; i < rt2x00dev->ops->tx->entry_num; i++) {
-                rt2x00pci_register_read(rt2x00dev, STA_CSR4, &reg);
+                rt2x00mmio_register_read(rt2x00dev, STA_CSR4, &reg);
                 if (!rt2x00_get_field32(reg, STA_CSR4_VALID))
                         break;
 
@@ -2259,9 +2263,9 @@ static inline void rt61pci_enable_interrupt(struct rt2x00_dev *rt2x00dev,
          */
         spin_lock_irq(&rt2x00dev->irqmask_lock);
 
-        rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, INT_MASK_CSR, &reg);
         rt2x00_set_field32(&reg, irq_field, 0);
-        rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, INT_MASK_CSR, reg);
 
         spin_unlock_irq(&rt2x00dev->irqmask_lock);
 }
@@ -2277,9 +2281,9 @@ static void rt61pci_enable_mcu_interrupt(struct rt2x00_dev *rt2x00dev,
          */
         spin_lock_irq(&rt2x00dev->irqmask_lock);
 
-        rt2x00pci_register_read(rt2x00dev, MCU_INT_MASK_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MCU_INT_MASK_CSR, &reg);
         rt2x00_set_field32(&reg, irq_field, 0);
-        rt2x00pci_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
 
         spin_unlock_irq(&rt2x00dev->irqmask_lock);
 }
@@ -2303,7 +2307,7 @@ static void rt61pci_tbtt_tasklet(unsigned long data)
 static void rt61pci_rxdone_tasklet(unsigned long data)
 {
         struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
-        if (rt2x00pci_rxdone(rt2x00dev))
+        if (rt2x00mmio_rxdone(rt2x00dev))
                 tasklet_schedule(&rt2x00dev->rxdone_tasklet);
         else if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
                 rt61pci_enable_interrupt(rt2x00dev, INT_MASK_CSR_RXDONE);
@@ -2313,8 +2317,8 @@ static void rt61pci_autowake_tasklet(unsigned long data)
 {
         struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
         rt61pci_wakeup(rt2x00dev);
-        rt2x00pci_register_write(rt2x00dev,
-                                 M2H_CMD_DONE_CSR, 0xffffffff);
+        rt2x00mmio_register_write(rt2x00dev,
+                                  M2H_CMD_DONE_CSR, 0xffffffff);
         if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
                 rt61pci_enable_mcu_interrupt(rt2x00dev, MCU_INT_MASK_CSR_TWAKEUP);
 }
@@ -2329,11 +2333,11 @@ static irqreturn_t rt61pci_interrupt(int irq, void *dev_instance)
          * Get the interrupt sources & saved to local variable.
          * Write register value back to clear pending interrupts.
          */
-        rt2x00pci_register_read(rt2x00dev, MCU_INT_SOURCE_CSR, &reg_mcu);
-        rt2x00pci_register_write(rt2x00dev, MCU_INT_SOURCE_CSR, reg_mcu);
+        rt2x00mmio_register_read(rt2x00dev, MCU_INT_SOURCE_CSR, &reg_mcu);
+        rt2x00mmio_register_write(rt2x00dev, MCU_INT_SOURCE_CSR, reg_mcu);
 
-        rt2x00pci_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
-        rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+        rt2x00mmio_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
+        rt2x00mmio_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
 
         if (!reg && !reg_mcu)
                 return IRQ_NONE;
@@ -2370,13 +2374,13 @@ static irqreturn_t rt61pci_interrupt(int irq, void *dev_instance)
          */
         spin_lock(&rt2x00dev->irqmask_lock);
 
-        rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, INT_MASK_CSR, &reg);
         reg |= mask;
-        rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, INT_MASK_CSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, MCU_INT_MASK_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MCU_INT_MASK_CSR, &reg);
         reg |= mask_mcu;
-        rt2x00pci_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
 
         spin_unlock(&rt2x00dev->irqmask_lock);
 
@@ -2394,7 +2398,7 @@ static int rt61pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
         u8 *mac;
         s8 value;
 
-        rt2x00pci_register_read(rt2x00dev, E2PROM_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, E2PROM_CSR, &reg);
 
         eeprom.data = rt2x00dev;
         eeprom.register_read = rt61pci_eepromregister_read;
@@ -2512,7 +2516,7 @@ static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
          * Identify RF chipset.
          */
         value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR0, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR0, &reg);
         rt2x00_set_chip(rt2x00dev, rt2x00_get_field32(reg, MAC_CSR0_CHIPSET),
                         value, rt2x00_get_field32(reg, MAC_CSR0_REVISION));
 
@@ -2837,7 +2841,7 @@ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
         /*
          * Disable power saving.
          */
-        rt2x00pci_register_write(rt2x00dev, SOFT_RESET_CSR, 0x00000007);
+        rt2x00mmio_register_write(rt2x00dev, SOFT_RESET_CSR, 0x00000007);
 
         /*
          * Allocate eeprom data.
@@ -2854,9 +2858,9 @@ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
          * Enable rfkill polling by setting GPIO direction of the
          * rfkill switch GPIO pin correctly.
          */
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00mmio_register_read(rt2x00dev, MAC_CSR13, &reg);
         rt2x00_set_field32(&reg, MAC_CSR13_DIR5, 1);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
+        rt2x00mmio_register_write(rt2x00dev, MAC_CSR13, reg);
 
         /*
          * Initialize hw specifications.
@@ -2926,25 +2930,25 @@ static int rt61pci_conf_tx(struct ieee80211_hw *hw,
         field.bit_offset = (queue_idx & 1) * 16;
         field.bit_mask = 0xffff << field.bit_offset;
 
-        rt2x00pci_register_read(rt2x00dev, offset, &reg);
+        rt2x00mmio_register_read(rt2x00dev, offset, &reg);
         rt2x00_set_field32(&reg, field, queue->txop);
-        rt2x00pci_register_write(rt2x00dev, offset, reg);
+        rt2x00mmio_register_write(rt2x00dev, offset, reg);
 
         /* Update WMM registers */
         field.bit_offset = queue_idx * 4;
         field.bit_mask = 0xf << field.bit_offset;
 
-        rt2x00pci_register_read(rt2x00dev, AIFSN_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, AIFSN_CSR, &reg);
         rt2x00_set_field32(&reg, field, queue->aifs);
-        rt2x00pci_register_write(rt2x00dev, AIFSN_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, AIFSN_CSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CWMIN_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CWMIN_CSR, &reg);
         rt2x00_set_field32(&reg, field, queue->cw_min);
-        rt2x00pci_register_write(rt2x00dev, CWMIN_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, CWMIN_CSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CWMAX_CSR, &reg);
+        rt2x00mmio_register_read(rt2x00dev, CWMAX_CSR, &reg);
         rt2x00_set_field32(&reg, field, queue->cw_max);
-        rt2x00pci_register_write(rt2x00dev, CWMAX_CSR, reg);
+        rt2x00mmio_register_write(rt2x00dev, CWMAX_CSR, reg);
 
         return 0;
 }
@@ -2955,9 +2959,9 @@ static u64 rt61pci_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
         u64 tsf;
         u32 reg;
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR13, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR13, &reg);
         tsf = (u64) rt2x00_get_field32(reg, TXRX_CSR13_HIGH_TSFTIMER) << 32;
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR12, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR12, &reg);
         tsf |= rt2x00_get_field32(reg, TXRX_CSR12_LOW_TSFTIMER);
 
         return tsf;
@@ -2996,8 +3000,8 @@ static const struct rt2x00lib_ops rt61pci_rt2x00_ops = {
         .get_firmware_name      = rt61pci_get_firmware_name,
         .check_firmware         = rt61pci_check_firmware,
         .load_firmware          = rt61pci_load_firmware,
-        .initialize             = rt2x00pci_initialize,
-        .uninitialize           = rt2x00pci_uninitialize,
+        .initialize             = rt2x00mmio_initialize,
+        .uninitialize           = rt2x00mmio_uninitialize,
         .get_entry_state        = rt61pci_get_entry_state,
         .clear_entry            = rt61pci_clear_entry,
         .set_device_state       = rt61pci_set_device_state,
@@ -3008,7 +3012,7 @@ static const struct rt2x00lib_ops rt61pci_rt2x00_ops = {
         .start_queue            = rt61pci_start_queue,
         .kick_queue             = rt61pci_kick_queue,
         .stop_queue             = rt61pci_stop_queue,
-        .flush_queue            = rt2x00pci_flush_queue,
+        .flush_queue            = rt2x00mmio_flush_queue,
         .write_tx_desc          = rt61pci_write_tx_desc,
         .write_beacon           = rt61pci_write_beacon,
         .clear_beacon           = rt61pci_clear_beacon,
@@ -3026,21 +3030,21 @@ static const struct data_queue_desc rt61pci_queue_rx = {
         .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = RXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt61pci_queue_tx = {
         .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct data_queue_desc rt61pci_queue_bcn = {
         .entry_num              = 4,
         .data_size              = 0, /* No DMA required for beacons */
         .desc_size              = TXINFO_SIZE,
-        .priv_size              = sizeof(struct queue_entry_priv_pci),
+        .priv_size              = sizeof(struct queue_entry_priv_mmio),
 };
 
 static const struct rt2x00_ops rt61pci_ops = {
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index b6aa0c40658f..7253de3d8c66 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -55,6 +55,15 @@ config RTL8723AE
 
         If you choose to build it as a module, it will be called rtl8723ae
 
+config RTL8188EE
+        tristate "Realtek RTL8188EE Wireless Network Adapter"
+        depends on RTLWIFI && PCI
+        ---help---
+        This is the driver for Realtek RTL8188EE 802.11n PCIe
+        wireless network adapters.
+
+        If you choose to build it as a module, it will be called rtl8188ee
+
 config RTL8192CU
         tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
         depends on RTLWIFI && USB
diff --git a/drivers/net/wireless/rtlwifi/Makefile b/drivers/net/wireless/rtlwifi/Makefile
index 3b1cbac741e3..ff02b874f8d8 100644
--- a/drivers/net/wireless/rtlwifi/Makefile
+++ b/drivers/net/wireless/rtlwifi/Makefile
@@ -26,5 +26,6 @@ obj-$(CONFIG_RTL8192CU)		+= rtl8192cu/
 obj-$(CONFIG_RTL8192SE)         += rtl8192se/
 obj-$(CONFIG_RTL8192DE)         += rtl8192de/
 obj-$(CONFIG_RTL8723AE)         += rtl8723ae/
+obj-$(CONFIG_RTL8188EE)         += rtl8188ee/
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 0e7866d1d0e2..af59dd5718e1 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -54,7 +54,8 @@
  *5) frame process functions
  *6) IOT functions
  *7) sysfs functions
- *8) ...
+ *8) vif functions
+ *9) ...
  */
 
 /*********************************************************
@@ -198,34 +199,46 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
 
         ht_cap->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
 
-        /*
-         *hw->wiphy->bands[IEEE80211_BAND_2GHZ]
+        /*hw->wiphy->bands[IEEE80211_BAND_2GHZ]
          *base on ant_num
          *rx_mask: RX mask
-         *if rx_ant =1 rx_mask[0]=0xff;==>MCS0-MCS7
-         *if rx_ant =2 rx_mask[1]=0xff;==>MCS8-MCS15
-         *if rx_ant >=3 rx_mask[2]=0xff;
-         *if BW_40 rx_mask[4]=0x01;
+         *if rx_ant = 1 rx_mask[0]= 0xff;==>MCS0-MCS7
+         *if rx_ant = 2 rx_mask[1]= 0xff;==>MCS8-MCS15
+         *if rx_ant >= 3 rx_mask[2]= 0xff;
+         *if BW_40 rx_mask[4]= 0x01;
          *highest supported RX rate
          */
-        if (get_rf_type(rtlphy) == RF_1T2R || get_rf_type(rtlphy) == RF_2T2R) {
+        if (rtlpriv->dm.supp_phymode_switch) {
 
-                RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "1T2R or 2T2R\n");
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_EMERG,
+                         "Support phy mode switch\n");
 
                 ht_cap->mcs.rx_mask[0] = 0xFF;
                 ht_cap->mcs.rx_mask[1] = 0xFF;
                 ht_cap->mcs.rx_mask[4] = 0x01;
 
                 ht_cap->mcs.rx_highest = cpu_to_le16(MAX_BIT_RATE_40MHZ_MCS15);
-        } else if (get_rf_type(rtlphy) == RF_1T1R) {
-
-                RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n");
-
-                ht_cap->mcs.rx_mask[0] = 0xFF;
-                ht_cap->mcs.rx_mask[1] = 0x00;
-                ht_cap->mcs.rx_mask[4] = 0x01;
-
-                ht_cap->mcs.rx_highest = cpu_to_le16(MAX_BIT_RATE_40MHZ_MCS7);
+        } else {
+                if (get_rf_type(rtlphy) == RF_1T2R ||
+                    get_rf_type(rtlphy) == RF_2T2R) {
+                        RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+                                 "1T2R or 2T2R\n");
+                        ht_cap->mcs.rx_mask[0] = 0xFF;
+                        ht_cap->mcs.rx_mask[1] = 0xFF;
+                        ht_cap->mcs.rx_mask[4] = 0x01;
+
+                        ht_cap->mcs.rx_highest =
+                                 cpu_to_le16(MAX_BIT_RATE_40MHZ_MCS15);
+                } else if (get_rf_type(rtlphy) == RF_1T1R) {
+                        RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n");
+
+                        ht_cap->mcs.rx_mask[0] = 0xFF;
+                        ht_cap->mcs.rx_mask[1] = 0x00;
+                        ht_cap->mcs.rx_mask[4] = 0x01;
+
+                        ht_cap->mcs.rx_highest =
+                                 cpu_to_le16(MAX_BIT_RATE_40MHZ_MCS7);
+                }
         }
 }
 
@@ -311,6 +324,8 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw)
             IEEE80211_HW_AMPDU_AGGREGATION |
             IEEE80211_HW_CONNECTION_MONITOR |
             /* IEEE80211_HW_SUPPORTS_CQM_RSSI | */
+            IEEE80211_HW_CONNECTION_MONITOR |
+            IEEE80211_HW_MFP_CAPABLE |
             IEEE80211_HW_REPORTS_TX_ACK_STATUS | 0;
 
         /* swlps or hwlps has been set in diff chip in init_sw_vars */
@@ -323,8 +338,12 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw)
         hw->wiphy->interface_modes =
             BIT(NL80211_IFTYPE_AP) |
             BIT(NL80211_IFTYPE_STATION) |
-            BIT(NL80211_IFTYPE_ADHOC);
+            BIT(NL80211_IFTYPE_ADHOC) |
+            BIT(NL80211_IFTYPE_MESH_POINT) |
+            BIT(NL80211_IFTYPE_P2P_CLIENT) |
+            BIT(NL80211_IFTYPE_P2P_GO);
 
+        hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
         hw->wiphy->rts_threshold = 2347;
 
         hw->queues = AC_MAX;
@@ -354,9 +373,10 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         /* <1> timer */
-        init_timer(&rtlpriv->works.watchdog_timer);
         setup_timer(&rtlpriv->works.watchdog_timer,
                     rtl_watch_dog_timer_callback, (unsigned long)hw);
+        setup_timer(&rtlpriv->works.dualmac_easyconcurrent_retrytimer,
+                    rtl_easy_concurrent_retrytimer_callback, (unsigned long)hw);
 
         /* <2> work queue */
         rtlpriv->works.hw = hw;
@@ -369,6 +389,8 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
                           (void *)rtl_swlps_wq_callback);
         INIT_DELAYED_WORK(&rtlpriv->works.ps_rfon_wq,
                           (void *)rtl_swlps_rfon_wq_callback);
+        INIT_DELAYED_WORK(&rtlpriv->works.fwevt_wq,
+                          (void *)rtl_fwevt_wq_callback);
 
 }
 
@@ -382,6 +404,7 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
         cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
         cancel_delayed_work(&rtlpriv->works.ps_work);
         cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
+        cancel_delayed_work(&rtlpriv->works.fwevt_wq);
 }
 
 void rtl_init_rfkill(struct ieee80211_hw *hw)
@@ -436,12 +459,6 @@ int rtl_init_core(struct ieee80211_hw *hw)
         if (rtl_regd_init(hw, rtl_reg_notifier)) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "REGD init failed\n");
                 return 1;
-        } else {
-                /* CRDA regd hint must after init CRDA */
-                if (regulatory_hint(hw->wiphy, rtlpriv->regd.alpha2)) {
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
-                                 "regulatory_hint fail\n");
-                }
         }
 
         /* <4> locks */
@@ -449,15 +466,25 @@ int rtl_init_core(struct ieee80211_hw *hw)
         mutex_init(&rtlpriv->locks.ps_mutex);
         spin_lock_init(&rtlpriv->locks.ips_lock);
         spin_lock_init(&rtlpriv->locks.irq_th_lock);
+        spin_lock_init(&rtlpriv->locks.irq_pci_lock);
+        spin_lock_init(&rtlpriv->locks.tx_lock);
         spin_lock_init(&rtlpriv->locks.h2c_lock);
         spin_lock_init(&rtlpriv->locks.rf_ps_lock);
         spin_lock_init(&rtlpriv->locks.rf_lock);
         spin_lock_init(&rtlpriv->locks.waitq_lock);
+        spin_lock_init(&rtlpriv->locks.entry_list_lock);
+        spin_lock_init(&rtlpriv->locks.fw_ps_lock);
         spin_lock_init(&rtlpriv->locks.cck_and_rw_pagea_lock);
+        spin_lock_init(&rtlpriv->locks.check_sendpkt_lock);
+        spin_lock_init(&rtlpriv->locks.fw_ps_lock);
+        spin_lock_init(&rtlpriv->locks.lps_lock);
+
+        /* <5> init list */
+        INIT_LIST_HEAD(&rtlpriv->entry_list);
 
         rtlmac->link_state = MAC80211_NOLINK;
 
-        /* <5> init deferred work */
+        /* <6> init deferred work */
         _rtl_init_deferred_work(hw);
 
         return 0;
@@ -523,7 +550,8 @@ static void _rtl_query_shortgi(struct ieee80211_hw *hw,
         if (mac->opmode == NL80211_IFTYPE_STATION)
                 bw_40 = mac->bw_40;
         else if (mac->opmode == NL80211_IFTYPE_AP ||
-                 mac->opmode == NL80211_IFTYPE_ADHOC)
+                 mac->opmode == NL80211_IFTYPE_ADHOC ||
+                 mac->opmode == NL80211_IFTYPE_MESH_POINT)
                 bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
 
         if (bw_40 && sgi_40)
@@ -578,23 +606,26 @@ static void _rtl_txrate_selectmode(struct ieee80211_hw *hw,
         if (!tcb_desc->disable_ratefallback || !tcb_desc->use_driver_rate) {
                 if (mac->opmode == NL80211_IFTYPE_STATION) {
                         tcb_desc->ratr_index = 0;
-                } else if (mac->opmode == NL80211_IFTYPE_ADHOC) {
+                } else if (mac->opmode == NL80211_IFTYPE_ADHOC ||
+                           mac->opmode == NL80211_IFTYPE_MESH_POINT) {
                         if (tcb_desc->multicast || tcb_desc->broadcast) {
                                 tcb_desc->hw_rate =
                                     rtlpriv->cfg->maps[RTL_RC_CCK_RATE2M];
                                 tcb_desc->use_driver_rate = 1;
+                                tcb_desc->ratr_index = RATR_INX_WIRELESS_MC;
                         } else {
-                                /* TODO */
+                                tcb_desc->ratr_index = ratr_index;
                         }
-                        tcb_desc->ratr_index = ratr_index;
                 } else if (mac->opmode == NL80211_IFTYPE_AP) {
                         tcb_desc->ratr_index = ratr_index;
                 }
         }
 
         if (rtlpriv->dm.useramask) {
-                /* TODO we will differentiate adhoc and station futrue  */
-                if (mac->opmode == NL80211_IFTYPE_STATION) {
+                tcb_desc->ratr_index = ratr_index;
+                /* TODO we will differentiate adhoc and station future  */
+                if (mac->opmode == NL80211_IFTYPE_STATION ||
+                    mac->opmode == NL80211_IFTYPE_MESH_POINT) {
                         tcb_desc->mac_id = 0;
 
                         if (mac->mode == WIRELESS_MODE_N_24G)
@@ -608,7 +639,7 @@ static void _rtl_txrate_selectmode(struct ieee80211_hw *hw,
                         else if (mac->mode & WIRELESS_MODE_A)
                                 tcb_desc->ratr_index = RATR_INX_WIRELESS_G;
                 } else if (mac->opmode == NL80211_IFTYPE_AP ||
-                        mac->opmode == NL80211_IFTYPE_ADHOC) {
+                           mac->opmode == NL80211_IFTYPE_ADHOC) {
                         if (NULL != sta) {
                                 if (sta->aid > 0)
                                         tcb_desc->mac_id = sta->aid + 1;
@@ -619,7 +650,6 @@ static void _rtl_txrate_selectmode(struct ieee80211_hw *hw,
                         }
                 }
         }
-
 }
 
 static void _rtl_query_bandwidth_mode(struct ieee80211_hw *hw,
@@ -633,7 +663,8 @@ static void _rtl_query_bandwidth_mode(struct ieee80211_hw *hw,
         if (!sta)
                 return;
         if (mac->opmode == NL80211_IFTYPE_AP ||
-            mac->opmode == NL80211_IFTYPE_ADHOC) {
+            mac->opmode == NL80211_IFTYPE_ADHOC ||
+            mac->opmode == NL80211_IFTYPE_MESH_POINT) {
                 if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
                         return;
         } else if (mac->opmode == NL80211_IFTYPE_STATION) {
@@ -834,8 +865,8 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (rtlpriv->dm.supp_phymode_switch &&
             mac->link_state < MAC80211_LINKED &&
             (ieee80211_is_auth(fc) || ieee80211_is_probe_req(fc))) {
-                if (rtlpriv->cfg->ops->check_switch_to_dmdp)
-                        rtlpriv->cfg->ops->check_switch_to_dmdp(hw);
+                if (rtlpriv->cfg->ops->chk_switch_dmdp)
+                        rtlpriv->cfg->ops->chk_switch_dmdp(hw);
         }
         if (ieee80211_is_auth(fc)) {
                 RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
@@ -924,6 +955,56 @@ void rtl_get_tcb_desc(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(rtl_get_tcb_desc);
 
+static bool addbareq_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct ieee80211_sta *sta = NULL;
+        struct ieee80211_hdr *hdr = rtl_get_hdr(skb);
+        struct rtl_sta_info *sta_entry = NULL;
+        struct ieee80211_mgmt *mgmt = (void *)skb->data;
+        u16 capab = 0, tid = 0;
+        struct rtl_tid_data *tid_data;
+        struct sk_buff *skb_delba = NULL;
+        struct ieee80211_rx_status rx_status = { 0 };
+
+        rcu_read_lock();
+        sta = rtl_find_sta(hw, hdr->addr3);
+        if (sta == NULL) {
+                RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_EMERG,
+                         "sta is NULL\n");
+                rcu_read_unlock();
+                return true;
+        }
+
+        sta_entry = (struct rtl_sta_info *)sta->drv_priv;
+        if (!sta_entry) {
+                rcu_read_unlock();
+                return true;
+        }
+        capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
+        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+        tid_data = &sta_entry->tids[tid];
+        if (tid_data->agg.rx_agg_state == RTL_RX_AGG_START) {
+                skb_delba = rtl_make_del_ba(hw, hdr->addr2, hdr->addr3, tid);
+                if (skb_delba) {
+                        rx_status.freq = hw->conf.chandef.chan->center_freq;
+                        rx_status.band = hw->conf.chandef.chan->band;
+                        rx_status.flag |= RX_FLAG_DECRYPTED;
+                        rx_status.flag |= RX_FLAG_MACTIME_END;
+                        rx_status.rate_idx = 0;
+                        rx_status.signal = 50 + 10;
+                        memcpy(IEEE80211_SKB_RXCB(skb_delba), &rx_status,
+                               sizeof(rx_status));
+                        RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_DMESG,
+                                      "fake del\n", skb_delba->data,
+                                      skb_delba->len);
+                        ieee80211_rx_irqsafe(hw, skb_delba);
+                }
+        }
+        rcu_read_unlock();
+        return false;
+}
+
 bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
 {
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
@@ -948,6 +1029,11 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                         RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
                                  "%s ACT_ADDBAREQ From :%pM\n",
                                  is_tx ? "Tx" : "Rx", hdr->addr2);
+                        RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_DMESG, "req\n",
+                                      skb->data, skb->len);
+                        if (!is_tx)
+                                if (addbareq_rx(hw, skb))
+                                        return true;
                         break;
                 case ACT_ADDBARSP:
                         RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
@@ -1003,8 +1089,9 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                                          is_tx ? "Tx" : "Rx");
 
                                 if (is_tx) {
+                                        rtlpriv->enter_ps = false;
                                         schedule_work(&rtlpriv->
-                                                      works.lps_leave_work);
+                                                      works.lps_change_work);
                                         ppsc->last_delaylps_stamp_jiffies =
                                             jiffies;
                                 }
@@ -1014,7 +1101,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                 }
         } else if (ETH_P_ARP == ether_type) {
                 if (is_tx) {
-                        schedule_work(&rtlpriv->works.lps_leave_work);
+                        rtlpriv->enter_ps = false;
+                        schedule_work(&rtlpriv->works.lps_change_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
@@ -1024,7 +1112,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                          "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
 
                 if (is_tx) {
-                        schedule_work(&rtlpriv->works.lps_leave_work);
+                        rtlpriv->enter_ps = false;
+                        schedule_work(&rtlpriv->works.lps_change_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
@@ -1101,6 +1190,58 @@ int rtl_tx_agg_stop(struct ieee80211_hw *hw,
         return 0;
 }
 
+int rtl_rx_agg_start(struct ieee80211_hw *hw,
+                     struct ieee80211_sta *sta, u16 tid)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_tid_data *tid_data;
+        struct rtl_sta_info *sta_entry = NULL;
+
+        if (sta == NULL)
+                return -EINVAL;
+
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
+
+        sta_entry = (struct rtl_sta_info *)sta->drv_priv;
+        if (!sta_entry)
+                return -ENXIO;
+        tid_data = &sta_entry->tids[tid];
+
+        RT_TRACE(rtlpriv, COMP_RECV, DBG_DMESG,
+                 "on ra = %pM tid = %d seq:%d\n", sta->addr, tid,
+                 tid_data->seq_number);
+
+        tid_data->agg.rx_agg_state = RTL_RX_AGG_START;
+        return 0;
+}
+
+int rtl_rx_agg_stop(struct ieee80211_hw *hw,
+                    struct ieee80211_sta *sta, u16 tid)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_sta_info *sta_entry = NULL;
+
+        if (sta == NULL)
+                return -EINVAL;
+
+        if (!sta->addr) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "ra = NULL\n");
+                return -EINVAL;
+        }
+
+        RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+                 "on ra = %pM tid = %d\n", sta->addr, tid);
+
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
+
+        sta_entry = (struct rtl_sta_info *)sta->drv_priv;
+        sta_entry->tids[tid].agg.rx_agg_state = RTL_RX_AGG_STOP;
+
+        return 0;
+}
+
 int rtl_tx_agg_oper(struct ieee80211_hw *hw,
                 struct ieee80211_sta *sta, u16 tid)
 {
@@ -1132,6 +1273,34 @@ int rtl_tx_agg_oper(struct ieee80211_hw *hw,
  * wq & timer callback functions
  *
  *********************************************************/
+/* this function is used for roaming */
+void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+
+        if (rtlpriv->mac80211.opmode != NL80211_IFTYPE_STATION)
+                return;
+
+        if (rtlpriv->mac80211.link_state < MAC80211_LINKED)
+                return;
+
+        /* check if this really is a beacon */
+        if (!ieee80211_is_beacon(hdr->frame_control) &&
+            !ieee80211_is_probe_resp(hdr->frame_control))
+                return;
+
+        /* min. beacon length + FCS_LEN */
+        if (skb->len <= 40 + FCS_LEN)
+                return;
+
+        /* and only beacons from the associated BSSID, please */
+        if (compare_ether_addr(hdr->addr3, rtlpriv->mac80211.bssid))
+                return;
+
+        rtlpriv->link_info.bcn_rx_inperiod++;
+}
+
 void rtl_watchdog_wq_callback(void *data)
 {
         struct rtl_works *rtlworks = container_of_dwork_rtl(data,
@@ -1142,6 +1311,8 @@ void rtl_watchdog_wq_callback(void *data)
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         bool busytraffic = false;
+        bool tx_busy_traffic = false;
+        bool rx_busy_traffic = false;
         bool higher_busytraffic = false;
         bool higher_busyrxtraffic = false;
         u8 idx, tid;
@@ -1151,7 +1322,6 @@ void rtl_watchdog_wq_callback(void *data)
         u32 aver_tx_cnt_inperiod = 0;
         u32 aver_tidtx_inperiod[MAX_TID_COUNT] = {0};
         u32 tidtx_inp4eriod[MAX_TID_COUNT] = {0};
-        bool enter_ps = false;
 
         if (is_hal_stop(rtlhal))
                 return;
@@ -1191,8 +1361,13 @@ void rtl_watchdog_wq_callback(void *data)
                 aver_tx_cnt_inperiod = tx_cnt_inp4eriod / 4;
 
                 /* (2) check traffic busy */
-                if (aver_rx_cnt_inperiod > 100 || aver_tx_cnt_inperiod > 100)
+                if (aver_rx_cnt_inperiod > 100 || aver_tx_cnt_inperiod > 100) {
                         busytraffic = true;
+                        if (aver_rx_cnt_inperiod > aver_tx_cnt_inperiod)
+                                rx_busy_traffic = true;
+                        else
+                                tx_busy_traffic = false;
+                }
 
                 /* Higher Tx/Rx data. */
                 if (aver_rx_cnt_inperiod > 4000 ||
@@ -1228,15 +1403,12 @@ void rtl_watchdog_wq_callback(void *data)
                 if (((rtlpriv->link_info.num_rx_inperiod +
                       rtlpriv->link_info.num_tx_inperiod) > 8) ||
                     (rtlpriv->link_info.num_rx_inperiod > 2))
-                        enter_ps = false;
+                        rtlpriv->enter_ps = true;
                 else
-                        enter_ps = true;
+                        rtlpriv->enter_ps = false;
 
                 /* LeisurePS only work in infra mode. */
-                if (enter_ps)
-                        rtl_lps_enter(hw);
-                else
-                        rtl_lps_leave(hw);
+                schedule_work(&rtlpriv->works.lps_change_work);
         }
 
         rtlpriv->link_info.num_rx_inperiod = 0;
@@ -1246,10 +1418,37 @@ void rtl_watchdog_wq_callback(void *data)
 
         rtlpriv->link_info.busytraffic = busytraffic;
         rtlpriv->link_info.higher_busytraffic = higher_busytraffic;
+        rtlpriv->link_info.rx_busy_traffic = rx_busy_traffic;
+        rtlpriv->link_info.tx_busy_traffic = tx_busy_traffic;
         rtlpriv->link_info.higher_busyrxtraffic = higher_busyrxtraffic;
 
         /* <3> DM */
         rtlpriv->cfg->ops->dm_watchdog(hw);
+
+        /* <4> roaming */
+        if (mac->link_state == MAC80211_LINKED &&
+            mac->opmode == NL80211_IFTYPE_STATION) {
+                if ((rtlpriv->link_info.bcn_rx_inperiod +
+                     rtlpriv->link_info.num_rx_inperiod) == 0) {
+                        rtlpriv->link_info.roam_times++;
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+                                 "AP off for %d s\n",
+                                 (rtlpriv->link_info.roam_times * 2));
+
+                        /* if we can't recv beacon for 6s, we should
+                         * reconnect this AP
+                         */
+                        if (rtlpriv->link_info.roam_times >= 3) {
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                         "AP off, try to reconnect now\n");
+                                rtlpriv->link_info.roam_times = 0;
+                                ieee80211_connection_loss(rtlpriv->mac80211.vif);
+                        }
+                } else {
+                        rtlpriv->link_info.roam_times = 0;
+                }
+        }
+        rtlpriv->link_info.bcn_rx_inperiod = 0;
 }
 
 void rtl_watch_dog_timer_callback(unsigned long data)
@@ -1264,6 +1463,28 @@ void rtl_watch_dog_timer_callback(unsigned long data)
                   jiffies + MSECS(RTL_WATCH_DOG_TIME));
 }
 
+void rtl_fwevt_wq_callback(void *data)
+{
+        struct rtl_works *rtlworks =
+                container_of_dwork_rtl(data, struct rtl_works, fwevt_wq);
+        struct ieee80211_hw *hw = rtlworks->hw;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        rtlpriv->cfg->ops->c2h_command_handle(hw);
+}
+
+void rtl_easy_concurrent_retrytimer_callback(unsigned long data)
+{
+        struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_priv *buddy_priv = rtlpriv->buddy_priv;
+
+        if (buddy_priv == NULL)
+                return;
+
+        rtlpriv->cfg->ops->dualmac_easy_concurrent(hw);
+}
+
 /*********************************************************
  *
  * frame process functions
@@ -1334,14 +1555,16 @@ static struct sk_buff *rtl_make_smps_action(struct ieee80211_hw *hw,
 }
 
 int rtl_send_smps_action(struct ieee80211_hw *hw,
-                struct ieee80211_sta *sta, u8 *da, u8 *bssid,
+                struct ieee80211_sta *sta,
                 enum ieee80211_smps_mode smps)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
-        struct sk_buff *skb = rtl_make_smps_action(hw, smps, da, bssid);
+        struct sk_buff *skb = NULL;
         struct rtl_tcb_desc tcb_desc;
+        u8 bssid[ETH_ALEN] = {0};
+
         memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
 
         if (rtlpriv->mac80211.act_scanning)
@@ -1356,21 +1579,67 @@ int rtl_send_smps_action(struct ieee80211_hw *hw,
         if (!test_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status))
                 goto err_free;
 
+        if (rtlpriv->mac80211.opmode == NL80211_IFTYPE_AP)
+                memcpy(bssid, rtlpriv->efuse.dev_addr, ETH_ALEN);
+        else
+                memcpy(bssid, rtlpriv->mac80211.bssid, ETH_ALEN);
+
+        skb = rtl_make_smps_action(hw, smps, sta->addr, bssid);
         /* this is a type = mgmt * stype = action frame */
         if (skb) {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                 struct rtl_sta_info *sta_entry =
                         (struct rtl_sta_info *) sta->drv_priv;
                 sta_entry->mimo_ps = smps;
-                rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0);
 
                 info->control.rates[0].idx = 0;
                 info->band = hw->conf.chandef.chan->band;
                 rtlpriv->intf_ops->adapter_tx(hw, sta, skb, &tcb_desc);
         }
+        return 1;
+
 err_free:
         return 0;
 }
+EXPORT_SYMBOL(rtl_send_smps_action);
+
+/* There seem to be issues in mac80211 regarding when del ba frames can be
+ * received. As a work around, we make a fake del_ba if we receive a ba_req;
+ * however, rx_agg was opened to let mac80211 release some ba related
+ * resources. This del_ba is for tx only.
+ */
+struct sk_buff *rtl_make_del_ba(struct ieee80211_hw *hw,
+                                u8 *sa, u8 *bssid, u16 tid)
+{
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *action_frame;
+        u16 params;
+
+        /* 27 = header + category + action + smps mode */
+        skb = dev_alloc_skb(34 + hw->extra_tx_headroom);
+        if (!skb)
+                return NULL;
+
+        skb_reserve(skb, hw->extra_tx_headroom);
+        action_frame = (void *)skb_put(skb, 34);
+        memset(action_frame, 0, 34);
+        memcpy(action_frame->sa, sa, ETH_ALEN);
+        memcpy(action_frame->da, rtlefuse->dev_addr, ETH_ALEN);
+        memcpy(action_frame->bssid, bssid, ETH_ALEN);
+        action_frame->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_ACTION);
+        action_frame->u.action.category = WLAN_CATEGORY_BACK;
+        action_frame->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
+        params = (u16)(1 << 11);        /* bit 11 initiator */
+        params |= (u16)(tid << 12);             /* bit 15:12 TID number */
+
+        action_frame->u.action.u.delba.params = cpu_to_le16(params);
+        action_frame->u.action.u.delba.reason_code =
+                cpu_to_le16(WLAN_REASON_QSTA_TIMEOUT);
+
+        return skb;
+}
 
 /*********************************************************
  *
@@ -1587,11 +1856,17 @@ MODULE_AUTHOR("Larry Finger	<Larry.FInger@lwfinger.net>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
 
+struct rtl_global_var global_var = {};
+
 static int __init rtl_core_module_init(void)
 {
         if (rtl_rate_control_register())
                 pr_err("Unable to register rtl_rc, use default RC !!\n");
 
+        /* init some global vars */
+        INIT_LIST_HEAD(&global_var.glb_priv_list);
+        spin_lock_init(&global_var.glb_list_lock);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/rtlwifi/base.h b/drivers/net/wireless/rtlwifi/base.h
index 5a8c80e259f7..8576bc34b032 100644
--- a/drivers/net/wireless/rtlwifi/base.h
+++ b/drivers/net/wireless/rtlwifi/base.h
@@ -113,6 +113,7 @@ void rtl_init_rx_config(struct ieee80211_hw *hw);
 void rtl_init_rfkill(struct ieee80211_hw *hw);
 void rtl_deinit_rfkill(struct ieee80211_hw *hw);
 
+void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb);
 void rtl_watch_dog_timer_callback(unsigned long data);
 void rtl_deinit_deferred_work(struct ieee80211_hw *hw);
 
@@ -126,7 +127,12 @@ int rtl_tx_agg_stop(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
                     u16 tid);
 int rtl_tx_agg_oper(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
                     u16 tid);
+int rtl_rx_agg_start(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+                     u16 tid);
+int rtl_rx_agg_stop(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+                    u16 tid);
 void rtl_watchdog_wq_callback(void *data);
+void rtl_fwevt_wq_callback(void *data);
 
 void rtl_get_tcb_desc(struct ieee80211_hw *hw,
                       struct ieee80211_tx_info *info,
@@ -134,14 +140,18 @@ void rtl_get_tcb_desc(struct ieee80211_hw *hw,
                       struct sk_buff *skb, struct rtl_tcb_desc *tcb_desc);
 
 int rtl_send_smps_action(struct ieee80211_hw *hw,
-                struct ieee80211_sta *sta, u8 *da, u8 *bssid,
-                enum ieee80211_smps_mode smps);
+                         struct ieee80211_sta *sta,
+                         enum ieee80211_smps_mode smps);
 u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie);
 void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
 u8 rtl_tid_to_ac(u8 tid);
 extern struct attribute_group rtl_attribute_group;
+void rtl_easy_concurrent_retrytimer_callback(unsigned long data);
+extern struct rtl_global_var global_var;
 int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
                          bool isht, u8 desc_rate, bool first_ampdu);
 bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
+struct sk_buff *rtl_make_del_ba(struct ieee80211_hw *hw,
+                                u8 *sa, u8 *bssid, u16 tid);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 64a41ecf86cf..ee84844be008 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -104,9 +104,12 @@ static void rtl_op_stop(struct ieee80211_hw *hw)
         if (is_hal_stop(rtlhal))
                 return;
 
+        /* here is must, because adhoc do stop and start,
+         * but stop with RFOFF may cause something wrong,
+         * like adhoc TP
+         */
         if (unlikely(ppsc->rfpwr_state == ERFOFF)) {
                 rtl_ips_nic_on(hw);
-                mdelay(1);
         }
 
         mutex_lock(&rtlpriv->locks.conf_mutex);
@@ -167,7 +170,11 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
         rtl_ips_nic_on(hw);
 
         mutex_lock(&rtlpriv->locks.conf_mutex);
-        switch (vif->type) {
+
+        switch (ieee80211_vif_type_p2p(vif)) {
+        case NL80211_IFTYPE_P2P_CLIENT:
+                mac->p2p = P2P_ROLE_CLIENT;
+                /*fall through*/
         case NL80211_IFTYPE_STATION:
                 if (mac->beacon_enabled == 1) {
                         RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
@@ -192,6 +199,9 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
                                 (u8 *) (&mac->basic_rates));
 
                 break;
+        case NL80211_IFTYPE_P2P_GO:
+                mac->p2p = P2P_ROLE_GO;
+                /*fall through*/
         case NL80211_IFTYPE_AP:
                 RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
                          "NL80211_IFTYPE_AP\n");
@@ -205,6 +215,19 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
                 rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE,
                                 (u8 *) (&mac->basic_rates));
                 break;
+        case NL80211_IFTYPE_MESH_POINT:
+                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+                         "NL80211_IFTYPE_MESH_POINT\n");
+
+                mac->link_state = MAC80211_LINKED;
+                rtlpriv->cfg->ops->set_bcn_reg(hw);
+                if (rtlpriv->rtlhal.current_bandtype == BAND_ON_2_4G)
+                        mac->basic_rates = 0xfff;
+                else
+                        mac->basic_rates = 0xff0;
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE,
+                                (u8 *)(&mac->basic_rates));
+                break;
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "operation mode %d is not supported!\n", vif->type);
@@ -212,6 +235,13 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
                 goto out;
         }
 
+        if (mac->p2p) {
+                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+                         "p2p role %x\n", vif->type);
+                mac->basic_rates = 0xff0;/*disable cck rate for p2p*/
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE,
+                                (u8 *)(&mac->basic_rates));
+        }
         mac->vif = vif;
         mac->opmode = vif->type;
         rtlpriv->cfg->ops->set_network_type(hw, vif->type);
@@ -232,9 +262,9 @@ static void rtl_op_remove_interface(struct ieee80211_hw *hw,
         mutex_lock(&rtlpriv->locks.conf_mutex);
 
         /* Free beacon resources */
-        if ((mac->opmode == NL80211_IFTYPE_AP) ||
-            (mac->opmode == NL80211_IFTYPE_ADHOC) ||
-            (mac->opmode == NL80211_IFTYPE_MESH_POINT)) {
+        if ((vif->type == NL80211_IFTYPE_AP) ||
+            (vif->type == NL80211_IFTYPE_ADHOC) ||
+            (vif->type == NL80211_IFTYPE_MESH_POINT)) {
                 if (mac->beacon_enabled == 1) {
                         mac->beacon_enabled = 0;
                         rtlpriv->cfg->ops->update_interrupt_mask(hw, 0,
@@ -247,6 +277,7 @@ static void rtl_op_remove_interface(struct ieee80211_hw *hw,
          *Note: We assume NL80211_IFTYPE_UNSPECIFIED as
          *NO LINK for our hardware.
          */
+        mac->p2p = 0;
         mac->vif = NULL;
         mac->link_state = MAC80211_NOLINK;
         memset(mac->bssid, 0, 6);
@@ -256,6 +287,22 @@ static void rtl_op_remove_interface(struct ieee80211_hw *hw,
         mutex_unlock(&rtlpriv->locks.conf_mutex);
 }
 
+static int rtl_op_change_interface(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      enum nl80211_iftype new_type, bool p2p)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        int ret;
+        rtl_op_remove_interface(hw, vif);
+
+        vif->type = new_type;
+        vif->p2p = p2p;
+        ret = rtl_op_add_interface(hw, vif);
+        RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+                 "p2p %x\n", p2p);
+        return ret;
+}
+
 static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -264,6 +311,9 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
         struct ieee80211_conf *conf = &hw->conf;
 
+        if (mac->skip_scan)
+                return 1;
+
         mutex_lock(&rtlpriv->locks.conf_mutex);
         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {  /*BIT(2)*/
                 RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
@@ -323,6 +373,16 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
                 struct ieee80211_channel *channel = hw->conf.chandef.chan;
                 u8 wide_chan = (u8) channel->hw_value;
 
+                if (mac->act_scanning)
+                        mac->n_channels++;
+
+                if (rtlpriv->dm.supp_phymode_switch &&
+                    mac->link_state < MAC80211_LINKED &&
+                    !mac->act_scanning) {
+                        if (rtlpriv->cfg->ops->chk_switch_dmdp)
+                                rtlpriv->cfg->ops->chk_switch_dmdp(hw);
+                }
+
                 /*
                  *because we should back channel to
                  *current_network.chan in in scanning,
@@ -373,13 +433,13 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
                 if (wide_chan <= 0)
                         wide_chan = 1;
 
-                /* In scanning, before we go offchannel we may send a ps=1 null
-                 * to AP, and then we may send a ps = 0 null to AP quickly, but
-                 * first null may have caused AP to put lots of packet to hw tx
-                 * buffer. These packets must be tx'd before we go off channel
-                 * so we must delay more time to let AP flush these packets
-                 * before going offchannel, or dis-association or delete BA will
-                 * happen by AP
+                /* In scanning, before we go offchannel we may send a ps = 1
+                 * null to AP, and then we may send a ps = 0 null to AP quickly,
+                 * but first null may have caused AP to put lots of packet to
+                 * hw tx buffer. These packets must be tx'd before we go off
+                 * channel so we must delay more time to let AP flush these
+                 * packets before going offchannel, or dis-association or
+                 * delete BA will be caused by AP
                  */
                 if (rtlpriv->mac80211.offchan_delay) {
                         rtlpriv->mac80211.offchan_delay = false;
@@ -441,7 +501,8 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
          * and nolink check bssid is set in set network_type */
         if ((changed_flags & FIF_BCN_PRBRESP_PROMISC) &&
                 (mac->link_state >= MAC80211_LINKED)) {
-                if (mac->opmode != NL80211_IFTYPE_AP) {
+                if (mac->opmode != NL80211_IFTYPE_AP &&
+                    mac->opmode != NL80211_IFTYPE_MESH_POINT) {
                         if (*new_flags & FIF_BCN_PRBRESP_PROMISC) {
                                 rtlpriv->cfg->ops->set_chk_bssid(hw, false);
                         } else {
@@ -481,32 +542,43 @@ static int rtl_op_sta_add(struct ieee80211_hw *hw,
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rtl_sta_info *sta_entry;
 
         if (sta) {
                 sta_entry = (struct rtl_sta_info *) sta->drv_priv;
+                spin_lock_bh(&rtlpriv->locks.entry_list_lock);
+                list_add_tail(&sta_entry->list, &rtlpriv->entry_list);
+                spin_unlock_bh(&rtlpriv->locks.entry_list_lock);
                 if (rtlhal->current_bandtype == BAND_ON_2_4G) {
                         sta_entry->wireless_mode = WIRELESS_MODE_G;
                         if (sta->supp_rates[0] <= 0xf)
                                 sta_entry->wireless_mode = WIRELESS_MODE_B;
-                        if (sta->ht_cap.ht_supported)
+                        if (sta->ht_cap.ht_supported == true)
                                 sta_entry->wireless_mode = WIRELESS_MODE_N_24G;
+
+                        if (vif->type == NL80211_IFTYPE_ADHOC)
+                                sta_entry->wireless_mode = WIRELESS_MODE_G;
                 } else if (rtlhal->current_bandtype == BAND_ON_5G) {
                         sta_entry->wireless_mode = WIRELESS_MODE_A;
-                        if (sta->ht_cap.ht_supported)
+                        if (sta->ht_cap.ht_supported == true)
                                 sta_entry->wireless_mode = WIRELESS_MODE_N_24G;
-                }
 
-                /* I found some times mac80211 give wrong supp_rates for adhoc*/
-                if (rtlpriv->mac80211.opmode == NL80211_IFTYPE_ADHOC)
-                        sta_entry->wireless_mode = WIRELESS_MODE_G;
+                        if (vif->type == NL80211_IFTYPE_ADHOC)
+                                sta_entry->wireless_mode = WIRELESS_MODE_A;
+                }
+                /*disable cck rate for p2p*/
+                if (mac->p2p)
+                        sta->supp_rates[0] &= 0xfffffff0;
 
+                memcpy(sta_entry->mac_addr, sta->addr, ETH_ALEN);
                 RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
                          "Add sta addr is %pM\n", sta->addr);
                 rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0);
         }
         return 0;
 }
+
 static int rtl_op_sta_remove(struct ieee80211_hw *hw,
                                 struct ieee80211_vif *vif,
                                 struct ieee80211_sta *sta)
@@ -519,9 +591,14 @@ static int rtl_op_sta_remove(struct ieee80211_hw *hw,
                 sta_entry = (struct rtl_sta_info *) sta->drv_priv;
                 sta_entry->wireless_mode = 0;
                 sta_entry->ratr_index = 0;
+
+                spin_lock_bh(&rtlpriv->locks.entry_list_lock);
+                list_del(&sta_entry->list);
+                spin_unlock_bh(&rtlpriv->locks.entry_list_lock);
         }
         return 0;
 }
+
 static int _rtl_get_hal_qnum(u16 queue)
 {
         int qnum;
@@ -547,8 +624,8 @@ static int _rtl_get_hal_qnum(u16 queue)
 }
 
 /*
- *for mac80211 VO=0, VI=1, BE=2, BK=3
- *for rtl819x  BE=0, BK=1, VI=2, VO=3
+ *for mac80211 VO = 0, VI = 1, BE = 2, BK = 3
+ *for rtl819x  BE = 0, BK = 1, VI = 2, VO = 3
  */
 static int rtl_op_conf_tx(struct ieee80211_hw *hw,
                    struct ieee80211_vif *vif, u16 queue,
@@ -630,6 +707,7 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
         /*TODO: reference to enum ieee80211_bss_change */
         if (changed & BSS_CHANGED_ASSOC) {
                 if (bss_conf->assoc) {
+                        struct ieee80211_sta *sta = NULL;
                         /* we should reset all sec info & cam
                          * before set cam after linked, we should not
                          * reset in disassoc, that will cause tkip->wep
@@ -647,23 +725,39 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
 
                         if (rtlpriv->cfg->ops->linked_set_reg)
                                 rtlpriv->cfg->ops->linked_set_reg(hw);
-                        if (mac->opmode == NL80211_IFTYPE_STATION && sta)
+                        rcu_read_lock();
+                        sta = ieee80211_find_sta(vif, (u8 *)bss_conf->bssid);
+
+                        if (vif->type == NL80211_IFTYPE_STATION && sta)
                                 rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0);
+                        RT_TRACE(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD,
+                                 "send PS STATIC frame\n");
+                        if (rtlpriv->dm.supp_phymode_switch) {
+                                if (sta->ht_cap.ht_supported)
+                                        rtl_send_smps_action(hw, sta,
+                                                 IEEE80211_SMPS_STATIC);
+                        }
+                        rcu_read_unlock();
+
                         RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
                                  "BSS_CHANGED_ASSOC\n");
                 } else {
-                        if (mac->link_state == MAC80211_LINKED)
-                                rtl_lps_leave(hw);
+                        if (mac->link_state == MAC80211_LINKED) {
+                                rtlpriv->enter_ps = false;
+                                schedule_work(&rtlpriv->works.lps_change_work);
+                        }
 
+                        if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE)
+                                rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
                         mac->link_state = MAC80211_NOLINK;
                         memset(mac->bssid, 0, 6);
-
-                        /* reset sec info */
-                        rtl_cam_reset_sec_info(hw);
-
-                        rtl_cam_reset_all_entry(hw);
                         mac->vendor = PEER_UNKNOWN;
 
+                        if (rtlpriv->dm.supp_phymode_switch) {
+                                if (rtlpriv->cfg->ops->chk_switch_dmdp)
+                                        rtlpriv->cfg->ops->chk_switch_dmdp(hw);
+                        }
+
                         RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
                                  "BSS_CHANGED_UN_ASSOC\n");
                 }
@@ -778,7 +872,7 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
                 }
 
                 if (changed & BSS_CHANGED_BASIC_RATES) {
-                        /* for 5G must << RATE_6M_INDEX=4,
+                        /* for 5G must << RATE_6M_INDEX = 4,
                          * because 5G have no cck rate*/
                         if (rtlhal->current_bandtype == BAND_ON_5G)
                                 basic_rates = sta->supp_rates[1] << 4;
@@ -815,6 +909,9 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
                                 ppsc->report_linked = false;
                         }
                 }
+                if (rtlpriv->cfg->ops->bt_wifi_media_status_notify)
+                        rtlpriv->cfg->ops->bt_wifi_media_status_notify(hw,
+                                                         ppsc->report_linked);
         }
 
 out:
@@ -885,7 +982,6 @@ static int rtl_op_ampdu_action(struct ieee80211_hw *hw,
                 RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
                          "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid);
                 return rtl_tx_agg_stop(hw, sta, tid);
-                break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
                 RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
                          "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid);
@@ -894,11 +990,11 @@ static int rtl_op_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_RX_START:
                 RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
                          "IEEE80211_AMPDU_RX_START:TID:%d\n", tid);
-                break;
+                return rtl_rx_agg_start(hw, sta, tid);
         case IEEE80211_AMPDU_RX_STOP:
                 RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
                          "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid);
-                break;
+                return rtl_rx_agg_stop(hw, sta, tid);
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "IEEE80211_AMPDU_ERR!!!!:\n");
@@ -912,12 +1008,20 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
 
-        mac->act_scanning = true;
-
         RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
+        mac->act_scanning = true;
+        if (rtlpriv->link_info.higher_busytraffic) {
+                mac->skip_scan = true;
+                return;
+        }
 
+        if (rtlpriv->dm.supp_phymode_switch) {
+                if (rtlpriv->cfg->ops->chk_switch_dmdp)
+                        rtlpriv->cfg->ops->chk_switch_dmdp(hw);
+        }
         if (mac->link_state == MAC80211_LINKED) {
-                rtl_lps_leave(hw);
+                rtlpriv->enter_ps = false;
+                schedule_work(&rtlpriv->works.lps_change_work);
                 mac->link_state = MAC80211_LINKED_SCANNING;
         } else {
                 rtl_ips_nic_on(hw);
@@ -937,6 +1041,16 @@ static void rtl_op_sw_scan_complete(struct ieee80211_hw *hw)
 
         RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
         mac->act_scanning = false;
+        mac->skip_scan = false;
+        if (rtlpriv->link_info.higher_busytraffic)
+                return;
+
+        /*p2p will use 1/6/11 to scan */
+        if (mac->n_channels == 3)
+                mac->p2p_in_use = true;
+        else
+                mac->p2p_in_use = false;
+        mac->n_channels = 0;
         /* Dual mac */
         rtlpriv->rtlhal.load_imrandiqk_setting_for2g = false;
 
@@ -970,6 +1084,11 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                          "not open hw encryption\n");
                 return -ENOSPC; /*User disabled HW-crypto */
         }
+        /* To support IBSS, use sw-crypto for GTK */
+        if (((vif->type == NL80211_IFTYPE_ADHOC) ||
+             (vif->type == NL80211_IFTYPE_MESH_POINT)) &&
+              !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                return -ENOSPC;
         RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
                  "%s hardware based encryption for keyidx: %d, mac: %pM\n",
                  cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
@@ -996,6 +1115,14 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 key_type = AESCCMP_ENCRYPTION;
                 RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n");
                 break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                /*HW doesn't support CMAC encryption, use software CMAC */
+                key_type = AESCMAC_ENCRYPTION;
+                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n");
+                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+                         "HW don't support CMAC encryption, use software CMAC\n");
+                err = -EOPNOTSUPP;
+                goto out_unlock;
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "alg_err:%x!!!!\n",
                          key->cipher);
@@ -1017,13 +1144,14 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
          * 1) wep only: is just for wep enc, in this condition
          * rtlpriv->sec.pairwise_enc_algorithm == NO_ENCRYPTION
          * will be true & enable_hw_sec will be set when wep
-         * ke setting.
+         * key setting.
          * 2) wep(group) + AES(pairwise): some AP like cisco
          * may use it, in this condition enable_hw_sec will not
          * be set when wep key setting */
         /* we must reset sec_info after lingked before set key,
          * or some flag will be wrong*/
-        if (mac->opmode == NL80211_IFTYPE_AP) {
+        if (vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_MESH_POINT) {
                 if (!group_key || key_type == WEP40_ENCRYPTION ||
                         key_type == WEP104_ENCRYPTION) {
                         if (group_key)
@@ -1098,12 +1226,16 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 key->hw_key_idx = key_idx;
                 if (key_type == TKIP_ENCRYPTION)
                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                /*use software CCMP encryption for management frames (MFP) */
+                if (key_type == AESCCMP_ENCRYPTION)
+                        key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
                 break;
         case DISABLE_KEY:
                 RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
                          "disable key delete one entry\n");
                 /*set local buf about wep key. */
-                if (mac->opmode == NL80211_IFTYPE_AP) {
+                if (vif->type == NL80211_IFTYPE_AP ||
+                    vif->type == NL80211_IFTYPE_MESH_POINT) {
                         if (sta)
                                 rtl_cam_del_entry(hw, sta->addr);
                 }
@@ -1163,7 +1295,7 @@ static void rtl_op_rfkill_poll(struct ieee80211_hw *hw)
 }
 
 /* this function is called by mac80211 to flush tx buffer
- * before switch channle or power save, or tx buffer packet
+ * before switch channel or power save, or tx buffer packet
  * maybe send after offchannel or rf sleep, this may cause
  * dis-association by AP */
 static void rtl_op_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
@@ -1180,6 +1312,7 @@ const struct ieee80211_ops rtl_ops = {
         .tx = rtl_op_tx,
         .add_interface = rtl_op_add_interface,
         .remove_interface = rtl_op_remove_interface,
+        .change_interface = rtl_op_change_interface,
         .config = rtl_op_config,
         .configure_filter = rtl_op_configure_filter,
         .sta_add = rtl_op_sta_add,
diff --git a/drivers/net/wireless/rtlwifi/debug.c b/drivers/net/wireless/rtlwifi/debug.c
index bdda9b2fffe1..7d52d3d7769f 100644
--- a/drivers/net/wireless/rtlwifi/debug.c
+++ b/drivers/net/wireless/rtlwifi/debug.c
@@ -41,7 +41,10 @@ void rtl_dbgp_flag_init(struct ieee80211_hw *hw)
             COMP_BEACON | COMP_RATE | COMP_RXDESC | COMP_DIG | COMP_TXAGC |
             COMP_POWER | COMP_POWER_TRACKING | COMP_BB_POWERSAVING | COMP_SWAS |
             COMP_RF | COMP_TURBO | COMP_RATR | COMP_CMD |
-            COMP_EFUSE | COMP_QOS | COMP_MAC80211 | COMP_REGD | COMP_CHAN;
+            COMP_EFUSE | COMP_QOS | COMP_MAC80211 | COMP_REGD | COMP_CHAN |
+            COMP_EASY_CONCURRENT | COMP_EFUSE | COMP_QOS | COMP_MAC80211 |
+            COMP_REGD | COMP_CHAN | COMP_BT_COEXIST;
+
 
         for (i = 0; i < DBGP_TYPE_MAX; i++)
                 rtlpriv->dbg.dbgp_type[i] = 0;
diff --git a/drivers/net/wireless/rtlwifi/debug.h b/drivers/net/wireless/rtlwifi/debug.h
index fd3269f47685..6d669364e3d9 100644
--- a/drivers/net/wireless/rtlwifi/debug.h
+++ b/drivers/net/wireless/rtlwifi/debug.h
@@ -115,11 +115,11 @@
 /* Define EEPROM and EFUSE  check module bit*/
 #define EEPROM_W                        BIT(0)
 #define EFUSE_PG                        BIT(1)
-#define EFUSE_READ_ALL          BIT(2)
+#define EFUSE_READ_ALL                  BIT(2)
 
 /* Define init check for module bit*/
 #define INIT_EEPROM                     BIT(0)
-#define INIT_TxPower            BIT(1)
+#define INIT_TXPOWER                    BIT(1)
 #define INIT_IQK                        BIT(2)
 #define INIT_RF                         BIT(3)
 
@@ -135,6 +135,15 @@
 #define PHY_TXPWR                       BIT(8)
 #define PHY_PWRDIFF                     BIT(9)
 
+/* Define Dynamic Mechanism check module bit --> FDM */
+#define WA_IOT                          BIT(0)
+#define DM_PWDB                         BIT(1)
+#define DM_MONITOR                      BIT(2)
+#define DM_DIG                          BIT(3)
+#define DM_EDCA_TURBO                   BIT(4)
+
+#define DM_PWDB                         BIT(1)
+
 enum dbgp_flag_e {
         FQOS = 0,
         FTX = 1,
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index 8e2f9afb125a..9e3894178e77 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -35,8 +35,6 @@ static const u8 MAX_PGPKT_SIZE = 9;
 static const u8 PGPKT_DATA_SIZE = 8;
 static const int EFUSE_MAX_SIZE = 512;
 
-static const u8 EFUSE_OOB_PROTECT_BYTES = 15;
-
 static const struct efuse_map RTL8712_SDIO_EFUSE_TABLE[] = {
         {0, 0, 0, 2},
         {0, 1, 0, 2},
@@ -240,6 +238,7 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
         u8 rtemp8[1];
         u16 efuse_addr = 0;
         u8 offset, wren;
+        u8 u1temp = 0;
         u16 i;
         u16 j;
         const u16 efuse_max_section =
@@ -285,10 +284,31 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
         }
 
         while ((*rtemp8 != 0xFF) && (efuse_addr < efuse_len)) {
-                offset = ((*rtemp8 >> 4) & 0x0f);
+                /*  Check PG header for section num.  */
+                if ((*rtemp8 & 0x1F) == 0x0F) {/* extended header */
+                        u1temp = ((*rtemp8 & 0xE0) >> 5);
+                        read_efuse_byte(hw, efuse_addr, rtemp8);
 
-                if (offset < efuse_max_section) {
+                        if ((*rtemp8 & 0x0F) == 0x0F) {
+                                efuse_addr++;
+                                read_efuse_byte(hw, efuse_addr, rtemp8);
+
+                                if (*rtemp8 != 0xFF &&
+                                    (efuse_addr < efuse_len)) {
+                                        efuse_addr++;
+                                }
+                                continue;
+                        } else {
+                                offset = ((*rtemp8 & 0xF0) >> 1) | u1temp;
+                                wren = (*rtemp8 & 0x0F);
+                                efuse_addr++;
+                        }
+                } else {
+                        offset = ((*rtemp8 >> 4) & 0x0f);
                         wren = (*rtemp8 & 0x0f);
+                }
+
+                if (offset < efuse_max_section) {
                         RTPRINT(rtlpriv, FEEPROM, EFUSE_READ_ALL,
                                 "offset-%d Worden=%x\n", offset, wren);
 
@@ -391,7 +411,8 @@ bool efuse_shadow_update_chk(struct ieee80211_hw *hw)
         efuse_used = rtlefuse->efuse_usedbytes;
 
         if ((totalbytes + efuse_used) >=
-            (EFUSE_MAX_SIZE - EFUSE_OOB_PROTECT_BYTES))
+            (EFUSE_MAX_SIZE -
+             rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN]))
                 result = false;
 
         RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
@@ -932,8 +953,8 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw,
         u8 badworden = 0x0F;
         static int repeat_times;
 
-        if (efuse_get_current_size(hw) >=
-            (EFUSE_MAX_SIZE - EFUSE_OOB_PROTECT_BYTES)) {
+        if (efuse_get_current_size(hw) >= (EFUSE_MAX_SIZE -
+            rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN])) {
                 RTPRINT(rtlpriv, FEEPROM, EFUSE_PG,
                         "efuse_pg_packet_write error\n");
                 return false;
@@ -949,8 +970,8 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw,
 
         RTPRINT(rtlpriv, FEEPROM, EFUSE_PG,  "efuse Power ON\n");
 
-        while (continual && (efuse_addr <
-               (EFUSE_MAX_SIZE - EFUSE_OOB_PROTECT_BYTES))) {
+        while (continual && (efuse_addr < (EFUSE_MAX_SIZE -
+               rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN]))) {
 
                 if (write_state == PG_STATE_HEADER) {
                         badworden = 0x0F;
@@ -1003,7 +1024,8 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw,
                 }
         }
 
-        if (efuse_addr >= (EFUSE_MAX_SIZE - EFUSE_OOB_PROTECT_BYTES)) {
+        if (efuse_addr >= (EFUSE_MAX_SIZE -
+            rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN])) {
                 RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
                          "efuse_addr(%#x) Out of size!!\n", efuse_addr);
         }
@@ -1102,8 +1124,11 @@ static void efuse_power_switch(struct ieee80211_hw *hw, u8 write, u8 pwrstate)
         u8 tempval;
         u16 tmpV16;
 
-        if (pwrstate && (rtlhal->hw_type !=
-                HARDWARE_TYPE_RTL8192SE)) {
+        if (pwrstate && (rtlhal->hw_type != HARDWARE_TYPE_RTL8192SE)) {
+                if (rtlhal->hw_type == HARDWARE_TYPE_RTL8188EE)
+                        rtl_write_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_ACCESS],
+                                       0x69);
+
                 tmpV16 = rtl_read_word(rtlpriv,
                                        rtlpriv->cfg->maps[SYS_ISO_CTRL]);
                 if (!(tmpV16 & rtlpriv->cfg->maps[EFUSE_PWC_EV12V])) {
@@ -1153,6 +1178,10 @@ static void efuse_power_switch(struct ieee80211_hw *hw, u8 write, u8 pwrstate)
                 }
 
         } else {
+                if (rtlhal->hw_type == HARDWARE_TYPE_RTL8188EE)
+                        rtl_write_byte(rtlpriv,
+                                       rtlpriv->cfg->maps[EFUSE_ACCESS], 0);
+
                 if (write) {
                         tempval = rtl_read_byte(rtlpriv,
                                                 rtlpriv->cfg->maps[EFUSE_TEST] +
diff --git a/drivers/net/wireless/rtlwifi/efuse.h b/drivers/net/wireless/rtlwifi/efuse.h
index 2bdea9a8699e..395a326acfb4 100644
--- a/drivers/net/wireless/rtlwifi/efuse.h
+++ b/drivers/net/wireless/rtlwifi/efuse.h
@@ -32,7 +32,6 @@
 
 #define EFUSE_IC_ID_OFFSET              506
 
-#define EFUSE_REAL_CONTENT_LEN          512
 #define EFUSE_MAP_LEN                   128
 #define EFUSE_MAX_WORD_UNIT             4
 
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 4261e8ecc4c3..999ffc12578b 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -59,7 +59,7 @@ static u8 _rtl_mac_to_hwqueue(struct ieee80211_hw *hw,
 
         if (unlikely(ieee80211_is_beacon(fc)))
                 return BEACON_QUEUE;
-        if (ieee80211_is_mgmt(fc))
+        if (ieee80211_is_mgmt(fc) || ieee80211_is_ctl(fc))
                 return MGNT_QUEUE;
         if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192SE)
                 if (ieee80211_is_nullfunc(fc))
@@ -271,9 +271,6 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
         struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-        u8 pcibridge_busnum = pcipriv->ndis_adapter.pcibridge_busnum;
-        u8 pcibridge_devnum = pcipriv->ndis_adapter.pcibridge_devnum;
-        u8 pcibridge_funcnum = pcipriv->ndis_adapter.pcibridge_funcnum;
         u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor;
         u8 num4bytes = pcipriv->ndis_adapter.num4bytes;
         u16 aspmlevel;
@@ -302,8 +299,7 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
                               u_pcibridge_aspmsetting);
 
         RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
-                 "PlatformEnableASPM():PciBridge busnumber[%x], DevNumbe[%x], funcnumber[%x], Write reg[%x] = %x\n",
-                 pcibridge_busnum, pcibridge_devnum, pcibridge_funcnum,
+                 "PlatformEnableASPM(): Write reg[%x] = %x\n",
                  (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
                  u_pcibridge_aspmsetting);
 
@@ -349,6 +345,49 @@ static bool rtl_pci_get_amd_l1_patch(struct ieee80211_hw *hw)
         return status;
 }
 
+static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+                                     struct rtl_priv **buddy_priv)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+        bool find_buddy_priv = false;
+        struct rtl_priv *tpriv = NULL;
+        struct rtl_pci_priv *tpcipriv = NULL;
+
+        if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) {
+                list_for_each_entry(tpriv, &rtlpriv->glb_var->glb_priv_list,
+                                    list) {
+                        if (tpriv) {
+                                tpcipriv = (struct rtl_pci_priv *)tpriv->priv;
+                                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                                         "pcipriv->ndis_adapter.funcnumber %x\n",
+                                        pcipriv->ndis_adapter.funcnumber);
+                                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                                         "tpcipriv->ndis_adapter.funcnumber %x\n",
+                                        tpcipriv->ndis_adapter.funcnumber);
+
+                                if ((pcipriv->ndis_adapter.busnumber ==
+                                     tpcipriv->ndis_adapter.busnumber) &&
+                                    (pcipriv->ndis_adapter.devnumber ==
+                                    tpcipriv->ndis_adapter.devnumber) &&
+                                    (pcipriv->ndis_adapter.funcnumber !=
+                                    tpcipriv->ndis_adapter.funcnumber)) {
+                                        find_buddy_priv = true;
+                                        break;
+                                }
+                        }
+                }
+        }
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "find_buddy_priv %d\n", find_buddy_priv);
+
+        if (find_buddy_priv)
+                *buddy_priv = tpriv;
+
+        return find_buddy_priv;
+}
+
 static void rtl_pci_get_linkcontrol_field(struct ieee80211_hw *hw)
 {
         struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
@@ -420,17 +459,14 @@ static void _rtl_pci_io_handler_init(struct device *dev,
 
 }
 
-static void _rtl_pci_io_handler_release(struct ieee80211_hw *hw)
-{
-}
-
 static bool _rtl_update_earlymode_info(struct ieee80211_hw *hw,
                 struct sk_buff *skb, struct rtl_tcb_desc *tcb_desc, u8 tid)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        u8 additionlen = FCS_LEN;
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
         struct sk_buff *next_skb;
+        u8 additionlen = FCS_LEN;
 
         /* here open is 4, wep/tkip is 8, aes is 12*/
         if (info->control.hw_key)
@@ -455,7 +491,7 @@ static bool _rtl_update_earlymode_info(struct ieee80211_hw *hw,
                                       next_skb))
                         break;
 
-                if (tcb_desc->empkt_num >= 5)
+                if (tcb_desc->empkt_num >= rtlhal->max_earlymode_num)
                         break;
         }
         spin_unlock_bh(&rtlpriv->locks.waitq_lock);
@@ -471,11 +507,17 @@ static void _rtl_pci_tx_chk_waitq(struct ieee80211_hw *hw)
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         struct sk_buff *skb = NULL;
         struct ieee80211_tx_info *info = NULL;
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
         int tid;
 
         if (!rtlpriv->rtlhal.earlymode_enable)
                 return;
 
+        if (rtlpriv->dm.supp_phymode_switch &&
+            (rtlpriv->easy_concurrent_ctl.switch_in_process ||
+            (rtlpriv->buddy_priv &&
+            rtlpriv->buddy_priv->easy_concurrent_ctl.switch_in_process)))
+                return;
         /* we juse use em for BE/BK/VI/VO */
         for (tid = 7; tid >= 0; tid--) {
                 u8 hw_queue = ac_to_hwq[rtl_tid_to_ac(tid)];
@@ -487,7 +529,8 @@ static void _rtl_pci_tx_chk_waitq(struct ieee80211_hw *hw)
 
                         spin_lock_bh(&rtlpriv->locks.waitq_lock);
                         if (!skb_queue_empty(&mac->skb_waitq[tid]) &&
-                           (ring->entries - skb_queue_len(&ring->queue) > 5)) {
+                            (ring->entries - skb_queue_len(&ring->queue) >
+                             rtlhal->max_earlymode_num)) {
                                 skb = skb_dequeue(&mac->skb_waitq[tid]);
                         } else {
                                 spin_unlock_bh(&rtlpriv->locks.waitq_lock);
@@ -525,9 +568,8 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
                 u8 own = (u8) rtlpriv->cfg->ops->get_desc((u8 *) entry, true,
                                                           HW_DESC_OWN);
 
-                /*
-                 *beacon packet will only use the first
-                 *descriptor defautly,and the own may not
+                /*beacon packet will only use the first
+                 *descriptor by defaut, and the own may not
                  *be cleared by the hardware
                  */
                 if (own)
@@ -558,8 +600,9 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
                 }
 
                 /* for sw LPS, just after NULL skb send out, we can
-                 * sure AP kown we are sleeped, our we should not let
-                 * rf to sleep*/
+                 * sure AP knows we are sleeping, we should not let
+                 * rf sleep
+                 */
                 fc = rtl_get_fc(skb);
                 if (ieee80211_is_nullfunc(fc)) {
                         if (ieee80211_has_pm(fc)) {
@@ -569,6 +612,15 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
                                 rtlpriv->psc.state_inap = false;
                         }
                 }
+                if (ieee80211_is_action(fc)) {
+                        struct ieee80211_mgmt *action_frame =
+                                (struct ieee80211_mgmt *)skb->data;
+                        if (action_frame->u.action.u.ht_smps.action ==
+                            WLAN_HT_ACTION_SMPS) {
+                                dev_kfree_skb(skb);
+                                goto tx_status_ok;
+                        }
+                }
 
                 /* update tid tx pkt num */
                 tid = rtl_get_tid(skb);
@@ -602,7 +654,8 @@ tx_status_ok:
         if (((rtlpriv->link_info.num_rx_inperiod +
                 rtlpriv->link_info.num_tx_inperiod) > 8) ||
                 (rtlpriv->link_info.num_rx_inperiod > 2)) {
-                schedule_work(&rtlpriv->works.lps_leave_work);
+                rtlpriv->enter_ps = false;
+                schedule_work(&rtlpriv->works.lps_change_work);
         }
 }
 
@@ -637,6 +690,10 @@ static void _rtl_receive_one(struct ieee80211_hw *hw, struct sk_buff *skb,
                         rtlpriv->link_info.num_rx_inperiod++;
         }
 
+        /* static bcn for roaming */
+        rtl_beacon_statistic(hw, skb);
+        rtl_p2p_info(hw, (void *)skb->data, skb->len);
+
         /* for sw lps */
         rtl_swlps_beacon(hw, (void *)skb->data, skb->len);
         rtl_recognize_peer(hw, (void *)skb->data, skb->len);
@@ -727,9 +784,10 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                 _rtl_receive_one(hw, skb, rx_status);
 
                 if (((rtlpriv->link_info.num_rx_inperiod +
-                        rtlpriv->link_info.num_tx_inperiod) > 8) ||
-                        (rtlpriv->link_info.num_rx_inperiod > 2)) {
-                        schedule_work(&rtlpriv->works.lps_leave_work);
+                      rtlpriv->link_info.num_tx_inperiod) > 8) ||
+                      (rtlpriv->link_info.num_rx_inperiod > 2)) {
+                        rtlpriv->enter_ps = false;
+                        schedule_work(&rtlpriv->works.lps_change_work);
                 }
 
                 dev_kfree_skb_any(skb);
@@ -803,7 +861,7 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
                 RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n");
         }
 
-        if (inta & rtlpriv->cfg->maps[RTL_IMR_BcnInt]) {
+        if (inta & rtlpriv->cfg->maps[RTL_IMR_BCNINT]) {
                 RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
                          "prepare beacon for interrupt!\n");
                 tasklet_schedule(&rtlpriv->works.irq_prepare_bcn_tasklet);
@@ -884,6 +942,16 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
                 _rtl_pci_rx_interrupt(hw);
         }
 
+        /*fw related*/
+        if (rtlhal->hw_type == HARDWARE_TYPE_RTL8723AE) {
+                if (inta & rtlpriv->cfg->maps[RTL_IMR_C2HCMD]) {
+                        RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+                                 "firmware interrupt!\n");
+                        queue_delayed_work(rtlpriv->works.rtl_wq,
+                                           &rtlpriv->works.fwevt_wq, 0);
+                }
+        }
+
         if (rtlpriv->rtlhal.earlymode_enable)
                 tasklet_schedule(&rtlpriv->works.irq_tasklet);
 
@@ -939,13 +1007,17 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
         return;
 }
 
-static void rtl_lps_leave_work_callback(struct work_struct *work)
+static void rtl_lps_change_work_callback(struct work_struct *work)
 {
         struct rtl_works *rtlworks =
-            container_of(work, struct rtl_works, lps_leave_work);
+            container_of(work, struct rtl_works, lps_change_work);
         struct ieee80211_hw *hw = rtlworks->hw;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
 
-        rtl_lps_leave(hw);
+        if (rtlpriv->enter_ps)
+                rtl_lps_enter(hw);
+        else
+                rtl_lps_leave(hw);
 }
 
 static void _rtl_pci_init_trx_var(struct ieee80211_hw *hw)
@@ -1009,7 +1081,8 @@ static void _rtl_pci_init_struct(struct ieee80211_hw *hw,
         tasklet_init(&rtlpriv->works.irq_prepare_bcn_tasklet,
                      (void (*)(unsigned long))_rtl_pci_prepare_bcn_tasklet,
                      (unsigned long)hw);
-        INIT_WORK(&rtlpriv->works.lps_leave_work, rtl_lps_leave_work_callback);
+        INIT_WORK(&rtlpriv->works.lps_change_work,
+                  rtl_lps_change_work_callback);
 }
 
 static int _rtl_pci_init_tx_ring(struct ieee80211_hw *hw,
@@ -1458,10 +1531,14 @@ static void rtl_pci_flush(struct ieee80211_hw *hw, bool drop)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         u16 i = 0;
         int queue_id;
         struct rtl8192_tx_ring *ring;
 
+        if (mac->skip_scan)
+                return;
+
         for (queue_id = RTL_PCI_MAX_TX_QUEUE_COUNT - 1; queue_id >= 0;) {
                 u32 queue_len;
                 ring = &pcipriv->dev.tx_ring[queue_id];
@@ -1491,7 +1568,7 @@ static void rtl_pci_deinit(struct ieee80211_hw *hw)
 
         synchronize_irq(rtlpci->pdev->irq);
         tasklet_kill(&rtlpriv->works.irq_tasklet);
-        cancel_work_sync(&rtlpriv->works.lps_leave_work);
+        cancel_work_sync(&rtlpriv->works.lps_change_work);
 
         flush_workqueue(rtlpriv->works.rtl_wq);
         destroy_workqueue(rtlpriv->works.rtl_wq);
@@ -1566,7 +1643,7 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
         set_hal_stop(rtlhal);
 
         rtlpriv->cfg->ops->disable_interrupt(hw);
-        cancel_work_sync(&rtlpriv->works.lps_leave_work);
+        cancel_work_sync(&rtlpriv->works.lps_change_work);
 
         spin_lock_irqsave(&rtlpriv->locks.rf_ps_lock, flags);
         while (ppsc->rfchange_inprogress) {
@@ -1673,6 +1750,10 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
                          "8192D PCI-E is found - vid/did=%x/%x\n",
                          venderid, deviceid);
+        } else if (deviceid == RTL_PCI_8188EE_DID) {
+                rtlhal->hw_type = HARDWARE_TYPE_RTL8188EE;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                         "Find adapter, Hardware type is 8188EE\n");
         } else {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
                          "Err: Unknown device - vid/did=%x/%x\n",
@@ -1704,6 +1785,9 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
         pcipriv->ndis_adapter.devnumber = PCI_SLOT(pdev->devfn);
         pcipriv->ndis_adapter.funcnumber = PCI_FUNC(pdev->devfn);
 
+        /* some ARM have no bridge_pdev and will crash here
+         * so we should check if bridge_pdev is NULL
+         */
         if (bridge_pdev) {
                 /*find bridge info if available */
                 pcipriv->ndis_adapter.pcibridge_vendorid = bridge_pdev->vendor;
@@ -1758,6 +1842,7 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
                  pcipriv->ndis_adapter.amd_l1_patch);
 
         rtl_pci_parse_configuration(pdev, hw);
+        list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list);
 
         return true;
 }
@@ -1804,6 +1889,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
         pci_set_drvdata(pdev, hw);
 
         rtlpriv = hw->priv;
+        rtlpriv->hw = hw;
         pcipriv = (void *)rtlpriv->priv;
         pcipriv->dev.pdev = pdev;
         init_completion(&rtlpriv->firmware_loading_complete);
@@ -1812,6 +1898,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
         rtlpriv->rtlhal.interface = INTF_PCI;
         rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
         rtlpriv->intf_ops = &rtl_pci_ops;
+        rtlpriv->glb_var = &global_var;
 
         /*
          *init dbgp flags before all
@@ -1916,7 +2003,6 @@ int rtl_pci_probe(struct pci_dev *pdev,
 
 fail3:
         rtl_deinit_core(hw);
-        _rtl_pci_io_handler_release(hw);
 
         if (rtlpriv->io.pci_mem_start != 0)
                 pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
@@ -1965,14 +2051,15 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
 
         rtl_pci_deinit(hw);
         rtl_deinit_core(hw);
-        _rtl_pci_io_handler_release(hw);
         rtlpriv->cfg->ops->deinit_sw_vars(hw);
 
         if (rtlpci->irq_alloc) {
+                synchronize_irq(rtlpci->pdev->irq);
                 free_irq(rtlpci->pdev->irq, hw);
                 rtlpci->irq_alloc = 0;
         }
 
+        list_del(&rtlpriv->list);
         if (rtlpriv->io.pci_mem_start != 0) {
                 pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
                 pci_release_regions(pdev);
@@ -2034,6 +2121,7 @@ struct rtl_intf_ops rtl_pci_ops = {
         .read_efuse_byte = read_efuse_byte,
         .adapter_start = rtl_pci_start,
         .adapter_stop = rtl_pci_stop,
+        .check_buddy_priv = rtl_pci_check_buddy_priv,
         .adapter_tx = rtl_pci_tx,
         .flush = rtl_pci_flush,
         .reset_trx_ring = rtl_pci_reset_trx_ring,
diff --git a/drivers/net/wireless/rtlwifi/pci.h b/drivers/net/wireless/rtlwifi/pci.h
index 65b08f50022e..d3262ec45d23 100644
--- a/drivers/net/wireless/rtlwifi/pci.h
+++ b/drivers/net/wireless/rtlwifi/pci.h
@@ -94,6 +94,7 @@
 #define RTL_PCI_8192CU_DID      0x8191  /*8192ce */
 #define RTL_PCI_8192DE_DID      0x8193  /*8192de */
 #define RTL_PCI_8192DE_DID2     0x002B  /*92DE*/
+#define RTL_PCI_8188EE_DID      0x8179  /*8188ee*/
 
 /*8192 support 16 pages of IO registers*/
 #define RTL_MEM_MAPPED_IO_RANGE_8190PCI         0x1000
@@ -175,6 +176,7 @@ struct rtl_pci {
         /*irq */
         u8 irq_alloc;
         u32 irq_mask[2];
+        u32 sys_irq_mask;
 
         /*Bcn control register setting */
         u32 reg_bcn_ctrl_val;
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index 13ad33e85577..884bceae38a9 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -180,6 +180,9 @@ void rtl_ips_nic_off_wq_callback(void *data)
                 return;
         }
 
+        if (mac->p2p_in_use)
+                return;
+
         if (mac->link_state > MAC80211_NOLINK)
                 return;
 
@@ -189,6 +192,9 @@ void rtl_ips_nic_off_wq_callback(void *data)
         if (rtlpriv->sec.being_setkey)
                 return;
 
+        if (rtlpriv->cfg->ops->bt_coex_off_before_lps)
+                rtlpriv->cfg->ops->bt_coex_off_before_lps(hw);
+
         if (ppsc->inactiveps) {
                 rtstate = ppsc->rfpwr_state;
 
@@ -231,6 +237,9 @@ void rtl_ips_nic_off(struct ieee80211_hw *hw)
                            &rtlpriv->works.ips_nic_off_wq, MSECS(100));
 }
 
+/* NOTICE: any opmode should exc nic_on, or disable without
+ * nic_on may something wrong, like adhoc TP
+ */
 void rtl_ips_nic_on(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -299,7 +308,7 @@ static void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
-        u8 rpwm_val, fw_pwrmode;
+        bool enter_fwlps;
 
         if (mac->opmode == NL80211_IFTYPE_ADHOC)
                 return;
@@ -324,43 +333,31 @@ static void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
          */
 
         if ((ppsc->fwctrl_lps) && ppsc->report_linked) {
-                bool fw_current_inps;
                 if (ppsc->dot11_psmode == EACTIVE) {
                         RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
                                  "FW LPS leave ps_mode:%x\n",
                                  FW_PS_ACTIVE_MODE);
-
-                        rpwm_val = 0x0C;        /* RF on */
-                        fw_pwrmode = FW_PS_ACTIVE_MODE;
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SET_RPWM,
-                                        &rpwm_val);
+                        enter_fwlps = false;
+                        ppsc->pwr_mode = FW_PS_ACTIVE_MODE;
+                        ppsc->smart_ps = 0;
                         rtlpriv->cfg->ops->set_hw_reg(hw,
-                                        HW_VAR_H2C_FW_PWRMODE,
-                                        &fw_pwrmode);
-                        fw_current_inps = false;
-
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                        HW_VAR_FW_PSMODE_STATUS,
-                                        (u8 *) (&fw_current_inps));
+                                                HW_VAR_FW_LPS_ACTION,
+                                                (u8 *)(&enter_fwlps));
+                        if (ppsc->p2p_ps_info.opp_ps)
+                                rtl_p2p_ps_cmd(hw, P2P_PS_ENABLE);
 
                 } else {
                         if (rtl_get_fwlps_doze(hw)) {
                                 RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
                                          "FW LPS enter ps_mode:%x\n",
                                          ppsc->fwctrl_psmode);
-
-                                rpwm_val = 0x02;        /* RF off */
-                                fw_current_inps = true;
+                                enter_fwlps = true;
+                                ppsc->pwr_mode = ppsc->fwctrl_psmode;
+                                ppsc->smart_ps = 2;
                                 rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                HW_VAR_FW_PSMODE_STATUS,
-                                                (u8 *) (&fw_current_inps));
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                HW_VAR_H2C_FW_PWRMODE,
-                                                &ppsc->fwctrl_psmode);
+                                                        HW_VAR_FW_LPS_ACTION,
+                                                        (u8 *)(&enter_fwlps));
 
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                HW_VAR_SET_RPWM,
-                                                &rpwm_val);
                         } else {
                                 /* Reset the power save related parameters. */
                                 ppsc->dot11_psmode = EACTIVE;
@@ -642,3 +639,286 @@ void rtl_swlps_wq_callback(void *data)
                 rtlpriv->psc.state = ps;
         }
 }
+
+static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
+                           unsigned int len)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct ieee80211_mgmt *mgmt = (void *)data;
+        struct rtl_p2p_ps_info *p2pinfo = &(rtlpriv->psc.p2p_ps_info);
+        u8 *pos, *end, *ie;
+        u16 noa_len;
+        static u8 p2p_oui_ie_type[4] = {0x50, 0x6f, 0x9a, 0x09};
+        u8 noa_num, index, i, noa_index = 0;
+        bool find_p2p_ie = false , find_p2p_ps_ie = false;
+        pos = (u8 *)mgmt->u.beacon.variable;
+        end = data + len;
+        ie = NULL;
+
+        while (pos + 1 < end) {
+                if (pos + 2 + pos[1] > end)
+                        return;
+
+                if (pos[0] == 221 && pos[1] > 4) {
+                        if (memcmp(&pos[2], p2p_oui_ie_type, 4) == 0) {
+                                ie = pos + 2+4;
+                                break;
+                        }
+                }
+                pos += 2 + pos[1];
+        }
+
+        if (ie == NULL)
+                return;
+        find_p2p_ie = true;
+        /*to find noa ie*/
+        while (ie + 1 < end) {
+                noa_len = READEF2BYTE(&ie[1]);
+                if (ie + 3 + ie[1] > end)
+                        return;
+
+                if (ie[0] == 12) {
+                        find_p2p_ps_ie = true;
+                        if ((noa_len - 2) % 13 != 0) {
+                                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                                         "P2P notice of absence: invalid length.%d\n",
+                                         noa_len);
+                                return;
+                        } else {
+                                noa_num = (noa_len - 2) / 13;
+                        }
+                        noa_index = ie[3];
+                        if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
+                            P2P_PS_NONE || noa_index != p2pinfo->noa_index) {
+                                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+                                         "update NOA ie.\n");
+                                p2pinfo->noa_index = noa_index;
+                                p2pinfo->opp_ps = (ie[4] >> 7);
+                                p2pinfo->ctwindow = ie[4] & 0x7F;
+                                p2pinfo->noa_num = noa_num;
+                                index = 5;
+                                for (i = 0; i < noa_num; i++) {
+                                        p2pinfo->noa_count_type[i] =
+                                                 READEF1BYTE(ie+index);
+                                        index += 1;
+                                        p2pinfo->noa_duration[i] =
+                                                 READEF4BYTE(ie+index);
+                                        index += 4;
+                                        p2pinfo->noa_interval[i] =
+                                                 READEF4BYTE(ie+index);
+                                        index += 4;
+                                        p2pinfo->noa_start_time[i] =
+                                                 READEF4BYTE(ie+index);
+                                        index += 4;
+                                }
+
+                                if (p2pinfo->opp_ps == 1) {
+                                        p2pinfo->p2p_ps_mode = P2P_PS_CTWINDOW;
+                                        /* Driver should wait LPS entering
+                                         * CTWindow
+                                         */
+                                        if (rtlpriv->psc.fw_current_inpsmode)
+                                                rtl_p2p_ps_cmd(hw,
+                                                               P2P_PS_ENABLE);
+                                } else if (p2pinfo->noa_num > 0) {
+                                        p2pinfo->p2p_ps_mode = P2P_PS_NOA;
+                                        rtl_p2p_ps_cmd(hw, P2P_PS_ENABLE);
+                                } else if (p2pinfo->p2p_ps_mode > P2P_PS_NONE) {
+                                        rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
+                                }
+                        }
+                break;
+                }
+                ie += 3 + noa_len;
+        }
+
+        if (find_p2p_ie == true) {
+                if ((p2pinfo->p2p_ps_mode > P2P_PS_NONE) &&
+                    (find_p2p_ps_ie == false))
+                        rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
+        }
+}
+
+static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
+                              unsigned int len)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct ieee80211_mgmt *mgmt = (void *)data;
+        struct rtl_p2p_ps_info *p2pinfo = &(rtlpriv->psc.p2p_ps_info);
+        u8 noa_num, index, i, noa_index = 0;
+        u8 *pos, *end, *ie;
+        u16 noa_len;
+        static u8 p2p_oui_ie_type[4] = {0x50, 0x6f, 0x9a, 0x09};
+
+        pos = (u8 *)&mgmt->u.action.category;
+        end = data + len;
+        ie = NULL;
+
+        if (pos[0] == 0x7f) {
+                if (memcmp(&pos[1], p2p_oui_ie_type, 4) == 0)
+                        ie = pos + 3+4;
+        }
+
+        if (ie == NULL)
+                return;
+
+        RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n");
+        /*to find noa ie*/
+        while (ie + 1 < end) {
+                noa_len = READEF2BYTE(&ie[1]);
+                if (ie + 3 + ie[1] > end)
+                        return;
+
+                if (ie[0] == 12) {
+                        RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n");
+                        RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_LOUD, "noa ie ",
+                                      ie, noa_len);
+                        if ((noa_len - 2) % 13 != 0) {
+                                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+                                         "P2P notice of absence: invalid length.%d\n",
+                                         noa_len);
+                                return;
+                        } else {
+                                noa_num = (noa_len - 2) / 13;
+                        }
+                        noa_index = ie[3];
+                        if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
+                            P2P_PS_NONE || noa_index != p2pinfo->noa_index) {
+                                p2pinfo->noa_index = noa_index;
+                                p2pinfo->opp_ps = (ie[4] >> 7);
+                                p2pinfo->ctwindow = ie[4] & 0x7F;
+                                p2pinfo->noa_num = noa_num;
+                                index = 5;
+                                for (i = 0; i < noa_num; i++) {
+                                        p2pinfo->noa_count_type[i] =
+                                                         READEF1BYTE(ie+index);
+                                        index += 1;
+                                        p2pinfo->noa_duration[i] =
+                                                         READEF4BYTE(ie+index);
+                                        index += 4;
+                                        p2pinfo->noa_interval[i] =
+                                                         READEF4BYTE(ie+index);
+                                        index += 4;
+                                        p2pinfo->noa_start_time[i] =
+                                                         READEF4BYTE(ie+index);
+                                        index += 4;
+                                }
+
+                                if (p2pinfo->opp_ps == 1) {
+                                        p2pinfo->p2p_ps_mode = P2P_PS_CTWINDOW;
+                                        /* Driver should wait LPS entering
+                                         * CTWindow
+                                         */
+                                        if (rtlpriv->psc.fw_current_inpsmode)
+                                                rtl_p2p_ps_cmd(hw,
+                                                               P2P_PS_ENABLE);
+                                } else if (p2pinfo->noa_num > 0) {
+                                        p2pinfo->p2p_ps_mode = P2P_PS_NOA;
+                                        rtl_p2p_ps_cmd(hw, P2P_PS_ENABLE);
+                                } else if (p2pinfo->p2p_ps_mode > P2P_PS_NONE) {
+                                        rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
+                                }
+                        }
+                break;
+                }
+                ie += 3 + noa_len;
+        }
+}
+
+void rtl_p2p_ps_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *rtlps = rtl_psc(rtl_priv(hw));
+        struct rtl_p2p_ps_info  *p2pinfo = &(rtlpriv->psc.p2p_ps_info);
+
+        RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n", p2p_ps_state);
+        switch (p2p_ps_state) {
+        case P2P_PS_DISABLE:
+                p2pinfo->p2p_ps_state = p2p_ps_state;
+                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                 HW_VAR_H2C_FW_P2P_PS_OFFLOAD,
+                                 (u8 *)(&p2p_ps_state));
+
+                p2pinfo->noa_index = 0;
+                p2pinfo->ctwindow = 0;
+                p2pinfo->opp_ps = 0;
+                p2pinfo->noa_num = 0;
+                p2pinfo->p2p_ps_mode = P2P_PS_NONE;
+                if (rtlps->fw_current_inpsmode == true) {
+                        if (rtlps->smart_ps == 0) {
+                                rtlps->smart_ps = 2;
+                                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                         HW_VAR_H2C_FW_PWRMODE,
+                                         (u8 *)(&rtlps->pwr_mode));
+                        }
+                }
+                break;
+        case P2P_PS_ENABLE:
+                if (p2pinfo->p2p_ps_mode > P2P_PS_NONE) {
+                        p2pinfo->p2p_ps_state = p2p_ps_state;
+
+                        if (p2pinfo->ctwindow > 0) {
+                                if (rtlps->smart_ps != 0) {
+                                        rtlps->smart_ps = 0;
+                                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                 HW_VAR_H2C_FW_PWRMODE,
+                                                 (u8 *)(&rtlps->pwr_mode));
+                                }
+                        }
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                 HW_VAR_H2C_FW_P2P_PS_OFFLOAD,
+                                 (u8 *)(&p2p_ps_state));
+                }
+                break;
+        case P2P_PS_SCAN:
+        case P2P_PS_SCAN_DONE:
+        case P2P_PS_ALLSTASLEEP:
+                if (p2pinfo->p2p_ps_mode > P2P_PS_NONE) {
+                        p2pinfo->p2p_ps_state = p2p_ps_state;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                 HW_VAR_H2C_FW_P2P_PS_OFFLOAD,
+                                 (u8 *)(&p2p_ps_state));
+                }
+                break;
+        default:
+                break;
+        }
+        RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+                 "ctwindow %x oppps %x\n", p2pinfo->ctwindow, p2pinfo->opp_ps);
+        RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+                 "count %x duration %x index %x interval %x start time %x noa num %x\n",
+                 p2pinfo->noa_count_type[0], p2pinfo->noa_duration[0],
+                 p2pinfo->noa_index, p2pinfo->noa_interval[0],
+                 p2pinfo->noa_start_time[0], p2pinfo->noa_num);
+        RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "end\n");
+}
+
+void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct ieee80211_hdr *hdr = (void *)data;
+
+        if (!mac->p2p)
+                return;
+        if (mac->link_state != MAC80211_LINKED)
+                return;
+        /* min. beacon length + FCS_LEN */
+        if (len <= 40 + FCS_LEN)
+                return;
+
+        /* and only beacons from the associated BSSID, please */
+        if (compare_ether_addr(hdr->addr3, rtlpriv->mac80211.bssid))
+                return;
+
+        /* check if this really is a beacon */
+        if (!(ieee80211_is_beacon(hdr->frame_control) ||
+              ieee80211_is_probe_resp(hdr->frame_control) ||
+              ieee80211_is_action(hdr->frame_control)))
+                return;
+
+        if (ieee80211_is_action(hdr->frame_control))
+                rtl_p2p_action_ie(hw, data, len - FCS_LEN);
+        else
+                rtl_p2p_noa_ie(hw, data, len - FCS_LEN);
+}
diff --git a/drivers/net/wireless/rtlwifi/ps.h b/drivers/net/wireless/rtlwifi/ps.h
index 1357856998c2..4d682b753f50 100644
--- a/drivers/net/wireless/rtlwifi/ps.h
+++ b/drivers/net/wireless/rtlwifi/ps.h
@@ -47,5 +47,7 @@ void rtl_swlps_wq_callback(void *data);
 void rtl_swlps_rfon_wq_callback(void *data);
 void rtl_swlps_rf_awake(struct ieee80211_hw *hw);
 void rtl_swlps_rf_sleep(struct ieee80211_hw *hw);
+void rtl_p2p_ps_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
+void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/Makefile b/drivers/net/wireless/rtlwifi/rtl8188ee/Makefile
new file mode 100644
index 000000000000..5b194e97f4b3
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/Makefile
@@ -0,0 +1,16 @@
+rtl8188ee-objs :=               \
+                dm.o            \
+                fw.o            \
+                hw.o            \
+                led.o           \
+                phy.o           \
+                pwrseq.o        \
+                pwrseqcmd.o     \
+                rf.o            \
+                sw.o            \
+                table.o         \
+                trx.o
+
+obj-$(CONFIG_RTL8188EE) += rtl8188ee.o
+
+ccflags-y += -Idrivers/net/wireless/rtlwifi -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/def.h b/drivers/net/wireless/rtlwifi/rtl8188ee/def.h
new file mode 100644
index 000000000000..c764fff9ebe6
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/def.h
@@ -0,0 +1,324 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92C_DEF_H__
+#define __RTL92C_DEF_H__
+
+#define HAL_RETRY_LIMIT_INFRA                           48
+#define HAL_RETRY_LIMIT_AP_ADHOC                        7
+
+#define RESET_DELAY_8185                                20
+
+#define RT_IBSS_INT_MASKS       (IMR_BCNINT | IMR_TBDOK | IMR_TBDER)
+#define RT_AC_INT_MASKS         (IMR_VIDOK | IMR_VODOK | IMR_BEDOK|IMR_BKDOK)
+
+#define NUM_OF_FIRMWARE_QUEUE                           10
+#define NUM_OF_PAGES_IN_FW                              0x100
+#define NUM_OF_PAGE_IN_FW_QUEUE_BK                      0x07
+#define NUM_OF_PAGE_IN_FW_QUEUE_BE                      0x07
+#define NUM_OF_PAGE_IN_FW_QUEUE_VI                      0x07
+#define NUM_OF_PAGE_IN_FW_QUEUE_VO                      0x07
+#define NUM_OF_PAGE_IN_FW_QUEUE_HCCA                    0x0
+#define NUM_OF_PAGE_IN_FW_QUEUE_CMD                     0x0
+#define NUM_OF_PAGE_IN_FW_QUEUE_MGNT                    0x02
+#define NUM_OF_PAGE_IN_FW_QUEUE_HIGH                    0x02
+#define NUM_OF_PAGE_IN_FW_QUEUE_BCN                     0x2
+#define NUM_OF_PAGE_IN_FW_QUEUE_PUB                     0xA1
+
+#define NUM_OF_PAGE_IN_FW_QUEUE_BK_DTM                  0x026
+#define NUM_OF_PAGE_IN_FW_QUEUE_BE_DTM                  0x048
+#define NUM_OF_PAGE_IN_FW_QUEUE_VI_DTM                  0x048
+#define NUM_OF_PAGE_IN_FW_QUEUE_VO_DTM                  0x026
+#define NUM_OF_PAGE_IN_FW_QUEUE_PUB_DTM                 0x00
+
+#define MAX_LINES_HWCONFIG_TXT                          1000
+#define MAX_BYTES_LINE_HWCONFIG_TXT                     256
+
+#define SW_THREE_WIRE                                   0
+#define HW_THREE_WIRE                                   2
+
+#define BT_DEMO_BOARD                                   0
+#define BT_QA_BOARD                                     1
+#define BT_FPGA                                         2
+
+#define HAL_PRIME_CHNL_OFFSET_DONT_CARE                 0
+#define HAL_PRIME_CHNL_OFFSET_LOWER                     1
+#define HAL_PRIME_CHNL_OFFSET_UPPER                     2
+
+#define MAX_H2C_QUEUE_NUM                               10
+
+#define RX_MPDU_QUEUE                                   0
+#define RX_CMD_QUEUE                                    1
+#define RX_MAX_QUEUE                                    2
+#define AC2QUEUEID(_AC)                                 (_AC)
+
+#define C2H_RX_CMD_HDR_LEN                              8
+#define GET_C2H_CMD_CMD_LEN(__prxhdr)                   \
+        LE_BITS_TO_4BYTE((__prxhdr), 0, 16)
+#define GET_C2H_CMD_ELEMENT_ID(__prxhdr)                \
+        LE_BITS_TO_4BYTE((__prxhdr), 16, 8)
+#define GET_C2H_CMD_CMD_SEQ(__prxhdr)                   \
+        LE_BITS_TO_4BYTE((__prxhdr), 24, 7)
+#define GET_C2H_CMD_CONTINUE(__prxhdr)                  \
+        LE_BITS_TO_4BYTE((__prxhdr), 31, 1)
+#define GET_C2H_CMD_CONTENT(__prxhdr)                   \
+        ((u8 *)(__prxhdr) + C2H_RX_CMD_HDR_LEN)
+
+#define GET_C2H_CMD_FEEDBACK_ELEMENT_ID(__pcmdfbhdr)    \
+        LE_BITS_TO_4BYTE((__pcmdfbhdr), 0, 8)
+#define GET_C2H_CMD_FEEDBACK_CCX_LEN(__pcmdfbhdr)       \
+        LE_BITS_TO_4BYTE((__pcmdfbhdr), 8, 8)
+#define GET_C2H_CMD_FEEDBACK_CCX_CMD_CNT(__pcmdfbhdr)   \
+        LE_BITS_TO_4BYTE((__pcmdfbhdr), 16, 16)
+#define GET_C2H_CMD_FEEDBACK_CCX_MAC_ID(__pcmdfbhdr)    \
+        LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 0, 5)
+#define GET_C2H_CMD_FEEDBACK_CCX_VALID(__pcmdfbhdr)     \
+        LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 7, 1)
+#define GET_C2H_CMD_FEEDBACK_CCX_RETRY_CNT(__pcmdfbhdr) \
+        LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 8, 5)
+#define GET_C2H_CMD_FEEDBACK_CCX_TOK(__pcmdfbhdr)       \
+        LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 15, 1)
+#define GET_C2H_CMD_FEEDBACK_CCX_QSEL(__pcmdfbhdr)      \
+        LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 16, 4)
+#define GET_C2H_CMD_FEEDBACK_CCX_SEQ(__pcmdfbhdr)       \
+        LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 20, 12)
+
+#define CHIP_BONDING_IDENTIFIER(_value) (((_value)>>22)&0x3)
+
+
+/* [15:12] IC version(CUT): A-cut=0, B-cut=1, C-cut=2, D-cut=3
+ * [7] Manufacturer: TSMC=0, UMC=1
+ * [6:4] RF type: 1T1R=0, 1T2R=1, 2T2R=2
+ * [3] Chip type: TEST=0, NORMAL=1
+ * [2:0] IC type: 81xxC=0, 8723=1, 92D=2
+ */
+#define CHIP_8723                       BIT(0)
+#define CHIP_92D                        BIT(1)
+#define NORMAL_CHIP                     BIT(3)
+#define RF_TYPE_1T1R                    (~(BIT(4)|BIT(5)|BIT(6)))
+#define RF_TYPE_1T2R                    BIT(4)
+#define RF_TYPE_2T2R                    BIT(5)
+#define CHIP_VENDOR_UMC                 BIT(7)
+#define B_CUT_VERSION                   BIT(12)
+#define C_CUT_VERSION                   BIT(13)
+#define D_CUT_VERSION                   ((BIT(12)|BIT(13)))
+#define E_CUT_VERSION                   BIT(14)
+
+
+/* MASK */
+#define IC_TYPE_MASK                    (BIT(0)|BIT(1)|BIT(2))
+#define CHIP_TYPE_MASK                  BIT(3)
+#define RF_TYPE_MASK                    (BIT(4)|BIT(5)|BIT(6))
+#define MANUFACTUER_MASK                BIT(7)
+#define ROM_VERSION_MASK                (BIT(11)|BIT(10)|BIT(9)|BIT(8))
+#define CUT_VERSION_MASK                (BIT(15)|BIT(14)|BIT(13)|BIT(12))
+
+/* Get element */
+#define GET_CVID_IC_TYPE(version)       ((version) & IC_TYPE_MASK)
+#define GET_CVID_CHIP_TYPE(version)     ((version) & CHIP_TYPE_MASK)
+#define GET_CVID_RF_TYPE(version)       ((version) & RF_TYPE_MASK)
+#define GET_CVID_MANUFACTUER(version)   ((version) & MANUFACTUER_MASK)
+#define GET_CVID_ROM_VERSION(version)   ((version) & ROM_VERSION_MASK)
+#define GET_CVID_CUT_VERSION(version)   ((version) & CUT_VERSION_MASK)
+
+
+#define IS_81XXC(version)                                               \
+        ((GET_CVID_IC_TYPE(version) == 0) ? true : false)
+#define IS_8723_SERIES(version)                                         \
+        ((GET_CVID_IC_TYPE(version) == CHIP_8723) ? true : false)
+#define IS_92D(version)                                                 \
+        ((GET_CVID_IC_TYPE(version) == CHIP_92D) ? true : false)
+
+#define IS_NORMAL_CHIP(version)                                         \
+        ((GET_CVID_CHIP_TYPE(version)) ? true : false)
+#define IS_NORMAL_CHIP92D(version)                                      \
+        ((GET_CVID_CHIP_TYPE(version)) ? true : false)
+
+#define IS_1T1R(version)                                                \
+        ((GET_CVID_RF_TYPE(version)) ? false : true)
+#define IS_1T2R(version)                                                \
+        ((GET_CVID_RF_TYPE(version) == RF_TYPE_1T2R) ? true : false)
+#define IS_2T2R(version)                                                \
+        ((GET_CVID_RF_TYPE(version) == RF_TYPE_2T2R) ? true : false)
+#define IS_CHIP_VENDOR_UMC(version)                                     \
+        ((GET_CVID_MANUFACTUER(version)) ? true : false)
+
+#define IS_92C_SERIAL(version)                                          \
+        ((IS_81XXC(version) && IS_2T2R(version)) ? true : false)
+#define IS_81xxC_VENDOR_UMC_A_CUT(version)                              \
+        (IS_81XXC(version) ? ((IS_CHIP_VENDOR_UMC(version)) ?           \
+         ((GET_CVID_CUT_VERSION(version)) ? false : true) : false) : false)
+#define IS_81xxC_VENDOR_UMC_B_CUT(version)                              \
+        (IS_81XXC(version) ? (IS_CHIP_VENDOR_UMC(version) ?             \
+        ((GET_CVID_CUT_VERSION(version) == B_CUT_VERSION) ? true        \
+        : false) : false) : false)
+
+enum version_8188e {
+        VERSION_TEST_CHIP_88E = 0x00,
+        VERSION_NORMAL_CHIP_88E = 0x01,
+        VERSION_UNKNOWN = 0xFF,
+};
+
+enum rx_packet_type {
+        NORMAL_RX,
+        TX_REPORT1,
+        TX_REPORT2,
+        HIS_REPORT,
+};
+
+enum rtl819x_loopback_e {
+        RTL819X_NO_LOOPBACK = 0,
+        RTL819X_MAC_LOOPBACK = 1,
+        RTL819X_DMA_LOOPBACK = 2,
+        RTL819X_CCK_LOOPBACK = 3,
+};
+
+enum rf_optype {
+        RF_OP_BY_SW_3WIRE = 0,
+        RF_OP_BY_FW,
+        RF_OP_MAX
+};
+
+enum rf_power_state {
+        RF_ON,
+        RF_OFF,
+        RF_SLEEP,
+        RF_SHUT_DOWN,
+};
+
+enum power_save_mode {
+        POWER_SAVE_MODE_ACTIVE,
+        POWER_SAVE_MODE_SAVE,
+};
+
+enum power_polocy_config {
+        POWERCFG_MAX_POWER_SAVINGS,
+        POWERCFG_GLOBAL_POWER_SAVINGS,
+        POWERCFG_LOCAL_POWER_SAVINGS,
+        POWERCFG_LENOVO,
+};
+
+enum interface_select_pci {
+        INTF_SEL1_MINICARD,
+        INTF_SEL0_PCIE,
+        INTF_SEL2_RSV,
+        INTF_SEL3_RSV,
+};
+
+enum hal_fw_c2h_cmd_id {
+        HAL_FW_C2H_CMD_Read_MACREG,
+        HAL_FW_C2H_CMD_Read_BBREG,
+        HAL_FW_C2H_CMD_Read_RFREG,
+        HAL_FW_C2H_CMD_Read_EEPROM,
+        HAL_FW_C2H_CMD_Read_EFUSE,
+        HAL_FW_C2H_CMD_Read_CAM,
+        HAL_FW_C2H_CMD_Get_BasicRate,
+        HAL_FW_C2H_CMD_Get_DataRate,
+        HAL_FW_C2H_CMD_Survey,
+        HAL_FW_C2H_CMD_SurveyDone,
+        HAL_FW_C2H_CMD_JoinBss,
+        HAL_FW_C2H_CMD_AddSTA,
+        HAL_FW_C2H_CMD_DelSTA,
+        HAL_FW_C2H_CMD_AtimDone,
+        HAL_FW_C2H_CMD_TX_Report,
+        HAL_FW_C2H_CMD_CCX_Report,
+        HAL_FW_C2H_CMD_DTM_Report,
+        HAL_FW_C2H_CMD_TX_Rate_Statistics,
+        HAL_FW_C2H_CMD_C2HLBK,
+        HAL_FW_C2H_CMD_C2HDBG,
+        HAL_FW_C2H_CMD_C2HFEEDBACK,
+        HAL_FW_C2H_CMD_MAX
+};
+
+enum wake_on_wlan_mode {
+        ewowlandisable,
+        ewakeonmagicpacketonly,
+        ewakeonpatternmatchonly,
+        ewakeonbothtypepacket
+};
+
+enum rtl_desc_qsel {
+        QSLT_BK = 0x2,
+        QSLT_BE = 0x0,
+        QSLT_VI = 0x5,
+        QSLT_VO = 0x7,
+        QSLT_BEACON = 0x10,
+        QSLT_HIGH = 0x11,
+        QSLT_MGNT = 0x12,
+        QSLT_CMD = 0x13,
+};
+
+enum rtl_desc92c_rate {
+        DESC92C_RATE1M = 0x00,
+        DESC92C_RATE2M = 0x01,
+        DESC92C_RATE5_5M = 0x02,
+        DESC92C_RATE11M = 0x03,
+
+        DESC92C_RATE6M = 0x04,
+        DESC92C_RATE9M = 0x05,
+        DESC92C_RATE12M = 0x06,
+        DESC92C_RATE18M = 0x07,
+        DESC92C_RATE24M = 0x08,
+        DESC92C_RATE36M = 0x09,
+        DESC92C_RATE48M = 0x0a,
+        DESC92C_RATE54M = 0x0b,
+
+        DESC92C_RATEMCS0 = 0x0c,
+        DESC92C_RATEMCS1 = 0x0d,
+        DESC92C_RATEMCS2 = 0x0e,
+        DESC92C_RATEMCS3 = 0x0f,
+        DESC92C_RATEMCS4 = 0x10,
+        DESC92C_RATEMCS5 = 0x11,
+        DESC92C_RATEMCS6 = 0x12,
+        DESC92C_RATEMCS7 = 0x13,
+        DESC92C_RATEMCS8 = 0x14,
+        DESC92C_RATEMCS9 = 0x15,
+        DESC92C_RATEMCS10 = 0x16,
+        DESC92C_RATEMCS11 = 0x17,
+        DESC92C_RATEMCS12 = 0x18,
+        DESC92C_RATEMCS13 = 0x19,
+        DESC92C_RATEMCS14 = 0x1a,
+        DESC92C_RATEMCS15 = 0x1b,
+        DESC92C_RATEMCS15_SG = 0x1c,
+        DESC92C_RATEMCS32 = 0x20,
+};
+
+struct phy_sts_cck_8192s_t {
+        u8 adc_pwdb_X[4];
+        u8 sq_rpt;
+        u8 cck_agc_rpt;
+};
+
+struct h2c_cmd_8192c {
+        u8 element_id;
+        u32 cmd_len;
+        u8 *p_cmdbuffer;
+};
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
new file mode 100644
index 000000000000..21a5cf060677
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
@@ -0,0 +1,1794 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "../wifi.h"
+#include "../base.h"
+#include "../pci.h"
+#include "reg.h"
+#include "def.h"
+#include "phy.h"
+#include "dm.h"
+#include "fw.h"
+#include "trx.h"
+
+static const u32 ofdmswing_table[OFDM_TABLE_SIZE] = {
+        0x7f8001fe,             /* 0, +6.0dB */
+        0x788001e2,             /* 1, +5.5dB */
+        0x71c001c7,             /* 2, +5.0dB */
+        0x6b8001ae,             /* 3, +4.5dB */
+        0x65400195,             /* 4, +4.0dB */
+        0x5fc0017f,             /* 5, +3.5dB */
+        0x5a400169,             /* 6, +3.0dB */
+        0x55400155,             /* 7, +2.5dB */
+        0x50800142,             /* 8, +2.0dB */
+        0x4c000130,             /* 9, +1.5dB */
+        0x47c0011f,             /* 10, +1.0dB */
+        0x43c0010f,             /* 11, +0.5dB */
+        0x40000100,             /* 12, +0dB */
+        0x3c8000f2,             /* 13, -0.5dB */
+        0x390000e4,             /* 14, -1.0dB */
+        0x35c000d7,             /* 15, -1.5dB */
+        0x32c000cb,             /* 16, -2.0dB */
+        0x300000c0,             /* 17, -2.5dB */
+        0x2d4000b5,             /* 18, -3.0dB */
+        0x2ac000ab,             /* 19, -3.5dB */
+        0x288000a2,             /* 20, -4.0dB */
+        0x26000098,             /* 21, -4.5dB */
+        0x24000090,             /* 22, -5.0dB */
+        0x22000088,             /* 23, -5.5dB */
+        0x20000080,             /* 24, -6.0dB */
+        0x1e400079,             /* 25, -6.5dB */
+        0x1c800072,             /* 26, -7.0dB */
+        0x1b00006c,             /* 27. -7.5dB */
+        0x19800066,             /* 28, -8.0dB */
+        0x18000060,             /* 29, -8.5dB */
+        0x16c0005b,             /* 30, -9.0dB */
+        0x15800056,             /* 31, -9.5dB */
+        0x14400051,             /* 32, -10.0dB */
+        0x1300004c,             /* 33, -10.5dB */
+        0x12000048,             /* 34, -11.0dB */
+        0x11000044,             /* 35, -11.5dB */
+        0x10000040,             /* 36, -12.0dB */
+        0x0f00003c,             /* 37, -12.5dB */
+        0x0e400039,             /* 38, -13.0dB */
+        0x0d800036,             /* 39, -13.5dB */
+        0x0cc00033,             /* 40, -14.0dB */
+        0x0c000030,             /* 41, -14.5dB */
+        0x0b40002d,             /* 42, -15.0dB */
+};
+
+static const u8 cck_tbl_ch1_13[CCK_TABLE_SIZE][8] = {
+        {0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04},       /* 0, +0dB */
+        {0x33, 0x32, 0x2b, 0x23, 0x1a, 0x11, 0x08, 0x04},       /* 1, -0.5dB */
+        {0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03},       /* 2, -1.0dB */
+        {0x2d, 0x2d, 0x27, 0x1f, 0x18, 0x0f, 0x08, 0x03},       /* 3, -1.5dB */
+        {0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03},       /* 4, -2.0dB */
+        {0x28, 0x28, 0x22, 0x1c, 0x15, 0x0d, 0x07, 0x03},       /* 5, -2.5dB */
+        {0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03},       /* 6, -3.0dB */
+        {0x24, 0x23, 0x1f, 0x19, 0x13, 0x0c, 0x06, 0x03},       /* 7, -3.5dB */
+        {0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02},       /* 8, -4.0dB */
+        {0x20, 0x20, 0x1b, 0x16, 0x11, 0x08, 0x05, 0x02},       /* 9, -4.5dB */
+        {0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02},       /* 10, -5.0dB */
+        {0x1d, 0x1c, 0x18, 0x14, 0x0f, 0x0a, 0x05, 0x02},       /* 11, -5.5dB */
+        {0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02},       /* 12, -6.0dB */
+        {0x1a, 0x19, 0x16, 0x12, 0x0d, 0x09, 0x04, 0x02},       /* 13, -6.5dB */
+        {0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02},       /* 14, -7.0dB */
+        {0x17, 0x16, 0x13, 0x10, 0x0c, 0x08, 0x04, 0x02},       /* 15, -7.5dB */
+        {0x16, 0x15, 0x12, 0x0f, 0x0b, 0x07, 0x04, 0x01},       /* 16, -8.0dB */
+        {0x14, 0x14, 0x11, 0x0e, 0x0b, 0x07, 0x03, 0x02},       /* 17, -8.5dB */
+        {0x13, 0x13, 0x10, 0x0d, 0x0a, 0x06, 0x03, 0x01},       /* 18, -9.0dB */
+        {0x12, 0x12, 0x0f, 0x0c, 0x09, 0x06, 0x03, 0x01},       /* 19, -9.5dB */
+        {0x11, 0x11, 0x0f, 0x0c, 0x09, 0x06, 0x03, 0x01},       /* 20, -10.0dB*/
+        {0x10, 0x10, 0x0e, 0x0b, 0x08, 0x05, 0x03, 0x01},       /* 21, -10.5dB*/
+        {0x0f, 0x0f, 0x0d, 0x0b, 0x08, 0x05, 0x03, 0x01},       /* 22, -11.0dB*/
+        {0x0e, 0x0e, 0x0c, 0x0a, 0x08, 0x05, 0x02, 0x01},       /* 23, -11.5dB*/
+        {0x0d, 0x0d, 0x0c, 0x0a, 0x07, 0x05, 0x02, 0x01},       /* 24, -12.0dB*/
+        {0x0d, 0x0c, 0x0b, 0x09, 0x07, 0x04, 0x02, 0x01},       /* 25, -12.5dB*/
+        {0x0c, 0x0c, 0x0a, 0x09, 0x06, 0x04, 0x02, 0x01},       /* 26, -13.0dB*/
+        {0x0b, 0x0b, 0x0a, 0x08, 0x06, 0x04, 0x02, 0x01},       /* 27, -13.5dB*/
+        {0x0b, 0x0a, 0x09, 0x08, 0x06, 0x04, 0x02, 0x01},       /* 28, -14.0dB*/
+        {0x0a, 0x0a, 0x09, 0x07, 0x05, 0x03, 0x02, 0x01},       /* 29, -14.5dB*/
+        {0x0a, 0x09, 0x08, 0x07, 0x05, 0x03, 0x02, 0x01},       /* 30, -15.0dB*/
+        {0x09, 0x09, 0x08, 0x06, 0x05, 0x03, 0x01, 0x01},       /* 31, -15.5dB*/
+        {0x09, 0x08, 0x07, 0x06, 0x04, 0x03, 0x01, 0x01}        /* 32, -16.0dB*/
+};
+
+static const u8 cck_tbl_ch14[CCK_TABLE_SIZE][8] = {
+        {0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00},       /* 0, +0dB */
+        {0x33, 0x32, 0x2b, 0x19, 0x00, 0x00, 0x00, 0x00},       /* 1, -0.5dB */
+        {0x30, 0x2f, 0x29, 0x18, 0x00, 0x00, 0x00, 0x00},       /* 2, -1.0dB */
+        {0x2d, 0x2d, 0x17, 0x17, 0x00, 0x00, 0x00, 0x00},       /* 3, -1.5dB */
+        {0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00},       /* 4, -2.0dB */
+        {0x28, 0x28, 0x24, 0x14, 0x00, 0x00, 0x00, 0x00},       /* 5, -2.5dB */
+        {0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00},       /* 6, -3.0dB */
+        {0x24, 0x23, 0x1f, 0x12, 0x00, 0x00, 0x00, 0x00},       /* 7, -3.5dB */
+        {0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00},       /* 8, -4.0dB */
+        {0x20, 0x20, 0x1b, 0x10, 0x00, 0x00, 0x00, 0x00},       /* 9, -4.5dB */
+        {0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00},       /* 10, -5.0dB */
+        {0x1d, 0x1c, 0x18, 0x0e, 0x00, 0x00, 0x00, 0x00},       /* 11, -5.5dB */
+        {0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00},       /* 12, -6.0dB */
+        {0x1a, 0x19, 0x16, 0x0d, 0x00, 0x00, 0x00, 0x00},       /* 13, -6.5dB */
+        {0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00},       /* 14, -7.0dB */
+        {0x17, 0x16, 0x13, 0x0b, 0x00, 0x00, 0x00, 0x00},       /* 15, -7.5dB */
+        {0x16, 0x15, 0x12, 0x0b, 0x00, 0x00, 0x00, 0x00},       /* 16, -8.0dB */
+        {0x14, 0x14, 0x11, 0x0a, 0x00, 0x00, 0x00, 0x00},       /* 17, -8.5dB */
+        {0x13, 0x13, 0x10, 0x0a, 0x00, 0x00, 0x00, 0x00},       /* 18, -9.0dB */
+        {0x12, 0x12, 0x0f, 0x09, 0x00, 0x00, 0x00, 0x00},       /* 19, -9.5dB */
+        {0x11, 0x11, 0x0f, 0x09, 0x00, 0x00, 0x00, 0x00},       /* 20, -10.0dB*/
+        {0x10, 0x10, 0x0e, 0x08, 0x00, 0x00, 0x00, 0x00},       /* 21, -10.5dB*/
+        {0x0f, 0x0f, 0x0d, 0x08, 0x00, 0x00, 0x00, 0x00},       /* 22, -11.0dB*/
+        {0x0e, 0x0e, 0x0c, 0x07, 0x00, 0x00, 0x00, 0x00},       /* 23, -11.5dB*/
+        {0x0d, 0x0d, 0x0c, 0x07, 0x00, 0x00, 0x00, 0x00},       /* 24, -12.0dB*/
+        {0x0d, 0x0c, 0x0b, 0x06, 0x00, 0x00, 0x00, 0x00},       /* 25, -12.5dB*/
+        {0x0c, 0x0c, 0x0a, 0x06, 0x00, 0x00, 0x00, 0x00},       /* 26, -13.0dB*/
+        {0x0b, 0x0b, 0x0a, 0x06, 0x00, 0x00, 0x00, 0x00},       /* 27, -13.5dB*/
+        {0x0b, 0x0a, 0x09, 0x05, 0x00, 0x00, 0x00, 0x00},       /* 28, -14.0dB*/
+        {0x0a, 0x0a, 0x09, 0x05, 0x00, 0x00, 0x00, 0x00},       /* 29, -14.5dB*/
+        {0x0a, 0x09, 0x08, 0x05, 0x00, 0x00, 0x00, 0x00},       /* 30, -15.0dB*/
+        {0x09, 0x09, 0x08, 0x05, 0x00, 0x00, 0x00, 0x00},       /* 31, -15.5dB*/
+        {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}        /* 32, -16.0dB*/
+};
+
+#define CAL_SWING_OFF(_off, _dir, _size, _del)                          \
+        do {                                                            \
+                for (_off = 0; _off < _size; _off++) {                  \
+                        if (_del < thermal_threshold[_dir][_off]) {     \
+                                if (_off != 0)                          \
+                                        _off--;                         \
+                                break;                                  \
+                        }                                               \
+                }                                                       \
+                if (_off >= _size)                                      \
+                        _off = _size - 1;                               \
+        } while (0)
+
+static void rtl88e_set_iqk_matrix(struct ieee80211_hw *hw,
+                                  u8 ofdm_index, u8 rfpath,
+                                  long iqk_result_x, long iqk_result_y)
+{
+        long ele_a = 0, ele_d, ele_c = 0, value32;
+
+        ele_d = (ofdmswing_table[ofdm_index] & 0xFFC00000)>>22;
+
+        if (iqk_result_x != 0) {
+                if ((iqk_result_x & 0x00000200) != 0)
+                        iqk_result_x = iqk_result_x | 0xFFFFFC00;
+                ele_a = ((iqk_result_x * ele_d)>>8)&0x000003FF;
+
+                if ((iqk_result_y & 0x00000200) != 0)
+                        iqk_result_y = iqk_result_y | 0xFFFFFC00;
+                ele_c = ((iqk_result_y * ele_d)>>8)&0x000003FF;
+
+                switch (rfpath) {
+                case RF90_PATH_A:
+                        value32 = (ele_d << 22)|((ele_c & 0x3F)<<16) | ele_a;
+                        rtl_set_bbreg(hw, ROFDM0_XATXIQIMBAL, MASKDWORD,
+                                      value32);
+                        value32 = (ele_c & 0x000003C0) >> 6;
+                        rtl_set_bbreg(hw, ROFDM0_XCTXAFE, MASKH4BITS, value32);
+                        value32 = ((iqk_result_x * ele_d) >> 7) & 0x01;
+                        rtl_set_bbreg(hw, ROFDM0_ECCATHRES, BIT(24), value32);
+                        break;
+                case RF90_PATH_B:
+                        value32 = (ele_d << 22)|((ele_c & 0x3F)<<16) | ele_a;
+                        rtl_set_bbreg(hw, ROFDM0_XBTXIQIMBAL,
+                                      MASKDWORD, value32);
+                        value32 = (ele_c & 0x000003C0) >> 6;
+                        rtl_set_bbreg(hw, ROFDM0_XDTXAFE, MASKH4BITS, value32);
+                        value32 = ((iqk_result_x * ele_d) >> 7) & 0x01;
+                        rtl_set_bbreg(hw, ROFDM0_ECCATHRES, BIT(28), value32);
+                        break;
+                default:
+                        break;
+                }
+        } else {
+                switch (rfpath) {
+                case RF90_PATH_A:
+                        rtl_set_bbreg(hw, ROFDM0_XATXIQIMBAL, MASKDWORD,
+                                      ofdmswing_table[ofdm_index]);
+                        rtl_set_bbreg(hw, ROFDM0_XCTXAFE, MASKH4BITS, 0x00);
+                        rtl_set_bbreg(hw, ROFDM0_ECCATHRES, BIT(24), 0x00);
+                        break;
+                case RF90_PATH_B:
+                        rtl_set_bbreg(hw, ROFDM0_XBTXIQIMBAL, MASKDWORD,
+                                      ofdmswing_table[ofdm_index]);
+                        rtl_set_bbreg(hw, ROFDM0_XDTXAFE, MASKH4BITS, 0x00);
+                        rtl_set_bbreg(hw, ROFDM0_ECCATHRES, BIT(28), 0x00);
+                        break;
+                default:
+                        break;
+                }
+        }
+}
+
+void rtl88e_dm_txpower_track_adjust(struct ieee80211_hw *hw,
+        u8 type, u8 *pdirection, u32 *poutwrite_val)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        u8 pwr_val = 0;
+        u8 cck_base = rtldm->swing_idx_cck_base;
+        u8 cck_val = rtldm->swing_idx_cck;
+        u8 ofdm_base = rtldm->swing_idx_ofdm_base;
+        u8 ofdm_val = rtlpriv->dm.swing_idx_ofdm[RF90_PATH_A];
+
+        if (type == 0) {
+                if (ofdm_val <= ofdm_base) {
+                        *pdirection = 1;
+                        pwr_val = ofdm_base - ofdm_val;
+                } else {
+                        *pdirection = 2;
+                        pwr_val = ofdm_val - ofdm_base;
+                }
+        } else if (type == 1) {
+                if (cck_val <= cck_base) {
+                        *pdirection = 1;
+                        pwr_val = cck_base - cck_val;
+                } else {
+                        *pdirection = 2;
+                        pwr_val = cck_val - cck_base;
+                }
+        }
+
+        if (pwr_val >= TXPWRTRACK_MAX_IDX && (*pdirection == 1))
+                pwr_val = TXPWRTRACK_MAX_IDX;
+
+        *poutwrite_val = pwr_val | (pwr_val << 8) | (pwr_val << 16) |
+                         (pwr_val << 24);
+}
+
+
+static void rtl88e_chk_tx_track(struct ieee80211_hw *hw,
+                                enum pwr_track_control_method method,
+                                u8 rfpath, u8 index)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        int jj = rtldm->swing_idx_cck;
+        int i;
+
+        if (method == TXAGC) {
+                if (rtldm->swing_flag_ofdm == true ||
+                    rtldm->swing_flag_cck == true) {
+                        u8 chan = rtlphy->current_channel;
+                        rtl88e_phy_set_txpower_level(hw, chan);
+                        rtldm->swing_flag_ofdm = false;
+                        rtldm->swing_flag_cck = false;
+                }
+        } else if (method == BBSWING) {
+                if (!rtldm->cck_inch14) {
+                        for (i = 0; i < 8; i++)
+                                rtl_write_byte(rtlpriv, 0xa22 + i,
+                                               cck_tbl_ch1_13[jj][i]);
+                } else {
+                        for (i = 0; i < 8; i++)
+                                rtl_write_byte(rtlpriv, 0xa22 + i,
+                                               cck_tbl_ch14[jj][i]);
+                }
+
+                if (rfpath == RF90_PATH_A) {
+                        long x = rtlphy->iqk_matrix[index].value[0][0];
+                        long y = rtlphy->iqk_matrix[index].value[0][1];
+                        u8 indx = rtldm->swing_idx_ofdm[rfpath];
+                        rtl88e_set_iqk_matrix(hw, indx, rfpath, x, y);
+                } else if (rfpath == RF90_PATH_B) {
+                        u8 indx = rtldm->swing_idx_ofdm[rfpath];
+                        long x = rtlphy->iqk_matrix[indx].value[0][4];
+                        long y = rtlphy->iqk_matrix[indx].value[0][5];
+                        rtl88e_set_iqk_matrix(hw, indx, rfpath, x, y);
+                }
+        } else {
+                return;
+        }
+}
+
+static void rtl88e_dm_diginit(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
+
+        dm_dig->dig_enable_flag = true;
+        dm_dig->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
+        dm_dig->pre_igvalue = 0;
+        dm_dig->cursta_cstate = DIG_STA_DISCONNECT;
+        dm_dig->presta_cstate = DIG_STA_DISCONNECT;
+        dm_dig->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
+        dm_dig->rssi_lowthresh = DM_DIG_THRESH_LOW;
+        dm_dig->rssi_highthresh = DM_DIG_THRESH_HIGH;
+        dm_dig->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
+        dm_dig->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
+        dm_dig->rx_gain_max = DM_DIG_MAX;
+        dm_dig->rx_gain_min = DM_DIG_MIN;
+        dm_dig->back_val = DM_DIG_BACKOFF_DEFAULT;
+        dm_dig->back_range_max = DM_DIG_BACKOFF_MAX;
+        dm_dig->back_range_min = DM_DIG_BACKOFF_MIN;
+        dm_dig->pre_cck_cca_thres = 0xff;
+        dm_dig->cur_cck_cca_thres = 0x83;
+        dm_dig->forbidden_igi = DM_DIG_MIN;
+        dm_dig->large_fa_hit = 0;
+        dm_dig->recover_cnt = 0;
+        dm_dig->dig_min_0 = 0x25;
+        dm_dig->dig_min_1 = 0x25;
+        dm_dig->media_connect_0 = false;
+        dm_dig->media_connect_1 = false;
+        rtlpriv->dm.dm_initialgain_enable = true;
+}
+
+static u8 rtl88e_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
+        long rssi_val_min = 0;
+
+        if ((dm_dig->curmultista_cstate == DIG_MULTISTA_CONNECT) &&
+            (dm_dig->cursta_cstate == DIG_STA_CONNECT)) {
+                if (rtlpriv->dm.entry_min_undec_sm_pwdb != 0)
+                        rssi_val_min =
+                            (rtlpriv->dm.entry_min_undec_sm_pwdb >
+                            rtlpriv->dm.undec_sm_pwdb) ?
+                            rtlpriv->dm.undec_sm_pwdb :
+                            rtlpriv->dm.entry_min_undec_sm_pwdb;
+                else
+                        rssi_val_min = rtlpriv->dm.undec_sm_pwdb;
+        } else if (dm_dig->cursta_cstate == DIG_STA_CONNECT ||
+                   dm_dig->cursta_cstate == DIG_STA_BEFORE_CONNECT) {
+                rssi_val_min = rtlpriv->dm.undec_sm_pwdb;
+        } else if (dm_dig->curmultista_cstate ==
+                DIG_MULTISTA_CONNECT) {
+                rssi_val_min = rtlpriv->dm.entry_min_undec_sm_pwdb;
+        }
+        return (u8)rssi_val_min;
+}
+
+static void rtl88e_dm_false_alarm_counter_statistics(struct ieee80211_hw *hw)
+{
+        u32 ret_value;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct false_alarm_statistics *alm_cnt = &(rtlpriv->falsealm_cnt);
+
+        rtl_set_bbreg(hw, ROFDM0_LSTF, BIT(31), 1);
+        rtl_set_bbreg(hw, ROFDM1_LSTF, BIT(31), 1);
+
+        ret_value = rtl_get_bbreg(hw, ROFDM0_FRAMESYNC, MASKDWORD);
+        alm_cnt->cnt_fast_fsync_fail = (ret_value&0xffff);
+        alm_cnt->cnt_sb_search_fail = ((ret_value&0xffff0000)>>16);
+
+        ret_value = rtl_get_bbreg(hw, ROFDM_PHYCOUNTER1, MASKDWORD);
+        alm_cnt->cnt_ofdm_cca = (ret_value&0xffff);
+        alm_cnt->cnt_parity_fail = ((ret_value & 0xffff0000) >> 16);
+
+        ret_value = rtl_get_bbreg(hw, ROFDM_PHYCOUNTER2, MASKDWORD);
+        alm_cnt->cnt_rate_illegal = (ret_value & 0xffff);
+        alm_cnt->cnt_crc8_fail = ((ret_value & 0xffff0000) >> 16);
+
+        ret_value = rtl_get_bbreg(hw, ROFDM_PHYCOUNTER3, MASKDWORD);
+        alm_cnt->cnt_mcs_fail = (ret_value & 0xffff);
+        alm_cnt->cnt_ofdm_fail = alm_cnt->cnt_parity_fail +
+                                 alm_cnt->cnt_rate_illegal +
+                                 alm_cnt->cnt_crc8_fail +
+                                 alm_cnt->cnt_mcs_fail +
+                                 alm_cnt->cnt_fast_fsync_fail +
+                                 alm_cnt->cnt_sb_search_fail;
+
+        ret_value = rtl_get_bbreg(hw, REG_SC_CNT, MASKDWORD);
+        alm_cnt->cnt_bw_lsc = (ret_value & 0xffff);
+        alm_cnt->cnt_bw_usc = ((ret_value & 0xffff0000) >> 16);
+
+        rtl_set_bbreg(hw, RCCK0_FALSEALARMREPORT, BIT(12), 1);
+        rtl_set_bbreg(hw, RCCK0_FALSEALARMREPORT, BIT(14), 1);
+
+        ret_value = rtl_get_bbreg(hw, RCCK0_FACOUNTERLOWER, MASKBYTE0);
+        alm_cnt->cnt_cck_fail = ret_value;
+
+        ret_value = rtl_get_bbreg(hw, RCCK0_FACOUNTERUPPER, MASKBYTE3);
+        alm_cnt->cnt_cck_fail += (ret_value & 0xff) << 8;
+
+        ret_value = rtl_get_bbreg(hw, RCCK0_CCA_CNT, MASKDWORD);
+        alm_cnt->cnt_cck_cca = ((ret_value & 0xff) << 8) |
+                                ((ret_value&0xFF00)>>8);
+
+        alm_cnt->cnt_all = alm_cnt->cnt_fast_fsync_fail +
+                           alm_cnt->cnt_sb_search_fail +
+                           alm_cnt->cnt_parity_fail +
+                           alm_cnt->cnt_rate_illegal +
+                           alm_cnt->cnt_crc8_fail +
+                           alm_cnt->cnt_mcs_fail +
+                           alm_cnt->cnt_cck_fail;
+        alm_cnt->cnt_cca_all = alm_cnt->cnt_ofdm_cca + alm_cnt->cnt_cck_cca;
+
+        rtl_set_bbreg(hw, ROFDM0_TRSWISOLATION, BIT(31), 1);
+        rtl_set_bbreg(hw, ROFDM0_TRSWISOLATION, BIT(31), 0);
+        rtl_set_bbreg(hw, ROFDM1_LSTF, BIT(27), 1);
+        rtl_set_bbreg(hw, ROFDM1_LSTF, BIT(27), 0);
+        rtl_set_bbreg(hw, ROFDM0_LSTF, BIT(31), 0);
+        rtl_set_bbreg(hw, ROFDM1_LSTF, BIT(31), 0);
+        rtl_set_bbreg(hw, RCCK0_FALSEALARMREPORT, BIT(13)|BIT(12), 0);
+        rtl_set_bbreg(hw, RCCK0_FALSEALARMREPORT, BIT(13)|BIT(12), 2);
+        rtl_set_bbreg(hw, RCCK0_FALSEALARMREPORT, BIT(15)|BIT(14), 0);
+        rtl_set_bbreg(hw, RCCK0_FALSEALARMREPORT, BIT(15)|BIT(14), 2);
+
+        RT_TRACE(rtlpriv, COMP_DIG, DBG_TRACE,
+                 "cnt_parity_fail = %d, cnt_rate_illegal = %d, "
+                 "cnt_crc8_fail = %d, cnt_mcs_fail = %d\n",
+                 alm_cnt->cnt_parity_fail,
+                 alm_cnt->cnt_rate_illegal,
+                 alm_cnt->cnt_crc8_fail, alm_cnt->cnt_mcs_fail);
+
+        RT_TRACE(rtlpriv, COMP_DIG, DBG_TRACE,
+                 "cnt_ofdm_fail = %x, cnt_cck_fail = %x, cnt_all = %x\n",
+                 alm_cnt->cnt_ofdm_fail,
+                 alm_cnt->cnt_cck_fail, alm_cnt->cnt_all);
+}
+
+static void rtl88e_dm_cck_packet_detection_thresh(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
+        u8 cur_cck_cca_thresh;
+
+        if (dm_dig->cursta_cstate == DIG_STA_CONNECT) {
+                dm_dig->rssi_val_min = rtl88e_dm_initial_gain_min_pwdb(hw);
+                if (dm_dig->rssi_val_min > 25) {
+                        cur_cck_cca_thresh = 0xcd;
+                } else if ((dm_dig->rssi_val_min <= 25) &&
+                           (dm_dig->rssi_val_min > 10)) {
+                        cur_cck_cca_thresh = 0x83;
+                } else {
+                        if (rtlpriv->falsealm_cnt.cnt_cck_fail > 1000)
+                                cur_cck_cca_thresh = 0x83;
+                        else
+                                cur_cck_cca_thresh = 0x40;
+                }
+
+        } else {
+                if (rtlpriv->falsealm_cnt.cnt_cck_fail > 1000)
+                        cur_cck_cca_thresh = 0x83;
+                else
+                        cur_cck_cca_thresh = 0x40;
+        }
+
+        if (dm_dig->cur_cck_cca_thres != cur_cck_cca_thresh)
+                rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2, cur_cck_cca_thresh);
+
+        dm_dig->cur_cck_cca_thres = cur_cck_cca_thresh;
+        dm_dig->pre_cck_cca_thres = dm_dig->cur_cck_cca_thres;
+        RT_TRACE(rtlpriv, COMP_DIG, DBG_TRACE,
+                 "CCK cca thresh hold =%x\n", dm_dig->cur_cck_cca_thres);
+}
+
+static void rtl88e_dm_dig(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        u8 dig_min, dig_maxofmin;
+        bool bfirstconnect;
+        u8 dm_dig_max, dm_dig_min;
+        u8 current_igi = dm_dig->cur_igvalue;
+
+        if (rtlpriv->dm.dm_initialgain_enable == false)
+                return;
+        if (dm_dig->dig_enable_flag == false)
+                return;
+        if (mac->act_scanning == true)
+                return;
+
+        if (mac->link_state >= MAC80211_LINKED)
+                dm_dig->cursta_cstate = DIG_STA_CONNECT;
+        else
+                dm_dig->cursta_cstate = DIG_STA_DISCONNECT;
+        if (rtlpriv->mac80211.opmode == NL80211_IFTYPE_AP ||
+            rtlpriv->mac80211.opmode == NL80211_IFTYPE_ADHOC)
+                dm_dig->cursta_cstate = DIG_STA_DISCONNECT;
+
+        dm_dig_max = DM_DIG_MAX;
+        dm_dig_min = DM_DIG_MIN;
+        dig_maxofmin = DM_DIG_MAX_AP;
+        dig_min = dm_dig->dig_min_0;
+        bfirstconnect = ((mac->link_state >= MAC80211_LINKED) ? true : false) &&
+                         (dm_dig->media_connect_0 == false);
+
+        dm_dig->rssi_val_min =
+                rtl88e_dm_initial_gain_min_pwdb(hw);
+
+        if (mac->link_state >= MAC80211_LINKED) {
+                if ((dm_dig->rssi_val_min + 20) > dm_dig_max)
+                        dm_dig->rx_gain_max = dm_dig_max;
+                else if ((dm_dig->rssi_val_min + 20) < dm_dig_min)
+                        dm_dig->rx_gain_max = dm_dig_min;
+                else
+                        dm_dig->rx_gain_max = dm_dig->rssi_val_min + 20;
+
+                if (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV) {
+                        dig_min  = dm_dig->antdiv_rssi_max;
+                } else {
+                        if (dm_dig->rssi_val_min < dm_dig_min)
+                                dig_min = dm_dig_min;
+                        else if (dm_dig->rssi_val_min < dig_maxofmin)
+                                dig_min = dig_maxofmin;
+                        else
+                                dig_min = dm_dig->rssi_val_min;
+                }
+        } else {
+                dm_dig->rx_gain_max = dm_dig_max;
+                dig_min = dm_dig_min;
+                RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD, "no link\n");
+        }
+
+        if (rtlpriv->falsealm_cnt.cnt_all > 10000) {
+                dm_dig->large_fa_hit++;
+                if (dm_dig->forbidden_igi < current_igi) {
+                        dm_dig->forbidden_igi = current_igi;
+                        dm_dig->large_fa_hit = 1;
+                }
+
+                if (dm_dig->large_fa_hit >= 3) {
+                        if ((dm_dig->forbidden_igi + 1) > dm_dig->rx_gain_max)
+                                dm_dig->rx_gain_min = dm_dig->rx_gain_max;
+                        else
+                                dm_dig->rx_gain_min = dm_dig->forbidden_igi + 1;
+                        dm_dig->recover_cnt = 3600;
+                }
+        } else {
+                if (dm_dig->recover_cnt != 0) {
+                        dm_dig->recover_cnt--;
+                } else {
+                        if (dm_dig->large_fa_hit == 0) {
+                                if ((dm_dig->forbidden_igi - 1) < dig_min) {
+                                        dm_dig->forbidden_igi = dig_min;
+                                        dm_dig->rx_gain_min = dig_min;
+                                } else {
+                                        dm_dig->forbidden_igi--;
+                                        dm_dig->rx_gain_min =
+                                                 dm_dig->forbidden_igi + 1;
+                                }
+                        } else if (dm_dig->large_fa_hit == 3) {
+                                dm_dig->large_fa_hit = 0;
+                        }
+                }
+        }
+
+        if (dm_dig->cursta_cstate == DIG_STA_CONNECT) {
+                if (bfirstconnect) {
+                        current_igi = dm_dig->rssi_val_min;
+                } else {
+                        if (rtlpriv->falsealm_cnt.cnt_all > DM_DIG_FA_TH2)
+                                current_igi += 2;
+                        else if (rtlpriv->falsealm_cnt.cnt_all > DM_DIG_FA_TH1)
+                                current_igi++;
+                        else if (rtlpriv->falsealm_cnt.cnt_all < DM_DIG_FA_TH0)
+                                current_igi--;
+                }
+        } else {
+                if (rtlpriv->falsealm_cnt.cnt_all > 10000)
+                        current_igi += 2;
+                else if (rtlpriv->falsealm_cnt.cnt_all > 8000)
+                        current_igi++;
+                else if (rtlpriv->falsealm_cnt.cnt_all < 500)
+                        current_igi--;
+        }
+
+        if (current_igi > DM_DIG_FA_UPPER)
+                current_igi = DM_DIG_FA_UPPER;
+        else if (current_igi < DM_DIG_FA_LOWER)
+                current_igi = DM_DIG_FA_LOWER;
+
+        if (rtlpriv->falsealm_cnt.cnt_all > 10000)
+                current_igi = DM_DIG_FA_UPPER;
+
+        dm_dig->cur_igvalue = current_igi;
+        rtl88e_dm_write_dig(hw);
+        dm_dig->media_connect_0 = ((mac->link_state >= MAC80211_LINKED) ?
+                                    true : false);
+        dm_dig->dig_min_0 = dig_min;
+
+        rtl88e_dm_cck_packet_detection_thresh(hw);
+}
+
+static void rtl88e_dm_init_dynamic_txpower(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        rtlpriv->dm.dynamic_txpower_enable = false;
+
+        rtlpriv->dm.last_dtp_lvl = TXHIGHPWRLEVEL_NORMAL;
+        rtlpriv->dm.dynamic_txhighpower_lvl = TXHIGHPWRLEVEL_NORMAL;
+}
+
+static void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        long undec_sm_pwdb;
+
+        if (!rtlpriv->dm.dynamic_txpower_enable)
+                return;
+
+        if (rtlpriv->dm.dm_flag & HAL_DM_HIPWR_DISABLE) {
+                rtlpriv->dm.dynamic_txhighpower_lvl = TXHIGHPWRLEVEL_NORMAL;
+                return;
+        }
+
+        if ((mac->link_state < MAC80211_LINKED) &&
+            (rtlpriv->dm.entry_min_undec_sm_pwdb == 0)) {
+                RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+                         "Not connected\n");
+
+                rtlpriv->dm.dynamic_txhighpower_lvl = TXHIGHPWRLEVEL_NORMAL;
+
+                rtlpriv->dm.last_dtp_lvl = TXHIGHPWRLEVEL_NORMAL;
+                return;
+        }
+
+        if (mac->link_state >= MAC80211_LINKED) {
+                if (mac->opmode == NL80211_IFTYPE_ADHOC) {
+                        undec_sm_pwdb =
+                            rtlpriv->dm.entry_min_undec_sm_pwdb;
+                        RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+                                 "AP Client PWDB = 0x%lx\n",
+                                  undec_sm_pwdb);
+                } else {
+                        undec_sm_pwdb =
+                            rtlpriv->dm.undec_sm_pwdb;
+                        RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+                                 "STA Default Port PWDB = 0x%lx\n",
+                                  undec_sm_pwdb);
+                }
+        } else {
+                undec_sm_pwdb = rtlpriv->dm.entry_min_undec_sm_pwdb;
+
+                RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+                         "AP Ext Port PWDB = 0x%lx\n", undec_sm_pwdb);
+        }
+
+        if (undec_sm_pwdb >= TX_POWER_NEAR_FIELD_THRESH_LVL2) {
+                rtlpriv->dm.dynamic_txhighpower_lvl = TXHIGHPWRLEVEL_LEVEL1;
+                RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+                         "TXHIGHPWRLEVEL_LEVEL1 (TxPwr = 0x0)\n");
+        } else if ((undec_sm_pwdb <
+                    (TX_POWER_NEAR_FIELD_THRESH_LVL2 - 3)) &&
+                   (undec_sm_pwdb >= TX_POWER_NEAR_FIELD_THRESH_LVL1)) {
+                rtlpriv->dm.dynamic_txhighpower_lvl = TXHIGHPWRLEVEL_LEVEL1;
+                RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+                         "TXHIGHPWRLEVEL_LEVEL1 (TxPwr = 0x10)\n");
+        } else if (undec_sm_pwdb < (TX_POWER_NEAR_FIELD_THRESH_LVL1 - 5)) {
+                rtlpriv->dm.dynamic_txhighpower_lvl = TXHIGHPWRLEVEL_NORMAL;
+                RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+                         "TXHIGHPWRLEVEL_NORMAL\n");
+        }
+
+        if ((rtlpriv->dm.dynamic_txhighpower_lvl != rtlpriv->dm.last_dtp_lvl)) {
+                RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+                         "PHY_SetTxPowerLevel8192S() Channel = %d\n",
+                          rtlphy->current_channel);
+                rtl88e_phy_set_txpower_level(hw, rtlphy->current_channel);
+        }
+
+        rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl;
+}
+
+void rtl88e_dm_write_dig(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
+
+        RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
+                 "cur_igvalue = 0x%x, "
+                  "pre_igvalue = 0x%x, back_val = %d\n",
+                  dm_dig->cur_igvalue, dm_dig->pre_igvalue,
+                  dm_dig->back_val);
+
+        if (dm_dig->cur_igvalue > 0x3f)
+                dm_dig->cur_igvalue = 0x3f;
+        if (dm_dig->pre_igvalue != dm_dig->cur_igvalue) {
+                rtl_set_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f,
+                              dm_dig->cur_igvalue);
+
+                dm_dig->pre_igvalue = dm_dig->cur_igvalue;
+        }
+}
+
+static void rtl88e_dm_pwdb_monitor(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_sta_info *drv_priv;
+        static u64 last_txok;
+        static u64 last_rx;
+        long tmp_entry_max_pwdb = 0, tmp_entry_min_pwdb = 0xff;
+
+        if (rtlhal->oem_id == RT_CID_819x_HP) {
+                u64 cur_txok_cnt = 0;
+                u64 cur_rxok_cnt = 0;
+                cur_txok_cnt = rtlpriv->stats.txbytesunicast - last_txok;
+                cur_rxok_cnt = rtlpriv->stats.rxbytesunicast - last_rx;
+                last_txok = cur_txok_cnt;
+                last_rx = cur_rxok_cnt;
+
+                if (cur_rxok_cnt > (cur_txok_cnt * 6))
+                        rtl_write_dword(rtlpriv, REG_ARFR0, 0x8f015);
+                else
+                        rtl_write_dword(rtlpriv, REG_ARFR0, 0xff015);
+        }
+
+        /* AP & ADHOC & MESH */
+        spin_lock_bh(&rtlpriv->locks.entry_list_lock);
+        list_for_each_entry(drv_priv, &rtlpriv->entry_list, list) {
+                if (drv_priv->rssi_stat.undec_sm_pwdb < tmp_entry_min_pwdb)
+                        tmp_entry_min_pwdb = drv_priv->rssi_stat.undec_sm_pwdb;
+                if (drv_priv->rssi_stat.undec_sm_pwdb > tmp_entry_max_pwdb)
+                        tmp_entry_max_pwdb = drv_priv->rssi_stat.undec_sm_pwdb;
+        }
+        spin_unlock_bh(&rtlpriv->locks.entry_list_lock);
+
+        /* If associated entry is found */
+        if (tmp_entry_max_pwdb != 0) {
+                rtlpriv->dm.entry_max_undec_sm_pwdb = tmp_entry_max_pwdb;
+                RTPRINT(rtlpriv, FDM, DM_PWDB, "EntryMaxPWDB = 0x%lx(%ld)\n",
+                        tmp_entry_max_pwdb, tmp_entry_max_pwdb);
+        } else {
+                rtlpriv->dm.entry_max_undec_sm_pwdb = 0;
+        }
+        /* If associated entry is found */
+        if (tmp_entry_min_pwdb != 0xff) {
+                rtlpriv->dm.entry_min_undec_sm_pwdb = tmp_entry_min_pwdb;
+                RTPRINT(rtlpriv, FDM, DM_PWDB, "EntryMinPWDB = 0x%lx(%ld)\n",
+                        tmp_entry_min_pwdb, tmp_entry_min_pwdb);
+        } else {
+                rtlpriv->dm.entry_min_undec_sm_pwdb = 0;
+        }
+        /* Indicate Rx signal strength to FW. */
+        if (!rtlpriv->dm.useramask)
+                rtl_write_byte(rtlpriv, 0x4fe, rtlpriv->dm.undec_sm_pwdb);
+}
+
+void rtl88e_dm_init_edca_turbo(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        rtlpriv->dm.current_turbo_edca = false;
+        rtlpriv->dm.is_any_nonbepkts = false;
+        rtlpriv->dm.is_cur_rdlstate = false;
+}
+
+static void rtl88e_dm_check_edca_turbo(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        static u64 last_txok_cnt;
+        static u64 last_rxok_cnt;
+        static u32 last_bt_edca_ul;
+        static u32 last_bt_edca_dl;
+        u64 cur_txok_cnt = 0;
+        u64 cur_rxok_cnt = 0;
+        u32 edca_be_ul = 0x5ea42b;
+        u32 edca_be_dl = 0x5ea42b;
+        bool change_edca = false;
+
+        if ((last_bt_edca_ul != rtlpcipriv->bt_coexist.bt_edca_ul) ||
+            (last_bt_edca_dl != rtlpcipriv->bt_coexist.bt_edca_dl)) {
+                rtlpriv->dm.current_turbo_edca = false;
+                last_bt_edca_ul = rtlpcipriv->bt_coexist.bt_edca_ul;
+                last_bt_edca_dl = rtlpcipriv->bt_coexist.bt_edca_dl;
+        }
+
+        if (rtlpcipriv->bt_coexist.bt_edca_ul != 0) {
+                edca_be_ul = rtlpcipriv->bt_coexist.bt_edca_ul;
+                change_edca = true;
+        }
+
+        if (rtlpcipriv->bt_coexist.bt_edca_dl != 0) {
+                edca_be_ul = rtlpcipriv->bt_coexist.bt_edca_dl;
+                change_edca = true;
+        }
+
+        if (mac->link_state != MAC80211_LINKED) {
+                rtlpriv->dm.current_turbo_edca = false;
+                return;
+        }
+
+        if ((!mac->ht_enable) && (!rtlpcipriv->bt_coexist.bt_coexistence)) {
+                if (!(edca_be_ul & 0xffff0000))
+                        edca_be_ul |= 0x005e0000;
+
+                if (!(edca_be_dl & 0xffff0000))
+                        edca_be_dl |= 0x005e0000;
+        }
+
+        if ((change_edca) || ((!rtlpriv->dm.is_any_nonbepkts) &&
+                              (!rtlpriv->dm.disable_framebursting))) {
+                cur_txok_cnt = rtlpriv->stats.txbytesunicast - last_txok_cnt;
+                cur_rxok_cnt = rtlpriv->stats.rxbytesunicast - last_rxok_cnt;
+
+                if (cur_rxok_cnt > 4 * cur_txok_cnt) {
+                        if (!rtlpriv->dm.is_cur_rdlstate ||
+                            !rtlpriv->dm.current_turbo_edca) {
+                                rtl_write_dword(rtlpriv,
+                                                REG_EDCA_BE_PARAM,
+                                                edca_be_dl);
+                                rtlpriv->dm.is_cur_rdlstate = true;
+                        }
+                } else {
+                        if (rtlpriv->dm.is_cur_rdlstate ||
+                            !rtlpriv->dm.current_turbo_edca) {
+                                rtl_write_dword(rtlpriv,
+                                                REG_EDCA_BE_PARAM,
+                                                edca_be_ul);
+                                rtlpriv->dm.is_cur_rdlstate = false;
+                        }
+                }
+                rtlpriv->dm.current_turbo_edca = true;
+        } else {
+                if (rtlpriv->dm.current_turbo_edca) {
+                        u8 tmp = AC0_BE;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                      HW_VAR_AC_PARAM,
+                                                      (u8 *)(&tmp));
+                        rtlpriv->dm.current_turbo_edca = false;
+                }
+        }
+
+        rtlpriv->dm.is_any_nonbepkts = false;
+        last_txok_cnt = rtlpriv->stats.txbytesunicast;
+        last_rxok_cnt = rtlpriv->stats.rxbytesunicast;
+}
+
+static void rtl88e_dm_txpower_tracking_callback_thermalmeter(struct ieee80211_hw
+                                                             *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct rtl_dm   *rtldm = rtl_dm(rtl_priv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u8 thermalvalue = 0, delta, delta_lck, delta_iqk, off;
+        u8 th_avg_cnt = 0;
+        u32 thermalvalue_avg = 0;
+        long  ele_d, temp_cck;
+        char ofdm_index[2], cck_index = 0, ofdm_old[2] = {0, 0}, cck_old = 0;
+        int i = 0;
+        bool is2t = false;
+
+        u8 ofdm_min_index = 6, rf = (is2t) ? 2 : 1;
+        u8 index_for_channel;
+        enum _dec_inc {dec, power_inc};
+
+        /* 0.1 the following TWO tables decide the final index of
+         * OFDM/CCK swing table
+         */
+        char del_tbl_idx[2][15] = {
+                {0, 0, 2, 3, 4, 4, 5, 6, 7, 7, 8, 9, 10, 10, 11},
+                {0, 0, -1, -2, -3, -4, -4, -4, -4, -5, -7, -8, -9, -9, -10}
+        };
+        u8 thermal_threshold[2][15] = {
+                {0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 27},
+                {0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 25, 25, 25}
+        };
+
+        /*Initilization (7 steps in total) */
+        rtlpriv->dm.txpower_trackinginit = true;
+        RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                 "rtl88e_dm_txpower_tracking_callback_thermalmeter\n");
+
+        thermalvalue = (u8) rtl_get_rfreg(hw, RF90_PATH_A, RF_T_METER, 0xfc00);
+        if (!thermalvalue)
+                return;
+        RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                 "Readback Thermal Meter = 0x%x pre thermal meter 0x%x eeprom_thermalmeter 0x%x\n",
+                 thermalvalue, rtlpriv->dm.thermalvalue,
+                 rtlefuse->eeprom_thermalmeter);
+
+        /*1. Query OFDM Default Setting: Path A*/
+        ele_d = rtl_get_bbreg(hw, ROFDM0_XATXIQIMBAL, MASKDWORD) & MASKOFDM_D;
+        for (i = 0; i < OFDM_TABLE_LENGTH; i++) {
+                if (ele_d == (ofdmswing_table[i] & MASKOFDM_D)) {
+                        ofdm_old[0] = (u8) i;
+                        rtldm->swing_idx_ofdm_base = (u8)i;
+                        RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                                 "Initial pathA ele_d reg0x%x = 0x%lx, ofdm_index = 0x%x\n",
+                                 ROFDM0_XATXIQIMBAL,
+                                 ele_d, ofdm_old[0]);
+                        break;
+                }
+        }
+
+        if (is2t) {
+                ele_d = rtl_get_bbreg(hw, ROFDM0_XBTXIQIMBAL,
+                                      MASKDWORD) & MASKOFDM_D;
+                for (i = 0; i < OFDM_TABLE_LENGTH; i++) {
+                        if (ele_d == (ofdmswing_table[i] & MASKOFDM_D)) {
+                                ofdm_old[1] = (u8)i;
+
+                                RT_TRACE(rtlpriv, COMP_POWER_TRACKING,
+                                         DBG_LOUD,
+                                         "Initial pathB ele_d reg0x%x = 0x%lx, ofdm_index = 0x%x\n",
+                                         ROFDM0_XBTXIQIMBAL, ele_d,
+                                         ofdm_old[1]);
+                                break;
+                        }
+                }
+        }
+        /*2.Query CCK default setting From 0xa24*/
+        temp_cck = rtl_get_bbreg(hw, RCCK0_TXFILTER2, MASKDWORD) & MASKCCK;
+        for (i = 0; i < CCK_TABLE_LENGTH; i++) {
+                if (rtlpriv->dm.cck_inch14) {
+                        if (memcmp(&temp_cck, &cck_tbl_ch14[i][2], 4) == 0) {
+                                cck_old = (u8)i;
+                                rtldm->swing_idx_cck_base = (u8)i;
+                                RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                                         "Initial reg0x%x = 0x%lx, cck_index = 0x%x, ch 14 %d\n",
+                                         RCCK0_TXFILTER2, temp_cck, cck_old,
+                                         rtlpriv->dm.cck_inch14);
+                                break;
+                        }
+                } else {
+                        if (memcmp(&temp_cck, &cck_tbl_ch1_13[i][2], 4) == 0) {
+                                cck_old = (u8)i;
+                                rtldm->swing_idx_cck_base = (u8)i;
+                                RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                                         "Initial reg0x%x = 0x%lx, cck_index = 0x%x, ch14 %d\n",
+                                         RCCK0_TXFILTER2, temp_cck, cck_old,
+                                         rtlpriv->dm.cck_inch14);
+                                break;
+                        }
+                }
+        }
+
+        /*3 Initialize ThermalValues of RFCalibrateInfo*/
+        if (!rtldm->thermalvalue) {
+                rtlpriv->dm.thermalvalue = rtlefuse->eeprom_thermalmeter;
+                rtlpriv->dm.thermalvalue_lck = thermalvalue;
+                rtlpriv->dm.thermalvalue_iqk = thermalvalue;
+                for (i = 0; i < rf; i++)
+                        rtlpriv->dm.ofdm_index[i] = ofdm_old[i];
+                rtlpriv->dm.cck_index = cck_old;
+        }
+
+        /*4 Calculate average thermal meter*/
+        rtldm->thermalvalue_avg[rtldm->thermalvalue_avg_index] = thermalvalue;
+        rtldm->thermalvalue_avg_index++;
+        if (rtldm->thermalvalue_avg_index == AVG_THERMAL_NUM_88E)
+                rtldm->thermalvalue_avg_index = 0;
+
+        for (i = 0; i < AVG_THERMAL_NUM_88E; i++) {
+                if (rtldm->thermalvalue_avg[i]) {
+                        thermalvalue_avg += rtldm->thermalvalue_avg[i];
+                        th_avg_cnt++;
+                }
+        }
+
+        if (th_avg_cnt)
+                thermalvalue = (u8)(thermalvalue_avg / th_avg_cnt);
+
+        /* 5 Calculate delta, delta_LCK, delta_IQK.*/
+        if (rtlhal->reloadtxpowerindex) {
+                delta = (thermalvalue > rtlefuse->eeprom_thermalmeter) ?
+                    (thermalvalue - rtlefuse->eeprom_thermalmeter) :
+                    (rtlefuse->eeprom_thermalmeter - thermalvalue);
+                rtlhal->reloadtxpowerindex = false;
+                rtlpriv->dm.done_txpower = false;
+        } else if (rtlpriv->dm.done_txpower) {
+                delta = (thermalvalue > rtlpriv->dm.thermalvalue) ?
+                        (thermalvalue - rtlpriv->dm.thermalvalue) :
+                        (rtlpriv->dm.thermalvalue - thermalvalue);
+        } else {
+                delta = (thermalvalue > rtlefuse->eeprom_thermalmeter) ?
+                        (thermalvalue - rtlefuse->eeprom_thermalmeter) :
+                        (rtlefuse->eeprom_thermalmeter - thermalvalue);
+        }
+        delta_lck = (thermalvalue > rtlpriv->dm.thermalvalue_lck) ?
+                    (thermalvalue - rtlpriv->dm.thermalvalue_lck) :
+                    (rtlpriv->dm.thermalvalue_lck - thermalvalue);
+        delta_iqk = (thermalvalue > rtlpriv->dm.thermalvalue_iqk) ?
+                    (thermalvalue - rtlpriv->dm.thermalvalue_iqk) :
+                    (rtlpriv->dm.thermalvalue_iqk - thermalvalue);
+
+        RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                 "Readback Thermal Meter = 0x%x pre thermal meter 0x%x "
+                 "eeprom_thermalmeter 0x%x delta 0x%x "
+                 "delta_lck 0x%x delta_iqk 0x%x\n",
+                 thermalvalue, rtlpriv->dm.thermalvalue,
+                 rtlefuse->eeprom_thermalmeter, delta, delta_lck,
+                 delta_iqk);
+        /* 6 If necessary, do LCK.*/
+        if (delta_lck >= 8) {
+                rtlpriv->dm.thermalvalue_lck = thermalvalue;
+                rtl88e_phy_lc_calibrate(hw);
+        }
+
+        /* 7 If necessary, move the index of swing table to adjust Tx power. */
+        if (delta > 0 && rtlpriv->dm.txpower_track_control) {
+                delta = (thermalvalue > rtlefuse->eeprom_thermalmeter) ?
+                        (thermalvalue - rtlefuse->eeprom_thermalmeter) :
+                        (rtlefuse->eeprom_thermalmeter - thermalvalue);
+
+                /* 7.1 Get the final CCK_index and OFDM_index for each
+                 * swing table.
+                 */
+                if (thermalvalue > rtlefuse->eeprom_thermalmeter) {
+                        CAL_SWING_OFF(off, power_inc, IDX_MAP, delta);
+                        for (i = 0; i < rf; i++)
+                                ofdm_index[i] = rtldm->ofdm_index[i] +
+                                                del_tbl_idx[power_inc][off];
+                        cck_index = rtldm->cck_index +
+                                    del_tbl_idx[power_inc][off];
+                } else {
+                        CAL_SWING_OFF(off, dec, IDX_MAP, delta);
+                        for (i = 0; i < rf; i++)
+                                ofdm_index[i] = rtldm->ofdm_index[i] +
+                                                del_tbl_idx[dec][off];
+                        cck_index = rtldm->cck_index + del_tbl_idx[dec][off];
+                }
+
+                /* 7.2 Handle boundary conditions of index.*/
+                for (i = 0; i < rf; i++) {
+                        if (ofdm_index[i] > OFDM_TABLE_SIZE-1)
+                                ofdm_index[i] = OFDM_TABLE_SIZE-1;
+                        else if (rtldm->ofdm_index[i] < ofdm_min_index)
+                                ofdm_index[i] = ofdm_min_index;
+                }
+
+                if (cck_index > CCK_TABLE_SIZE - 1)
+                        cck_index = CCK_TABLE_SIZE - 1;
+                else if (cck_index < 0)
+                        cck_index = 0;
+
+                /*7.3Configure the Swing Table to adjust Tx Power.*/
+                if (rtlpriv->dm.txpower_track_control) {
+                        rtldm->done_txpower = true;
+                        rtldm->swing_idx_ofdm[RF90_PATH_A] =
+                                 (u8)ofdm_index[RF90_PATH_A];
+                        if (is2t)
+                                rtldm->swing_idx_ofdm[RF90_PATH_B] =
+                                         (u8)ofdm_index[RF90_PATH_B];
+                        rtldm->swing_idx_cck = cck_index;
+                        if (rtldm->swing_idx_ofdm_cur !=
+                            rtldm->swing_idx_ofdm[0]) {
+                                rtldm->swing_idx_ofdm_cur =
+                                         rtldm->swing_idx_ofdm[0];
+                                rtldm->swing_flag_ofdm = true;
+                        }
+
+                        if (rtldm->swing_idx_cck != rtldm->swing_idx_cck) {
+                                rtldm->swing_idx_cck_cur = rtldm->swing_idx_cck;
+                                rtldm->swing_flag_cck = true;
+                        }
+
+                        rtl88e_chk_tx_track(hw, TXAGC, 0, 0);
+
+                        if (is2t)
+                                rtl88e_chk_tx_track(hw, BBSWING,
+                                                    RF90_PATH_B,
+                                                    index_for_channel);
+                }
+        }
+
+        if (delta_iqk >= 8) {
+                rtlpriv->dm.thermalvalue_iqk = thermalvalue;
+                rtl88e_phy_iq_calibrate(hw, false);
+        }
+
+        if (rtldm->txpower_track_control)
+                rtldm->thermalvalue = thermalvalue;
+        rtldm->txpowercount = 0;
+        RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, "end\n");
+}
+
+static void rtl88e_dm_init_txpower_tracking(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        rtlpriv->dm.txpower_tracking = true;
+        rtlpriv->dm.txpower_trackinginit = false;
+        rtlpriv->dm.txpowercount = 0;
+        rtlpriv->dm.txpower_track_control = true;
+
+        rtlpriv->dm.swing_idx_ofdm[RF90_PATH_A] = 12;
+        rtlpriv->dm.swing_idx_ofdm_cur = 12;
+        rtlpriv->dm.swing_flag_ofdm = false;
+        RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                 "  rtlpriv->dm.txpower_tracking = %d\n",
+                 rtlpriv->dm.txpower_tracking);
+}
+
+void rtl88e_dm_check_txpower_tracking(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        static u8 tm_trigger;
+
+        if (!rtlpriv->dm.txpower_tracking)
+                return;
+
+        if (!tm_trigger) {
+                rtl_set_rfreg(hw, RF90_PATH_A, RF_T_METER, BIT(17)|BIT(16),
+                              0x03);
+                RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                         "Trigger 88E Thermal Meter!!\n");
+                tm_trigger = 1;
+                return;
+        } else {
+                RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                         "Schedule TxPowerTracking !!\n");
+                rtl88e_dm_txpower_tracking_callback_thermalmeter(hw);
+                tm_trigger = 0;
+        }
+}
+
+void rtl88e_dm_init_rate_adaptive_mask(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rate_adaptive *p_ra = &(rtlpriv->ra);
+
+        p_ra->ratr_state = DM_RATR_STA_INIT;
+        p_ra->pre_ratr_state = DM_RATR_STA_INIT;
+
+        if (rtlpriv->dm.dm_type == DM_TYPE_BYDRIVER)
+                rtlpriv->dm.useramask = true;
+        else
+                rtlpriv->dm.useramask = false;
+}
+
+static void rtl88e_dm_refresh_rate_adaptive_mask(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rate_adaptive *p_ra = &(rtlpriv->ra);
+        struct ieee80211_sta *sta = NULL;
+        u32 low_rssi, hi_rssi;
+
+        if (is_hal_stop(rtlhal)) {
+                RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                         "driver is going to unload\n");
+                return;
+        }
+
+        if (!rtlpriv->dm.useramask) {
+                RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                         "driver does not control rate adaptive mask\n");
+                return;
+        }
+
+        if (mac->link_state == MAC80211_LINKED &&
+            mac->opmode == NL80211_IFTYPE_STATION) {
+                switch (p_ra->pre_ratr_state) {
+                case DM_RATR_STA_HIGH:
+                        hi_rssi = 50;
+                        low_rssi = 20;
+                        break;
+                case DM_RATR_STA_MIDDLE:
+                        hi_rssi = 55;
+                        low_rssi = 20;
+                        break;
+                case DM_RATR_STA_LOW:
+                        hi_rssi = 50;
+                        low_rssi = 25;
+                        break;
+                default:
+                        hi_rssi = 50;
+                        low_rssi = 20;
+                        break;
+                }
+
+                if (rtlpriv->dm.undec_sm_pwdb > (long)hi_rssi)
+                        p_ra->ratr_state = DM_RATR_STA_HIGH;
+                else if (rtlpriv->dm.undec_sm_pwdb > (long)low_rssi)
+                        p_ra->ratr_state = DM_RATR_STA_MIDDLE;
+                else
+                        p_ra->ratr_state = DM_RATR_STA_LOW;
+
+                if (p_ra->pre_ratr_state != p_ra->ratr_state) {
+                        RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                                 "RSSI = %ld\n",
+                                 rtlpriv->dm.undec_sm_pwdb);
+                        RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                                 "RSSI_LEVEL = %d\n", p_ra->ratr_state);
+                        RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                                 "PreState = %d, CurState = %d\n",
+                                  p_ra->pre_ratr_state, p_ra->ratr_state);
+
+                        rcu_read_lock();
+                        sta = rtl_find_sta(hw, mac->bssid);
+                        if (sta)
+                                rtlpriv->cfg->ops->update_rate_tbl(hw, sta,
+                                                   p_ra->ratr_state);
+                        rcu_read_unlock();
+
+                        p_ra->pre_ratr_state = p_ra->ratr_state;
+                }
+        }
+}
+
+static void rtl92c_dm_init_dynamic_bb_powersaving(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct ps_t *dm_pstable = &rtlpriv->dm_pstable;
+
+        dm_pstable->pre_ccastate = CCA_MAX;
+        dm_pstable->cur_ccasate = CCA_MAX;
+        dm_pstable->pre_rfstate = RF_MAX;
+        dm_pstable->cur_rfstate = RF_MAX;
+        dm_pstable->rssi_val_min = 0;
+}
+
+static void rtl88e_dm_update_rx_idle_ant(struct ieee80211_hw *hw, u8 ant)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct fast_ant_training *fat_tbl = &(rtldm->fat_table);
+        u32 def_ant, opt_ant;
+
+        if (fat_tbl->rx_idle_ant != ant) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                         "need to update rx idle ant\n");
+                if (ant == MAIN_ANT) {
+                        def_ant = (fat_tbl->rx_idle_ant == CG_TRX_HW_ANTDIV) ?
+                                   MAIN_ANT_CG_TRX : MAIN_ANT_CGCS_RX;
+                        opt_ant = (fat_tbl->rx_idle_ant == CG_TRX_HW_ANTDIV) ?
+                                   AUX_ANT_CG_TRX : AUX_ANT_CGCS_RX;
+                } else {
+                        def_ant = (fat_tbl->rx_idle_ant == CG_TRX_HW_ANTDIV) ?
+                                   AUX_ANT_CG_TRX : AUX_ANT_CGCS_RX;
+                        opt_ant = (fat_tbl->rx_idle_ant == CG_TRX_HW_ANTDIV) ?
+                                   MAIN_ANT_CG_TRX : MAIN_ANT_CGCS_RX;
+                }
+
+                if (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV) {
+                        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(5) |
+                                      BIT(4) | BIT(3), def_ant);
+                        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(8) |
+                                      BIT(7) | BIT(6), opt_ant);
+                        rtl_set_bbreg(hw, DM_REG_ANTSEL_CTRL_11N, BIT(14) |
+                                      BIT(13) | BIT(12), def_ant);
+                        rtl_set_bbreg(hw, DM_REG_RESP_TX_11N, BIT(6) | BIT(7),
+                                      def_ant);
+                } else if (rtlefuse->antenna_div_type == CGCS_RX_HW_ANTDIV) {
+                        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(5) |
+                                      BIT(4) | BIT(3), def_ant);
+                        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(8) |
+                                      BIT(7) | BIT(6), opt_ant);
+                }
+        }
+        fat_tbl->rx_idle_ant = ant;
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "RxIdleAnt %s\n",
+                 ((ant == MAIN_ANT) ? ("MAIN_ANT") : ("AUX_ANT")));
+}
+
+static void rtl88e_dm_update_tx_ant(struct ieee80211_hw *hw,
+        u8 ant, u32 mac_id)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct fast_ant_training *fat_tbl = &(rtldm->fat_table);
+        u8 target_ant;
+
+        if (ant == MAIN_ANT)
+                target_ant = MAIN_ANT_CG_TRX;
+        else
+                target_ant = AUX_ANT_CG_TRX;
+
+        fat_tbl->antsel_a[mac_id] = target_ant & BIT(0);
+        fat_tbl->antsel_b[mac_id] = (target_ant & BIT(1)) >> 1;
+        fat_tbl->antsel_c[mac_id] = (target_ant & BIT(2)) >> 2;
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "txfrominfo target ant %s\n",
+                 ((ant == MAIN_ANT) ? ("MAIN_ANT") : ("AUX_ANT")));
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "antsel_tr_mux = 3'b%d%d%d\n",
+                 fat_tbl->antsel_c[mac_id],
+                 fat_tbl->antsel_b[mac_id], fat_tbl->antsel_a[mac_id]);
+}
+
+static void rtl88e_dm_rx_hw_antena_div_init(struct ieee80211_hw *hw)
+{
+        u32  value32;
+        /*MAC Setting*/
+        value32 = rtl_get_bbreg(hw, DM_REG_ANTSEL_PIN_11N, MASKDWORD);
+        rtl_set_bbreg(hw, DM_REG_ANTSEL_PIN_11N, MASKDWORD, value32 |
+                     (BIT(23) | BIT(25)));
+        /*Pin Setting*/
+        rtl_set_bbreg(hw, DM_REG_PIN_CTRL_11N, BIT(9) | BIT(8), 0);
+        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(10), 0);
+        rtl_set_bbreg(hw, DM_REG_LNA_SWITCH_11N, BIT(22), 1);
+        rtl_set_bbreg(hw, DM_REG_LNA_SWITCH_11N, BIT(31), 1);
+        /*OFDM Setting*/
+        rtl_set_bbreg(hw, DM_REG_ANTDIV_PARA1_11N, MASKDWORD, 0x000000a0);
+        /*CCK Setting*/
+        rtl_set_bbreg(hw, DM_REG_BB_PWR_SAV4_11N, BIT(7), 1);
+        rtl_set_bbreg(hw, DM_REG_CCK_ANTDIV_PARA2_11N, BIT(4), 1);
+        rtl88e_dm_update_rx_idle_ant(hw, MAIN_ANT);
+        rtl_set_bbreg(hw, DM_REG_ANT_MAPPING1_11N, MASKLWORD, 0x0201);
+}
+
+static void rtl88e_dm_trx_hw_antenna_div_init(struct ieee80211_hw *hw)
+{
+        u32  value32;
+
+        /*MAC Setting*/
+        value32 = rtl_get_bbreg(hw, DM_REG_ANTSEL_PIN_11N, MASKDWORD);
+        rtl_set_bbreg(hw, DM_REG_ANTSEL_PIN_11N, MASKDWORD, value32 |
+                     (BIT(23) | BIT(25)));
+        /*Pin Setting*/
+        rtl_set_bbreg(hw, DM_REG_PIN_CTRL_11N, BIT(9) | BIT(8), 0);
+        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(10), 0);
+        rtl_set_bbreg(hw, DM_REG_LNA_SWITCH_11N, BIT(22), 0);
+        rtl_set_bbreg(hw, DM_REG_LNA_SWITCH_11N, BIT(31), 1);
+        /*OFDM Setting*/
+        rtl_set_bbreg(hw, DM_REG_ANTDIV_PARA1_11N, MASKDWORD, 0x000000a0);
+        /*CCK Setting*/
+        rtl_set_bbreg(hw, DM_REG_BB_PWR_SAV4_11N, BIT(7), 1);
+        rtl_set_bbreg(hw, DM_REG_CCK_ANTDIV_PARA2_11N, BIT(4), 1);
+        /*TX Setting*/
+        rtl_set_bbreg(hw, DM_REG_TX_ANT_CTRL_11N, BIT(21), 0);
+        rtl88e_dm_update_rx_idle_ant(hw, MAIN_ANT);
+        rtl_set_bbreg(hw, DM_REG_ANT_MAPPING1_11N, MASKLWORD, 0x0201);
+}
+
+static void rtl88e_dm_fast_training_init(struct ieee80211_hw *hw)
+{
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct fast_ant_training *fat_tbl = &(rtldm->fat_table);
+        u32 ant_combo = 2;
+        u32 value32, i;
+
+        for (i = 0; i < 6; i++) {
+                fat_tbl->bssid[i] = 0;
+                fat_tbl->ant_sum[i] = 0;
+                fat_tbl->ant_cnt[i] = 0;
+                fat_tbl->ant_ave[i] = 0;
+        }
+        fat_tbl->train_idx = 0;
+        fat_tbl->fat_state = FAT_NORMAL_STATE;
+
+        /*MAC Setting*/
+        value32 = rtl_get_bbreg(hw, DM_REG_ANTSEL_PIN_11N, MASKDWORD);
+        rtl_set_bbreg(hw, DM_REG_ANTSEL_PIN_11N, MASKDWORD, value32 | (BIT(23) |
+                      BIT(25)));
+        value32 = rtl_get_bbreg(hw, DM_REG_ANT_TRAIN_2, MASKDWORD);
+        rtl_set_bbreg(hw, DM_REG_ANT_TRAIN_2, MASKDWORD, value32 | (BIT(16) |
+                      BIT(17)));
+        rtl_set_bbreg(hw, DM_REG_ANT_TRAIN_2, MASKLWORD, 0);
+        rtl_set_bbreg(hw, DM_REG_ANT_TRAIN_1, MASKDWORD, 0);
+
+        /*Pin Setting*/
+        rtl_set_bbreg(hw, DM_REG_PIN_CTRL_11N, BIT(9) | BIT(8), 0);
+        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(10), 0);
+        rtl_set_bbreg(hw, DM_REG_LNA_SWITCH_11N, BIT(22), 0);
+        rtl_set_bbreg(hw, DM_REG_LNA_SWITCH_11N, BIT(31), 1);
+
+        /*OFDM Setting*/
+        rtl_set_bbreg(hw, DM_REG_ANTDIV_PARA1_11N, MASKDWORD, 0x000000a0);
+        /*antenna mapping table*/
+        if (ant_combo == 2) {
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING1_11N, MASKBYTE0, 1);
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING1_11N, MASKBYTE1, 2);
+        } else if (ant_combo == 7) {
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING1_11N, MASKBYTE0, 1);
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING1_11N, MASKBYTE1, 2);
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING1_11N, MASKBYTE2, 2);
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING1_11N, MASKBYTE3, 3);
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING2_11N, MASKBYTE0, 4);
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING2_11N, MASKBYTE1, 5);
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING2_11N, MASKBYTE2, 6);
+                rtl_set_bbreg(hw, DM_REG_ANT_MAPPING2_11N, MASKBYTE3, 7);
+        }
+
+        /*TX Setting*/
+        rtl_set_bbreg(hw, DM_REG_TX_ANT_CTRL_11N, BIT(21), 1);
+        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(5) | BIT(4) | BIT(3), 0);
+        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(8) | BIT(7) | BIT(6), 1);
+        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(2) | BIT(1) | BIT(0),
+                      (ant_combo - 1));
+
+        rtl_set_bbreg(hw, DM_REG_IGI_A_11N, BIT(7), 1);
+}
+
+static void rtl88e_dm_antenna_div_init(struct ieee80211_hw *hw)
+{
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+
+        if (rtlefuse->antenna_div_type == CGCS_RX_HW_ANTDIV)
+                rtl88e_dm_rx_hw_antena_div_init(hw);
+        else if (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV)
+                rtl88e_dm_trx_hw_antenna_div_init(hw);
+        else if (rtlefuse->antenna_div_type == CG_TRX_SMART_ANTDIV)
+                rtl88e_dm_fast_training_init(hw);
+}
+
+void rtl88e_dm_set_tx_ant_by_tx_info(struct ieee80211_hw *hw,
+                                     u8 *pdesc, u32 mac_id)
+{
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct fast_ant_training *fat_tbl = &(rtldm->fat_table);
+
+        if ((rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV) ||
+            (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV)) {
+                SET_TX_DESC_ANTSEL_A(pdesc, fat_tbl->antsel_a[mac_id]);
+                SET_TX_DESC_ANTSEL_B(pdesc, fat_tbl->antsel_b[mac_id]);
+                SET_TX_DESC_ANTSEL_C(pdesc, fat_tbl->antsel_c[mac_id]);
+        }
+}
+
+void rtl88e_dm_ant_sel_statistics(struct ieee80211_hw *hw,
+                                  u8 antsel_tr_mux, u32 mac_id, u32 rx_pwdb_all)
+{
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct fast_ant_training *fat_tbl = &(rtldm->fat_table);
+
+        if (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV) {
+                if (antsel_tr_mux == MAIN_ANT_CG_TRX) {
+                        fat_tbl->main_ant_sum[mac_id] += rx_pwdb_all;
+                        fat_tbl->main_ant_cnt[mac_id]++;
+                } else {
+                        fat_tbl->aux_ant_sum[mac_id] += rx_pwdb_all;
+                        fat_tbl->aux_ant_cnt[mac_id]++;
+                }
+        } else if (rtlefuse->antenna_div_type == CGCS_RX_HW_ANTDIV) {
+                if (antsel_tr_mux == MAIN_ANT_CGCS_RX) {
+                        fat_tbl->main_ant_sum[mac_id] += rx_pwdb_all;
+                        fat_tbl->main_ant_cnt[mac_id]++;
+                } else {
+                        fat_tbl->aux_ant_sum[mac_id] += rx_pwdb_all;
+                        fat_tbl->aux_ant_cnt[mac_id]++;
+                }
+        }
+}
+
+static void rtl88e_dm_hw_ant_div(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct rtl_sta_info *drv_priv;
+        struct fast_ant_training *fat_tbl = &(rtldm->fat_table);
+        u32 i, min_rssi = 0xff, ant_div_max_rssi = 0, max_rssi = 0;
+        u32 local_min_rssi, local_max_rssi;
+        u32 main_rssi, aux_rssi;
+        u8 rx_idle_ant = 0, target_ant = 7;
+
+        i = 0;
+        main_rssi = (fat_tbl->main_ant_cnt[i] != 0) ?
+                    (fat_tbl->main_ant_sum[i] /
+                     fat_tbl->main_ant_cnt[i]) : 0;
+        aux_rssi = (fat_tbl->aux_ant_cnt[i] != 0) ?
+                (fat_tbl->aux_ant_sum[i] / fat_tbl->aux_ant_cnt[i]) : 0;
+        target_ant = (main_rssi == aux_rssi) ?
+                     fat_tbl->rx_idle_ant : ((main_rssi >= aux_rssi) ?
+                     MAIN_ANT : AUX_ANT);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "main_ant_sum %d main_ant_cnt %d\n",
+                 fat_tbl->main_ant_sum[i], fat_tbl->main_ant_cnt[i]);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "aux_ant_sum %d aux_ant_cnt %d\n",
+                 fat_tbl->aux_ant_sum[i],
+                 fat_tbl->aux_ant_cnt[i]);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "main_rssi %d aux_rssi%d\n", main_rssi, aux_rssi);
+        local_max_rssi = (main_rssi > aux_rssi) ? main_rssi : aux_rssi;
+        if ((local_max_rssi > ant_div_max_rssi) && (local_max_rssi < 40))
+                ant_div_max_rssi = local_max_rssi;
+        if (local_max_rssi > max_rssi)
+                max_rssi = local_max_rssi;
+
+        if ((fat_tbl->rx_idle_ant == MAIN_ANT) && (main_rssi == 0))
+                main_rssi = aux_rssi;
+        else if ((fat_tbl->rx_idle_ant == AUX_ANT) && (aux_rssi == 0))
+                aux_rssi = main_rssi;
+
+        local_min_rssi = (main_rssi > aux_rssi) ? aux_rssi : main_rssi;
+        if (local_min_rssi < min_rssi) {
+                min_rssi = local_min_rssi;
+                rx_idle_ant = target_ant;
+        }
+        if (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV)
+                rtl88e_dm_update_tx_ant(hw, target_ant, i);
+
+        if (rtlpriv->mac80211.opmode == NL80211_IFTYPE_AP ||
+            rtlpriv->mac80211.opmode == NL80211_IFTYPE_ADHOC) {
+                spin_lock_bh(&rtlpriv->locks.entry_list_lock);
+                list_for_each_entry(drv_priv, &rtlpriv->entry_list, list) {
+                        i++;
+                        main_rssi = (fat_tbl->main_ant_cnt[i] != 0) ?
+                                (fat_tbl->main_ant_sum[i] /
+                                 fat_tbl->main_ant_cnt[i]) : 0;
+                        aux_rssi = (fat_tbl->aux_ant_cnt[i] != 0) ?
+                                   (fat_tbl->aux_ant_sum[i] /
+                                    fat_tbl->aux_ant_cnt[i]) : 0;
+                        target_ant = (main_rssi == aux_rssi) ?
+                                      fat_tbl->rx_idle_ant : ((main_rssi >=
+                                      aux_rssi) ? MAIN_ANT : AUX_ANT);
+
+
+                        local_max_rssi = max_t(u32, main_rssi, aux_rssi);
+                        if ((local_max_rssi > ant_div_max_rssi) &&
+                            (local_max_rssi < 40))
+                                ant_div_max_rssi = local_max_rssi;
+                        if (local_max_rssi > max_rssi)
+                                max_rssi = local_max_rssi;
+
+                        if ((fat_tbl->rx_idle_ant == MAIN_ANT) && !main_rssi)
+                                main_rssi = aux_rssi;
+                        else if ((fat_tbl->rx_idle_ant == AUX_ANT) &&
+                                 (aux_rssi == 0))
+                                aux_rssi = main_rssi;
+
+                        local_min_rssi = (main_rssi > aux_rssi) ?
+                                          aux_rssi : main_rssi;
+                        if (local_min_rssi < min_rssi) {
+                                min_rssi = local_min_rssi;
+                                rx_idle_ant = target_ant;
+                        }
+                        if (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV)
+                                rtl88e_dm_update_tx_ant(hw, target_ant, i);
+                }
+                spin_unlock_bh(&rtlpriv->locks.entry_list_lock);
+        }
+
+        for (i = 0; i < ASSOCIATE_ENTRY_NUM; i++) {
+                fat_tbl->main_ant_sum[i] = 0;
+                fat_tbl->aux_ant_sum[i] = 0;
+                fat_tbl->main_ant_cnt[i] = 0;
+                fat_tbl->aux_ant_cnt[i] = 0;
+        }
+
+        rtl88e_dm_update_rx_idle_ant(hw, rx_idle_ant);
+
+        dm_dig->antdiv_rssi_max = ant_div_max_rssi;
+        dm_dig->rssi_max = max_rssi;
+}
+
+static void rtl88e_set_next_mac_address_target(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct rtl_sta_info *drv_priv;
+        struct fast_ant_training *fat_tbl = &(rtldm->fat_table);
+        u32 value32, i, j = 0;
+
+        if (mac->link_state >= MAC80211_LINKED) {
+                for (i = 0; i < ASSOCIATE_ENTRY_NUM; i++) {
+                        if ((fat_tbl->train_idx + 1) == ASSOCIATE_ENTRY_NUM)
+                                fat_tbl->train_idx = 0;
+                        else
+                                fat_tbl->train_idx++;
+
+                        if (fat_tbl->train_idx == 0) {
+                                value32 = (mac->mac_addr[5] << 8) |
+                                           mac->mac_addr[4];
+                                rtl_set_bbreg(hw, DM_REG_ANT_TRAIN_2,
+                                              MASKLWORD, value32);
+
+                                value32 = (mac->mac_addr[3] << 24) |
+                                          (mac->mac_addr[2] << 16) |
+                                          (mac->mac_addr[1] << 8) |
+                                           mac->mac_addr[0];
+                                rtl_set_bbreg(hw, DM_REG_ANT_TRAIN_1,
+                                              MASKDWORD, value32);
+                                break;
+                        }
+
+                        if (rtlpriv->mac80211.opmode !=
+                            NL80211_IFTYPE_STATION) {
+                                spin_lock_bh(&rtlpriv->locks.entry_list_lock);
+                                list_for_each_entry(drv_priv,
+                                                    &rtlpriv->entry_list,
+                                                    list) {
+                                        j++;
+                                        if (j != fat_tbl->train_idx)
+                                                continue;
+
+                                        value32 = (drv_priv->mac_addr[5] << 8) |
+                                                   drv_priv->mac_addr[4];
+                                        rtl_set_bbreg(hw, DM_REG_ANT_TRAIN_2,
+                                                      MASKLWORD, value32);
+
+                                        value32 = (drv_priv->mac_addr[3]<<24) |
+                                                  (drv_priv->mac_addr[2]<<16) |
+                                                  (drv_priv->mac_addr[1]<<8) |
+                                                   drv_priv->mac_addr[0];
+                                        rtl_set_bbreg(hw, DM_REG_ANT_TRAIN_1,
+                                                      MASKDWORD, value32);
+                                        break;
+                                }
+                                spin_unlock_bh(&rtlpriv->locks.entry_list_lock);
+                                /*find entry, break*/
+                                if (j == fat_tbl->train_idx)
+                                        break;
+                        }
+                }
+        }
+}
+
+static void rtl88e_dm_fast_ant_training(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct fast_ant_training *fat_tbl = &(rtldm->fat_table);
+        u32 i, max_rssi = 0;
+        u8 target_ant = 2;
+        bool bpkt_filter_match = false;
+
+        if (fat_tbl->fat_state == FAT_TRAINING_STATE) {
+                for (i = 0; i < 7; i++) {
+                        if (fat_tbl->ant_cnt[i] == 0) {
+                                fat_tbl->ant_ave[i] = 0;
+                        } else {
+                                fat_tbl->ant_ave[i] = fat_tbl->ant_sum[i] /
+                                        fat_tbl->ant_cnt[i];
+                                bpkt_filter_match = true;
+                        }
+
+                        if (fat_tbl->ant_ave[i] > max_rssi) {
+                                max_rssi = fat_tbl->ant_ave[i];
+                                target_ant = (u8) i;
+                        }
+                }
+
+                if (bpkt_filter_match == false) {
+                        rtl_set_bbreg(hw, DM_REG_TXAGC_A_1_MCS32_11N,
+                                      BIT(16), 0);
+                        rtl_set_bbreg(hw, DM_REG_IGI_A_11N, BIT(7), 0);
+                } else {
+                        rtl_set_bbreg(hw, DM_REG_TXAGC_A_1_MCS32_11N,
+                                      BIT(16), 0);
+                        rtl_set_bbreg(hw, DM_REG_RX_ANT_CTRL_11N, BIT(8) |
+                                      BIT(7) | BIT(6), target_ant);
+                        rtl_set_bbreg(hw, DM_REG_TX_ANT_CTRL_11N, BIT(21), 1);
+
+                        fat_tbl->antsel_a[fat_tbl->train_idx] =
+                                  target_ant & BIT(0);
+                        fat_tbl->antsel_b[fat_tbl->train_idx] =
+                                 (target_ant & BIT(1)) >> 1;
+                        fat_tbl->antsel_c[fat_tbl->train_idx] =
+                                 (target_ant & BIT(2)) >> 2;
+
+                        if (target_ant == 0)
+                                rtl_set_bbreg(hw, DM_REG_IGI_A_11N, BIT(7), 0);
+                }
+
+                for (i = 0; i < 7; i++) {
+                        fat_tbl->ant_sum[i] = 0;
+                        fat_tbl->ant_cnt[i] = 0;
+                }
+
+                fat_tbl->fat_state = FAT_NORMAL_STATE;
+                return;
+        }
+
+        if (fat_tbl->fat_state == FAT_NORMAL_STATE) {
+                rtl88e_set_next_mac_address_target(hw);
+
+                fat_tbl->fat_state = FAT_TRAINING_STATE;
+                rtl_set_bbreg(hw, DM_REG_TXAGC_A_1_MCS32_11N, BIT(16), 1);
+                rtl_set_bbreg(hw, DM_REG_IGI_A_11N, BIT(7), 1);
+
+                mod_timer(&rtlpriv->works.fast_antenna_training_timer,
+                          jiffies + MSECS(RTL_WATCH_DOG_TIME));
+        }
+}
+
+void rtl88e_dm_fast_antenna_training_callback(unsigned long data)
+{
+        struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+
+        rtl88e_dm_fast_ant_training(hw);
+}
+
+static void rtl88e_dm_antenna_diversity(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct fast_ant_training *fat_tbl = &(rtldm->fat_table);
+
+        if (mac->link_state < MAC80211_LINKED) {
+                RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD, "No Link\n");
+                if (fat_tbl->becomelinked == true) {
+                        RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
+                                 "need to turn off HW AntDiv\n");
+                        rtl_set_bbreg(hw, DM_REG_IGI_A_11N, BIT(7), 0);
+                        rtl_set_bbreg(hw, DM_REG_CCK_ANTDIV_PARA1_11N,
+                                      BIT(15), 0);
+                        if (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV)
+                                rtl_set_bbreg(hw, DM_REG_TX_ANT_CTRL_11N,
+                                              BIT(21), 0);
+                        fat_tbl->becomelinked =
+                          (mac->link_state == MAC80211_LINKED) ? true : false;
+                }
+                return;
+        } else {
+                if (fat_tbl->becomelinked == false) {
+                        RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
+                                 "Need to turn on HW AntDiv\n");
+                        rtl_set_bbreg(hw, DM_REG_IGI_A_11N, BIT(7), 1);
+                        rtl_set_bbreg(hw, DM_REG_CCK_ANTDIV_PARA1_11N,
+                                      BIT(15), 1);
+                        if (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV)
+                                rtl_set_bbreg(hw, DM_REG_TX_ANT_CTRL_11N,
+                                              BIT(21), 1);
+                        fat_tbl->becomelinked =
+                           (mac->link_state >= MAC80211_LINKED) ? true : false;
+                }
+        }
+
+        if ((rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV) ||
+            (rtlefuse->antenna_div_type == CGCS_RX_HW_ANTDIV))
+                rtl88e_dm_hw_ant_div(hw);
+        else if (rtlefuse->antenna_div_type == CG_TRX_SMART_ANTDIV)
+                rtl88e_dm_fast_ant_training(hw);
+}
+
+void rtl88e_dm_init(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
+        rtl88e_dm_diginit(hw);
+        rtl88e_dm_init_dynamic_txpower(hw);
+        rtl88e_dm_init_edca_turbo(hw);
+        rtl88e_dm_init_rate_adaptive_mask(hw);
+        rtl88e_dm_init_txpower_tracking(hw);
+        rtl92c_dm_init_dynamic_bb_powersaving(hw);
+        rtl88e_dm_antenna_div_init(hw);
+}
+
+void rtl88e_dm_watchdog(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        bool fw_current_inpsmode = false;
+        bool fw_ps_awake = true;
+
+        rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_FW_PSMODE_STATUS,
+                                      (u8 *)(&fw_current_inpsmode));
+        rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_FWLPS_RF_ON,
+                                      (u8 *)(&fw_ps_awake));
+        if (ppsc->p2p_ps_info.p2p_ps_mode)
+                fw_ps_awake = false;
+
+        if ((ppsc->rfpwr_state == ERFON) &&
+            ((!fw_current_inpsmode) && fw_ps_awake) &&
+            (!ppsc->rfchange_inprogress)) {
+                rtl88e_dm_pwdb_monitor(hw);
+                rtl88e_dm_dig(hw);
+                rtl88e_dm_false_alarm_counter_statistics(hw);
+                rtl92c_dm_dynamic_txpower(hw);
+                rtl88e_dm_check_txpower_tracking(hw);
+                rtl88e_dm_refresh_rate_adaptive_mask(hw);
+                rtl88e_dm_check_edca_turbo(hw);
+                rtl88e_dm_antenna_diversity(hw);
+        }
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
new file mode 100644
index 000000000000..0e07f72ea158
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
@@ -0,0 +1,326 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL88E_DM_H__
+#define __RTL88E_DM_H__
+
+#define MAIN_ANT                                        0
+#define AUX_ANT                                         1
+#define MAIN_ANT_CG_TRX                                 1
+#define AUX_ANT_CG_TRX                                  0
+#define MAIN_ANT_CGCS_RX                                0
+#define AUX_ANT_CGCS_RX                                 1
+
+/*RF REG LIST*/
+#define DM_REG_RF_MODE_11N                              0x00
+#define DM_REG_RF_0B_11N                                0x0B
+#define DM_REG_CHNBW_11N                                0x18
+#define DM_REG_T_METER_11N                              0x24
+#define DM_REG_RF_25_11N                                0x25
+#define DM_REG_RF_26_11N                                0x26
+#define DM_REG_RF_27_11N                                0x27
+#define DM_REG_RF_2B_11N                                0x2B
+#define DM_REG_RF_2C_11N                                0x2C
+#define DM_REG_RXRF_A3_11N                              0x3C
+#define DM_REG_T_METER_92D_11N                          0x42
+#define DM_REG_T_METER_88E_11N                          0x42
+
+/*BB REG LIST*/
+/*PAGE 8 */
+#define DM_REG_BB_CTRL_11N                              0x800
+#define DM_REG_RF_PIN_11N                               0x804
+#define DM_REG_PSD_CTRL_11N                             0x808
+#define DM_REG_TX_ANT_CTRL_11N                          0x80C
+#define DM_REG_BB_PWR_SAV5_11N                          0x818
+#define DM_REG_CCK_RPT_FORMAT_11N                       0x824
+#define DM_REG_RX_DEFAULT_A_11N                         0x858
+#define DM_REG_RX_DEFAULT_B_11N                         0x85A
+#define DM_REG_BB_PWR_SAV3_11N                          0x85C
+#define DM_REG_ANTSEL_CTRL_11N                          0x860
+#define DM_REG_RX_ANT_CTRL_11N                          0x864
+#define DM_REG_PIN_CTRL_11N                             0x870
+#define DM_REG_BB_PWR_SAV1_11N                          0x874
+#define DM_REG_ANTSEL_PATH_11N                          0x878
+#define DM_REG_BB_3WIRE_11N                             0x88C
+#define DM_REG_SC_CNT_11N                               0x8C4
+#define DM_REG_PSD_DATA_11N                             0x8B4
+/*PAGE 9*/
+#define DM_REG_ANT_MAPPING1_11N                         0x914
+#define DM_REG_ANT_MAPPING2_11N                         0x918
+/*PAGE A*/
+#define DM_REG_CCK_ANTDIV_PARA1_11N                     0xA00
+#define DM_REG_CCK_CCA_11N                              0xA0A
+#define DM_REG_CCK_ANTDIV_PARA2_11N                     0xA0C
+#define DM_REG_CCK_ANTDIV_PARA3_11N                     0xA10
+#define DM_REG_CCK_ANTDIV_PARA4_11N                     0xA14
+#define DM_REG_CCK_FILTER_PARA1_11N                     0xA22
+#define DM_REG_CCK_FILTER_PARA2_11N                     0xA23
+#define DM_REG_CCK_FILTER_PARA3_11N                     0xA24
+#define DM_REG_CCK_FILTER_PARA4_11N                     0xA25
+#define DM_REG_CCK_FILTER_PARA5_11N                     0xA26
+#define DM_REG_CCK_FILTER_PARA6_11N                     0xA27
+#define DM_REG_CCK_FILTER_PARA7_11N                     0xA28
+#define DM_REG_CCK_FILTER_PARA8_11N                     0xA29
+#define DM_REG_CCK_FA_RST_11N                           0xA2C
+#define DM_REG_CCK_FA_MSB_11N                           0xA58
+#define DM_REG_CCK_FA_LSB_11N                           0xA5C
+#define DM_REG_CCK_CCA_CNT_11N                          0xA60
+#define DM_REG_BB_PWR_SAV4_11N                          0xA74
+/*PAGE B */
+#define DM_REG_LNA_SWITCH_11N                           0xB2C
+#define DM_REG_PATH_SWITCH_11N                          0xB30
+#define DM_REG_RSSI_CTRL_11N                            0xB38
+#define DM_REG_CONFIG_ANTA_11N                          0xB68
+#define DM_REG_RSSI_BT_11N                              0xB9C
+/*PAGE C */
+#define DM_REG_OFDM_FA_HOLDC_11N                        0xC00
+#define DM_REG_RX_PATH_11N                              0xC04
+#define DM_REG_TRMUX_11N                                0xC08
+#define DM_REG_OFDM_FA_RSTC_11N                         0xC0C
+#define DM_REG_RXIQI_MATRIX_11N                         0xC14
+#define DM_REG_TXIQK_MATRIX_LSB1_11N                    0xC4C
+#define DM_REG_IGI_A_11N                                0xC50
+#define DM_REG_ANTDIV_PARA2_11N                         0xC54
+#define DM_REG_IGI_B_11N                                0xC58
+#define DM_REG_ANTDIV_PARA3_11N                         0xC5C
+#define DM_REG_BB_PWR_SAV2_11N                          0xC70
+#define DM_REG_RX_OFF_11N                               0xC7C
+#define DM_REG_TXIQK_MATRIXA_11N                        0xC80
+#define DM_REG_TXIQK_MATRIXB_11N                        0xC88
+#define DM_REG_TXIQK_MATRIXA_LSB2_11N                   0xC94
+#define DM_REG_TXIQK_MATRIXB_LSB2_11N                   0xC9C
+#define DM_REG_RXIQK_MATRIX_LSB_11N                     0xCA0
+#define DM_REG_ANTDIV_PARA1_11N                         0xCA4
+#define DM_REG_OFDM_FA_TYPE1_11N                        0xCF0
+/*PAGE D */
+#define DM_REG_OFDM_FA_RSTD_11N                         0xD00
+#define DM_REG_OFDM_FA_TYPE2_11N                        0xDA0
+#define DM_REG_OFDM_FA_TYPE3_11N                        0xDA4
+#define DM_REG_OFDM_FA_TYPE4_11N                        0xDA8
+/*PAGE E */
+#define DM_REG_TXAGC_A_6_18_11N                         0xE00
+#define DM_REG_TXAGC_A_24_54_11N                        0xE04
+#define DM_REG_TXAGC_A_1_MCS32_11N                      0xE08
+#define DM_REG_TXAGC_A_MCS0_3_11N                       0xE10
+#define DM_REG_TXAGC_A_MCS4_7_11N                       0xE14
+#define DM_REG_TXAGC_A_MCS8_11_11N                      0xE18
+#define DM_REG_TXAGC_A_MCS12_15_11N                     0xE1C
+#define DM_REG_FPGA0_IQK_11N                            0xE28
+#define DM_REG_TXIQK_TONE_A_11N                         0xE30
+#define DM_REG_RXIQK_TONE_A_11N                         0xE34
+#define DM_REG_TXIQK_PI_A_11N                           0xE38
+#define DM_REG_RXIQK_PI_A_11N                           0xE3C
+#define DM_REG_TXIQK_11N                                0xE40
+#define DM_REG_RXIQK_11N                                0xE44
+#define DM_REG_IQK_AGC_PTS_11N                          0xE48
+#define DM_REG_IQK_AGC_RSP_11N                          0xE4C
+#define DM_REG_BLUETOOTH_11N                            0xE6C
+#define DM_REG_RX_WAIT_CCA_11N                          0xE70
+#define DM_REG_TX_CCK_RFON_11N                          0xE74
+#define DM_REG_TX_CCK_BBON_11N                          0xE78
+#define DM_REG_OFDM_RFON_11N                            0xE7C
+#define DM_REG_OFDM_BBON_11N                            0xE80
+#define DM_REG_TX2RX_11N                                0xE84
+#define DM_REG_TX2TX_11N                                0xE88
+#define DM_REG_RX_CCK_11N                               0xE8C
+#define DM_REG_RX_OFDM_11N                              0xED0
+#define DM_REG_RX_WAIT_RIFS_11N                         0xED4
+#define DM_REG_RX2RX_11N                                0xED8
+#define DM_REG_STANDBY_11N                              0xEDC
+#define DM_REG_SLEEP_11N                                0xEE0
+#define DM_REG_PMPD_ANAEN_11N                           0xEEC
+
+
+/*MAC REG LIST*/
+#define DM_REG_BB_RST_11N                               0x02
+#define DM_REG_ANTSEL_PIN_11N                           0x4C
+#define DM_REG_EARLY_MODE_11N                           0x4D0
+#define DM_REG_RSSI_MONITOR_11N                         0x4FE
+#define DM_REG_EDCA_VO_11N                              0x500
+#define DM_REG_EDCA_VI_11N                              0x504
+#define DM_REG_EDCA_BE_11N                              0x508
+#define DM_REG_EDCA_BK_11N                              0x50C
+#define DM_REG_TXPAUSE_11N                              0x522
+#define DM_REG_RESP_TX_11N                              0x6D8
+#define DM_REG_ANT_TRAIN_1                              0x7b0
+#define DM_REG_ANT_TRAIN_2                              0x7b4
+
+/*DIG Related*/
+#define DM_BIT_IGI_11N                                  0x0000007F
+
+#define HAL_DM_DIG_DISABLE                              BIT(0)
+#define HAL_DM_HIPWR_DISABLE                            BIT(1)
+
+#define OFDM_TABLE_LENGTH                               43
+#define CCK_TABLE_LENGTH                                33
+
+#define OFDM_TABLE_SIZE                                 43
+#define CCK_TABLE_SIZE                                  33
+
+#define BW_AUTO_SWITCH_HIGH_LOW                         25
+#define BW_AUTO_SWITCH_LOW_HIGH                         30
+
+#define DM_DIG_THRESH_HIGH                              40
+#define DM_DIG_THRESH_LOW                               35
+
+#define DM_FALSEALARM_THRESH_LOW                        400
+#define DM_FALSEALARM_THRESH_HIGH                       1000
+
+#define DM_DIG_MAX                                      0x3e
+#define DM_DIG_MIN                                      0x1e
+
+#define DM_DIG_MAX_AP                                   0x32
+#define DM_DIG_MIN_AP                                   0x20
+
+#define DM_DIG_FA_UPPER                                 0x3e
+#define DM_DIG_FA_LOWER                                 0x1e
+#define DM_DIG_FA_TH0                                   0x200
+#define DM_DIG_FA_TH1                                   0x300
+#define DM_DIG_FA_TH2                                   0x400
+
+#define DM_DIG_BACKOFF_MAX                              12
+#define DM_DIG_BACKOFF_MIN                              -4
+#define DM_DIG_BACKOFF_DEFAULT                          10
+
+#define RXPATHSELECTION_SS_TH_LOW                       30
+#define RXPATHSELECTION_DIFF_TH                         18
+
+#define DM_RATR_STA_INIT                                0
+#define DM_RATR_STA_HIGH                                1
+#define DM_RATR_STA_MIDDLE                              2
+#define DM_RATR_STA_LOW                                 3
+
+#define CTS2SELF_THVAL                                  30
+#define REGC38_TH                                       20
+
+#define WAIOTTHVAL                                      25
+
+#define TXHIGHPWRLEVEL_NORMAL                           0
+#define TXHIGHPWRLEVEL_LEVEL1                           1
+#define TXHIGHPWRLEVEL_LEVEL2                           2
+#define TXHIGHPWRLEVEL_BT1                              3
+#define TXHIGHPWRLEVEL_BT2                              4
+
+#define DM_TYPE_BYFW                                    0
+#define DM_TYPE_BYDRIVER                                1
+
+#define TX_POWER_NEAR_FIELD_THRESH_LVL2                 74
+#define TX_POWER_NEAR_FIELD_THRESH_LVL1                 67
+#define TXPWRTRACK_MAX_IDX                              6
+
+struct swat_t {
+        u8 failure_cnt;
+        u8 try_flag;
+        u8 stop_trying;
+        long pre_rssi;
+        long trying_threshold;
+        u8 cur_antenna;
+        u8 pre_antenna;
+};
+
+enum FAT_STATE {
+        FAT_NORMAL_STATE        = 0,
+        FAT_TRAINING_STATE = 1,
+};
+
+enum tag_dynamic_init_gain_operation_type_definition {
+        DIG_TYPE_THRESH_HIGH = 0,
+        DIG_TYPE_THRESH_LOW = 1,
+        DIG_TYPE_BACKOFF = 2,
+        DIG_TYPE_RX_GAIN_MIN = 3,
+        DIG_TYPE_RX_GAIN_MAX = 4,
+        DIG_TYPE_ENABLE = 5,
+        DIG_TYPE_DISABLE = 6,
+        DIG_OP_TYPE_MAX
+};
+
+enum tag_cck_packet_detection_threshold_type_definition {
+        CCK_PD_STAGE_LOWRSSI = 0,
+        CCK_PD_STAGE_HIGHRSSI = 1,
+        CCK_FA_STAGE_LOW = 2,
+        CCK_FA_STAGE_HIGH = 3,
+        CCK_PD_STAGE_MAX = 4,
+};
+
+enum dm_1r_cca_e {
+        CCA_1R = 0,
+        CCA_2R = 1,
+        CCA_MAX = 2,
+};
+
+enum dm_rf_e {
+        RF_SAVE = 0,
+        RF_NORMAL = 1,
+        RF_MAX = 2,
+};
+
+enum dm_sw_ant_switch_e {
+        ANS_ANTENNA_B = 1,
+        ANS_ANTENNA_A = 2,
+        ANS_ANTENNA_MAX = 3,
+};
+
+enum dm_dig_ext_port_alg_e {
+        DIG_EXT_PORT_STAGE_0 = 0,
+        DIG_EXT_PORT_STAGE_1 = 1,
+        DIG_EXT_PORT_STAGE_2 = 2,
+        DIG_EXT_PORT_STAGE_3 = 3,
+        DIG_EXT_PORT_STAGE_MAX = 4,
+};
+
+enum dm_dig_connect_e {
+        DIG_STA_DISCONNECT = 0,
+        DIG_STA_CONNECT = 1,
+        DIG_STA_BEFORE_CONNECT = 2,
+        DIG_MULTISTA_DISCONNECT = 3,
+        DIG_MULTISTA_CONNECT = 4,
+        DIG_CONNECT_MAX
+};
+
+enum pwr_track_control_method {
+        BBSWING,
+        TXAGC
+};
+
+void rtl88e_dm_set_tx_ant_by_tx_info(struct ieee80211_hw *hw,
+                                     u8 *pdesc, u32 mac_id);
+void rtl88e_dm_ant_sel_statistics(struct ieee80211_hw *hw, u8 antsel_tr_mux,
+                                  u32 mac_id, u32 rx_pwdb_all);
+void rtl88e_dm_fast_antenna_training_callback(unsigned long data);
+void rtl88e_dm_init(struct ieee80211_hw *hw);
+void rtl88e_dm_watchdog(struct ieee80211_hw *hw);
+void rtl88e_dm_write_dig(struct ieee80211_hw *hw);
+void rtl88e_dm_init_edca_turbo(struct ieee80211_hw *hw);
+void rtl88e_dm_check_txpower_tracking(struct ieee80211_hw *hw);
+void rtl88e_dm_init_rate_adaptive_mask(struct ieee80211_hw *hw);
+void rtl88e_dm_txpower_track_adjust(struct ieee80211_hw *hw,
+                                    u8 type, u8 *pdirection,
+                                    u32 *poutwrite_val);
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/fw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/fw.c
new file mode 100644
index 000000000000..57e4cc5833a9
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/fw.c
@@ -0,0 +1,830 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "../wifi.h"
+#include "../pci.h"
+#include "../base.h"
+#include "reg.h"
+#include "def.h"
+#include "fw.h"
+
+#include <linux/kmemleak.h>
+
+static void _rtl88e_enable_fw_download(struct ieee80211_hw *hw, bool enable)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 tmp;
+
+        if (enable) {
+                tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
+                rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp | 0x04);
+
+                tmp = rtl_read_byte(rtlpriv, REG_MCUFWDL);
+                rtl_write_byte(rtlpriv, REG_MCUFWDL, tmp | 0x01);
+
+                tmp = rtl_read_byte(rtlpriv, REG_MCUFWDL + 2);
+                rtl_write_byte(rtlpriv, REG_MCUFWDL + 2, tmp & 0xf7);
+        } else {
+                tmp = rtl_read_byte(rtlpriv, REG_MCUFWDL);
+                rtl_write_byte(rtlpriv, REG_MCUFWDL, tmp & 0xfe);
+
+                rtl_write_byte(rtlpriv, REG_MCUFWDL + 1, 0x00);
+        }
+}
+
+static void _rtl88e_fw_block_write(struct ieee80211_hw *hw,
+                                   const u8 *buffer, u32 size)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 blk_sz = sizeof(u32);
+        u8 *buf_ptr = (u8 *)buffer;
+        u32 *pu4BytePtr = (u32 *)buffer;
+        u32 i, offset, blk_cnt, remain;
+
+        blk_cnt = size / blk_sz;
+        remain = size % blk_sz;
+
+        for (i = 0; i < blk_cnt; i++) {
+                offset = i * blk_sz;
+                rtl_write_dword(rtlpriv, (FW_8192C_START_ADDRESS + offset),
+                                *(pu4BytePtr + i));
+        }
+
+        if (remain) {
+                offset = blk_cnt * blk_sz;
+                buf_ptr += offset;
+                for (i = 0; i < remain; i++) {
+                        rtl_write_byte(rtlpriv, (FW_8192C_START_ADDRESS +
+                                                 offset + i), *(buf_ptr + i));
+                }
+        }
+}
+
+static void _rtl88e_fw_page_write(struct ieee80211_hw *hw,
+                                  u32 page, const u8 *buffer, u32 size)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 value8;
+        u8 u8page = (u8) (page & 0x07);
+
+        value8 = (rtl_read_byte(rtlpriv, REG_MCUFWDL + 2) & 0xF8) | u8page;
+
+        rtl_write_byte(rtlpriv, (REG_MCUFWDL + 2), value8);
+        _rtl88e_fw_block_write(hw, buffer, size);
+}
+
+static void _rtl88e_fill_dummy(u8 *pfwbuf, u32 *pfwlen)
+{
+        u32 fwlen = *pfwlen;
+        u8 remain = (u8) (fwlen % 4);
+
+        remain = (remain == 0) ? 0 : (4 - remain);
+
+        while (remain > 0) {
+                pfwbuf[fwlen] = 0;
+                fwlen++;
+                remain--;
+        }
+
+        *pfwlen = fwlen;
+}
+
+static void _rtl88e_write_fw(struct ieee80211_hw *hw,
+                             enum version_8188e version, u8 *buffer, u32 size)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 *buf_ptr = (u8 *)buffer;
+        u32 page_no, remain;
+        u32 page, offset;
+
+        RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "FW size is %d bytes,\n", size);
+
+        _rtl88e_fill_dummy(buf_ptr, &size);
+
+        page_no = size / FW_8192C_PAGE_SIZE;
+        remain = size % FW_8192C_PAGE_SIZE;
+
+        if (page_no > 8) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Page numbers should not greater then 8\n");
+        }
+
+        for (page = 0; page < page_no; page++) {
+                offset = page * FW_8192C_PAGE_SIZE;
+                _rtl88e_fw_page_write(hw, page, (buf_ptr + offset),
+                                      FW_8192C_PAGE_SIZE);
+        }
+
+        if (remain) {
+                offset = page_no * FW_8192C_PAGE_SIZE;
+                page = page_no;
+                _rtl88e_fw_page_write(hw, page, (buf_ptr + offset), remain);
+        }
+}
+
+static int _rtl88e_fw_free_to_go(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        int err = -EIO;
+        u32 counter = 0;
+        u32 value32;
+
+        do {
+                value32 = rtl_read_dword(rtlpriv, REG_MCUFWDL);
+        } while ((counter++ < FW_8192C_POLLING_TIMEOUT_COUNT) &&
+                 (!(value32 & FWDL_CHKSUM_RPT)));
+
+        if (counter >= FW_8192C_POLLING_TIMEOUT_COUNT) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "chksum report faill ! REG_MCUFWDL:0x%08x .\n",
+                          value32);
+                goto exit;
+        }
+
+        RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+                 "Checksum report OK ! REG_MCUFWDL:0x%08x .\n", value32);
+
+        value32 = rtl_read_dword(rtlpriv, REG_MCUFWDL);
+        value32 |= MCUFWDL_RDY;
+        value32 &= ~WINTINI_RDY;
+        rtl_write_dword(rtlpriv, REG_MCUFWDL, value32);
+
+        rtl88e_firmware_selfreset(hw);
+        counter = 0;
+
+        do {
+                value32 = rtl_read_dword(rtlpriv, REG_MCUFWDL);
+                if (value32 & WINTINI_RDY) {
+                        RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+                                 "Polling FW ready success!! REG_MCUFWDL:0x%08x.\n",
+                                  value32);
+                        err = 0;
+                        goto exit;
+                }
+
+                udelay(FW_8192C_POLLING_DELAY);
+
+        } while (counter++ < FW_8192C_POLLING_TIMEOUT_COUNT);
+
+        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                 "Polling FW ready fail!! REG_MCUFWDL:0x%08x .\n", value32);
+
+exit:
+        return err;
+}
+
+int rtl88e_download_fw(struct ieee80211_hw *hw, bool buse_wake_on_wlan_fw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl92c_firmware_header *pfwheader;
+        u8 *pfwdata;
+        u32 fwsize;
+        int err;
+        enum version_8188e version = rtlhal->version;
+
+        if (!rtlhal->pfirmware)
+                return 1;
+
+        pfwheader = (struct rtl92c_firmware_header *)rtlhal->pfirmware;
+        pfwdata = (u8 *)rtlhal->pfirmware;
+        fwsize = rtlhal->fwsize;
+        RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG,
+                 "normal Firmware SIZE %d\n", fwsize);
+
+        if (IS_FW_HEADER_EXIST(pfwheader)) {
+                RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG,
+                         "Firmware Version(%d), Signature(%#x), Size(%d)\n",
+                         pfwheader->version, pfwheader->signature,
+                         (int)sizeof(struct rtl92c_firmware_header));
+
+                pfwdata = pfwdata + sizeof(struct rtl92c_firmware_header);
+                fwsize = fwsize - sizeof(struct rtl92c_firmware_header);
+        }
+
+        if (rtl_read_byte(rtlpriv, REG_MCUFWDL) & BIT(7)) {
+                rtl_write_byte(rtlpriv, REG_MCUFWDL, 0);
+                rtl88e_firmware_selfreset(hw);
+        }
+        _rtl88e_enable_fw_download(hw, true);
+        _rtl88e_write_fw(hw, version, pfwdata, fwsize);
+        _rtl88e_enable_fw_download(hw, false);
+
+        err = _rtl88e_fw_free_to_go(hw);
+
+        RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG,
+                 "Firmware is%s ready to run!\n", err ? " not" : "");
+        return 0;
+}
+
+static bool _rtl88e_check_fw_read_last_h2c(struct ieee80211_hw *hw, u8 boxnum)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 val_hmetfr;
+
+        val_hmetfr = rtl_read_byte(rtlpriv, REG_HMETFR);
+        if (((val_hmetfr >> boxnum) & BIT(0)) == 0)
+                return true;
+        return false;
+}
+
+static void _rtl88e_fill_h2c_command(struct ieee80211_hw *hw,
+                                     u8 element_id, u32 cmd_len,
+                                     u8 *cmd_b)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u8 boxnum;
+        u16 box_reg = 0, box_extreg = 0;
+        u8 u1b_tmp;
+        bool isfw_read = false;
+        u8 buf_index = 0;
+        bool write_sucess = false;
+        u8 wait_h2c_limit = 100;
+        u8 wait_writeh2c_limit = 100;
+        u8 boxc[4], boxext[2];
+        u32 h2c_waitcounter = 0;
+        unsigned long flag;
+        u8 idx;
+
+        RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, "come in\n");
+
+        while (true) {
+                spin_lock_irqsave(&rtlpriv->locks.h2c_lock, flag);
+                if (rtlhal->h2c_setinprogress) {
+                        RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+                                 "H2C set in progress! Wait to set..element_id(%d).\n",
+                                 element_id);
+
+                        while (rtlhal->h2c_setinprogress) {
+                                spin_unlock_irqrestore(&rtlpriv->locks.h2c_lock,
+                                                       flag);
+                                h2c_waitcounter++;
+                                RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+                                         "Wait 100 us (%d times)...\n",
+                                         h2c_waitcounter);
+                                udelay(100);
+
+                                if (h2c_waitcounter > 1000)
+                                        return;
+                                spin_lock_irqsave(&rtlpriv->locks.h2c_lock,
+                                                  flag);
+                        }
+                        spin_unlock_irqrestore(&rtlpriv->locks.h2c_lock, flag);
+                } else {
+                        rtlhal->h2c_setinprogress = true;
+                        spin_unlock_irqrestore(&rtlpriv->locks.h2c_lock, flag);
+                        break;
+                }
+        }
+
+        while (!write_sucess) {
+                wait_writeh2c_limit--;
+                if (wait_writeh2c_limit == 0) {
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "Write H2C fail because no trigger for FW INT!\n");
+                        break;
+                }
+
+                boxnum = rtlhal->last_hmeboxnum;
+                switch (boxnum) {
+                case 0:
+                        box_reg = REG_HMEBOX_0;
+                        box_extreg = REG_HMEBOX_EXT_0;
+                        break;
+                case 1:
+                        box_reg = REG_HMEBOX_1;
+                        box_extreg = REG_HMEBOX_EXT_1;
+                        break;
+                case 2:
+                        box_reg = REG_HMEBOX_2;
+                        box_extreg = REG_HMEBOX_EXT_2;
+                        break;
+                case 3:
+                        box_reg = REG_HMEBOX_3;
+                        box_extreg = REG_HMEBOX_EXT_3;
+                        break;
+                default:
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "switch case not processed\n");
+                        break;
+                }
+
+                isfw_read = _rtl88e_check_fw_read_last_h2c(hw, boxnum);
+                while (!isfw_read) {
+                        wait_h2c_limit--;
+                        if (wait_h2c_limit == 0) {
+                                RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+                                         "Wating too long for FW read "
+                                         "clear HMEBox(%d)!\n", boxnum);
+                                break;
+                        }
+
+                        udelay(10);
+
+                        isfw_read = _rtl88e_check_fw_read_last_h2c(hw, boxnum);
+                        u1b_tmp = rtl_read_byte(rtlpriv, 0x130);
+                        RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+                                 "Wating for FW read clear HMEBox(%d)!!! "
+                                 "0x130 = %2x\n", boxnum, u1b_tmp);
+                }
+
+                if (!isfw_read) {
+                        RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+                                 "Write H2C register BOX[%d] fail!!!!! "
+                                 "Fw do not read.\n", boxnum);
+                        break;
+                }
+
+                memset(boxc, 0, sizeof(boxc));
+                memset(boxext, 0, sizeof(boxext));
+                boxc[0] = element_id;
+                RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+                         "Write element_id box_reg(%4x) = %2x\n",
+                         box_reg, element_id);
+
+                switch (cmd_len) {
+                case 1:
+                case 2:
+                case 3:
+                        /*boxc[0] &= ~(BIT(7));*/
+                        memcpy((u8 *)(boxc) + 1, cmd_b + buf_index, cmd_len);
+
+                        for (idx = 0; idx < 4; idx++)
+                                rtl_write_byte(rtlpriv, box_reg+idx, boxc[idx]);
+                        break;
+                case 4:
+                case 5:
+                case 6:
+                case 7:
+                        /*boxc[0] |= (BIT(7));*/
+                        memcpy((u8 *)(boxext), cmd_b + buf_index+3, cmd_len-3);
+                        memcpy((u8 *)(boxc) + 1, cmd_b + buf_index, 3);
+
+                        for (idx = 0; idx < 2; idx++) {
+                                rtl_write_byte(rtlpriv, box_extreg + idx,
+                                               boxext[idx]);
+                        }
+
+                        for (idx = 0; idx < 4; idx++) {
+                                rtl_write_byte(rtlpriv, box_reg + idx,
+                                               boxc[idx]);
+                        }
+                        break;
+                default:
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "switch case not processed\n");
+                        break;
+                }
+
+                write_sucess = true;
+
+                rtlhal->last_hmeboxnum = boxnum + 1;
+                if (rtlhal->last_hmeboxnum == 4)
+                        rtlhal->last_hmeboxnum = 0;
+
+                RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+                         "pHalData->last_hmeboxnum  = %d\n",
+                         rtlhal->last_hmeboxnum);
+        }
+
+        spin_lock_irqsave(&rtlpriv->locks.h2c_lock, flag);
+        rtlhal->h2c_setinprogress = false;
+        spin_unlock_irqrestore(&rtlpriv->locks.h2c_lock, flag);
+
+        RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, "go out\n");
+}
+
+void rtl88e_fill_h2c_cmd(struct ieee80211_hw *hw,
+                         u8 element_id, u32 cmd_len, u8 *cmd_b)
+{
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u32 tmp_cmdbuf[2];
+
+        if (rtlhal->fw_ready == false) {
+                RT_ASSERT(false, "fail H2C cmd - Fw download fail!!!\n");
+                return;
+        }
+
+        memset(tmp_cmdbuf, 0, 8);
+        memcpy(tmp_cmdbuf, cmd_b, cmd_len);
+        _rtl88e_fill_h2c_command(hw, element_id, cmd_len, (u8 *)&tmp_cmdbuf);
+
+        return;
+}
+
+void rtl88e_firmware_selfreset(struct ieee80211_hw *hw)
+{
+        u8 u1b_tmp;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        u1b_tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN+1);
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN+1, (u1b_tmp & (~BIT(2))));
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN+1, (u1b_tmp | BIT(2)));
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "8051Reset88E(): 8051 reset success.\n");
+}
+
+void rtl88e_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 u1_h2c_set_pwrmode[H2C_88E_PWEMODE_LENGTH] = { 0 };
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        u8 power_state = 0;
+
+        RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, "FW LPS mode = %d\n", mode);
+        SET_H2CCMD_PWRMODE_PARM_MODE(u1_h2c_set_pwrmode, ((mode) ? 1 : 0));
+        SET_H2CCMD_PWRMODE_PARM_RLBM(u1_h2c_set_pwrmode, 0);
+        SET_H2CCMD_PWRMODE_PARM_SMART_PS(u1_h2c_set_pwrmode,
+                                         (rtlpriv->mac80211.p2p) ?
+                                         ppsc->smart_ps : 1);
+        SET_H2CCMD_PWRMODE_PARM_AWAKE_INTERVAL(u1_h2c_set_pwrmode,
+                                               ppsc->reg_max_lps_awakeintvl);
+        SET_H2CCMD_PWRMODE_PARM_ALL_QUEUE_UAPSD(u1_h2c_set_pwrmode, 0);
+        if (mode == FW_PS_ACTIVE_MODE)
+                power_state |= FW_PWR_STATE_ACTIVE;
+        else
+                power_state |= FW_PWR_STATE_RF_OFF;
+        SET_H2CCMD_PWRMODE_PARM_PWR_STATE(u1_h2c_set_pwrmode, power_state);
+
+        RT_PRINT_DATA(rtlpriv, COMP_CMD, DBG_DMESG,
+                      "rtl92c_set_fw_pwrmode(): u1_h2c_set_pwrmode\n",
+                      u1_h2c_set_pwrmode, H2C_88E_PWEMODE_LENGTH);
+        rtl88e_fill_h2c_cmd(hw, H2C_88E_SETPWRMODE, H2C_88E_PWEMODE_LENGTH,
+                            u1_h2c_set_pwrmode);
+}
+
+void rtl88e_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus)
+{
+        u8 u1_joinbssrpt_parm[1] = { 0 };
+
+        SET_H2CCMD_JOINBSSRPT_PARM_OPMODE(u1_joinbssrpt_parm, mstatus);
+
+        rtl88e_fill_h2c_cmd(hw, H2C_88E_JOINBSSRPT, 1, u1_joinbssrpt_parm);
+}
+
+void rtl88e_set_fw_ap_off_load_cmd(struct ieee80211_hw *hw,
+                                   u8 ap_offload_enable)
+{
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        u8 u1_apoffload_parm[H2C_88E_AP_OFFLOAD_LENGTH] = { 0 };
+
+        SET_H2CCMD_AP_OFFLOAD_ON(u1_apoffload_parm, ap_offload_enable);
+        SET_H2CCMD_AP_OFFLOAD_HIDDEN(u1_apoffload_parm, mac->hiddenssid);
+        SET_H2CCMD_AP_OFFLOAD_DENYANY(u1_apoffload_parm, 0);
+
+        rtl88e_fill_h2c_cmd(hw, H2C_88E_AP_OFFLOAD, H2C_88E_AP_OFFLOAD_LENGTH,
+                            u1_apoffload_parm);
+}
+
+static bool _rtl88e_cmd_send_packet(struct ieee80211_hw *hw,
+                                    struct sk_buff *skb)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl8192_tx_ring *ring;
+        struct rtl_tx_desc *pdesc;
+        struct sk_buff *pskb = NULL;
+        unsigned long flags;
+
+        ring = &rtlpci->tx_ring[BEACON_QUEUE];
+
+        pskb = __skb_dequeue(&ring->queue);
+        if (pskb)
+                kfree_skb(pskb);
+
+        spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
+
+        pdesc = &ring->desc[0];
+
+        rtlpriv->cfg->ops->fill_tx_cmddesc(hw, (u8 *)pdesc, 1, 1, skb);
+
+        __skb_queue_tail(&ring->queue, skb);
+
+        spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+
+        rtlpriv->cfg->ops->tx_polling(hw, BEACON_QUEUE);
+
+        return true;
+}
+
+#define BEACON_PG               0 /* ->1 */
+#define PSPOLL_PG               2
+#define NULL_PG                 3
+#define PROBERSP_PG             4 /* ->5 */
+
+#define TOTAL_RESERVED_PKT_LEN  768
+
+static u8 reserved_page_packet[TOTAL_RESERVED_PKT_LEN] = {
+        /* page 0 beacon */
+        0x80, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0x00, 0xE0, 0x4C, 0x76, 0x00, 0x42,
+        0x00, 0x40, 0x10, 0x10, 0x00, 0x03, 0x50, 0x08,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x64, 0x00, 0x00, 0x04, 0x00, 0x0C, 0x6C, 0x69,
+        0x6E, 0x6B, 0x73, 0x79, 0x73, 0x5F, 0x77, 0x6C,
+        0x61, 0x6E, 0x01, 0x04, 0x82, 0x84, 0x8B, 0x96,
+        0x03, 0x01, 0x01, 0x06, 0x02, 0x00, 0x00, 0x2A,
+        0x01, 0x00, 0x32, 0x08, 0x24, 0x30, 0x48, 0x6C,
+        0x0C, 0x12, 0x18, 0x60, 0x2D, 0x1A, 0x6C, 0x18,
+        0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x3D, 0x00, 0xDD, 0x06, 0x00, 0xE0, 0x4C, 0x02,
+        0x01, 0x70, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+        /* page 1 beacon */
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x10, 0x00, 0x20, 0x8C, 0x00, 0x12, 0x10, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+        /* page 2  ps-poll */
+        0xA4, 0x10, 0x01, 0xC0, 0x00, 0x40, 0x10, 0x10,
+        0x00, 0x03, 0x00, 0xE0, 0x4C, 0x76, 0x00, 0x42,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x18, 0x00, 0x20, 0x8C, 0x00, 0x12, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
+        0x80, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+        /* page 3  null */
+        0x48, 0x01, 0x00, 0x00, 0x00, 0x40, 0x10, 0x10,
+        0x00, 0x03, 0x00, 0xE0, 0x4C, 0x76, 0x00, 0x42,
+        0x00, 0x40, 0x10, 0x10, 0x00, 0x03, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x72, 0x00, 0x20, 0x8C, 0x00, 0x12, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
+        0x80, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+        /* page 4  probe_resp */
+        0x50, 0x00, 0x00, 0x00, 0x00, 0x40, 0x10, 0x10,
+        0x00, 0x03, 0x00, 0xE0, 0x4C, 0x76, 0x00, 0x42,
+        0x00, 0x40, 0x10, 0x10, 0x00, 0x03, 0x00, 0x00,
+        0x9E, 0x46, 0x15, 0x32, 0x27, 0xF2, 0x2D, 0x00,
+        0x64, 0x00, 0x00, 0x04, 0x00, 0x0C, 0x6C, 0x69,
+        0x6E, 0x6B, 0x73, 0x79, 0x73, 0x5F, 0x77, 0x6C,
+        0x61, 0x6E, 0x01, 0x04, 0x82, 0x84, 0x8B, 0x96,
+        0x03, 0x01, 0x01, 0x06, 0x02, 0x00, 0x00, 0x2A,
+        0x01, 0x00, 0x32, 0x08, 0x24, 0x30, 0x48, 0x6C,
+        0x0C, 0x12, 0x18, 0x60, 0x2D, 0x1A, 0x6C, 0x18,
+        0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x3D, 0x00, 0xDD, 0x06, 0x00, 0xE0, 0x4C, 0x02,
+        0x01, 0x70, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+        /* page 5  probe_resp */
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+void rtl88e_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct sk_buff *skb = NULL;
+
+        u32 totalpacketlen;
+        u8 u1RsvdPageLoc[5] = { 0 };
+
+        u8 *beacon;
+        u8 *pspoll;
+        u8 *nullfunc;
+        u8 *probersp;
+        /*---------------------------------------------------------
+         *                      (1) beacon
+         *---------------------------------------------------------
+         */
+        beacon = &reserved_page_packet[BEACON_PG * 128];
+        SET_80211_HDR_ADDRESS2(beacon, mac->mac_addr);
+        SET_80211_HDR_ADDRESS3(beacon, mac->bssid);
+
+        /*-------------------------------------------------------
+         *                      (2) ps-poll
+         *--------------------------------------------------------
+         */
+        pspoll = &reserved_page_packet[PSPOLL_PG * 128];
+        SET_80211_PS_POLL_AID(pspoll, (mac->assoc_id | 0xc000));
+        SET_80211_PS_POLL_BSSID(pspoll, mac->bssid);
+        SET_80211_PS_POLL_TA(pspoll, mac->mac_addr);
+
+        SET_H2CCMD_RSVDPAGE_LOC_PSPOLL(u1RsvdPageLoc, PSPOLL_PG);
+
+        /*--------------------------------------------------------
+         *                      (3) null data
+         *---------------------------------------------------------
+         */
+        nullfunc = &reserved_page_packet[NULL_PG * 128];
+        SET_80211_HDR_ADDRESS1(nullfunc, mac->bssid);
+        SET_80211_HDR_ADDRESS2(nullfunc, mac->mac_addr);
+        SET_80211_HDR_ADDRESS3(nullfunc, mac->bssid);
+
+        SET_H2CCMD_RSVDPAGE_LOC_NULL_DATA(u1RsvdPageLoc, NULL_PG);
+
+        /*---------------------------------------------------------
+         *                      (4) probe response
+         *----------------------------------------------------------
+         */
+        probersp = &reserved_page_packet[PROBERSP_PG * 128];
+        SET_80211_HDR_ADDRESS1(probersp, mac->bssid);
+        SET_80211_HDR_ADDRESS2(probersp, mac->mac_addr);
+        SET_80211_HDR_ADDRESS3(probersp, mac->bssid);
+
+        SET_H2CCMD_RSVDPAGE_LOC_PROBE_RSP(u1RsvdPageLoc, PROBERSP_PG);
+
+        totalpacketlen = TOTAL_RESERVED_PKT_LEN;
+
+        RT_PRINT_DATA(rtlpriv, COMP_CMD, DBG_LOUD,
+                      "rtl88e_set_fw_rsvdpagepkt(): HW_VAR_SET_TX_CMD: ALL\n",
+                      &reserved_page_packet[0], totalpacketlen);
+        RT_PRINT_DATA(rtlpriv, COMP_CMD, DBG_DMESG,
+                      "rtl88e_set_fw_rsvdpagepkt(): HW_VAR_SET_TX_CMD: ALL\n",
+                      u1RsvdPageLoc, 3);
+
+        skb = dev_alloc_skb(totalpacketlen);
+        if (!skb)
+                return;
+        kmemleak_not_leak(skb);
+        memcpy(skb_put(skb, totalpacketlen),
+               &reserved_page_packet, totalpacketlen);
+
+        if (_rtl88e_cmd_send_packet(hw, skb)) {
+                RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+                         "Set RSVD page location to Fw.\n");
+                RT_PRINT_DATA(rtlpriv, COMP_CMD, DBG_DMESG,
+                              "H2C_RSVDPAGE:\n", u1RsvdPageLoc, 3);
+                rtl88e_fill_h2c_cmd(hw, H2C_88E_RSVDPAGE,
+                                    sizeof(u1RsvdPageLoc), u1RsvdPageLoc);
+        } else
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                         "Set RSVD page location to Fw FAIL!!!!!!.\n");
+}
+
+/*Shoud check FW support p2p or not.*/
+static void rtl88e_set_p2p_ctw_period_cmd(struct ieee80211_hw *hw, u8 ctwindow)
+{
+        u8 u1_ctwindow_period[1] = {ctwindow};
+
+        rtl88e_fill_h2c_cmd(hw, H2C_88E_P2P_PS_CTW_CMD, 1, u1_ctwindow_period);
+}
+
+void rtl88e_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *rtlps = rtl_psc(rtl_priv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_p2p_ps_info *p2pinfo = &(rtlps->p2p_ps_info);
+        struct p2p_ps_offload_t *p2p_ps_offload = &rtlhal->p2p_ps_offload;
+        u8      i;
+        u16     ctwindow;
+        u32     start_time, tsf_low;
+
+        switch (p2p_ps_state) {
+        case P2P_PS_DISABLE:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_DISABLE\n");
+                memset(p2p_ps_offload, 0, sizeof(struct p2p_ps_offload_t));
+                break;
+        case P2P_PS_ENABLE:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_ENABLE\n");
+                /* update CTWindow value. */
+                if (p2pinfo->ctwindow > 0) {
+                        p2p_ps_offload->ctwindow_en = 1;
+                        ctwindow = p2pinfo->ctwindow;
+                        rtl88e_set_p2p_ctw_period_cmd(hw, ctwindow);
+                }
+                /* hw only support 2 set of NoA */
+                for (i = 0; i < p2pinfo->noa_num; i++) {
+                        /* To control the register setting for which NOA*/
+                        rtl_write_byte(rtlpriv, 0x5cf, (i << 4));
+                        if (i == 0)
+                                p2p_ps_offload->noa0_en = 1;
+                        else
+                                p2p_ps_offload->noa1_en = 1;
+
+                        /* config P2P NoA Descriptor Register */
+                        rtl_write_dword(rtlpriv, 0x5E0,
+                                        p2pinfo->noa_duration[i]);
+                        rtl_write_dword(rtlpriv, 0x5E4,
+                                        p2pinfo->noa_interval[i]);
+
+                        /*Get Current TSF value */
+                        tsf_low = rtl_read_dword(rtlpriv, REG_TSFTR);
+
+                        start_time = p2pinfo->noa_start_time[i];
+                        if (p2pinfo->noa_count_type[i] != 1) {
+                                while (start_time <= (tsf_low + (50 * 1024))) {
+                                        start_time += p2pinfo->noa_interval[i];
+                                        if (p2pinfo->noa_count_type[i] != 255)
+                                                p2pinfo->noa_count_type[i]--;
+                                }
+                        }
+                        rtl_write_dword(rtlpriv, 0x5E8, start_time);
+                        rtl_write_dword(rtlpriv, 0x5EC,
+                                        p2pinfo->noa_count_type[i]);
+                }
+
+                if ((p2pinfo->opp_ps == 1) || (p2pinfo->noa_num > 0)) {
+                        /* rst p2p circuit */
+                        rtl_write_byte(rtlpriv, REG_DUAL_TSF_RST, BIT(4));
+
+                        p2p_ps_offload->offload_en = 1;
+
+                        if (P2P_ROLE_GO == rtlpriv->mac80211.p2p) {
+                                p2p_ps_offload->role = 1;
+                                p2p_ps_offload->allstasleep = 0;
+                        } else {
+                                p2p_ps_offload->role = 0;
+                        }
+
+                        p2p_ps_offload->discovery = 0;
+                }
+                break;
+        case P2P_PS_SCAN:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_SCAN\n");
+                p2p_ps_offload->discovery = 1;
+                break;
+        case P2P_PS_SCAN_DONE:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_SCAN_DONE\n");
+                p2p_ps_offload->discovery = 0;
+                p2pinfo->p2p_ps_state = P2P_PS_ENABLE;
+                break;
+        default:
+                break;
+        }
+
+        rtl88e_fill_h2c_cmd(hw, H2C_88E_P2P_PS_OFFLOAD, 1,
+                            (u8 *)p2p_ps_offload);
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/fw.h b/drivers/net/wireless/rtlwifi/rtl8188ee/fw.h
new file mode 100644
index 000000000000..854a9875cd5f
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/fw.h
@@ -0,0 +1,301 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92C__FW__H__
+#define __RTL92C__FW__H__
+
+#define FW_8192C_SIZE                           0x8000
+#define FW_8192C_START_ADDRESS                  0x1000
+#define FW_8192C_END_ADDRESS                    0x5FFF
+#define FW_8192C_PAGE_SIZE                      4096
+#define FW_8192C_POLLING_DELAY                  5
+#define FW_8192C_POLLING_TIMEOUT_COUNT          3000
+
+#define IS_FW_HEADER_EXIST(_pfwhdr)             \
+        ((_pfwhdr->signature&0xFFFF) == 0x88E1)
+#define USE_OLD_WOWLAN_DEBUG_FW                 0
+
+#define H2C_88E_RSVDPAGE_LOC_LEN                5
+#define H2C_88E_PWEMODE_LENGTH                  5
+#define H2C_88E_JOINBSSRPT_LENGTH               1
+#define H2C_88E_AP_OFFLOAD_LENGTH               3
+#define H2C_88E_WOWLAN_LENGTH                   3
+#define H2C_88E_KEEP_ALIVE_CTRL_LENGTH          3
+#if (USE_OLD_WOWLAN_DEBUG_FW == 0)
+#define H2C_88E_REMOTE_WAKE_CTRL_LEN            1
+#else
+#define H2C_88E_REMOTE_WAKE_CTRL_LEN            3
+#endif
+#define H2C_88E_AOAC_GLOBAL_INFO_LEN            2
+#define H2C_88E_AOAC_RSVDPAGE_LOC_LEN           7
+
+/* Fw PS state for RPWM.
+ * BIT[2:0] = HW state
+ * BIT[3] = Protocol PS state, 1: register active state, 0: register sleep state
+ * BIT[4] = sub-state
+ */
+#define FW_PS_GO_ON                     BIT(0)
+#define FW_PS_TX_NULL                   BIT(1)
+#define FW_PS_RF_ON                     BIT(2)
+#define FW_PS_REGISTER_ACTIVE           BIT(3)
+
+#define FW_PS_DPS                       BIT(0)
+#define FW_PS_LCLK                      (FW_PS_DPS)
+#define FW_PS_RF_OFF                    BIT(1)
+#define FW_PS_ALL_ON                    BIT(2)
+#define FW_PS_ST_ACTIVE                 BIT(3)
+#define FW_PS_ISR_ENABLE                BIT(4)
+#define FW_PS_IMR_ENABLE                BIT(5)
+
+
+#define FW_PS_ACK                       BIT(6)
+#define FW_PS_TOGGLE                    BIT(7)
+
+ /* 88E RPWM value*/
+ /* BIT[0] = 1: 32k, 0: 40M*/
+#define FW_PS_CLOCK_OFF                 BIT(0)          /* 32k*/
+#define FW_PS_CLOCK_ON                  0               /*40M*/
+
+#define FW_PS_STATE_MASK                (0x0F)
+#define FW_PS_STATE_HW_MASK             (0x07)
+/*ISR_ENABLE, IMR_ENABLE, and PS mode should be inherited.*/
+#define FW_PS_STATE_INT_MASK            (0x3F)
+
+#define FW_PS_STATE(x)                  (FW_PS_STATE_MASK & (x))
+#define FW_PS_STATE_HW(x)               (FW_PS_STATE_HW_MASK & (x))
+#define FW_PS_STATE_INT(x)              (FW_PS_STATE_INT_MASK & (x))
+#define FW_PS_ISR_VAL(x)                ((x) & 0x70)
+#define FW_PS_IMR_MASK(x)               ((x) & 0xDF)
+#define FW_PS_KEEP_IMR(x)               ((x) & 0x20)
+
+#define FW_PS_STATE_S0                  (FW_PS_DPS)
+#define FW_PS_STATE_S1                  (FW_PS_LCLK)
+#define FW_PS_STATE_S2                  (FW_PS_RF_OFF)
+#define FW_PS_STATE_S3                  (FW_PS_ALL_ON)
+#define FW_PS_STATE_S4                  ((FW_PS_ST_ACTIVE) | (FW_PS_ALL_ON))
+
+#define FW_PS_STATE_ALL_ON_88E          (FW_PS_CLOCK_ON)
+#define FW_PS_STATE_RF_ON_88E           (FW_PS_CLOCK_ON)
+#define FW_PS_STATE_RF_OFF_88E          (FW_PS_CLOCK_ON)
+#define FW_PS_STATE_RF_OFF_LOW_PWR_88E  (FW_PS_CLOCK_OFF)
+
+#define FW_PS_STATE_ALL_ON_92C          (FW_PS_STATE_S4)
+#define FW_PS_STATE_RF_ON_92C           (FW_PS_STATE_S3)
+#define FW_PS_STATE_RF_OFF_92C          (FW_PS_STATE_S2)
+#define FW_PS_STATE_RF_OFF_LOW_PWR_92C  (FW_PS_STATE_S1)
+
+/* For 88E H2C PwrMode Cmd ID 5.*/
+#define FW_PWR_STATE_ACTIVE     ((FW_PS_RF_ON) | (FW_PS_REGISTER_ACTIVE))
+#define FW_PWR_STATE_RF_OFF             0
+
+#define FW_PS_IS_ACK(x)                 ((x) & FW_PS_ACK)
+#define FW_PS_IS_CLK_ON(x)              ((x) & (FW_PS_RF_OFF | FW_PS_ALL_ON))
+#define FW_PS_IS_RF_ON(x)               ((x) & (FW_PS_ALL_ON))
+#define FW_PS_IS_ACTIVE(x)              ((x) & (FW_PS_ST_ACTIVE))
+#define FW_PS_IS_CPWM_INT(x)            ((x) & 0x40)
+
+#define FW_CLR_PS_STATE(x)              ((x) = ((x) & (0xF0)))
+
+#define IS_IN_LOW_POWER_STATE_88E(fwpsstate)            \
+        (FW_PS_STATE(fwpsstate) == FW_PS_CLOCK_OFF)
+
+#define FW_PWR_STATE_ACTIVE     ((FW_PS_RF_ON) | (FW_PS_REGISTER_ACTIVE))
+#define FW_PWR_STATE_RF_OFF             0
+
+struct rtl92c_firmware_header {
+        u16 signature;
+        u8 category;
+        u8 function;
+        u16 version;
+        u8 subversion;
+        u8 rsvd1;
+        u8 month;
+        u8 date;
+        u8 hour;
+        u8 minute;
+        u16 ramcodesize;
+        u16 rsvd2;
+        u32 svnindex;
+        u32 rsvd3;
+        u32 rsvd4;
+        u32 rsvd5;
+};
+
+enum rtl8192c_h2c_cmd {
+        H2C_88E_RSVDPAGE = 0,
+        H2C_88E_JOINBSSRPT = 1,
+        H2C_88E_SCAN = 2,
+        H2C_88E_KEEP_ALIVE_CTRL = 3,
+        H2C_88E_DISCONNECT_DECISION = 4,
+#if (USE_OLD_WOWLAN_DEBUG_FW == 1)
+        H2C_88E_WO_WLAN = 5,
+#endif
+        H2C_88E_INIT_OFFLOAD = 6,
+#if (USE_OLD_WOWLAN_DEBUG_FW == 1)
+        H2C_88E_REMOTE_WAKE_CTRL = 7,
+#endif
+        H2C_88E_AP_OFFLOAD = 8,
+        H2C_88E_BCN_RSVDPAGE = 9,
+        H2C_88E_PROBERSP_RSVDPAGE = 10,
+
+        H2C_88E_SETPWRMODE = 0x20,
+        H2C_88E_PS_TUNING_PARA = 0x21,
+        H2C_88E_PS_TUNING_PARA2 = 0x22,
+        H2C_88E_PS_LPS_PARA = 0x23,
+        H2C_88E_P2P_PS_OFFLOAD = 024,
+
+#if (USE_OLD_WOWLAN_DEBUG_FW == 0)
+        H2C_88E_WO_WLAN = 0x80,
+        H2C_88E_REMOTE_WAKE_CTRL = 0x81,
+        H2C_88E_AOAC_GLOBAL_INFO = 0x82,
+        H2C_88E_AOAC_RSVDPAGE = 0x83,
+#endif
+        /* Not defined in new 88E H2C CMD Format */
+        H2C_88E_RA_MASK,
+        H2C_88E_SELECTIVE_SUSPEND_ROF_CMD,
+        H2C_88E_P2P_PS_MODE,
+        H2C_88E_PSD_RESULT,
+        /*Not defined CTW CMD for P2P yet*/
+        H2C_88E_P2P_PS_CTW_CMD,
+        MAX_88E_H2CCMD
+};
+
+#define pagenum_128(_len)       (u32)(((_len)>>7) + ((_len)&0x7F ? 1 : 0))
+
+#define SET_88E_H2CCMD_WOWLAN_FUNC_ENABLE(__cmd, __value)               \
+        SET_BITS_TO_LE_1BYTE(__cmd, 0, 1, __value)
+#define SET_88E_H2CCMD_WOWLAN_PATTERN_MATCH_ENABLE(__cmd, __value)      \
+        SET_BITS_TO_LE_1BYTE(__cmd, 1, 1, __value)
+#define SET_88E_H2CCMD_WOWLAN_MAGIC_PKT_ENABLE(__cmd, __value)  \
+        SET_BITS_TO_LE_1BYTE(__cmd, 2, 1, __value)
+#define SET_88E_H2CCMD_WOWLAN_UNICAST_PKT_ENABLE(__cmd, __value)        \
+        SET_BITS_TO_LE_1BYTE(__cmd, 3, 1, __value)
+#define SET_88E_H2CCMD_WOWLAN_ALL_PKT_DROP(__cmd, __value)              \
+        SET_BITS_TO_LE_1BYTE(__cmd, 4, 1, __value)
+#define SET_88E_H2CCMD_WOWLAN_GPIO_ACTIVE(__cmd, __value)               \
+        SET_BITS_TO_LE_1BYTE(__cmd, 5, 1, __value)
+#define SET_88E_H2CCMD_WOWLAN_REKEY_WAKE_UP(__cmd, __value)             \
+        SET_BITS_TO_LE_1BYTE(__cmd, 6, 1, __value)
+#define SET_88E_H2CCMD_WOWLAN_DISCONNECT_WAKE_UP(__cmd, __value)        \
+        SET_BITS_TO_LE_1BYTE(__cmd, 7, 1, __value)
+#define SET_88E_H2CCMD_WOWLAN_GPIONUM(__cmd, __value)           \
+        SET_BITS_TO_LE_1BYTE((__cmd)+1, 0, 8, __value)
+#define SET_88E_H2CCMD_WOWLAN_GPIO_DURATION(__cmd, __value)             \
+        SET_BITS_TO_LE_1BYTE((__cmd)+2, 0, 8, __value)
+
+
+#define SET_H2CCMD_PWRMODE_PARM_MODE(__ph2ccmd, __val)                  \
+        SET_BITS_TO_LE_1BYTE(__ph2ccmd, 0, 8, __val)
+#define SET_H2CCMD_PWRMODE_PARM_RLBM(__cmd, __value)            \
+        SET_BITS_TO_LE_1BYTE((__cmd)+1, 0, 4, __value)
+#define SET_H2CCMD_PWRMODE_PARM_SMART_PS(__cmd, __value)                \
+        SET_BITS_TO_LE_1BYTE((__cmd)+1, 4, 4, __value)
+#define SET_H2CCMD_PWRMODE_PARM_AWAKE_INTERVAL(__cmd, __value)  \
+        SET_BITS_TO_LE_1BYTE((__cmd)+2, 0, 8, __value)
+#define SET_H2CCMD_PWRMODE_PARM_ALL_QUEUE_UAPSD(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE((__cmd)+3, 0, 8, __value)
+#define SET_H2CCMD_PWRMODE_PARM_PWR_STATE(__cmd, __value)               \
+        SET_BITS_TO_LE_1BYTE((__cmd)+4, 0, 8, __value)
+#define GET_88E_H2CCMD_PWRMODE_PARM_MODE(__cmd)                 \
+        LE_BITS_TO_1BYTE(__cmd, 0, 8)
+
+#define SET_H2CCMD_JOINBSSRPT_PARM_OPMODE(__ph2ccmd, __val)             \
+        SET_BITS_TO_LE_1BYTE(__ph2ccmd, 0, 8, __val)
+#define SET_H2CCMD_RSVDPAGE_LOC_PROBE_RSP(__ph2ccmd, __val)             \
+        SET_BITS_TO_LE_1BYTE(__ph2ccmd, 0, 8, __val)
+#define SET_H2CCMD_RSVDPAGE_LOC_PSPOLL(__ph2ccmd, __val)                \
+        SET_BITS_TO_LE_1BYTE((__ph2ccmd)+1, 0, 8, __val)
+#define SET_H2CCMD_RSVDPAGE_LOC_NULL_DATA(__ph2ccmd, __val)             \
+        SET_BITS_TO_LE_1BYTE((__ph2ccmd)+2, 0, 8, __val)
+
+/* AP_OFFLOAD */
+#define SET_H2CCMD_AP_OFFLOAD_ON(__cmd, __value)                        \
+        SET_BITS_TO_LE_1BYTE(__cmd, 0, 8, __value)
+#define SET_H2CCMD_AP_OFFLOAD_HIDDEN(__cmd, __value)            \
+        SET_BITS_TO_LE_1BYTE((__cmd)+1, 0, 8, __value)
+#define SET_H2CCMD_AP_OFFLOAD_DENYANY(__cmd, __value)           \
+        SET_BITS_TO_LE_1BYTE((__cmd)+2, 0, 8, __value)
+#define SET_H2CCMD_AP_OFFLOAD_WAKEUP_EVT_RPT(__cmd, __value)    \
+        SET_BITS_TO_LE_1BYTE((__cmd)+3, 0, 8, __value)
+
+/* Keep Alive Control*/
+#define SET_88E_H2CCMD_KEEP_ALIVE_ENABLE(__cmd, __value)                \
+        SET_BITS_TO_LE_1BYTE(__cmd, 0, 1, __value)
+#define SET_88E_H2CCMD_KEEP_ALIVE_ACCPEPT_USER_DEFINED(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE(__cmd, 1, 1, __value)
+#define SET_88E_H2CCMD_KEEP_ALIVE_PERIOD(__cmd, __value)                \
+        SET_BITS_TO_LE_1BYTE((__cmd)+1, 0, 8, __value)
+
+/*REMOTE_WAKE_CTRL */
+#define SET_88E_H2CCMD_REMOTE_WAKE_CTRL_EN(__cmd, __value)              \
+        SET_BITS_TO_LE_1BYTE(__cmd, 0, 1, __value)
+#if (USE_OLD_WOWLAN_DEBUG_FW == 0)
+#define SET_88E_H2CCMD_REMOTE_WAKE_CTRL_ARP_OFFLOAD_EN(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE(__cmd, 1, 1, __value)
+#define SET_88E_H2CCMD_REMOTE_WAKE_CTRL_NDP_OFFLOAD_EN(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE(__cmd, 2, 1, __value)
+#define SET_88E_H2CCMD_REMOTE_WAKE_CTRL_GTK_OFFLOAD_EN(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE(__cmd, 3, 1, __value)
+#else
+#define SET_88E_H2_REM_WAKE_ENC_ALG(__cmd, __value)             \
+        SET_BITS_TO_LE_1BYTE((__cmd)+1, 0, 8, __value)
+#define SET_88E_H2CCMD_REMOTE_WAKE_CTRL_GROUP_ENC_ALG(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE((__cmd)+2, 0, 8, __value)
+#endif
+
+/* GTK_OFFLOAD */
+#define SET_88E_H2CCMD_AOAC_GLOBAL_INFO_PAIRWISE_ENC_ALG(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE(__cmd, 0, 8, __value)
+#define SET_88E_H2CCMD_AOAC_GLOBAL_INFO_GROUP_ENC_ALG(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE((__cmd)+1, 0, 8, __value)
+
+/* AOAC_RSVDPAGE_LOC */
+#define SET_88E_H2CCMD_AOAC_RSVD_LOC_REM_WAKE_CTRL_INFO(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE((__cmd), 0, 8, __value)
+#define SET_88E_H2CCMD_AOAC_RSVDPAGE_LOC_ARP_RSP(__cmd, __value)        \
+        SET_BITS_TO_LE_1BYTE((__cmd)+1, 0, 8, __value)
+#define SET_88E_H2CCMD_AOAC_RSVDPAGE_LOC_NEIGHBOR_ADV(__cmd, __value) \
+        SET_BITS_TO_LE_1BYTE((__cmd)+2, 0, 8, __value)
+#define SET_88E_H2CCMD_AOAC_RSVDPAGE_LOC_GTK_RSP(__cmd, __value)        \
+        SET_BITS_TO_LE_1BYTE((__cmd)+3, 0, 8, __value)
+#define SET_88E_H2CCMD_AOAC_RSVDPAGE_LOC_GTK_INFO(__cmd, __value)       \
+        SET_BITS_TO_LE_1BYTE((__cmd)+4, 0, 8, __value)
+
+int rtl88e_download_fw(struct ieee80211_hw *hw,
+                       bool buse_wake_on_wlan_fw);
+void rtl88e_fill_h2c_cmd(struct ieee80211_hw *hw, u8 element_id,
+                         u32 cmd_len, u8 *p_cmdbuffer);
+void rtl88e_firmware_selfreset(struct ieee80211_hw *hw);
+void rtl88e_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
+void rtl88e_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw,
+                                      u8 mstatus);
+void rtl88e_set_fw_ap_off_load_cmd(struct ieee80211_hw *hw,  u8 enable);
+void rtl88e_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
+void rtl88e_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
new file mode 100644
index 000000000000..b68cae3024fc
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
@@ -0,0 +1,2530 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "../wifi.h"
+#include "../efuse.h"
+#include "../base.h"
+#include "../regd.h"
+#include "../cam.h"
+#include "../ps.h"
+#include "../pci.h"
+#include "reg.h"
+#include "def.h"
+#include "phy.h"
+#include "dm.h"
+#include "fw.h"
+#include "led.h"
+#include "hw.h"
+#include "pwrseqcmd.h"
+#include "pwrseq.h"
+
+#define LLT_CONFIG              5
+
+static void _rtl88ee_set_bcn_ctrl_reg(struct ieee80211_hw *hw,
+                                      u8 set_bits, u8 clear_bits)
+{
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        rtlpci->reg_bcn_ctrl_val |= set_bits;
+        rtlpci->reg_bcn_ctrl_val &= ~clear_bits;
+
+        rtl_write_byte(rtlpriv, REG_BCN_CTRL, (u8) rtlpci->reg_bcn_ctrl_val);
+}
+
+static void _rtl88ee_stop_tx_beacon(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 tmp1byte;
+
+        tmp1byte = rtl_read_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2);
+        rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2, tmp1byte & (~BIT(6)));
+        rtl_write_byte(rtlpriv, REG_TBTT_PROHIBIT + 1, 0x64);
+        tmp1byte = rtl_read_byte(rtlpriv, REG_TBTT_PROHIBIT + 2);
+        tmp1byte &= ~(BIT(0));
+        rtl_write_byte(rtlpriv, REG_TBTT_PROHIBIT + 2, tmp1byte);
+}
+
+static void _rtl88ee_resume_tx_beacon(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 tmp1byte;
+
+        tmp1byte = rtl_read_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2);
+        rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2, tmp1byte | BIT(6));
+        rtl_write_byte(rtlpriv, REG_TBTT_PROHIBIT + 1, 0xff);
+        tmp1byte = rtl_read_byte(rtlpriv, REG_TBTT_PROHIBIT + 2);
+        tmp1byte |= BIT(0);
+        rtl_write_byte(rtlpriv, REG_TBTT_PROHIBIT + 2, tmp1byte);
+}
+
+static void _rtl88ee_enable_bcn_sub_func(struct ieee80211_hw *hw)
+{
+        _rtl88ee_set_bcn_ctrl_reg(hw, 0, BIT(1));
+}
+
+static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
+
+        while (skb_queue_len(&ring->queue)) {
+                struct rtl_tx_desc *entry = &ring->desc[ring->idx];
+                struct sk_buff *skb = __skb_dequeue(&ring->queue);
+
+                pci_unmap_single(rtlpci->pdev,
+                                 rtlpriv->cfg->ops->get_desc(
+                                 (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
+                                 skb->len, PCI_DMA_TODEVICE);
+                kfree_skb(skb);
+                ring->idx = (ring->idx + 1) % ring->entries;
+        }
+}
+
+static void _rtl88ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
+{
+        _rtl88ee_set_bcn_ctrl_reg(hw, BIT(1), 0);
+}
+
+static void _rtl88ee_set_fw_clock_on(struct ieee80211_hw *hw,
+                                     u8 rpwm_val, bool need_turn_off_ckk)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        bool support_remote_wake_up;
+        u32 count = 0, isr_regaddr, content;
+        bool schedule_timer = need_turn_off_ckk;
+
+        rtlpriv->cfg->ops->get_hw_reg(hw, HAL_DEF_WOWLAN,
+                                      (u8 *)(&support_remote_wake_up));
+        if (!rtlhal->fw_ready)
+                return;
+        if (!rtlpriv->psc.fw_current_inpsmode)
+                return;
+
+        while (1) {
+                spin_lock_bh(&rtlpriv->locks.fw_ps_lock);
+                if (rtlhal->fw_clk_change_in_progress) {
+                        while (rtlhal->fw_clk_change_in_progress) {
+                                spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+                                udelay(100);
+                                if (++count > 1000)
+                                        return;
+                                spin_lock_bh(&rtlpriv->locks.fw_ps_lock);
+                        }
+                        spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+                } else {
+                        rtlhal->fw_clk_change_in_progress = false;
+                        spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+                }
+        }
+
+        if (IS_IN_LOW_POWER_STATE_88E(rtlhal->fw_ps_state)) {
+                rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_SET_RPWM,
+                                              (u8 *)(&rpwm_val));
+                if (FW_PS_IS_ACK(rpwm_val)) {
+                        isr_regaddr = REG_HISR;
+                        content = rtl_read_dword(rtlpriv, isr_regaddr);
+                        while (!(content & IMR_CPWM) && (count < 500)) {
+                                udelay(50);
+                                count++;
+                                content = rtl_read_dword(rtlpriv, isr_regaddr);
+                        }
+
+                        if (content & IMR_CPWM) {
+                                rtl_write_word(rtlpriv, isr_regaddr, 0x0100);
+                                rtlhal->fw_ps_state = FW_PS_STATE_RF_ON_88E;
+                                RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+                                         "Receive CPWM INT!!! Set pHalData->FwPSState = %X\n",
+                                         rtlhal->fw_ps_state);
+                        }
+                }
+
+                spin_lock_bh(&rtlpriv->locks.fw_ps_lock);
+                rtlhal->fw_clk_change_in_progress = false;
+                spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+                if (schedule_timer) {
+                        mod_timer(&rtlpriv->works.fw_clockoff_timer,
+                                  jiffies + MSECS(10));
+                }
+        } else  {
+                spin_lock_bh(&rtlpriv->locks.fw_ps_lock);
+                rtlhal->fw_clk_change_in_progress = false;
+                spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+        }
+}
+
+static void _rtl88ee_set_fw_clock_off(struct ieee80211_hw *hw,
+                                      u8 rpwm_val)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl8192_tx_ring *ring;
+        enum rf_pwrstate rtstate;
+        bool schedule_timer = false;
+        u8 queue;
+
+        if (!rtlhal->fw_ready)
+                return;
+        if (!rtlpriv->psc.fw_current_inpsmode)
+                return;
+        if (!rtlhal->allow_sw_to_change_hwclc)
+                return;
+        rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RF_STATE, (u8 *)(&rtstate));
+        if (rtstate == ERFOFF || rtlpriv->psc.inactive_pwrstate == ERFOFF)
+                return;
+
+        for (queue = 0; queue < RTL_PCI_MAX_TX_QUEUE_COUNT; queue++) {
+                ring = &rtlpci->tx_ring[queue];
+                if (skb_queue_len(&ring->queue)) {
+                        schedule_timer = true;
+                        break;
+                }
+        }
+
+        if (schedule_timer) {
+                mod_timer(&rtlpriv->works.fw_clockoff_timer,
+                          jiffies + MSECS(10));
+                return;
+        }
+
+        if (FW_PS_STATE(rtlhal->fw_ps_state) !=
+            FW_PS_STATE_RF_OFF_LOW_PWR_88E) {
+                spin_lock_bh(&rtlpriv->locks.fw_ps_lock);
+                if (!rtlhal->fw_clk_change_in_progress) {
+                        rtlhal->fw_clk_change_in_progress = true;
+                        spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+                        rtlhal->fw_ps_state = FW_PS_STATE(rpwm_val);
+                        rtl_write_word(rtlpriv, REG_HISR, 0x0100);
+                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SET_RPWM,
+                                                      (u8 *)(&rpwm_val));
+                        spin_lock_bh(&rtlpriv->locks.fw_ps_lock);
+                        rtlhal->fw_clk_change_in_progress = false;
+                        spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+                } else {
+                        spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+                        mod_timer(&rtlpriv->works.fw_clockoff_timer,
+                                  jiffies + MSECS(10));
+                }
+        }
+}
+
+static void _rtl88ee_set_fw_ps_rf_on(struct ieee80211_hw *hw)
+{
+        u8 rpwm_val = 0;
+
+        rpwm_val |= (FW_PS_STATE_RF_OFF_88E | FW_PS_ACK);
+        _rtl88ee_set_fw_clock_on(hw, rpwm_val, true);
+}
+
+static void _rtl88ee_set_fw_ps_rf_off_low_power(struct ieee80211_hw *hw)
+{
+        u8 rpwm_val = 0;
+
+        rpwm_val |= FW_PS_STATE_RF_OFF_LOW_PWR_88E;
+        _rtl88ee_set_fw_clock_off(hw, rpwm_val);
+}
+
+void rtl88ee_fw_clk_off_timer_callback(unsigned long data)
+{
+        struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+
+        _rtl88ee_set_fw_ps_rf_off_low_power(hw);
+}
+
+static void _rtl88ee_fwlps_leave(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        bool fw_current_inps = false;
+        u8 rpwm_val = 0, fw_pwrmode = FW_PS_ACTIVE_MODE;
+
+        if (ppsc->low_power_enable) {
+                rpwm_val = (FW_PS_STATE_ALL_ON_88E|FW_PS_ACK);/* RF on */
+                _rtl88ee_set_fw_clock_on(hw, rpwm_val, false);
+                rtlhal->allow_sw_to_change_hwclc = false;
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_H2C_FW_PWRMODE,
+                                              (u8 *)(&fw_pwrmode));
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_FW_PSMODE_STATUS,
+                                              (u8 *)(&fw_current_inps));
+        } else {
+                rpwm_val = FW_PS_STATE_ALL_ON_88E;      /* RF on */
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SET_RPWM,
+                                              (u8 *)(&rpwm_val));
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_H2C_FW_PWRMODE,
+                                              (u8 *)(&fw_pwrmode));
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_FW_PSMODE_STATUS,
+                                              (u8 *)(&fw_current_inps));
+        }
+}
+
+static void _rtl88ee_fwlps_enter(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        bool fw_current_inps = true;
+        u8 rpwm_val;
+
+        if (ppsc->low_power_enable) {
+                rpwm_val = FW_PS_STATE_RF_OFF_LOW_PWR_88E;      /* RF off */
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_FW_PSMODE_STATUS,
+                                              (u8 *)(&fw_current_inps));
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_H2C_FW_PWRMODE,
+                                              (u8 *)(&ppsc->fwctrl_psmode));
+                rtlhal->allow_sw_to_change_hwclc = true;
+                _rtl88ee_set_fw_clock_off(hw, rpwm_val);
+        } else {
+                rpwm_val = FW_PS_STATE_RF_OFF_88E;      /* RF off */
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_FW_PSMODE_STATUS,
+                                              (u8 *)(&fw_current_inps));
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_H2C_FW_PWRMODE,
+                                              (u8 *)(&ppsc->fwctrl_psmode));
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SET_RPWM,
+                                              (u8 *)(&rpwm_val));
+        }
+}
+
+void rtl88ee_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+        switch (variable) {
+        case HW_VAR_RCR:
+                *((u32 *)(val)) = rtlpci->receive_config;
+                break;
+        case HW_VAR_RF_STATE:
+                *((enum rf_pwrstate *)(val)) = ppsc->rfpwr_state;
+                break;
+        case HW_VAR_FWLPS_RF_ON:{
+                        enum rf_pwrstate rfstate;
+                        u32 val_rcr;
+
+                        rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RF_STATE,
+                                                      (u8 *)(&rfstate));
+                        if (rfstate == ERFOFF) {
+                                *((bool *)(val)) = true;
+                        } else {
+                                val_rcr = rtl_read_dword(rtlpriv, REG_RCR);
+                                val_rcr &= 0x00070000;
+                                if (val_rcr)
+                                        *((bool *)(val)) = false;
+                                else
+                                        *((bool *)(val)) = true;
+                        }
+                        break;
+                }
+        case HW_VAR_FW_PSMODE_STATUS:
+                *((bool *)(val)) = ppsc->fw_current_inpsmode;
+                break;
+        case HW_VAR_CORRECT_TSF:{
+                u64 tsf;
+                u32 *ptsf_low = (u32 *)&tsf;
+                u32 *ptsf_high = ((u32 *)&tsf) + 1;
+
+                *ptsf_high = rtl_read_dword(rtlpriv, (REG_TSFTR + 4));
+                *ptsf_low = rtl_read_dword(rtlpriv, REG_TSFTR);
+
+                *((u64 *)(val)) = tsf;
+                break; }
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "switch case not process %x\n", variable);
+                break;
+        }
+}
+
+void rtl88ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        u8 idx;
+
+        switch (variable) {
+        case HW_VAR_ETHER_ADDR:
+                for (idx = 0; idx < ETH_ALEN; idx++)
+                        rtl_write_byte(rtlpriv, (REG_MACID + idx), val[idx]);
+                break;
+        case HW_VAR_BASIC_RATE:{
+                u16 rate_cfg = ((u16 *)val)[0];
+                u8 rate_index = 0;
+                rate_cfg = rate_cfg & 0x15f;
+                rate_cfg |= 0x01;
+                rtl_write_byte(rtlpriv, REG_RRSR, rate_cfg & 0xff);
+                rtl_write_byte(rtlpriv, REG_RRSR + 1, (rate_cfg >> 8) & 0xff);
+                while (rate_cfg > 0x1) {
+                        rate_cfg = (rate_cfg >> 1);
+                        rate_index++;
+                }
+                rtl_write_byte(rtlpriv, REG_INIRTS_RATE_SEL, rate_index);
+                break; }
+        case HW_VAR_BSSID:
+                for (idx = 0; idx < ETH_ALEN; idx++)
+                        rtl_write_byte(rtlpriv, (REG_BSSID + idx), val[idx]);
+                break;
+        case HW_VAR_SIFS:
+                rtl_write_byte(rtlpriv, REG_SIFS_CTX + 1, val[0]);
+                rtl_write_byte(rtlpriv, REG_SIFS_TRX + 1, val[1]);
+
+                rtl_write_byte(rtlpriv, REG_SPEC_SIFS + 1, val[0]);
+                rtl_write_byte(rtlpriv, REG_MAC_SPEC_SIFS + 1, val[0]);
+
+                if (!mac->ht_enable)
+                        rtl_write_word(rtlpriv, REG_RESP_SIFS_OFDM, 0x0e0e);
+                else
+                        rtl_write_word(rtlpriv, REG_RESP_SIFS_OFDM,
+                                       *((u16 *)val));
+                break;
+        case HW_VAR_SLOT_TIME:{
+                u8 e_aci;
+
+                RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD,
+                         "HW_VAR_SLOT_TIME %x\n", val[0]);
+
+                rtl_write_byte(rtlpriv, REG_SLOT, val[0]);
+
+                for (e_aci = 0; e_aci < AC_MAX; e_aci++) {
+                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_AC_PARAM,
+                                                      (u8 *)(&e_aci));
+                }
+                break; }
+        case HW_VAR_ACK_PREAMBLE:{
+                u8 reg_tmp;
+                u8 short_preamble = (bool) (*(u8 *)val);
+                reg_tmp = rtl_read_byte(rtlpriv, REG_TRXPTCL_CTL+2);
+                if (short_preamble) {
+                        reg_tmp |= 0x02;
+                        rtl_write_byte(rtlpriv, REG_TRXPTCL_CTL + 2, reg_tmp);
+                } else {
+                        reg_tmp |= 0xFD;
+                        rtl_write_byte(rtlpriv, REG_TRXPTCL_CTL + 2, reg_tmp);
+                }
+                break; }
+        case HW_VAR_WPA_CONFIG:
+                rtl_write_byte(rtlpriv, REG_SECCFG, *((u8 *)val));
+                break;
+        case HW_VAR_AMPDU_MIN_SPACE:{
+                u8 min_spacing_to_set;
+                u8 sec_min_space;
+
+                min_spacing_to_set = *((u8 *)val);
+                if (min_spacing_to_set <= 7) {
+                        sec_min_space = 0;
+
+                        if (min_spacing_to_set < sec_min_space)
+                                min_spacing_to_set = sec_min_space;
+
+                        mac->min_space_cfg = ((mac->min_space_cfg &
+                                               0xf8) | min_spacing_to_set);
+
+                        *val = min_spacing_to_set;
+
+                        RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD,
+                                 "Set HW_VAR_AMPDU_MIN_SPACE: %#x\n",
+                                  mac->min_space_cfg);
+
+                        rtl_write_byte(rtlpriv, REG_AMPDU_MIN_SPACE,
+                                       mac->min_space_cfg);
+                }
+                break; }
+        case HW_VAR_SHORTGI_DENSITY:{
+                u8 density_to_set;
+
+                density_to_set = *((u8 *)val);
+                mac->min_space_cfg |= (density_to_set << 3);
+
+                RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD,
+                         "Set HW_VAR_SHORTGI_DENSITY: %#x\n",
+                          mac->min_space_cfg);
+
+                rtl_write_byte(rtlpriv, REG_AMPDU_MIN_SPACE,
+                               mac->min_space_cfg);
+                break; }
+        case HW_VAR_AMPDU_FACTOR:{
+                u8 regtoset_normal[4] = { 0x41, 0xa8, 0x72, 0xb9 };
+                u8 factor;
+                u8 *reg = NULL;
+                u8 id = 0;
+
+                reg = regtoset_normal;
+
+                factor = *((u8 *)val);
+                if (factor <= 3) {
+                        factor = (1 << (factor + 2));
+                        if (factor > 0xf)
+                                factor = 0xf;
+
+                        for (id = 0; id < 4; id++) {
+                                if ((reg[id] & 0xf0) > (factor << 4))
+                                        reg[id] = (reg[id] & 0x0f) |
+                                                  (factor << 4);
+
+                                if ((reg[id] & 0x0f) > factor)
+                                        reg[id] = (reg[id] & 0xf0) | (factor);
+
+                                rtl_write_byte(rtlpriv, (REG_AGGLEN_LMT + id),
+                                               reg[id]);
+                        }
+
+                        RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD,
+                                 "Set HW_VAR_AMPDU_FACTOR: %#x\n", factor);
+                }
+                break; }
+        case HW_VAR_AC_PARAM:{
+                u8 e_aci = *((u8 *)val);
+                rtl88e_dm_init_edca_turbo(hw);
+
+                if (rtlpci->acm_method != eAcmWay2_SW)
+                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_ACM_CTRL,
+                                                      (u8 *)(&e_aci));
+                break; }
+        case HW_VAR_ACM_CTRL:{
+                u8 e_aci = *((u8 *)val);
+                union aci_aifsn *p_aci_aifsn =
+                    (union aci_aifsn *)(&(mac->ac[0].aifs));
+                u8 acm = p_aci_aifsn->f.acm;
+                u8 acm_ctrl = rtl_read_byte(rtlpriv, REG_ACMHWCTRL);
+
+                acm_ctrl = acm_ctrl | ((rtlpci->acm_method == 2) ? 0x0 : 0x1);
+
+                if (acm) {
+                        switch (e_aci) {
+                        case AC0_BE:
+                                acm_ctrl |= ACMHW_BEQEN;
+                                break;
+                        case AC2_VI:
+                                acm_ctrl |= ACMHW_VIQEN;
+                                break;
+                        case AC3_VO:
+                                acm_ctrl |= ACMHW_VOQEN;
+                                break;
+                        default:
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                                         "HW_VAR_ACM_CTRL acm set failed: eACI is %d\n",
+                                         acm);
+                                break;
+                        }
+                } else {
+                        switch (e_aci) {
+                        case AC0_BE:
+                                acm_ctrl &= (~ACMHW_BEQEN);
+                                break;
+                        case AC2_VI:
+                                acm_ctrl &= (~ACMHW_VIQEN);
+                                break;
+                        case AC3_VO:
+                                acm_ctrl &= (~ACMHW_BEQEN);
+                                break;
+                        default:
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                         "switch case not process\n");
+                                break;
+                        }
+                }
+
+                RT_TRACE(rtlpriv, COMP_QOS, DBG_TRACE,
+                         "SetHwReg8190pci(): [HW_VAR_ACM_CTRL] Write 0x%X\n",
+                         acm_ctrl);
+                rtl_write_byte(rtlpriv, REG_ACMHWCTRL, acm_ctrl);
+                break; }
+        case HW_VAR_RCR:
+                rtl_write_dword(rtlpriv, REG_RCR, ((u32 *)(val))[0]);
+                rtlpci->receive_config = ((u32 *)(val))[0];
+                break;
+        case HW_VAR_RETRY_LIMIT:{
+                u8 retry_limit = ((u8 *)(val))[0];
+
+                rtl_write_word(rtlpriv, REG_RL,
+                               retry_limit << RETRY_LIMIT_SHORT_SHIFT |
+                               retry_limit << RETRY_LIMIT_LONG_SHIFT);
+                break; }
+        case HW_VAR_DUAL_TSF_RST:
+                rtl_write_byte(rtlpriv, REG_DUAL_TSF_RST, (BIT(0) | BIT(1)));
+                break;
+        case HW_VAR_EFUSE_BYTES:
+                rtlefuse->efuse_usedbytes = *((u16 *)val);
+                break;
+        case HW_VAR_EFUSE_USAGE:
+                rtlefuse->efuse_usedpercentage = *((u8 *)val);
+                break;
+        case HW_VAR_IO_CMD:
+                rtl88e_phy_set_io_cmd(hw, (*(enum io_type *)val));
+                break;
+        case HW_VAR_SET_RPWM:{
+                u8 rpwm_val;
+
+                rpwm_val = rtl_read_byte(rtlpriv, REG_PCIE_HRPWM);
+                udelay(1);
+
+                if (rpwm_val & BIT(7)) {
+                        rtl_write_byte(rtlpriv, REG_PCIE_HRPWM,
+                                       (*(u8 *)val));
+                } else {
+                        rtl_write_byte(rtlpriv, REG_PCIE_HRPWM,
+                                       ((*(u8 *)val) | BIT(7)));
+                }
+                break; }
+        case HW_VAR_H2C_FW_PWRMODE:
+                rtl88e_set_fw_pwrmode_cmd(hw, (*(u8 *)val));
+                break;
+        case HW_VAR_FW_PSMODE_STATUS:
+                ppsc->fw_current_inpsmode = *((bool *)val);
+                break;
+        case HW_VAR_RESUME_CLK_ON:
+                _rtl88ee_set_fw_ps_rf_on(hw);
+                break;
+        case HW_VAR_FW_LPS_ACTION:{
+                bool enter_fwlps = *((bool *)val);
+
+                if (enter_fwlps)
+                        _rtl88ee_fwlps_enter(hw);
+                 else
+                        _rtl88ee_fwlps_leave(hw);
+                 break; }
+        case HW_VAR_H2C_FW_JOINBSSRPT:{
+                u8 mstatus = (*(u8 *)val);
+                u8 tmp, tmp_reg422, uval;
+                u8 count = 0, dlbcn_count = 0;
+                bool recover = false;
+
+                if (mstatus == RT_MEDIA_CONNECT) {
+                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_AID, NULL);
+
+                        tmp = rtl_read_byte(rtlpriv, REG_CR + 1);
+                        rtl_write_byte(rtlpriv, REG_CR + 1, (tmp | BIT(0)));
+
+                        _rtl88ee_set_bcn_ctrl_reg(hw, 0, BIT(3));
+                        _rtl88ee_set_bcn_ctrl_reg(hw, BIT(4), 0);
+
+                        tmp_reg422 = rtl_read_byte(rtlpriv,
+                                                   REG_FWHW_TXQ_CTRL + 2);
+                        rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
+                                       tmp_reg422 & (~BIT(6)));
+                        if (tmp_reg422 & BIT(6))
+                                recover = true;
+
+                        do {
+                                uval = rtl_read_byte(rtlpriv, REG_TDECTRL+2);
+                                rtl_write_byte(rtlpriv, REG_TDECTRL+2,
+                                               (uval | BIT(0)));
+                                _rtl88ee_return_beacon_queue_skb(hw);
+
+                                rtl88e_set_fw_rsvdpagepkt(hw, 0);
+                                uval = rtl_read_byte(rtlpriv, REG_TDECTRL+2);
+                                count = 0;
+                                while (!(uval & BIT(0)) && count < 20) {
+                                        count++;
+                                        udelay(10);
+                                        uval = rtl_read_byte(rtlpriv,
+                                                             REG_TDECTRL+2);
+                                }
+                                dlbcn_count++;
+                        } while (!(uval & BIT(0)) && dlbcn_count < 5);
+
+                        if (uval & BIT(0))
+                                rtl_write_byte(rtlpriv, REG_TDECTRL+2, BIT(0));
+
+                        _rtl88ee_set_bcn_ctrl_reg(hw, BIT(3), 0);
+                        _rtl88ee_set_bcn_ctrl_reg(hw, 0, BIT(4));
+
+                        if (recover) {
+                                rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
+                                               tmp_reg422);
+                        }
+                        rtl_write_byte(rtlpriv, REG_CR + 1, (tmp & ~(BIT(0))));
+                }
+                rtl88e_set_fw_joinbss_report_cmd(hw, (*(u8 *)val));
+                break; }
+        case HW_VAR_H2C_FW_P2P_PS_OFFLOAD:
+                rtl88e_set_p2p_ps_offload_cmd(hw, (*(u8 *)val));
+                break;
+        case HW_VAR_AID:{
+                u16 u2btmp;
+                u2btmp = rtl_read_word(rtlpriv, REG_BCN_PSR_RPT);
+                u2btmp &= 0xC000;
+                rtl_write_word(rtlpriv, REG_BCN_PSR_RPT, (u2btmp |
+                               mac->assoc_id));
+                break; }
+        case HW_VAR_CORRECT_TSF:{
+                u8 btype_ibss = ((u8 *)(val))[0];
+
+                if (btype_ibss == true)
+                        _rtl88ee_stop_tx_beacon(hw);
+
+                _rtl88ee_set_bcn_ctrl_reg(hw, 0, BIT(3));
+
+                rtl_write_dword(rtlpriv, REG_TSFTR,
+                                (u32) (mac->tsf & 0xffffffff));
+                rtl_write_dword(rtlpriv, REG_TSFTR + 4,
+                                (u32) ((mac->tsf >> 32) & 0xffffffff));
+
+                _rtl88ee_set_bcn_ctrl_reg(hw, BIT(3), 0);
+
+                if (btype_ibss == true)
+                        _rtl88ee_resume_tx_beacon(hw);
+                break; }
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "switch case not process %x\n", variable);
+                break;
+        }
+}
+
+static bool _rtl88ee_llt_write(struct ieee80211_hw *hw, u32 address, u32 data)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        bool status = true;
+        long count = 0;
+        u32 value = _LLT_INIT_ADDR(address) | _LLT_INIT_DATA(data) |
+                    _LLT_OP(_LLT_WRITE_ACCESS);
+
+        rtl_write_dword(rtlpriv, REG_LLT_INIT, value);
+
+        do {
+                value = rtl_read_dword(rtlpriv, REG_LLT_INIT);
+                if (_LLT_NO_ACTIVE == _LLT_OP_VALUE(value))
+                        break;
+
+                if (count > POLLING_LLT_THRESHOLD) {
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "Failed to polling write LLT done at address %d!\n",
+                                 address);
+                        status = false;
+                        break;
+                }
+        } while (++count);
+
+        return status;
+}
+
+static bool _rtl88ee_llt_table_init(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        unsigned short i;
+        u8 txpktbuf_bndy;
+        u8 maxpage;
+        bool status;
+
+        maxpage = 0xAF;
+        txpktbuf_bndy = 0xAB;
+
+        rtl_write_byte(rtlpriv, REG_RQPN_NPQ, 0x01);
+        rtl_write_dword(rtlpriv, REG_RQPN, 0x80730d29);
+
+
+        rtl_write_dword(rtlpriv, REG_TRXFF_BNDY, (0x25FF0000 | txpktbuf_bndy));
+        rtl_write_byte(rtlpriv, REG_TDECTRL + 1, txpktbuf_bndy);
+
+        rtl_write_byte(rtlpriv, REG_TXPKTBUF_BCNQ_BDNY, txpktbuf_bndy);
+        rtl_write_byte(rtlpriv, REG_TXPKTBUF_MGQ_BDNY, txpktbuf_bndy);
+
+        rtl_write_byte(rtlpriv, 0x45D, txpktbuf_bndy);
+        rtl_write_byte(rtlpriv, REG_PBP, 0x11);
+        rtl_write_byte(rtlpriv, REG_RX_DRVINFO_SZ, 0x4);
+
+        for (i = 0; i < (txpktbuf_bndy - 1); i++) {
+                status = _rtl88ee_llt_write(hw, i, i + 1);
+                if (true != status)
+                        return status;
+        }
+
+        status = _rtl88ee_llt_write(hw, (txpktbuf_bndy - 1), 0xFF);
+        if (true != status)
+                return status;
+
+        for (i = txpktbuf_bndy; i < maxpage; i++) {
+                status = _rtl88ee_llt_write(hw, i, (i + 1));
+                if (true != status)
+                        return status;
+        }
+
+        status = _rtl88ee_llt_write(hw, maxpage, txpktbuf_bndy);
+        if (true != status)
+                return status;
+
+        return true;
+}
+
+static void _rtl88ee_gen_refresh_led_state(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        struct rtl_led *pLed0 = &(pcipriv->ledctl.sw_led0);
+
+        if (rtlpriv->rtlhal.up_first_time)
+                return;
+
+        if (ppsc->rfoff_reason == RF_CHANGE_BY_IPS)
+                rtl88ee_sw_led_on(hw, pLed0);
+        else if (ppsc->rfoff_reason == RF_CHANGE_BY_INIT)
+                rtl88ee_sw_led_on(hw, pLed0);
+        else
+                rtl88ee_sw_led_off(hw, pLed0);
+}
+
+static bool _rtl88ee_init_mac(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u8 bytetmp;
+        u16 wordtmp;
+
+        /*Disable XTAL OUTPUT for power saving. YJ, add, 111206. */
+        bytetmp = rtl_read_byte(rtlpriv, REG_XCK_OUT_CTRL) & (~BIT(0));
+        rtl_write_byte(rtlpriv, REG_XCK_OUT_CTRL, bytetmp);
+        /*Auto Power Down to CHIP-off State*/
+        bytetmp = rtl_read_byte(rtlpriv, REG_APS_FSMCO + 1) & (~BIT(7));
+        rtl_write_byte(rtlpriv, REG_APS_FSMCO + 1, bytetmp);
+
+        rtl_write_byte(rtlpriv, REG_RSV_CTRL, 0x00);
+        /* HW Power on sequence */
+        if (!rtl88_hal_pwrseqcmdparsing(rtlpriv, PWR_CUT_ALL_MSK,
+                                        PWR_FAB_ALL_MSK, PWR_INTF_PCI_MSK,
+                                        Rtl8188E_NIC_ENABLE_FLOW)) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                         "init MAC Fail as rtl88_hal_pwrseqcmdparsing\n");
+                return false;
+        }
+
+        bytetmp = rtl_read_byte(rtlpriv, REG_APS_FSMCO) | BIT(4);
+        rtl_write_byte(rtlpriv, REG_APS_FSMCO, bytetmp);
+
+        bytetmp = rtl_read_byte(rtlpriv, REG_PCIE_CTRL_REG+2);
+        rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG+2, bytetmp|BIT(2));
+
+        bytetmp = rtl_read_byte(rtlpriv, REG_WATCH_DOG+1);
+        rtl_write_byte(rtlpriv, REG_WATCH_DOG+1, bytetmp|BIT(7));
+
+        bytetmp = rtl_read_byte(rtlpriv, REG_AFE_XTAL_CTRL_EXT+1);
+        rtl_write_byte(rtlpriv, REG_AFE_XTAL_CTRL_EXT+1, bytetmp|BIT(1));
+
+        bytetmp = rtl_read_byte(rtlpriv, REG_TX_RPT_CTRL);
+        rtl_write_byte(rtlpriv, REG_TX_RPT_CTRL, bytetmp|BIT(1)|BIT(0));
+        rtl_write_byte(rtlpriv, REG_TX_RPT_CTRL+1, 2);
+        rtl_write_word(rtlpriv, REG_TX_RPT_TIME, 0xcdf0);
+
+        /*Add for wake up online*/
+        bytetmp = rtl_read_byte(rtlpriv, REG_SYS_CLKR);
+
+        rtl_write_byte(rtlpriv, REG_SYS_CLKR, bytetmp|BIT(3));
+        bytetmp = rtl_read_byte(rtlpriv, REG_GPIO_MUXCFG+1);
+        rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG+1, (bytetmp & (~BIT(4))));
+        rtl_write_byte(rtlpriv, 0x367, 0x80);
+
+        rtl_write_word(rtlpriv, REG_CR, 0x2ff);
+        rtl_write_byte(rtlpriv, REG_CR+1, 0x06);
+        rtl_write_byte(rtlpriv, REG_CR+2, 0x00);
+
+        if (!rtlhal->mac_func_enable) {
+                if (_rtl88ee_llt_table_init(hw) == false) {
+                        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                                 "LLT table init fail\n");
+                        return false;
+                }
+        }
+
+
+        rtl_write_dword(rtlpriv, REG_HISR, 0xffffffff);
+        rtl_write_dword(rtlpriv, REG_HISRE, 0xffffffff);
+
+        wordtmp = rtl_read_word(rtlpriv, REG_TRXDMA_CTRL);
+        wordtmp &= 0xf;
+        wordtmp |= 0xE771;
+        rtl_write_word(rtlpriv, REG_TRXDMA_CTRL, wordtmp);
+
+        rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
+        rtl_write_word(rtlpriv, REG_RXFLTMAP2, 0xffff);
+        rtl_write_dword(rtlpriv, REG_TCR, rtlpci->transmit_config);
+
+        rtl_write_dword(rtlpriv, REG_BCNQ_DESA,
+                        ((u64) rtlpci->tx_ring[BEACON_QUEUE].dma) &
+                        DMA_BIT_MASK(32));
+        rtl_write_dword(rtlpriv, REG_MGQ_DESA,
+                        (u64) rtlpci->tx_ring[MGNT_QUEUE].dma &
+                        DMA_BIT_MASK(32));
+        rtl_write_dword(rtlpriv, REG_VOQ_DESA,
+                        (u64) rtlpci->tx_ring[VO_QUEUE].dma & DMA_BIT_MASK(32));
+        rtl_write_dword(rtlpriv, REG_VIQ_DESA,
+                        (u64) rtlpci->tx_ring[VI_QUEUE].dma & DMA_BIT_MASK(32));
+        rtl_write_dword(rtlpriv, REG_BEQ_DESA,
+                        (u64) rtlpci->tx_ring[BE_QUEUE].dma & DMA_BIT_MASK(32));
+        rtl_write_dword(rtlpriv, REG_BKQ_DESA,
+                        (u64) rtlpci->tx_ring[BK_QUEUE].dma & DMA_BIT_MASK(32));
+        rtl_write_dword(rtlpriv, REG_HQ_DESA,
+                        (u64) rtlpci->tx_ring[HIGH_QUEUE].dma &
+                        DMA_BIT_MASK(32));
+        rtl_write_dword(rtlpriv, REG_RX_DESA,
+                        (u64) rtlpci->rx_ring[RX_MPDU_QUEUE].dma &
+                        DMA_BIT_MASK(32));
+
+        /* if we want to support 64 bit DMA, we should set it here,
+         * but at the moment we do not support 64 bit DMA
+         */
+
+        rtl_write_dword(rtlpriv, REG_INT_MIG, 0);
+
+        rtl_write_dword(rtlpriv, REG_MCUTST_1, 0x0);
+        rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG+1, 0);/*Enable RX DMA */
+
+        if (rtlhal->earlymode_enable) {/*Early mode enable*/
+                bytetmp = rtl_read_byte(rtlpriv, REG_EARLY_MODE_CONTROL);
+                bytetmp |= 0x1f;
+                rtl_write_byte(rtlpriv, REG_EARLY_MODE_CONTROL, bytetmp);
+                rtl_write_byte(rtlpriv, REG_EARLY_MODE_CONTROL+3, 0x81);
+        }
+        _rtl88ee_gen_refresh_led_state(hw);
+        return true;
+}
+
+static void _rtl88ee_hw_configure(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 reg_prsr;
+
+        reg_prsr = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+
+        rtl_write_dword(rtlpriv, REG_RRSR, reg_prsr);
+        rtl_write_byte(rtlpriv, REG_HWSEQ_CTRL, 0xFF);
+}
+
+static void _rtl88ee_enable_aspm_back_door(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        u8 tmp1byte = 0;
+        u32 tmp4Byte = 0, count;
+
+        rtl_write_word(rtlpriv, 0x354, 0x8104);
+        rtl_write_word(rtlpriv, 0x358, 0x24);
+
+        rtl_write_word(rtlpriv, 0x350, 0x70c);
+        rtl_write_byte(rtlpriv, 0x352, 0x2);
+        tmp1byte = rtl_read_byte(rtlpriv, 0x352);
+        count = 0;
+        while (tmp1byte && count < 20) {
+                udelay(10);
+                tmp1byte = rtl_read_byte(rtlpriv, 0x352);
+                count++;
+        }
+        if (0 == tmp1byte) {
+                tmp4Byte = rtl_read_dword(rtlpriv, 0x34c);
+                rtl_write_dword(rtlpriv, 0x348, tmp4Byte|BIT(31));
+                rtl_write_word(rtlpriv, 0x350, 0xf70c);
+                rtl_write_byte(rtlpriv, 0x352, 0x1);
+        }
+
+        tmp1byte = rtl_read_byte(rtlpriv, 0x352);
+        count = 0;
+        while (tmp1byte && count < 20) {
+                udelay(10);
+                tmp1byte = rtl_read_byte(rtlpriv, 0x352);
+                count++;
+        }
+
+        rtl_write_word(rtlpriv, 0x350, 0x718);
+        rtl_write_byte(rtlpriv, 0x352, 0x2);
+        tmp1byte = rtl_read_byte(rtlpriv, 0x352);
+        count = 0;
+        while (tmp1byte && count < 20) {
+                udelay(10);
+                tmp1byte = rtl_read_byte(rtlpriv, 0x352);
+                count++;
+        }
+        if (ppsc->support_backdoor || (0 == tmp1byte)) {
+                tmp4Byte = rtl_read_dword(rtlpriv, 0x34c);
+                rtl_write_dword(rtlpriv, 0x348, tmp4Byte|BIT(11)|BIT(12));
+                rtl_write_word(rtlpriv, 0x350, 0xf718);
+                rtl_write_byte(rtlpriv, 0x352, 0x1);
+        }
+        tmp1byte = rtl_read_byte(rtlpriv, 0x352);
+        count = 0;
+        while (tmp1byte && count < 20) {
+                udelay(10);
+                tmp1byte = rtl_read_byte(rtlpriv, 0x352);
+                count++;
+        }
+}
+
+void rtl88ee_enable_hw_security_config(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 sec_reg_value;
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+                 "PairwiseEncAlgorithm = %d GroupEncAlgorithm = %d\n",
+                 rtlpriv->sec.pairwise_enc_algorithm,
+                 rtlpriv->sec.group_enc_algorithm);
+
+        if (rtlpriv->cfg->mod_params->sw_crypto || rtlpriv->sec.use_sw_sec) {
+                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+                         "not open hw encryption\n");
+                return;
+        }
+        sec_reg_value = SCR_TXENCENABLE | SCR_RXDECENABLE;
+
+        if (rtlpriv->sec.use_defaultkey) {
+                sec_reg_value |= SCR_TXUSEDK;
+                sec_reg_value |= SCR_RXUSEDK;
+        }
+
+        sec_reg_value |= (SCR_RXBCUSEDK | SCR_TXBCUSEDK);
+
+        rtl_write_byte(rtlpriv, REG_CR + 1, 0x02);
+
+        RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+                 "The SECR-value %x\n", sec_reg_value);
+        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value);
+}
+
+int rtl88ee_hw_init(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        bool rtstatus = true;
+        int err = 0;
+        u8 tmp_u1b, u1byte;
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Rtl8188EE hw init\n");
+        rtlpriv->rtlhal.being_init_adapter = true;
+        rtlpriv->intf_ops->disable_aspm(hw);
+
+        tmp_u1b = rtl_read_byte(rtlpriv, REG_SYS_CLKR+1);
+        u1byte = rtl_read_byte(rtlpriv, REG_CR);
+        if ((tmp_u1b & BIT(3)) && (u1byte != 0 && u1byte != 0xEA)) {
+                rtlhal->mac_func_enable = true;
+        } else {
+                rtlhal->mac_func_enable = false;
+                rtlhal->fw_ps_state = FW_PS_STATE_ALL_ON_88E;
+        }
+
+        rtstatus = _rtl88ee_init_mac(hw);
+        if (rtstatus != true) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Init MAC failed\n");
+                err = 1;
+                return err;
+        }
+
+        err = rtl88e_download_fw(hw, false);
+        if (err) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                         "Failed to download FW. Init HW without FW now..\n");
+                err = 1;
+                rtlhal->fw_ready = false;
+                return err;
+        } else {
+                rtlhal->fw_ready = true;
+        }
+        /*fw related variable initialize */
+        rtlhal->last_hmeboxnum = 0;
+        rtlhal->fw_ps_state = FW_PS_STATE_ALL_ON_88E;
+        rtlhal->fw_clk_change_in_progress = false;
+        rtlhal->allow_sw_to_change_hwclc = false;
+        ppsc->fw_current_inpsmode = false;
+
+        rtl88e_phy_mac_config(hw);
+        /* because last function modifies RCR, we update
+         * rcr var here, or TP will be unstable for receive_config
+         * is wrong, RX RCR_ACRC32 will cause TP unstable & Rx
+         * RCR_APP_ICV will cause mac80211 disassoc for cisco 1252
+         */
+        rtlpci->receive_config &= ~(RCR_ACRC32 | RCR_AICV);
+        rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
+
+        rtl88e_phy_bb_config(hw);
+        rtl_set_bbreg(hw, RFPGA0_RFMOD, BCCKEN, 0x1);
+        rtl_set_bbreg(hw, RFPGA0_RFMOD, BOFDMEN, 0x1);
+
+        rtlphy->rf_mode = RF_OP_BY_SW_3WIRE;
+        rtl88e_phy_rf_config(hw);
+
+        rtlphy->rfreg_chnlval[0] = rtl_get_rfreg(hw, (enum radio_path)0,
+                                                 RF_CHNLBW, RFREG_OFFSET_MASK);
+        rtlphy->rfreg_chnlval[0] = rtlphy->rfreg_chnlval[0] & 0xfff00fff;
+
+        _rtl88ee_hw_configure(hw);
+        rtl_cam_reset_all_entry(hw);
+        rtl88ee_enable_hw_security_config(hw);
+
+        rtlhal->mac_func_enable = true;
+        ppsc->rfpwr_state = ERFON;
+
+        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_ETHER_ADDR, mac->mac_addr);
+        _rtl88ee_enable_aspm_back_door(hw);
+        rtlpriv->intf_ops->enable_aspm(hw);
+
+        if (ppsc->rfpwr_state == ERFON) {
+                if ((rtlefuse->antenna_div_type == CGCS_RX_HW_ANTDIV) ||
+                    ((rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV) &&
+                    (rtlhal->oem_id == RT_CID_819x_HP))) {
+                        rtl88e_phy_set_rfpath_switch(hw, true);
+                        rtlpriv->dm.fat_table.rx_idle_ant = MAIN_ANT;
+                } else {
+                        rtl88e_phy_set_rfpath_switch(hw, false);
+                        rtlpriv->dm.fat_table.rx_idle_ant = AUX_ANT;
+                }
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                         "rx idle ant %s\n",
+                         (rtlpriv->dm.fat_table.rx_idle_ant == MAIN_ANT) ?
+                         ("MAIN_ANT") : ("AUX_ANT"));
+
+                if (rtlphy->iqk_initialized) {
+                        rtl88e_phy_iq_calibrate(hw, true);
+                } else {
+                        rtl88e_phy_iq_calibrate(hw, false);
+                        rtlphy->iqk_initialized = true;
+                }
+                rtl88e_dm_check_txpower_tracking(hw);
+                rtl88e_phy_lc_calibrate(hw);
+        }
+
+        tmp_u1b = efuse_read_1byte(hw, 0x1FA);
+        if (!(tmp_u1b & BIT(0))) {
+                rtl_set_rfreg(hw, RF90_PATH_A, 0x15, 0x0F, 0x05);
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "PA BIAS path A\n");
+        }
+
+        if (!(tmp_u1b & BIT(4))) {
+                tmp_u1b = rtl_read_byte(rtlpriv, 0x16);
+                tmp_u1b &= 0x0F;
+                rtl_write_byte(rtlpriv, 0x16, tmp_u1b | 0x80);
+                udelay(10);
+                rtl_write_byte(rtlpriv, 0x16, tmp_u1b | 0x90);
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "under 1.5V\n");
+        }
+        rtl_write_byte(rtlpriv, REG_NAV_CTRL+2,  ((30000+127)/128));
+        rtl88e_dm_init(hw);
+        rtlpriv->rtlhal.being_init_adapter = false;
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "end of Rtl8188EE hw init %x\n",
+                 err);
+        return 0;
+}
+
+static enum version_8188e _rtl88ee_read_chip_version(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        enum version_8188e version = VERSION_UNKNOWN;
+        u32 value32;
+
+        value32 = rtl_read_dword(rtlpriv, REG_SYS_CFG);
+        if (value32 & TRP_VAUX_EN) {
+                version = (enum version_8188e) VERSION_TEST_CHIP_88E;
+        } else {
+                version = NORMAL_CHIP;
+                version = version | ((value32 & TYPE_ID) ? RF_TYPE_2T2R : 0);
+                version = version | ((value32 & VENDOR_ID) ?
+                          CHIP_VENDOR_UMC : 0);
+        }
+
+        rtlphy->rf_type = RF_1T1R;
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "Chip RF Type: %s\n", (rtlphy->rf_type == RF_2T2R) ?
+                 "RF_2T2R" : "RF_1T1R");
+
+        return version;
+}
+
+static int _rtl88ee_set_media_status(struct ieee80211_hw *hw,
+                                     enum nl80211_iftype type)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 bt_msr = rtl_read_byte(rtlpriv, MSR);
+        enum led_ctl_mode ledaction = LED_CTL_NO_LINK;
+        bt_msr &= 0xfc;
+
+        if (type == NL80211_IFTYPE_UNSPECIFIED ||
+            type == NL80211_IFTYPE_STATION) {
+                _rtl88ee_stop_tx_beacon(hw);
+                _rtl88ee_enable_bcn_sub_func(hw);
+        } else if (type == NL80211_IFTYPE_ADHOC ||
+                type == NL80211_IFTYPE_AP ||
+                type == NL80211_IFTYPE_MESH_POINT) {
+                _rtl88ee_resume_tx_beacon(hw);
+                _rtl88ee_disable_bcn_sub_func(hw);
+        } else {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                         "Set HW_VAR_MEDIA_STATUS: No such media status(%x).\n",
+                         type);
+        }
+
+        switch (type) {
+        case NL80211_IFTYPE_UNSPECIFIED:
+                bt_msr |= MSR_NOLINK;
+                ledaction = LED_CTL_LINK;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "Set Network type to NO LINK!\n");
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                bt_msr |= MSR_ADHOC;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "Set Network type to Ad Hoc!\n");
+                break;
+        case NL80211_IFTYPE_STATION:
+                bt_msr |= MSR_INFRA;
+                ledaction = LED_CTL_LINK;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "Set Network type to STA!\n");
+                break;
+        case NL80211_IFTYPE_AP:
+                bt_msr |= MSR_AP;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "Set Network type to AP!\n");
+                break;
+        case NL80211_IFTYPE_MESH_POINT:
+                bt_msr |= MSR_ADHOC;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "Set Network type to Mesh Point!\n");
+                break;
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Network type %d not support!\n", type);
+                return 1;
+        }
+
+        rtl_write_byte(rtlpriv, (MSR), bt_msr);
+        rtlpriv->cfg->ops->led_control(hw, ledaction);
+        if ((bt_msr & 0xfc) == MSR_AP)
+                rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x00);
+        else
+                rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x66);
+        return 0;
+}
+
+void rtl88ee_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        u32 reg_rcr = rtlpci->receive_config;
+
+        if (rtlpriv->psc.rfpwr_state != ERFON)
+                return;
+
+        if (check_bssid == true) {
+                reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                                              (u8 *)(&reg_rcr));
+                _rtl88ee_set_bcn_ctrl_reg(hw, 0, BIT(4));
+        } else if (check_bssid == false) {
+                reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+                _rtl88ee_set_bcn_ctrl_reg(hw, BIT(4), 0);
+                rtlpriv->cfg->ops->set_hw_reg(hw,
+                        HW_VAR_RCR, (u8 *)(&reg_rcr));
+        }
+}
+
+int rtl88ee_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        if (_rtl88ee_set_media_status(hw, type))
+                return -EOPNOTSUPP;
+
+        if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
+                if (type != NL80211_IFTYPE_AP &&
+                    type != NL80211_IFTYPE_MESH_POINT)
+                        rtl88ee_set_check_bssid(hw, true);
+        } else {
+                rtl88ee_set_check_bssid(hw, false);
+        }
+
+        return 0;
+}
+
+/* don't set REG_EDCA_BE_PARAM here because mac80211 will send pkt when scan */
+void rtl88ee_set_qos(struct ieee80211_hw *hw, int aci)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        rtl88e_dm_init_edca_turbo(hw);
+        switch (aci) {
+        case AC1_BK:
+                rtl_write_dword(rtlpriv, REG_EDCA_BK_PARAM, 0xa44f);
+                break;
+        case AC0_BE:
+                break;
+        case AC2_VI:
+                rtl_write_dword(rtlpriv, REG_EDCA_VI_PARAM, 0x5e4322);
+                break;
+        case AC3_VO:
+                rtl_write_dword(rtlpriv, REG_EDCA_VO_PARAM, 0x2f3222);
+                break;
+        default:
+                RT_ASSERT(false, "invalid aci: %d !\n", aci);
+                break;
+        }
+}
+
+void rtl88ee_enable_interrupt(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+        rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+        rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
+        rtlpci->irq_enabled = true;
+        /* there are some C2H CMDs have been sent before system interrupt
+         * is enabled, e.g., C2H, CPWM.
+         * So we need to clear all C2H events that FW has notified, otherwise
+         * FW won't schedule any commands anymore.
+         */
+        rtl_write_byte(rtlpriv, REG_C2HEVT_CLEAR, 0);
+        /*enable system interrupt*/
+        rtl_write_dword(rtlpriv, REG_HSIMR, rtlpci->sys_irq_mask & 0xFFFFFFFF);
+}
+
+void rtl88ee_disable_interrupt(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+        rtl_write_dword(rtlpriv, REG_HIMR, IMR_DISABLED);
+        rtl_write_dword(rtlpriv, REG_HIMRE, IMR_DISABLED);
+        rtlpci->irq_enabled = false;
+        synchronize_irq(rtlpci->pdev->irq);
+}
+
+static void _rtl88ee_poweroff_adapter(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u8 u1b_tmp;
+        u32 count = 0;
+        rtlhal->mac_func_enable = false;
+        rtlpriv->intf_ops->enable_aspm(hw);
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "POWER OFF adapter\n");
+        u1b_tmp = rtl_read_byte(rtlpriv, REG_TX_RPT_CTRL);
+        rtl_write_byte(rtlpriv, REG_TX_RPT_CTRL, u1b_tmp & (~BIT(1)));
+
+        u1b_tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
+        while (!(u1b_tmp & BIT(1)) && (count++ < 100)) {
+                udelay(10);
+                u1b_tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
+                count++;
+        }
+        rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG+1, 0xFF);
+
+        rtl88_hal_pwrseqcmdparsing(rtlpriv, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK,
+                                   PWR_INTF_PCI_MSK,
+                                   Rtl8188E_NIC_LPS_ENTER_FLOW);
+
+        rtl_write_byte(rtlpriv, REG_RF_CTRL, 0x00);
+
+        if ((rtl_read_byte(rtlpriv, REG_MCUFWDL) & BIT(7)) && rtlhal->fw_ready)
+                rtl88e_firmware_selfreset(hw);
+
+        u1b_tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN+1);
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, (u1b_tmp & (~BIT(2))));
+        rtl_write_byte(rtlpriv, REG_MCUFWDL, 0x00);
+
+        u1b_tmp = rtl_read_byte(rtlpriv, REG_32K_CTRL);
+        rtl_write_byte(rtlpriv, REG_32K_CTRL, (u1b_tmp & (~BIT(0))));
+
+        rtl88_hal_pwrseqcmdparsing(rtlpriv, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK,
+                                   PWR_INTF_PCI_MSK, Rtl8188E_NIC_DISABLE_FLOW);
+
+        u1b_tmp = rtl_read_byte(rtlpriv, REG_RSV_CTRL+1);
+        rtl_write_byte(rtlpriv, REG_RSV_CTRL+1, (u1b_tmp & (~BIT(3))));
+        u1b_tmp = rtl_read_byte(rtlpriv, REG_RSV_CTRL+1);
+        rtl_write_byte(rtlpriv, REG_RSV_CTRL+1, (u1b_tmp | BIT(3)));
+
+        rtl_write_byte(rtlpriv, REG_RSV_CTRL, 0x0E);
+
+        u1b_tmp = rtl_read_byte(rtlpriv, GPIO_IN);
+        rtl_write_byte(rtlpriv, GPIO_OUT, u1b_tmp);
+        rtl_write_byte(rtlpriv, GPIO_IO_SEL, 0x7F);
+
+        u1b_tmp = rtl_read_byte(rtlpriv, REG_GPIO_IO_SEL);
+        rtl_write_byte(rtlpriv, REG_GPIO_IO_SEL, (u1b_tmp << 4) | u1b_tmp);
+        u1b_tmp = rtl_read_byte(rtlpriv, REG_GPIO_IO_SEL+1);
+        rtl_write_byte(rtlpriv, REG_GPIO_IO_SEL+1, u1b_tmp | 0x0F);
+
+        rtl_write_dword(rtlpriv, REG_GPIO_IO_SEL_2+2, 0x00080808);
+}
+
+void rtl88ee_card_disable(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        enum nl80211_iftype opmode;
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "RTL8188ee card disable\n");
+
+        mac->link_state = MAC80211_NOLINK;
+        opmode = NL80211_IFTYPE_UNSPECIFIED;
+
+        _rtl88ee_set_media_status(hw, opmode);
+
+        if (rtlpriv->rtlhal.driver_is_goingto_unload ||
+            ppsc->rfoff_reason > RF_CHANGE_BY_PS)
+                rtlpriv->cfg->ops->led_control(hw, LED_CTL_POWER_OFF);
+
+        RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC);
+        _rtl88ee_poweroff_adapter(hw);
+
+        /* after power off we should do iqk again */
+        rtlpriv->phy.iqk_initialized = false;
+}
+
+void rtl88ee_interrupt_recognized(struct ieee80211_hw *hw,
+                                  u32 *p_inta, u32 *p_intb)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+        *p_inta = rtl_read_dword(rtlpriv, ISR) & rtlpci->irq_mask[0];
+        rtl_write_dword(rtlpriv, ISR, *p_inta);
+
+        *p_intb = rtl_read_dword(rtlpriv, REG_HISRE) & rtlpci->irq_mask[1];
+        rtl_write_dword(rtlpriv, REG_HISRE, *p_intb);
+}
+
+void rtl88ee_set_beacon_related_registers(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        u16 bcn_interval, atim_window;
+
+        bcn_interval = mac->beacon_interval;
+        atim_window = 2;        /*FIX MERGE */
+        rtl88ee_disable_interrupt(hw);
+        rtl_write_word(rtlpriv, REG_ATIMWND, atim_window);
+        rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval);
+        rtl_write_word(rtlpriv, REG_BCNTCFG, 0x660f);
+        rtl_write_byte(rtlpriv, REG_RXTSF_OFFSET_CCK, 0x18);
+        rtl_write_byte(rtlpriv, REG_RXTSF_OFFSET_OFDM, 0x18);
+        rtl_write_byte(rtlpriv, 0x606, 0x30);
+        rtlpci->reg_bcn_ctrl_val |= BIT(3);
+        rtl_write_byte(rtlpriv, REG_BCN_CTRL, (u8) rtlpci->reg_bcn_ctrl_val);
+        /*rtl88ee_enable_interrupt(hw);*/
+}
+
+void rtl88ee_set_beacon_interval(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        u16 bcn_interval = mac->beacon_interval;
+
+        RT_TRACE(rtlpriv, COMP_BEACON, DBG_DMESG,
+                 "beacon_interval:%d\n", bcn_interval);
+        /*rtl88ee_disable_interrupt(hw);*/
+        rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval);
+        /*rtl88ee_enable_interrupt(hw);*/
+}
+
+void rtl88ee_update_interrupt_mask(struct ieee80211_hw *hw,
+                                   u32 add_msr, u32 rm_msr)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+        RT_TRACE(rtlpriv, COMP_INTR, DBG_LOUD,
+                 "add_msr:%x, rm_msr:%x\n", add_msr, rm_msr);
+
+        rtl88ee_disable_interrupt(hw);
+        if (add_msr)
+                rtlpci->irq_mask[0] |= add_msr;
+        if (rm_msr)
+                rtlpci->irq_mask[0] &= (~rm_msr);
+        rtl88ee_enable_interrupt(hw);
+}
+
+static inline u8 get_chnl_group(u8 chnl)
+{
+        u8 group;
+
+        group = chnl / 3;
+        if (chnl == 14)
+                group = 5;
+
+        return group;
+}
+
+static void set_diff0_2g(struct txpower_info_2g *pwr2g, u8 *hwinfo, u32 path,
+                         u32 i, u32 eadr)
+{
+        pwr2g->bw40_diff[path][i] = 0;
+        if (hwinfo[eadr] == 0xFF) {
+                pwr2g->bw20_diff[path][i] = 0x02;
+        } else {
+                pwr2g->bw20_diff[path][i] = (hwinfo[eadr]&0xf0)>>4;
+                /*bit sign number to 8 bit sign number*/
+                if (pwr2g->bw20_diff[path][i] & BIT(3))
+                        pwr2g->bw20_diff[path][i] |= 0xF0;
+        }
+
+        if (hwinfo[eadr] == 0xFF) {
+                pwr2g->ofdm_diff[path][i] = 0x04;
+        } else {
+                pwr2g->ofdm_diff[path][i] = (hwinfo[eadr] & 0x0f);
+                /*bit sign number to 8 bit sign number*/
+                if (pwr2g->ofdm_diff[path][i] & BIT(3))
+                        pwr2g->ofdm_diff[path][i] |= 0xF0;
+        }
+        pwr2g->cck_diff[path][i] = 0;
+}
+
+static void set_diff0_5g(struct txpower_info_5g *pwr5g, u8 *hwinfo, u32 path,
+                         u32 i, u32 eadr)
+{
+        pwr5g->bw40_diff[path][i] = 0;
+        if (hwinfo[eadr] == 0xFF) {
+                pwr5g->bw20_diff[path][i] = 0;
+        } else {
+                pwr5g->bw20_diff[path][i] = (hwinfo[eadr]&0xf0)>>4;
+                /*bit sign number to 8 bit sign number*/
+                if (pwr5g->bw20_diff[path][i] & BIT(3))
+                        pwr5g->bw20_diff[path][i] |= 0xF0;
+        }
+
+        if (hwinfo[eadr] == 0xFF) {
+                pwr5g->ofdm_diff[path][i] = 0x04;
+        } else {
+                pwr5g->ofdm_diff[path][i] = (hwinfo[eadr] & 0x0f);
+                /*bit sign number to 8 bit sign number*/
+                if (pwr5g->ofdm_diff[path][i] & BIT(3))
+                        pwr5g->ofdm_diff[path][i] |= 0xF0;
+        }
+}
+
+static void set_diff1_2g(struct txpower_info_2g *pwr2g, u8 *hwinfo, u32 path,
+                         u32 i, u32 eadr)
+{
+        if (hwinfo[eadr] == 0xFF) {
+                pwr2g->bw40_diff[path][i] = 0xFE;
+        } else {
+                pwr2g->bw40_diff[path][i] = (hwinfo[eadr]&0xf0)>>4;
+                if (pwr2g->bw40_diff[path][i] & BIT(3))
+                        pwr2g->bw40_diff[path][i] |= 0xF0;
+        }
+
+        if (hwinfo[eadr] == 0xFF) {
+                pwr2g->bw20_diff[path][i] = 0xFE;
+        } else {
+                pwr2g->bw20_diff[path][i] = (hwinfo[eadr]&0x0f);
+                if (pwr2g->bw20_diff[path][i] & BIT(3))
+                        pwr2g->bw20_diff[path][i] |= 0xF0;
+        }
+}
+
+static void set_diff1_5g(struct txpower_info_5g *pwr5g, u8 *hwinfo, u32 path,
+                         u32 i, u32 eadr)
+{
+        if (hwinfo[eadr] == 0xFF) {
+                pwr5g->bw40_diff[path][i] = 0xFE;
+        } else {
+                pwr5g->bw40_diff[path][i] = (hwinfo[eadr]&0xf0)>>4;
+                if (pwr5g->bw40_diff[path][i] & BIT(3))
+                        pwr5g->bw40_diff[path][i] |= 0xF0;
+        }
+
+        if (hwinfo[eadr] == 0xFF) {
+                pwr5g->bw20_diff[path][i] = 0xFE;
+        } else {
+                pwr5g->bw20_diff[path][i] = (hwinfo[eadr] & 0x0f);
+                if (pwr5g->bw20_diff[path][i] & BIT(3))
+                        pwr5g->bw20_diff[path][i] |= 0xF0;
+        }
+}
+
+static void set_diff2_2g(struct txpower_info_2g *pwr2g, u8 *hwinfo, u32 path,
+                         u32 i, u32 eadr)
+{
+        if (hwinfo[eadr] == 0xFF) {
+                pwr2g->ofdm_diff[path][i] = 0xFE;
+        } else {
+                pwr2g->ofdm_diff[path][i] = (hwinfo[eadr]&0xf0)>>4;
+                if (pwr2g->ofdm_diff[path][i] & BIT(3))
+                        pwr2g->ofdm_diff[path][i] |= 0xF0;
+        }
+
+        if (hwinfo[eadr] == 0xFF) {
+                pwr2g->cck_diff[path][i] = 0xFE;
+        } else {
+                pwr2g->cck_diff[path][i] = (hwinfo[eadr]&0x0f);
+                if (pwr2g->cck_diff[path][i] & BIT(3))
+                        pwr2g->cck_diff[path][i] |= 0xF0;
+        }
+}
+
+static void _rtl8188e_read_power_value_fromprom(struct ieee80211_hw *hw,
+                                                struct txpower_info_2g *pwr2g,
+                                                struct txpower_info_5g *pwr5g,
+                                                bool autoload_fail,
+                                                u8 *hwinfo)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 path, eadr = EEPROM_TX_PWR_INX, i;
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "hal_ReadPowerValueFromPROM88E(): PROMContent[0x%x]= 0x%x\n",
+                 (eadr+1), hwinfo[eadr+1]);
+        if (0xFF == hwinfo[eadr+1])
+                autoload_fail = true;
+
+        if (autoload_fail) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                         "auto load fail : Use Default value!\n");
+                for (path = 0; path < MAX_RF_PATH; path++) {
+                        /* 2.4G default value */
+                        for (i = 0; i < MAX_CHNL_GROUP_24G; i++) {
+                                pwr2g->index_cck_base[path][i] = 0x2D;
+                                pwr2g->index_bw40_base[path][i] = 0x2D;
+                        }
+                        for (i = 0; i < MAX_TX_COUNT; i++) {
+                                if (i == 0) {
+                                        pwr2g->bw20_diff[path][0] = 0x02;
+                                        pwr2g->ofdm_diff[path][0] = 0x04;
+                                } else {
+                                        pwr2g->bw20_diff[path][i] = 0xFE;
+                                        pwr2g->bw40_diff[path][i] = 0xFE;
+                                        pwr2g->cck_diff[path][i] = 0xFE;
+                                        pwr2g->ofdm_diff[path][i] = 0xFE;
+                                }
+                        }
+                }
+                return;
+        }
+
+        for (path = 0; path < MAX_RF_PATH; path++) {
+                /*2.4G default value*/
+                for (i = 0; i < MAX_CHNL_GROUP_24G; i++) {
+                        pwr2g->index_cck_base[path][i] = hwinfo[eadr++];
+                        if (pwr2g->index_cck_base[path][i] == 0xFF)
+                                pwr2g->index_cck_base[path][i] = 0x2D;
+                }
+                for (i = 0; i < MAX_CHNL_GROUP_24G; i++) {
+                        pwr2g->index_bw40_base[path][i] = hwinfo[eadr++];
+                        if (pwr2g->index_bw40_base[path][i] == 0xFF)
+                                pwr2g->index_bw40_base[path][i] = 0x2D;
+                }
+                for (i = 0; i < MAX_TX_COUNT; i++) {
+                        if (i == 0) {
+                                set_diff0_2g(pwr2g, hwinfo, path, i, eadr);
+                                eadr++;
+                        } else {
+                                set_diff1_2g(pwr2g, hwinfo, path, i, eadr);
+                                eadr++;
+
+                                set_diff2_2g(pwr2g, hwinfo, path, i, eadr);
+                                eadr++;
+                        }
+                }
+
+                /*5G default value*/
+                for (i = 0; i < MAX_CHNL_GROUP_5G; i++) {
+                        pwr5g->index_bw40_base[path][i] = hwinfo[eadr++];
+                        if (pwr5g->index_bw40_base[path][i] == 0xFF)
+                                pwr5g->index_bw40_base[path][i] = 0xFE;
+                }
+
+                for (i = 0; i < MAX_TX_COUNT; i++) {
+                        if (i == 0) {
+                                set_diff0_5g(pwr5g, hwinfo, path, i, eadr);
+                                eadr++;
+                        } else {
+                                set_diff1_5g(pwr5g, hwinfo, path, i, eadr);
+                                eadr++;
+                        }
+                }
+
+                if (hwinfo[eadr] == 0xFF) {
+                        pwr5g->ofdm_diff[path][1] = 0xFE;
+                        pwr5g->ofdm_diff[path][2] = 0xFE;
+                } else {
+                        pwr5g->ofdm_diff[path][1] = (hwinfo[eadr] & 0xf0) >> 4;
+                        pwr5g->ofdm_diff[path][2] = (hwinfo[eadr] & 0x0f);
+                }
+                eadr++;
+
+                if (hwinfo[eadr] == 0xFF)
+                        pwr5g->ofdm_diff[path][3] = 0xFE;
+                else
+                        pwr5g->ofdm_diff[path][3] = (hwinfo[eadr]&0x0f);
+                eadr++;
+
+                for (i = 1; i < MAX_TX_COUNT; i++) {
+                        if (pwr5g->ofdm_diff[path][i] == 0xFF)
+                                pwr5g->ofdm_diff[path][i] = 0xFE;
+                        else if (pwr5g->ofdm_diff[path][i] & BIT(3))
+                                pwr5g->ofdm_diff[path][i] |= 0xF0;
+                }
+        }
+}
+
+static void _rtl88ee_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
+                                                 bool autoload_fail,
+                                                 u8 *hwinfo)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct txpower_info_2g pwrinfo24g;
+        struct txpower_info_5g pwrinfo5g;
+        u8 rf_path, index;
+        u8 i;
+        int jj = EEPROM_RF_BOARD_OPTION_88E;
+        int kk = EEPROM_THERMAL_METER_88E;
+
+        _rtl8188e_read_power_value_fromprom(hw, &pwrinfo24g, &pwrinfo5g,
+                                            autoload_fail, hwinfo);
+
+        for (rf_path = 0; rf_path < 2; rf_path++) {
+                for (i = 0; i < 14; i++) {
+                        index = get_chnl_group(i+1);
+
+                        rtlefuse->txpwrlevel_cck[rf_path][i] =
+                                 pwrinfo24g.index_cck_base[rf_path][index];
+                        if (i == 13)
+                                rtlefuse->txpwrlevel_ht40_1s[rf_path][i] =
+                                     pwrinfo24g.index_bw40_base[rf_path][4];
+                        else
+                                rtlefuse->txpwrlevel_ht40_1s[rf_path][i] =
+                                     pwrinfo24g.index_bw40_base[rf_path][index];
+                        rtlefuse->txpwr_ht20diff[rf_path][i] =
+                                 pwrinfo24g.bw20_diff[rf_path][0];
+                        rtlefuse->txpwr_legacyhtdiff[rf_path][i] =
+                                 pwrinfo24g.ofdm_diff[rf_path][0];
+                }
+
+                for (i = 0; i < 14; i++) {
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
+                                "RF(%d)-Ch(%d) [CCK / HT40_1S ] = "
+                                "[0x%x / 0x%x ]\n", rf_path, i,
+                                rtlefuse->txpwrlevel_cck[rf_path][i],
+                                rtlefuse->txpwrlevel_ht40_1s[rf_path][i]);
+                }
+        }
+
+        if (!autoload_fail)
+                rtlefuse->eeprom_thermalmeter = hwinfo[kk];
+        else
+                rtlefuse->eeprom_thermalmeter = EEPROM_DEFAULT_THERMALMETER;
+
+        if (rtlefuse->eeprom_thermalmeter == 0xff || autoload_fail) {
+                rtlefuse->apk_thermalmeterignore = true;
+                rtlefuse->eeprom_thermalmeter = EEPROM_DEFAULT_THERMALMETER;
+        }
+
+        rtlefuse->thermalmeter[0] = rtlefuse->eeprom_thermalmeter;
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
+                "thermalmeter = 0x%x\n", rtlefuse->eeprom_thermalmeter);
+
+        if (!autoload_fail) {
+                rtlefuse->eeprom_regulatory = hwinfo[jj] & 0x07;/*bit0~2*/
+                if (hwinfo[jj] == 0xFF)
+                        rtlefuse->eeprom_regulatory = 0;
+        } else {
+                rtlefuse->eeprom_regulatory = 0;
+        }
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
+                "eeprom_regulatory = 0x%x\n", rtlefuse->eeprom_regulatory);
+}
+
+static void _rtl88ee_read_adapter_info(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_pci_priv *rppriv = rtl_pcipriv(hw);
+        u16 i, usvalue;
+        u8 hwinfo[HWSET_MAX_SIZE];
+        u16 eeprom_id;
+        int jj = EEPROM_RF_BOARD_OPTION_88E;
+        int kk = EEPROM_RF_FEATURE_OPTION_88E;
+
+        if (rtlefuse->epromtype == EEPROM_BOOT_EFUSE) {
+                rtl_efuse_shadow_map_update(hw);
+
+                memcpy(hwinfo, &rtlefuse->efuse_map[EFUSE_INIT_MAP][0],
+                       HWSET_MAX_SIZE);
+        } else if (rtlefuse->epromtype == EEPROM_93C46) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "RTL819X Not boot from eeprom, check it !!");
+        }
+
+        RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_DMESG, ("MAP\n"),
+                      hwinfo, HWSET_MAX_SIZE);
+
+        eeprom_id = *((u16 *)&hwinfo[0]);
+        if (eeprom_id != RTL8188E_EEPROM_ID) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                         "EEPROM ID(%#x) is invalid!!\n", eeprom_id);
+                rtlefuse->autoload_failflag = true;
+        } else {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
+                rtlefuse->autoload_failflag = false;
+        }
+
+        if (rtlefuse->autoload_failflag == true)
+                return;
+        /*VID DID SVID SDID*/
+        rtlefuse->eeprom_vid = *(u16 *)&hwinfo[EEPROM_VID];
+        rtlefuse->eeprom_did = *(u16 *)&hwinfo[EEPROM_DID];
+        rtlefuse->eeprom_svid = *(u16 *)&hwinfo[EEPROM_SVID];
+        rtlefuse->eeprom_smid = *(u16 *)&hwinfo[EEPROM_SMID];
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROMId = 0x%4x\n", eeprom_id);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
+        /*customer ID*/
+        rtlefuse->eeprom_oemid = *(u8 *)&hwinfo[EEPROM_CUSTOMER_ID];
+        if (rtlefuse->eeprom_oemid == 0xFF)
+                rtlefuse->eeprom_oemid = 0;
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid);
+        /*EEPROM version*/
+        rtlefuse->eeprom_version = *(u16 *)&hwinfo[EEPROM_VERSION];
+        /*mac address*/
+        for (i = 0; i < 6; i += 2) {
+                usvalue = *(u16 *)&hwinfo[EEPROM_MAC_ADDR + i];
+                *((u16 *)(&rtlefuse->dev_addr[i])) = usvalue;
+        }
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+                 "dev_addr: %pM\n", rtlefuse->dev_addr);
+        /*channel plan */
+        rtlefuse->eeprom_channelplan = *(u8 *)&hwinfo[EEPROM_CHANNELPLAN];
+        /* set channel paln to world wide 13 */
+        rtlefuse->channel_plan = COUNTRY_CODE_WORLD_WIDE_13;
+        /*tx power*/
+        _rtl88ee_read_txpower_info_from_hwpg(hw, rtlefuse->autoload_failflag,
+                                             hwinfo);
+        rtlefuse->txpwr_fromeprom = true;
+
+        rtl8188ee_read_bt_coexist_info_from_hwpg(hw,
+                                                 rtlefuse->autoload_failflag,
+                                                 hwinfo);
+        /*board type*/
+        rtlefuse->board_type = (((*(u8 *)&hwinfo[jj]) & 0xE0) >> 5);
+        /*Wake on wlan*/
+        rtlefuse->wowlan_enable = ((hwinfo[kk] & 0x40) >> 6);
+        /*parse xtal*/
+        rtlefuse->crystalcap = hwinfo[EEPROM_XTAL_88E];
+        if (hwinfo[EEPROM_XTAL_88E])
+                rtlefuse->crystalcap = 0x20;
+        /*antenna diversity*/
+        rtlefuse->antenna_div_cfg = (hwinfo[jj] & 0x18) >> 3;
+        if (hwinfo[jj] == 0xFF)
+                rtlefuse->antenna_div_cfg = 0;
+        if (rppriv->bt_coexist.eeprom_bt_coexist != 0 &&
+            rppriv->bt_coexist.eeprom_bt_ant_num == ANT_X1)
+                rtlefuse->antenna_div_cfg = 0;
+
+        rtlefuse->antenna_div_type = hwinfo[EEPROM_RF_ANTENNA_OPT_88E];
+        if (rtlefuse->antenna_div_type == 0xFF)
+                rtlefuse->antenna_div_type = 0x01;
+        if (rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV ||
+            rtlefuse->antenna_div_type == CGCS_RX_HW_ANTDIV)
+                rtlefuse->antenna_div_cfg = 1;
+
+        if (rtlhal->oem_id == RT_CID_DEFAULT) {
+                switch (rtlefuse->eeprom_oemid) {
+                case EEPROM_CID_DEFAULT:
+                        if (rtlefuse->eeprom_did == 0x8179) {
+                                if (rtlefuse->eeprom_svid == 0x1025) {
+                                        rtlhal->oem_id = RT_CID_819x_Acer;
+                                } else if ((rtlefuse->eeprom_svid == 0x10EC &&
+                                            rtlefuse->eeprom_smid == 0x0179) ||
+                                            (rtlefuse->eeprom_svid == 0x17AA &&
+                                            rtlefuse->eeprom_smid == 0x0179)) {
+                                        rtlhal->oem_id = RT_CID_819x_Lenovo;
+                                } else if (rtlefuse->eeprom_svid == 0x103c &&
+                                         rtlefuse->eeprom_smid == 0x197d) {
+                                        rtlhal->oem_id = RT_CID_819x_HP;
+                                } else {
+                                        rtlhal->oem_id = RT_CID_DEFAULT;
+                                }
+                        } else {
+                                rtlhal->oem_id = RT_CID_DEFAULT;
+                        }
+                        break;
+                case EEPROM_CID_TOSHIBA:
+                        rtlhal->oem_id = RT_CID_TOSHIBA;
+                        break;
+                case EEPROM_CID_QMI:
+                        rtlhal->oem_id = RT_CID_819x_QMI;
+                        break;
+                case EEPROM_CID_WHQL:
+                default:
+                        rtlhal->oem_id = RT_CID_DEFAULT;
+                        break;
+                }
+        }
+}
+
+static void _rtl88ee_hal_customized_behavior(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+
+        pcipriv->ledctl.led_opendrain = true;
+
+        switch (rtlhal->oem_id) {
+        case RT_CID_819x_HP:
+                pcipriv->ledctl.led_opendrain = true;
+                break;
+        case RT_CID_819x_Lenovo:
+        case RT_CID_DEFAULT:
+        case RT_CID_TOSHIBA:
+        case RT_CID_CCX:
+        case RT_CID_819x_Acer:
+        case RT_CID_WHQL:
+        default:
+                break;
+        }
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+                 "RT Customized ID: 0x%02X\n", rtlhal->oem_id);
+}
+
+void rtl88ee_read_eeprom_info(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u8 tmp_u1b;
+
+        rtlhal->version = _rtl88ee_read_chip_version(hw);
+        if (get_rf_type(rtlphy) == RF_1T1R) {
+                rtlpriv->dm.rfpath_rxenable[0] = true;
+        } else {
+                rtlpriv->dm.rfpath_rxenable[0] = true;
+                rtlpriv->dm.rfpath_rxenable[1] = true;
+        }
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "VersionID = 0x%4x\n",
+                 rtlhal->version);
+        tmp_u1b = rtl_read_byte(rtlpriv, REG_9346CR);
+        if (tmp_u1b & BIT(4)) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EEPROM\n");
+                rtlefuse->epromtype = EEPROM_93C46;
+        } else {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EFUSE\n");
+                rtlefuse->epromtype = EEPROM_BOOT_EFUSE;
+        }
+        if (tmp_u1b & BIT(5)) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
+                rtlefuse->autoload_failflag = false;
+                _rtl88ee_read_adapter_info(hw);
+        } else {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Autoload ERR!!\n");
+        }
+        _rtl88ee_hal_customized_behavior(hw);
+}
+
+static void rtl88ee_update_hal_rate_table(struct ieee80211_hw *hw,
+                                          struct ieee80211_sta *sta)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci_priv *rppriv = rtl_pcipriv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u32 ratr_value;
+        u8 ratr_index = 0;
+        u8 nmode = mac->ht_enable;
+        u8 mimo_ps = IEEE80211_SMPS_OFF;
+        u16 shortgi_rate;
+        u32 tmp_ratr_value;
+        u8 ctx40 = mac->bw_40;
+        u16 cap = sta->ht_cap.cap;
+        u8 short40 = (cap & IEEE80211_HT_CAP_SGI_40) ?  1 : 0;
+        u8 short20 = (cap & IEEE80211_HT_CAP_SGI_20) ?  1 : 0;
+        enum wireless_mode wirelessmode = mac->mode;
+
+        if (rtlhal->current_bandtype == BAND_ON_5G)
+                ratr_value = sta->supp_rates[1] << 4;
+        else
+                ratr_value = sta->supp_rates[0];
+        if (mac->opmode == NL80211_IFTYPE_ADHOC)
+                ratr_value = 0xfff;
+        ratr_value |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
+                        sta->ht_cap.mcs.rx_mask[0] << 12);
+        switch (wirelessmode) {
+        case WIRELESS_MODE_B:
+                if (ratr_value & 0x0000000c)
+                        ratr_value &= 0x0000000d;
+                else
+                        ratr_value &= 0x0000000f;
+                break;
+        case WIRELESS_MODE_G:
+                ratr_value &= 0x00000FF5;
+                break;
+        case WIRELESS_MODE_N_24G:
+        case WIRELESS_MODE_N_5G:
+                nmode = 1;
+                if (mimo_ps == IEEE80211_SMPS_STATIC) {
+                        ratr_value &= 0x0007F005;
+                } else {
+                        u32 ratr_mask;
+
+                        if (get_rf_type(rtlphy) == RF_1T2R ||
+                            get_rf_type(rtlphy) == RF_1T1R)
+                                ratr_mask = 0x000ff005;
+                        else
+                                ratr_mask = 0x0f0ff005;
+
+                        ratr_value &= ratr_mask;
+                }
+                break;
+        default:
+                if (rtlphy->rf_type == RF_1T2R)
+                        ratr_value &= 0x000ff0ff;
+                else
+                        ratr_value &= 0x0f0ff0ff;
+
+                break;
+        }
+
+        if ((rppriv->bt_coexist.bt_coexistence) &&
+            (rppriv->bt_coexist.bt_coexist_type == BT_CSR_BC4) &&
+            (rppriv->bt_coexist.bt_cur_state) &&
+            (rppriv->bt_coexist.bt_ant_isolation) &&
+            ((rppriv->bt_coexist.bt_service == BT_SCO) ||
+            (rppriv->bt_coexist.bt_service == BT_BUSY)))
+                ratr_value &= 0x0fffcfc0;
+        else
+                ratr_value &= 0x0FFFFFFF;
+
+        if (nmode && ((ctx40 && short40) ||
+                      (!ctx40 && short20))) {
+                ratr_value |= 0x10000000;
+                tmp_ratr_value = (ratr_value >> 12);
+
+                for (shortgi_rate = 15; shortgi_rate > 0; shortgi_rate--) {
+                        if ((1 << shortgi_rate) & tmp_ratr_value)
+                                break;
+                }
+
+                shortgi_rate = (shortgi_rate << 12) | (shortgi_rate << 8) |
+                    (shortgi_rate << 4) | (shortgi_rate);
+        }
+
+        rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
+
+        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG,
+                 "%x\n", rtl_read_dword(rtlpriv, REG_ARFR0));
+}
+
+static void rtl88ee_update_hal_rate_mask(struct ieee80211_hw *hw,
+                                         struct ieee80211_sta *sta, u8 rssi)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_sta_info *sta_entry = NULL;
+        u32 ratr_bitmap;
+        u8 ratr_index;
+        u16 cap = sta->ht_cap.cap;
+        u8 ctx40 = (cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ? 1 : 0;
+        u8 short40 = (cap & IEEE80211_HT_CAP_SGI_40) ?  1 : 0;
+        u8 short20 = (cap & IEEE80211_HT_CAP_SGI_20) ?  1 : 0;
+        enum wireless_mode wirelessmode = 0;
+        bool shortgi = false;
+        u8 rate_mask[5];
+        u8 macid = 0;
+        u8 mimo_ps = IEEE80211_SMPS_OFF;
+
+        sta_entry = (struct rtl_sta_info *)sta->drv_priv;
+        wirelessmode = sta_entry->wireless_mode;
+        if (mac->opmode == NL80211_IFTYPE_STATION ||
+            mac->opmode == NL80211_IFTYPE_MESH_POINT)
+                ctx40 = mac->bw_40;
+        else if (mac->opmode == NL80211_IFTYPE_AP ||
+                 mac->opmode == NL80211_IFTYPE_ADHOC)
+                macid = sta->aid + 1;
+
+        if (rtlhal->current_bandtype == BAND_ON_5G)
+                ratr_bitmap = sta->supp_rates[1] << 4;
+        else
+                ratr_bitmap = sta->supp_rates[0];
+        if (mac->opmode == NL80211_IFTYPE_ADHOC)
+                ratr_bitmap = 0xfff;
+        ratr_bitmap |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
+                        sta->ht_cap.mcs.rx_mask[0] << 12);
+        switch (wirelessmode) {
+        case WIRELESS_MODE_B:
+                ratr_index = RATR_INX_WIRELESS_B;
+                if (ratr_bitmap & 0x0000000c)
+                        ratr_bitmap &= 0x0000000d;
+                else
+                        ratr_bitmap &= 0x0000000f;
+                break;
+        case WIRELESS_MODE_G:
+                ratr_index = RATR_INX_WIRELESS_GB;
+
+                if (rssi == 1)
+                        ratr_bitmap &= 0x00000f00;
+                else if (rssi == 2)
+                        ratr_bitmap &= 0x00000ff0;
+                else
+                        ratr_bitmap &= 0x00000ff5;
+                break;
+        case WIRELESS_MODE_A:
+                ratr_index = RATR_INX_WIRELESS_A;
+                ratr_bitmap &= 0x00000ff0;
+                break;
+        case WIRELESS_MODE_N_24G:
+        case WIRELESS_MODE_N_5G:
+                ratr_index = RATR_INX_WIRELESS_NGB;
+
+                if (mimo_ps == IEEE80211_SMPS_STATIC) {
+                        if (rssi == 1)
+                                ratr_bitmap &= 0x00070000;
+                        else if (rssi == 2)
+                                ratr_bitmap &= 0x0007f000;
+                        else
+                                ratr_bitmap &= 0x0007f005;
+                } else {
+                        if (rtlphy->rf_type == RF_1T2R ||
+                            rtlphy->rf_type == RF_1T1R) {
+                                if (ctx40) {
+                                        if (rssi == 1)
+                                                ratr_bitmap &= 0x000f0000;
+                                        else if (rssi == 2)
+                                                ratr_bitmap &= 0x000ff000;
+                                        else
+                                                ratr_bitmap &= 0x000ff015;
+                                } else {
+                                        if (rssi == 1)
+                                                ratr_bitmap &= 0x000f0000;
+                                        else if (rssi == 2)
+                                                ratr_bitmap &= 0x000ff000;
+                                        else
+                                                ratr_bitmap &= 0x000ff005;
+                                }
+                        } else {
+                                if (ctx40) {
+                                        if (rssi == 1)
+                                                ratr_bitmap &= 0x0f8f0000;
+                                        else if (rssi == 2)
+                                                ratr_bitmap &= 0x0f8ff000;
+                                        else
+                                                ratr_bitmap &= 0x0f8ff015;
+                                } else {
+                                        if (rssi == 1)
+                                                ratr_bitmap &= 0x0f8f0000;
+                                        else if (rssi == 2)
+                                                ratr_bitmap &= 0x0f8ff000;
+                                        else
+                                                ratr_bitmap &= 0x0f8ff005;
+                                }
+                        }
+                }
+
+                if ((ctx40 && short40) || (!ctx40 && short20)) {
+                        if (macid == 0)
+                                shortgi = true;
+                        else if (macid == 1)
+                                shortgi = false;
+                }
+                break;
+        default:
+                ratr_index = RATR_INX_WIRELESS_NGB;
+
+                if (rtlphy->rf_type == RF_1T2R)
+                        ratr_bitmap &= 0x000ff0ff;
+                else
+                        ratr_bitmap &= 0x0f0ff0ff;
+                break;
+        }
+        sta_entry->ratr_index = ratr_index;
+
+        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG,
+                 "ratr_bitmap :%x\n", ratr_bitmap);
+        *(u32 *)&rate_mask = (ratr_bitmap & 0x0fffffff) |
+                             (ratr_index << 28);
+        rate_mask[4] = macid | (shortgi ? 0x20 : 0x00) | 0x80;
+        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG,
+                 "Rate_index:%x, ratr_val:%x, %x:%x:%x:%x:%x\n",
+                 ratr_index, ratr_bitmap, rate_mask[0], rate_mask[1],
+                 rate_mask[2], rate_mask[3], rate_mask[4]);
+        rtl88e_fill_h2c_cmd(hw, H2C_88E_RA_MASK, 5, rate_mask);
+        _rtl88ee_set_bcn_ctrl_reg(hw, BIT(3), 0);
+}
+
+void rtl88ee_update_hal_rate_tbl(struct ieee80211_hw *hw,
+                struct ieee80211_sta *sta, u8 rssi)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        if (rtlpriv->dm.useramask)
+                rtl88ee_update_hal_rate_mask(hw, sta, rssi);
+        else
+                rtl88ee_update_hal_rate_table(hw, sta);
+}
+
+void rtl88ee_update_channel_access_setting(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        u16 sifs_timer;
+
+        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SLOT_TIME,
+                                      (u8 *)&mac->slot_time);
+        if (!mac->ht_enable)
+                sifs_timer = 0x0a0a;
+        else
+                sifs_timer = 0x0e0e;
+        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SIFS, (u8 *)&sifs_timer);
+}
+
+bool rtl88ee_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 *valid)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        enum rf_pwrstate state_toset;
+        u32 u4tmp;
+        bool actuallyset = false;
+
+        if (rtlpriv->rtlhal.being_init_adapter)
+                return false;
+
+        if (ppsc->swrf_processing)
+                return false;
+
+        spin_lock(&rtlpriv->locks.rf_ps_lock);
+        if (ppsc->rfchange_inprogress) {
+                spin_unlock(&rtlpriv->locks.rf_ps_lock);
+                return false;
+        } else {
+                ppsc->rfchange_inprogress = true;
+                spin_unlock(&rtlpriv->locks.rf_ps_lock);
+        }
+
+        u4tmp = rtl_read_dword(rtlpriv, REG_GPIO_OUTPUT);
+        state_toset = (u4tmp & BIT(31)) ? ERFON : ERFOFF;
+
+
+        if ((ppsc->hwradiooff == true) && (state_toset == ERFON)) {
+                RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+                         "GPIOChangeRF  - HW Radio ON, RF ON\n");
+
+                state_toset = ERFON;
+                ppsc->hwradiooff = false;
+                actuallyset = true;
+        } else if ((ppsc->hwradiooff == false) && (state_toset == ERFOFF)) {
+                RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+                         "GPIOChangeRF  - HW Radio OFF, RF OFF\n");
+
+                state_toset = ERFOFF;
+                ppsc->hwradiooff = true;
+                actuallyset = true;
+        }
+
+        if (actuallyset) {
+                spin_lock(&rtlpriv->locks.rf_ps_lock);
+                ppsc->rfchange_inprogress = false;
+                spin_unlock(&rtlpriv->locks.rf_ps_lock);
+        } else {
+                if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_HALT_NIC)
+                        RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC);
+
+                spin_lock(&rtlpriv->locks.rf_ps_lock);
+                ppsc->rfchange_inprogress = false;
+                spin_unlock(&rtlpriv->locks.rf_ps_lock);
+        }
+
+        *valid = 1;
+        return !ppsc->hwradiooff;
+}
+
+static void add_one_key(struct ieee80211_hw *hw, u8 *macaddr,
+                        struct rtl_mac *mac, u32 key, u32 id,
+                        u8 enc_algo, bool is_pairwise)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+
+        RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "add one entry\n");
+        if (is_pairwise) {
+                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "set Pairwise key\n");
+
+                rtl_cam_add_one_entry(hw, macaddr, key, id, enc_algo,
+                                      CAM_CONFIG_NO_USEDK,
+                                      rtlpriv->sec.key_buf[key]);
+        } else {
+                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "set group key\n");
+
+                if (mac->opmode == NL80211_IFTYPE_ADHOC) {
+                        rtl_cam_add_one_entry(hw, rtlefuse->dev_addr,
+                                              PAIRWISE_KEYIDX,
+                                              CAM_PAIRWISE_KEY_POSITION,
+                                              enc_algo,
+                                              CAM_CONFIG_NO_USEDK,
+                                              rtlpriv->sec.key_buf[id]);
+                }
+
+                rtl_cam_add_one_entry(hw, macaddr, key, id, enc_algo,
+                                      CAM_CONFIG_NO_USEDK,
+                                      rtlpriv->sec.key_buf[id]);
+        }
+}
+
+void rtl88ee_set_key(struct ieee80211_hw *hw, u32 key,
+                     u8 *mac_ad, bool is_group, u8 enc_algo,
+                     bool is_wepkey, bool clear_all)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        u8 *macaddr = mac_ad;
+        u32 id = 0;
+        bool is_pairwise = false;
+
+        static u8 cam_const_addr[4][6] = {
+                {0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+                {0x00, 0x00, 0x00, 0x00, 0x00, 0x01},
+                {0x00, 0x00, 0x00, 0x00, 0x00, 0x02},
+                {0x00, 0x00, 0x00, 0x00, 0x00, 0x03}
+        };
+        static u8 cam_const_broad[] = {
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+        };
+
+        if (clear_all) {
+                u8 idx = 0;
+                u8 cam_offset = 0;
+                u8 clear_number = 5;
+
+                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "clear_all\n");
+
+                for (idx = 0; idx < clear_number; idx++) {
+                        rtl_cam_mark_invalid(hw, cam_offset + idx);
+                        rtl_cam_empty_entry(hw, cam_offset + idx);
+
+                        if (idx < 5) {
+                                memset(rtlpriv->sec.key_buf[idx], 0,
+                                       MAX_KEY_LEN);
+                                rtlpriv->sec.key_len[idx] = 0;
+                        }
+                }
+
+        } else {
+                switch (enc_algo) {
+                case WEP40_ENCRYPTION:
+                        enc_algo = CAM_WEP40;
+                        break;
+                case WEP104_ENCRYPTION:
+                        enc_algo = CAM_WEP104;
+                        break;
+                case TKIP_ENCRYPTION:
+                        enc_algo = CAM_TKIP;
+                        break;
+                case AESCCMP_ENCRYPTION:
+                        enc_algo = CAM_AES;
+                        break;
+                default:
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "switch case not processed\n");
+                        enc_algo = CAM_TKIP;
+                        break;
+                }
+
+                if (is_wepkey || rtlpriv->sec.use_defaultkey) {
+                        macaddr = cam_const_addr[key];
+                        id = key;
+                } else {
+                        if (is_group) {
+                                macaddr = cam_const_broad;
+                                id = key;
+                        } else {
+                                if (mac->opmode == NL80211_IFTYPE_AP ||
+                                    mac->opmode == NL80211_IFTYPE_MESH_POINT) {
+                                        id = rtl_cam_get_free_entry(hw, mac_ad);
+                                        if (id >=  TOTAL_CAM_ENTRY) {
+                                                RT_TRACE(rtlpriv, COMP_SEC,
+                                                         DBG_EMERG,
+                                                         "Can not find free hw security cam entry\n");
+                                                return;
+                                        }
+                                } else {
+                                        id = CAM_PAIRWISE_KEY_POSITION;
+                                }
+
+                                key = PAIRWISE_KEYIDX;
+                                is_pairwise = true;
+                        }
+                }
+
+                if (rtlpriv->sec.key_len[key] == 0) {
+                        RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+                                 "delete one entry, id is %d\n", id);
+                        if (mac->opmode == NL80211_IFTYPE_AP ||
+                            mac->opmode == NL80211_IFTYPE_MESH_POINT)
+                                rtl_cam_del_entry(hw, mac_ad);
+                        rtl_cam_delete_one_entry(hw, mac_ad, id);
+                } else {
+                        add_one_key(hw, macaddr, mac, key, id, enc_algo,
+                                    is_pairwise);
+                }
+        }
+}
+
+static void rtl8188ee_bt_var_init(struct ieee80211_hw *hw)
+{
+        struct rtl_pci_priv *rppriv = rtl_pcipriv(hw);
+        struct bt_coexist_info coexist = rppriv->bt_coexist;
+
+        coexist.bt_coexistence = rppriv->bt_coexist.eeprom_bt_coexist;
+        coexist.bt_ant_num = coexist.eeprom_bt_ant_num;
+        coexist.bt_coexist_type = coexist.eeprom_bt_type;
+
+        if (coexist.reg_bt_iso == 2)
+                coexist.bt_ant_isolation = coexist.eeprom_bt_ant_isol;
+        else
+                coexist.bt_ant_isolation = coexist.reg_bt_iso;
+
+        coexist.bt_radio_shared_type = coexist.eeprom_bt_radio_shared;
+
+        if (coexist.bt_coexistence) {
+                if (coexist.reg_bt_sco == 1)
+                        coexist.bt_service = BT_OTHER_ACTION;
+                else if (coexist.reg_bt_sco == 2)
+                        coexist.bt_service = BT_SCO;
+                else if (coexist.reg_bt_sco == 4)
+                        coexist.bt_service = BT_BUSY;
+                else if (coexist.reg_bt_sco == 5)
+                        coexist.bt_service = BT_OTHERBUSY;
+                else
+                        coexist.bt_service = BT_IDLE;
+
+                coexist.bt_edca_ul = 0;
+                coexist.bt_edca_dl = 0;
+                coexist.bt_rssi_state = 0xff;
+        }
+}
+
+void rtl8188ee_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
+                                              bool auto_load_fail, u8 *hwinfo)
+{
+        rtl8188ee_bt_var_init(hw);
+}
+
+void rtl8188ee_bt_reg_init(struct ieee80211_hw *hw)
+{
+        struct rtl_pci_priv *rppriv = rtl_pcipriv(hw);
+
+        /* 0:Low, 1:High, 2:From Efuse. */
+        rppriv->bt_coexist.reg_bt_iso = 2;
+        /* 0:Idle, 1:None-SCO, 2:SCO, 3:From Counter. */
+        rppriv->bt_coexist.reg_bt_sco = 3;
+        /* 0:Disable BT control A-MPDU, 1:Enable BT control A-MPDU. */
+        rppriv->bt_coexist.reg_bt_sco = 0;
+}
+
+void rtl8188ee_bt_hw_init(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_pci_priv *rppriv = rtl_pcipriv(hw);
+        struct bt_coexist_info coexist = rppriv->bt_coexist;
+        u8 u1_tmp;
+
+        if (coexist.bt_coexistence &&
+            ((coexist.bt_coexist_type == BT_CSR_BC4) ||
+              coexist.bt_coexist_type == BT_CSR_BC8)) {
+                if (coexist.bt_ant_isolation)
+                        rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG, 0xa0);
+
+                u1_tmp = rtl_read_byte(rtlpriv, 0x4fd) &
+                                       BIT_OFFSET_LEN_MASK_32(0, 1);
+                u1_tmp = u1_tmp | ((coexist.bt_ant_isolation == 1) ?
+                         0 : BIT_OFFSET_LEN_MASK_32(1, 1)) |
+                         ((coexist.bt_service == BT_SCO) ?
+                         0 : BIT_OFFSET_LEN_MASK_32(2, 1));
+                rtl_write_byte(rtlpriv, 0x4fd, u1_tmp);
+
+                rtl_write_dword(rtlpriv, REG_BT_COEX_TABLE+4, 0xaaaa9aaa);
+                rtl_write_dword(rtlpriv, REG_BT_COEX_TABLE+8, 0xffbd0040);
+                rtl_write_dword(rtlpriv, REG_BT_COEX_TABLE+0xc, 0x40000010);
+
+                /* Config to 1T1R. */
+                if (rtlphy->rf_type == RF_1T1R) {
+                        u1_tmp = rtl_read_byte(rtlpriv, ROFDM0_TRXPATHENABLE);
+                        u1_tmp &= ~(BIT_OFFSET_LEN_MASK_32(1, 1));
+                        rtl_write_byte(rtlpriv, ROFDM0_TRXPATHENABLE, u1_tmp);
+
+                        u1_tmp = rtl_read_byte(rtlpriv, ROFDM1_TRXPATHENABLE);
+                        u1_tmp &= ~(BIT_OFFSET_LEN_MASK_32(1, 1));
+                        rtl_write_byte(rtlpriv, ROFDM1_TRXPATHENABLE, u1_tmp);
+                }
+        }
+}
+
+void rtl88ee_suspend(struct ieee80211_hw *hw)
+{
+}
+
+void rtl88ee_resume(struct ieee80211_hw *hw)
+{
+}
+
+/* Turn on AAP (RCR:bit 0) for promicuous mode. */
+void rtl88ee_allow_all_destaddr(struct ieee80211_hw *hw,
+                                bool allow_all_da, bool write_into_reg)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+        if (allow_all_da) /* Set BIT0 */
+                rtlpci->receive_config |= RCR_AAP;
+         else /* Clear BIT0 */
+                rtlpci->receive_config &= ~RCR_AAP;
+
+        if (write_into_reg)
+                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
+
+        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
+                 "receive_config = 0x%08X, write_into_reg =%d\n",
+                 rtlpci->receive_config, write_into_reg);
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h
new file mode 100644
index 000000000000..b4460a41bd01
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h
@@ -0,0 +1,68 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92CE_HW_H__
+#define __RTL92CE_HW_H__
+
+void rtl88ee_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val);
+void rtl88ee_read_eeprom_info(struct ieee80211_hw *hw);
+void rtl88ee_interrupt_recognized(struct ieee80211_hw *hw,
+                                  u32 *p_inta, u32 *p_intb);
+int rtl88ee_hw_init(struct ieee80211_hw *hw);
+void rtl88ee_card_disable(struct ieee80211_hw *hw);
+void rtl88ee_enable_interrupt(struct ieee80211_hw *hw);
+void rtl88ee_disable_interrupt(struct ieee80211_hw *hw);
+int rtl88ee_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type);
+void rtl88ee_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid);
+void rtl88ee_set_qos(struct ieee80211_hw *hw, int aci);
+void rtl88ee_set_beacon_related_registers(struct ieee80211_hw *hw);
+void rtl88ee_set_beacon_interval(struct ieee80211_hw *hw);
+void rtl88ee_update_interrupt_mask(struct ieee80211_hw *hw,
+                                   u32 add_msr, u32 rm_msr);
+void rtl88ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val);
+void rtl88ee_update_hal_rate_tbl(struct ieee80211_hw *hw,
+                                 struct ieee80211_sta *sta, u8 rssi_level);
+void rtl88ee_update_channel_access_setting(struct ieee80211_hw *hw);
+bool rtl88ee_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 *valid);
+void rtl88ee_enable_hw_security_config(struct ieee80211_hw *hw);
+void rtl88ee_set_key(struct ieee80211_hw *hw, u32 key_index,
+                     u8 *p_macaddr, bool is_group, u8 enc_algo,
+                     bool is_wepkey, bool clear_all);
+
+void rtl8188ee_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
+                                              bool autoload_fail, u8 *hwinfo);
+void rtl8188ee_bt_reg_init(struct ieee80211_hw *hw);
+void rtl8188ee_bt_hw_init(struct ieee80211_hw *hw);
+void rtl88ee_suspend(struct ieee80211_hw *hw);
+void rtl88ee_resume(struct ieee80211_hw *hw);
+void rtl88ee_allow_all_destaddr(struct ieee80211_hw *hw,
+                                bool allow_all_da, bool write_into_reg);
+void rtl88ee_fw_clk_off_timer_callback(unsigned long data);
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/led.c b/drivers/net/wireless/rtlwifi/rtl8188ee/led.c
new file mode 100644
index 000000000000..c81a9cb6894c
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/led.c
@@ -0,0 +1,157 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "../wifi.h"
+#include "../pci.h"
+#include "reg.h"
+#include "led.h"
+
+static void rtl88ee_init_led(struct ieee80211_hw *hw,
+                             struct rtl_led *pled, enum rtl_led_pin ledpin)
+{
+        pled->hw = hw;
+        pled->ledpin = ledpin;
+        pled->ledon = false;
+}
+
+void rtl88ee_sw_led_on(struct ieee80211_hw *hw, struct rtl_led *pled)
+{
+        u8 ledcfg;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        RT_TRACE(rtlpriv, COMP_LED, DBG_LOUD,
+                 "LedAddr:%X ledpin =%d\n", REG_LEDCFG2, pled->ledpin);
+
+        switch (pled->ledpin) {
+        case LED_PIN_GPIO0:
+                break;
+        case LED_PIN_LED0:
+                ledcfg = rtl_read_byte(rtlpriv, REG_LEDCFG2);
+                rtl_write_byte(rtlpriv, REG_LEDCFG2,
+                               (ledcfg & 0xf0) | BIT(5) | BIT(6));
+                break;
+        case LED_PIN_LED1:
+                ledcfg = rtl_read_byte(rtlpriv, REG_LEDCFG1);
+                rtl_write_byte(rtlpriv, REG_LEDCFG1, ledcfg & 0x10);
+                break;
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "switch case not processed\n");
+                break;
+        }
+        pled->ledon = true;
+}
+
+void rtl88ee_sw_led_off(struct ieee80211_hw *hw, struct rtl_led *pled)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+        u8 ledcfg;
+        u8 val;
+
+        RT_TRACE(rtlpriv, COMP_LED, DBG_LOUD,
+                 "LedAddr:%X ledpin =%d\n", REG_LEDCFG2, pled->ledpin);
+
+        switch (pled->ledpin) {
+        case LED_PIN_GPIO0:
+                break;
+        case LED_PIN_LED0:
+                ledcfg = rtl_read_byte(rtlpriv, REG_LEDCFG2);
+                ledcfg &= 0xf0;
+                val = ledcfg | BIT(3) | BIT(5) | BIT(6);
+                if (pcipriv->ledctl.led_opendrain == true) {
+                        rtl_write_byte(rtlpriv, REG_LEDCFG2, val);
+                        ledcfg = rtl_read_byte(rtlpriv, REG_MAC_PINMUX_CFG);
+                        val = ledcfg & 0xFE;
+                        rtl_write_byte(rtlpriv, REG_MAC_PINMUX_CFG, val);
+                } else {
+                        rtl_write_byte(rtlpriv, REG_LEDCFG2, val);
+                }
+                break;
+        case LED_PIN_LED1:
+                ledcfg = rtl_read_byte(rtlpriv, REG_LEDCFG1);
+                ledcfg &= 0x10;
+                rtl_write_byte(rtlpriv, REG_LEDCFG1, (ledcfg | BIT(3)));
+                break;
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "switch case not processed\n");
+                break;
+        }
+        pled->ledon = false;
+}
+
+void rtl88ee_init_sw_leds(struct ieee80211_hw *hw)
+{
+        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+
+        rtl88ee_init_led(hw, &(pcipriv->ledctl.sw_led0), LED_PIN_LED0);
+        rtl88ee_init_led(hw, &(pcipriv->ledctl.sw_led1), LED_PIN_LED1);
+}
+
+static void rtl88ee_sw_led_control(struct ieee80211_hw *hw,
+                                    enum led_ctl_mode ledaction)
+{
+        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+        struct rtl_led *pLed0 = &(pcipriv->ledctl.sw_led0);
+
+        switch (ledaction) {
+        case LED_CTL_POWER_ON:
+        case LED_CTL_LINK:
+        case LED_CTL_NO_LINK:
+                rtl88ee_sw_led_on(hw, pLed0);
+                break;
+        case LED_CTL_POWER_OFF:
+                rtl88ee_sw_led_off(hw, pLed0);
+                break;
+        default:
+                break;
+        }
+}
+
+void rtl88ee_led_control(struct ieee80211_hw *hw,
+                        enum led_ctl_mode ledaction)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+
+        if ((ppsc->rfoff_reason > RF_CHANGE_BY_PS) &&
+            (ledaction == LED_CTL_TX ||
+             ledaction == LED_CTL_RX ||
+             ledaction == LED_CTL_SITE_SURVEY ||
+             ledaction == LED_CTL_LINK ||
+             ledaction == LED_CTL_NO_LINK ||
+             ledaction == LED_CTL_START_TO_LINK ||
+             ledaction == LED_CTL_POWER_ON)) {
+                return;
+        }
+        RT_TRACE(rtlpriv, COMP_LED, DBG_TRACE, "ledaction %d,\n",
+                 ledaction);
+        rtl88ee_sw_led_control(hw, ledaction);
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/led.h b/drivers/net/wireless/rtlwifi/rtl8188ee/led.h
new file mode 100644
index 000000000000..4073f6f847b2
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/led.h
@@ -0,0 +1,38 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92CE_LED_H__
+#define __RTL92CE_LED_H__
+
+void rtl88ee_init_sw_leds(struct ieee80211_hw *hw);
+void rtl88ee_sw_led_on(struct ieee80211_hw *hw, struct rtl_led *pled);
+void rtl88ee_sw_led_off(struct ieee80211_hw *hw, struct rtl_led *pled);
+void rtl88ee_led_control(struct ieee80211_hw *hw, enum led_ctl_mode ledaction);
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c
new file mode 100644
index 000000000000..e655c0473225
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c
@@ -0,0 +1,2202 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "../wifi.h"
+#include "../pci.h"
+#include "../ps.h"
+#include "reg.h"
+#include "def.h"
+#include "phy.h"
+#include "rf.h"
+#include "dm.h"
+#include "table.h"
+
+static void set_baseband_phy_config(struct ieee80211_hw *hw);
+static void set_baseband_agc_config(struct ieee80211_hw *hw);
+static void store_pwrindex_offset(struct ieee80211_hw *hw,
+                                  u32 regaddr, u32 bitmask,
+                                  u32 data);
+static bool check_cond(struct ieee80211_hw *hw, const u32  condition);
+
+static u32 rf_serial_read(struct ieee80211_hw *hw,
+                          enum radio_path rfpath, u32 offset)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct bb_reg_def *phreg = &rtlphy->phyreg_def[rfpath];
+        u32 newoffset;
+        u32 tmplong, tmplong2;
+        u8 rfpi_enable = 0;
+        u32 ret;
+        int jj = RF90_PATH_A;
+        int kk = RF90_PATH_B;
+
+        offset &= 0xff;
+        newoffset = offset;
+        if (RT_CANNOT_IO(hw)) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "return all one\n");
+                return 0xFFFFFFFF;
+        }
+        tmplong = rtl_get_bbreg(hw, RFPGA0_XA_HSSIPARAMETER2, MASKDWORD);
+        if (rfpath == jj)
+                tmplong2 = tmplong;
+        else
+                tmplong2 = rtl_get_bbreg(hw, phreg->rfhssi_para2, MASKDWORD);
+        tmplong2 = (tmplong2 & (~BLSSIREADADDRESS)) |
+            (newoffset << 23) | BLSSIREADEDGE;
+        rtl_set_bbreg(hw, RFPGA0_XA_HSSIPARAMETER2, MASKDWORD,
+                      tmplong & (~BLSSIREADEDGE));
+        mdelay(1);
+        rtl_set_bbreg(hw, phreg->rfhssi_para2, MASKDWORD, tmplong2);
+        mdelay(2);
+        if (rfpath == jj)
+                rfpi_enable = (u8) rtl_get_bbreg(hw, RFPGA0_XA_HSSIPARAMETER1,
+                                                 BIT(8));
+        else if (rfpath == kk)
+                rfpi_enable = (u8) rtl_get_bbreg(hw, RFPGA0_XB_HSSIPARAMETER1,
+                                                 BIT(8));
+        if (rfpi_enable)
+                ret = rtl_get_bbreg(hw, phreg->rf_rbpi, BLSSIREADBACKDATA);
+        else
+                ret = rtl_get_bbreg(hw, phreg->rf_rb, BLSSIREADBACKDATA);
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "RFR-%d Addr[0x%x]= 0x%x\n",
+                 rfpath, phreg->rf_rb, ret);
+        return ret;
+}
+
+static void rf_serial_write(struct ieee80211_hw *hw,
+                            enum radio_path rfpath, u32 offset,
+                            u32 data)
+{
+        u32 data_and_addr;
+        u32 newoffset;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct bb_reg_def *phreg = &rtlphy->phyreg_def[rfpath];
+
+        if (RT_CANNOT_IO(hw)) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "stop\n");
+                return;
+        }
+        offset &= 0xff;
+        newoffset = offset;
+        data_and_addr = ((newoffset << 20) | (data & 0x000fffff)) & 0x0fffffff;
+        rtl_set_bbreg(hw, phreg->rf3wire_offset, MASKDWORD, data_and_addr);
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "RFW-%d Addr[0x%x]= 0x%x\n",
+                 rfpath, phreg->rf3wire_offset, data_and_addr);
+}
+
+static u32 cal_bit_shift(u32 bitmask)
+{
+        u32 i;
+
+        for (i = 0; i <= 31; i++) {
+                if (((bitmask >> i) & 0x1) == 1)
+                        break;
+        }
+        return i;
+}
+
+static bool config_bb_with_header(struct ieee80211_hw *hw,
+                                  u8 configtype)
+{
+        if (configtype == BASEBAND_CONFIG_PHY_REG)
+                set_baseband_phy_config(hw);
+        else if (configtype == BASEBAND_CONFIG_AGC_TAB)
+                set_baseband_agc_config(hw);
+        return true;
+}
+
+static bool config_bb_with_pgheader(struct ieee80211_hw *hw,
+                                    u8 configtype)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        int i;
+        u32 *table_pg;
+        u16 tbl_page_len;
+        u32 v1 = 0, v2 = 0;
+
+        tbl_page_len = RTL8188EEPHY_REG_ARRAY_PGLEN;
+        table_pg = RTL8188EEPHY_REG_ARRAY_PG;
+
+        if (configtype == BASEBAND_CONFIG_PHY_REG) {
+                for (i = 0; i < tbl_page_len; i = i + 3) {
+                        v1 = table_pg[i];
+                        v2 = table_pg[i + 1];
+
+                        if (v1 < 0xcdcdcdcd) {
+                                if (table_pg[i] == 0xfe)
+                                        mdelay(50);
+                                else if (table_pg[i] == 0xfd)
+                                        mdelay(5);
+                                else if (table_pg[i] == 0xfc)
+                                        mdelay(1);
+                                else if (table_pg[i] == 0xfb)
+                                        udelay(50);
+                                else if (table_pg[i] == 0xfa)
+                                        udelay(5);
+                                else if (table_pg[i] == 0xf9)
+                                        udelay(1);
+
+                                store_pwrindex_offset(hw, table_pg[i],
+                                                      table_pg[i + 1],
+                                                      table_pg[i + 2]);
+                                continue;
+                        } else {
+                                if (!check_cond(hw, table_pg[i])) {
+                                        /*don't need the hw_body*/
+                                        i += 2; /* skip the pair of expression*/
+                                        v1 = table_pg[i];
+                                        v2 = table_pg[i + 1];
+                                        while (v2 != 0xDEAD) {
+                                                i += 3;
+                                                v1 = table_pg[i];
+                                                v2 = table_pg[i + 1];
+                                        }
+                                }
+                        }
+                }
+        } else {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "configtype != BaseBand_Config_PHY_REG\n");
+        }
+        return true;
+}
+
+static bool config_parafile(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_efuse *fuse = rtl_efuse(rtl_priv(hw));
+        bool rtstatus;
+
+        rtstatus = config_bb_with_header(hw, BASEBAND_CONFIG_PHY_REG);
+        if (rtstatus != true) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Write BB Reg Fail!!");
+                return false;
+        }
+
+        if (fuse->autoload_failflag == false) {
+                rtlphy->pwrgroup_cnt = 0;
+                rtstatus = config_bb_with_pgheader(hw, BASEBAND_CONFIG_PHY_REG);
+        }
+        if (rtstatus != true) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "BB_PG Reg Fail!!");
+                return false;
+        }
+        rtstatus = config_bb_with_header(hw, BASEBAND_CONFIG_AGC_TAB);
+        if (rtstatus != true) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "AGC Table Fail\n");
+                return false;
+        }
+        rtlphy->cck_high_power = (bool) (rtl_get_bbreg(hw,
+                                 RFPGA0_XA_HSSIPARAMETER2, 0x200));
+
+        return true;
+}
+
+static void rtl88e_phy_init_bb_rf_register_definition(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        int jj = RF90_PATH_A;
+        int kk = RF90_PATH_B;
+
+        rtlphy->phyreg_def[jj].rfintfs = RFPGA0_XAB_RFINTERFACESW;
+        rtlphy->phyreg_def[kk].rfintfs = RFPGA0_XAB_RFINTERFACESW;
+        rtlphy->phyreg_def[RF90_PATH_C].rfintfs = RFPGA0_XCD_RFINTERFACESW;
+        rtlphy->phyreg_def[RF90_PATH_D].rfintfs = RFPGA0_XCD_RFINTERFACESW;
+
+        rtlphy->phyreg_def[jj].rfintfi = RFPGA0_XAB_RFINTERFACERB;
+        rtlphy->phyreg_def[kk].rfintfi = RFPGA0_XAB_RFINTERFACERB;
+        rtlphy->phyreg_def[RF90_PATH_C].rfintfi = RFPGA0_XCD_RFINTERFACERB;
+        rtlphy->phyreg_def[RF90_PATH_D].rfintfi = RFPGA0_XCD_RFINTERFACERB;
+
+        rtlphy->phyreg_def[jj].rfintfo = RFPGA0_XA_RFINTERFACEOE;
+        rtlphy->phyreg_def[kk].rfintfo = RFPGA0_XB_RFINTERFACEOE;
+
+        rtlphy->phyreg_def[jj].rfintfe = RFPGA0_XA_RFINTERFACEOE;
+        rtlphy->phyreg_def[kk].rfintfe = RFPGA0_XB_RFINTERFACEOE;
+
+        rtlphy->phyreg_def[jj].rf3wire_offset = RFPGA0_XA_LSSIPARAMETER;
+        rtlphy->phyreg_def[kk].rf3wire_offset = RFPGA0_XB_LSSIPARAMETER;
+
+        rtlphy->phyreg_def[jj].rflssi_select = rFPGA0_XAB_RFPARAMETER;
+        rtlphy->phyreg_def[kk].rflssi_select = rFPGA0_XAB_RFPARAMETER;
+        rtlphy->phyreg_def[RF90_PATH_C].rflssi_select = rFPGA0_XCD_RFPARAMETER;
+        rtlphy->phyreg_def[RF90_PATH_D].rflssi_select = rFPGA0_XCD_RFPARAMETER;
+
+        rtlphy->phyreg_def[jj].rftxgain_stage = RFPGA0_TXGAINSTAGE;
+        rtlphy->phyreg_def[kk].rftxgain_stage = RFPGA0_TXGAINSTAGE;
+        rtlphy->phyreg_def[RF90_PATH_C].rftxgain_stage = RFPGA0_TXGAINSTAGE;
+        rtlphy->phyreg_def[RF90_PATH_D].rftxgain_stage = RFPGA0_TXGAINSTAGE;
+
+        rtlphy->phyreg_def[jj].rfhssi_para1 = RFPGA0_XA_HSSIPARAMETER1;
+        rtlphy->phyreg_def[kk].rfhssi_para1 = RFPGA0_XB_HSSIPARAMETER1;
+
+        rtlphy->phyreg_def[jj].rfhssi_para2 = RFPGA0_XA_HSSIPARAMETER2;
+        rtlphy->phyreg_def[kk].rfhssi_para2 = RFPGA0_XB_HSSIPARAMETER2;
+
+        rtlphy->phyreg_def[jj].rfsw_ctrl = RFPGA0_XAB_SWITCHCONTROL;
+        rtlphy->phyreg_def[kk].rfsw_ctrl = RFPGA0_XAB_SWITCHCONTROL;
+        rtlphy->phyreg_def[RF90_PATH_C].rfsw_ctrl = RFPGA0_XCD_SWITCHCONTROL;
+        rtlphy->phyreg_def[RF90_PATH_D].rfsw_ctrl = RFPGA0_XCD_SWITCHCONTROL;
+
+        rtlphy->phyreg_def[jj].rfagc_control1 = ROFDM0_XAAGCCORE1;
+        rtlphy->phyreg_def[kk].rfagc_control1 = ROFDM0_XBAGCCORE1;
+        rtlphy->phyreg_def[RF90_PATH_C].rfagc_control1 = ROFDM0_XCAGCCORE1;
+        rtlphy->phyreg_def[RF90_PATH_D].rfagc_control1 = ROFDM0_XDAGCCORE1;
+
+        rtlphy->phyreg_def[jj].rfagc_control2 = ROFDM0_XAAGCCORE2;
+        rtlphy->phyreg_def[kk].rfagc_control2 = ROFDM0_XBAGCCORE2;
+        rtlphy->phyreg_def[RF90_PATH_C].rfagc_control2 = ROFDM0_XCAGCCORE2;
+        rtlphy->phyreg_def[RF90_PATH_D].rfagc_control2 = ROFDM0_XDAGCCORE2;
+
+        rtlphy->phyreg_def[jj].rfrxiq_imbal = ROFDM0_XARXIQIMBAL;
+        rtlphy->phyreg_def[kk].rfrxiq_imbal = ROFDM0_XBRXIQIMBAL;
+        rtlphy->phyreg_def[RF90_PATH_C].rfrxiq_imbal = ROFDM0_XCRXIQIMBAL;
+        rtlphy->phyreg_def[RF90_PATH_D].rfrxiq_imbal = ROFDM0_XDRXIQIMBAL;
+
+        rtlphy->phyreg_def[jj].rfrx_afe = ROFDM0_XARXAFE;
+        rtlphy->phyreg_def[kk].rfrx_afe = ROFDM0_XBRXAFE;
+        rtlphy->phyreg_def[RF90_PATH_C].rfrx_afe = ROFDM0_XCRXAFE;
+        rtlphy->phyreg_def[RF90_PATH_D].rfrx_afe = ROFDM0_XDRXAFE;
+
+        rtlphy->phyreg_def[jj].rftxiq_imbal = ROFDM0_XATXIQIMBAL;
+        rtlphy->phyreg_def[kk].rftxiq_imbal = ROFDM0_XBTXIQIMBAL;
+        rtlphy->phyreg_def[RF90_PATH_C].rftxiq_imbal = ROFDM0_XCTXIQIMBAL;
+        rtlphy->phyreg_def[RF90_PATH_D].rftxiq_imbal = ROFDM0_XDTXIQIMBAL;
+
+        rtlphy->phyreg_def[jj].rftx_afe = ROFDM0_XATXAFE;
+        rtlphy->phyreg_def[kk].rftx_afe = ROFDM0_XBTXAFE;
+
+        rtlphy->phyreg_def[jj].rf_rb = RFPGA0_XA_LSSIREADBACK;
+        rtlphy->phyreg_def[kk].rf_rb = RFPGA0_XB_LSSIREADBACK;
+
+        rtlphy->phyreg_def[jj].rf_rbpi = TRANSCEIVEA_HSPI_READBACK;
+        rtlphy->phyreg_def[kk].rf_rbpi = TRANSCEIVEB_HSPI_READBACK;
+}
+
+static bool rtl88e_phy_set_sw_chnl_cmdarray(struct swchnlcmd *cmdtable,
+                                            u32 cmdtableidx, u32 cmdtablesz,
+                                            enum swchnlcmd_id cmdid,
+                                            u32 para1, u32 para2, u32 msdelay)
+{
+        struct swchnlcmd *pcmd;
+
+        if (cmdtable == NULL) {
+                RT_ASSERT(false, "cmdtable cannot be NULL.\n");
+                return false;
+        }
+
+        if (cmdtableidx >= cmdtablesz)
+                return false;
+
+        pcmd = cmdtable + cmdtableidx;
+        pcmd->cmdid = cmdid;
+        pcmd->para1 = para1;
+        pcmd->para2 = para2;
+        pcmd->msdelay = msdelay;
+        return true;
+}
+
+static bool chnl_step_by_step(struct ieee80211_hw *hw,
+                              u8 channel, u8 *stage, u8 *step,
+                              u32 *delay)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct swchnlcmd precommoncmd[MAX_PRECMD_CNT];
+        u32 precommoncmdcnt;
+        struct swchnlcmd postcommoncmd[MAX_POSTCMD_CNT];
+        u32 postcommoncmdcnt;
+        struct swchnlcmd rfdependcmd[MAX_RFDEPENDCMD_CNT];
+        u32 rfdependcmdcnt;
+        struct swchnlcmd *currentcmd = NULL;
+        u8 rfpath;
+        u8 num_total_rfpath = rtlphy->num_total_rfpath;
+
+        precommoncmdcnt = 0;
+        rtl88e_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
+                                        MAX_PRECMD_CNT,
+                                        CMDID_SET_TXPOWEROWER_LEVEL, 0, 0, 0);
+        rtl88e_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
+                                        MAX_PRECMD_CNT, CMDID_END, 0, 0, 0);
+
+        postcommoncmdcnt = 0;
+
+        rtl88e_phy_set_sw_chnl_cmdarray(postcommoncmd, postcommoncmdcnt++,
+                                        MAX_POSTCMD_CNT, CMDID_END, 0, 0, 0);
+
+        rfdependcmdcnt = 0;
+
+        RT_ASSERT((channel >= 1 && channel <= 14),
+                  "illegal channel for Zebra: %d\n", channel);
+
+        rtl88e_phy_set_sw_chnl_cmdarray(rfdependcmd, rfdependcmdcnt++,
+                                        MAX_RFDEPENDCMD_CNT, CMDID_RF_WRITEREG,
+                                        RF_CHNLBW, channel, 10);
+
+        rtl88e_phy_set_sw_chnl_cmdarray(rfdependcmd, rfdependcmdcnt++,
+                                        MAX_RFDEPENDCMD_CNT, CMDID_END, 0, 0,
+                                         0);
+
+        do {
+                switch (*stage) {
+                case 0:
+                        currentcmd = &precommoncmd[*step];
+                        break;
+                case 1:
+                        currentcmd = &rfdependcmd[*step];
+                        break;
+                case 2:
+                        currentcmd = &postcommoncmd[*step];
+                        break;
+                }
+
+                if (currentcmd->cmdid == CMDID_END) {
+                        if ((*stage) == 2) {
+                                return true;
+                        } else {
+                                (*stage)++;
+                                (*step) = 0;
+                                continue;
+                        }
+                }
+
+                switch (currentcmd->cmdid) {
+                case CMDID_SET_TXPOWEROWER_LEVEL:
+                        rtl88e_phy_set_txpower_level(hw, channel);
+                        break;
+                case CMDID_WRITEPORT_ULONG:
+                        rtl_write_dword(rtlpriv, currentcmd->para1,
+                                        currentcmd->para2);
+                        break;
+                case CMDID_WRITEPORT_USHORT:
+                        rtl_write_word(rtlpriv, currentcmd->para1,
+                                       (u16) currentcmd->para2);
+                        break;
+                case CMDID_WRITEPORT_UCHAR:
+                        rtl_write_byte(rtlpriv, currentcmd->para1,
+                                       (u8) currentcmd->para2);
+                        break;
+                case CMDID_RF_WRITEREG:
+                        for (rfpath = 0; rfpath < num_total_rfpath; rfpath++) {
+                                rtlphy->rfreg_chnlval[rfpath] =
+                                    ((rtlphy->rfreg_chnlval[rfpath] &
+                                      0xfffffc00) | currentcmd->para2);
+
+                                rtl_set_rfreg(hw, (enum radio_path)rfpath,
+                                              currentcmd->para1,
+                                              RFREG_OFFSET_MASK,
+                                              rtlphy->rfreg_chnlval[rfpath]);
+                        }
+                        break;
+                default:
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "switch case not processed\n");
+                        break;
+                }
+
+                break;
+        } while (true);
+
+        (*delay) = currentcmd->msdelay;
+        (*step)++;
+        return false;
+}
+
+static long rtl88e_pwr_idx_dbm(struct ieee80211_hw *hw,
+                               enum wireless_mode wirelessmode,
+                               u8 txpwridx)
+{
+        long offset;
+        long pwrout_dbm;
+
+        switch (wirelessmode) {
+        case WIRELESS_MODE_B:
+                offset = -7;
+                break;
+        case WIRELESS_MODE_G:
+        case WIRELESS_MODE_N_24G:
+                offset = -8;
+                break;
+        default:
+                offset = -8;
+                break;
+        }
+        pwrout_dbm = txpwridx / 2 + offset;
+        return pwrout_dbm;
+}
+
+static void rtl88e_phy_set_io(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
+
+        RT_TRACE(rtlpriv, COMP_CMD, DBG_TRACE,
+                 "--->Cmd(%#x), set_io_inprogress(%d)\n",
+                 rtlphy->current_io_type, rtlphy->set_io_inprogress);
+        switch (rtlphy->current_io_type) {
+        case IO_CMD_RESUME_DM_BY_SCAN:
+                dm_digtable->cur_igvalue = rtlphy->initgain_backup.xaagccore1;
+                /*rtl92c_dm_write_dig(hw);*/
+                rtl88e_phy_set_txpower_level(hw, rtlphy->current_channel);
+                rtl_set_bbreg(hw, RCCK0_CCA, 0xff0000, 0x83);
+                break;
+        case IO_CMD_PAUSE_DM_BY_SCAN:
+                rtlphy->initgain_backup.xaagccore1 = dm_digtable->cur_igvalue;
+                dm_digtable->cur_igvalue = 0x17;
+                rtl_set_bbreg(hw, RCCK0_CCA, 0xff0000, 0x40);
+                break;
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "switch case not processed\n");
+                break;
+        }
+        rtlphy->set_io_inprogress = false;
+        RT_TRACE(rtlpriv, COMP_CMD, DBG_TRACE,
+                 "(%#x)\n", rtlphy->current_io_type);
+}
+
+u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 returnvalue, originalvalue, bitshift;
+
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+                 "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
+        originalvalue = rtl_read_dword(rtlpriv, regaddr);
+        bitshift = cal_bit_shift(bitmask);
+        returnvalue = (originalvalue & bitmask) >> bitshift;
+
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+                 "BBR MASK = 0x%x Addr[0x%x]= 0x%x\n", bitmask,
+                 regaddr, originalvalue);
+
+        return returnvalue;
+}
+
+void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,
+                           u32 regaddr, u32 bitmask, u32 data)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 originalvalue, bitshift;
+
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+                 "regaddr(%#x), bitmask(%#x),data(%#x)\n",
+                 regaddr, bitmask, data);
+
+        if (bitmask != MASKDWORD) {
+                originalvalue = rtl_read_dword(rtlpriv, regaddr);
+                bitshift = cal_bit_shift(bitmask);
+                data = ((originalvalue & (~bitmask)) | (data << bitshift));
+        }
+
+        rtl_write_dword(rtlpriv, regaddr, data);
+
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+                 "regaddr(%#x), bitmask(%#x), data(%#x)\n",
+                 regaddr, bitmask, data);
+}
+
+u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw,
+                            enum radio_path rfpath, u32 regaddr, u32 bitmask)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 original_value, readback_value, bitshift;
+        unsigned long flags;
+
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+                 "regaddr(%#x), rfpath(%#x), bitmask(%#x)\n",
+                 regaddr, rfpath, bitmask);
+
+        spin_lock_irqsave(&rtlpriv->locks.rf_lock, flags);
+
+
+        original_value = rf_serial_read(hw, rfpath, regaddr);
+        bitshift = cal_bit_shift(bitmask);
+        readback_value = (original_value & bitmask) >> bitshift;
+
+        spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
+
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+                 "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
+                  regaddr, rfpath, bitmask, original_value);
+
+        return readback_value;
+}
+
+void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw,
+                           enum radio_path rfpath,
+                           u32 regaddr, u32 bitmask, u32 data)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 original_value, bitshift;
+        unsigned long flags;
+
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+                 "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n",
+                  regaddr, bitmask, data, rfpath);
+
+        spin_lock_irqsave(&rtlpriv->locks.rf_lock, flags);
+
+        if (bitmask != RFREG_OFFSET_MASK) {
+                        original_value = rf_serial_read(hw, rfpath, regaddr);
+                        bitshift = cal_bit_shift(bitmask);
+                        data = ((original_value & (~bitmask)) |
+                                (data << bitshift));
+                }
+
+        rf_serial_write(hw, rfpath, regaddr, data);
+
+
+        spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
+
+        RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+                 "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n",
+                 regaddr, bitmask, data, rfpath);
+}
+
+static bool config_mac_with_header(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 i;
+        u32 arraylength;
+        u32 *ptrarray;
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "Read Rtl8188EMACPHY_Array\n");
+        arraylength = RTL8188EEMAC_1T_ARRAYLEN;
+        ptrarray = RTL8188EEMAC_1T_ARRAY;
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "Img:RTL8188EEMAC_1T_ARRAY LEN %d\n", arraylength);
+        for (i = 0; i < arraylength; i = i + 2)
+                rtl_write_byte(rtlpriv, ptrarray[i], (u8) ptrarray[i + 1]);
+        return true;
+}
+
+bool rtl88e_phy_mac_config(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        bool rtstatus = config_mac_with_header(hw);
+
+        rtl_write_byte(rtlpriv, 0x04CA, 0x0B);
+        return rtstatus;
+}
+
+bool rtl88e_phy_bb_config(struct ieee80211_hw *hw)
+{
+        bool rtstatus = true;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u16 regval;
+        u8 reg_hwparafile = 1;
+        u32 tmp;
+        rtl88e_phy_init_bb_rf_register_definition(hw);
+        regval = rtl_read_word(rtlpriv, REG_SYS_FUNC_EN);
+        rtl_write_word(rtlpriv, REG_SYS_FUNC_EN,
+                       regval | BIT(13) | BIT(0) | BIT(1));
+
+        rtl_write_byte(rtlpriv, REG_RF_CTRL, RF_EN | RF_RSTB | RF_SDMRSTB);
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN,
+                       FEN_PPLL | FEN_PCIEA | FEN_DIO_PCIE |
+                       FEN_BB_GLB_RSTN | FEN_BBRSTB);
+        tmp = rtl_read_dword(rtlpriv, 0x4c);
+        rtl_write_dword(rtlpriv, 0x4c, tmp | BIT(23));
+        if (reg_hwparafile == 1)
+                rtstatus = config_parafile(hw);
+        return rtstatus;
+}
+
+bool rtl88e_phy_rf_config(struct ieee80211_hw *hw)
+{
+        return rtl88e_phy_rf6052_config(hw);
+}
+
+static bool check_cond(struct ieee80211_hw *hw,
+                                    const u32  condition)
+{
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_efuse *fuse = rtl_efuse(rtl_priv(hw));
+        u32 _board = fuse->board_type; /*need efuse define*/
+        u32 _interface = rtlhal->interface;
+        u32 _platform = 0x08;/*SupportPlatform */
+        u32 cond = condition;
+
+        if (condition == 0xCDCDCDCD)
+                return true;
+
+        cond = condition & 0xFF;
+        if ((_board & cond) == 0 && cond != 0x1F)
+                return false;
+
+        cond = condition & 0xFF00;
+        cond = cond >> 8;
+        if ((_interface & cond) == 0 && cond != 0x07)
+                return false;
+
+        cond = condition & 0xFF0000;
+        cond = cond >> 16;
+        if ((_platform & cond) == 0 && cond != 0x0F)
+                return false;
+        return true;
+}
+
+static void _rtl8188e_config_rf_reg(struct ieee80211_hw *hw,
+                                    u32 addr, u32 data, enum radio_path rfpath,
+                                    u32 regaddr)
+{
+        if (addr == 0xffe) {
+                mdelay(50);
+        } else if (addr == 0xfd) {
+                mdelay(5);
+        } else if (addr == 0xfc) {
+                mdelay(1);
+        } else if (addr == 0xfb) {
+                udelay(50);
+        } else if (addr == 0xfa) {
+                udelay(5);
+        } else if (addr == 0xf9) {
+                udelay(1);
+        } else {
+                rtl_set_rfreg(hw, rfpath, regaddr,
+                              RFREG_OFFSET_MASK,
+                              data);
+                udelay(1);
+        }
+}
+
+static void rtl88_config_s(struct ieee80211_hw *hw,
+        u32 addr, u32 data)
+{
+        u32 content = 0x1000; /*RF Content: radio_a_txt*/
+        u32 maskforphyset = (u32)(content & 0xE000);
+
+        _rtl8188e_config_rf_reg(hw, addr, data, RF90_PATH_A,
+                                addr | maskforphyset);
+}
+
+static void _rtl8188e_config_bb_reg(struct ieee80211_hw *hw,
+                                    u32 addr, u32 data)
+{
+        if (addr == 0xfe) {
+                mdelay(50);
+        } else if (addr == 0xfd) {
+                mdelay(5);
+        } else if (addr == 0xfc) {
+                mdelay(1);
+        } else if (addr == 0xfb) {
+                udelay(50);
+        } else if (addr == 0xfa) {
+                udelay(5);
+        } else if (addr == 0xf9) {
+                udelay(1);
+        } else {
+                rtl_set_bbreg(hw, addr, MASKDWORD, data);
+                udelay(1);
+        }
+}
+
+
+#define NEXT_PAIR(v1, v2, i)                            \
+        do {                                            \
+                i += 2; v1 = array_table[i];            \
+                v2 = array_table[i + 1];                \
+        } while (0)
+
+static void set_baseband_agc_config(struct ieee80211_hw *hw)
+{
+        int i;
+        u32 *array_table;
+        u16 arraylen;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 v1 = 0, v2 = 0;
+
+        arraylen = RTL8188EEAGCTAB_1TARRAYLEN;
+        array_table = RTL8188EEAGCTAB_1TARRAY;
+
+        for (i = 0; i < arraylen; i += 2) {
+                v1 = array_table[i];
+                v2 = array_table[i + 1];
+                if (v1 < 0xCDCDCDCD) {
+                        rtl_set_bbreg(hw, array_table[i], MASKDWORD,
+                                      array_table[i + 1]);
+                        udelay(1);
+                        continue;
+                } else {/*This line is the start line of branch.*/
+                        if (!check_cond(hw, array_table[i])) {
+                                /*Discard the following (offset, data) pairs*/
+                                NEXT_PAIR(v1, v2, i);
+                                while (v2 != 0xDEAD && v2 != 0xCDEF &&
+                                       v2 != 0xCDCD && i < arraylen - 2) {
+                                        NEXT_PAIR(v1, v2, i);
+                                }
+                                i -= 2; /* compensate for loop's += 2*/
+                        } else {
+                                /* Configure matched pairs and skip to end */
+                                NEXT_PAIR(v1, v2, i);
+                                while (v2 != 0xDEAD && v2 != 0xCDEF &&
+                                       v2 != 0xCDCD && i < arraylen - 2) {
+                                        rtl_set_bbreg(hw, array_table[i],
+                                                      MASKDWORD,
+                                                      array_table[i + 1]);
+                                        udelay(1);
+                                        NEXT_PAIR(v1, v2, i);
+                                }
+
+                                while (v2 != 0xDEAD && i < arraylen - 2)
+                                        NEXT_PAIR(v1, v2, i);
+                        }
+                }
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "The agctab_array_table[0] is %x Rtl818EEPHY_REGArray[1] is %x\n",
+                         array_table[i],
+                         array_table[i + 1]);
+        }
+}
+
+static void set_baseband_phy_config(struct ieee80211_hw *hw)
+{
+        int i;
+        u32 *array_table;
+        u16 arraylen;
+        u32 v1 = 0, v2 = 0;
+
+        arraylen = RTL8188EEPHY_REG_1TARRAYLEN;
+        array_table = RTL8188EEPHY_REG_1TARRAY;
+
+        for (i = 0; i < arraylen; i += 2) {
+                v1 = array_table[i];
+                v2 = array_table[i + 1];
+                if (v1 < 0xcdcdcdcd) {
+                        _rtl8188e_config_bb_reg(hw, v1, v2);
+                } else {/*This line is the start line of branch.*/
+                        if (!check_cond(hw, array_table[i])) {
+                                /*Discard the following (offset, data) pairs*/
+                                NEXT_PAIR(v1, v2, i);
+                                while (v2 != 0xDEAD &&
+                                       v2 != 0xCDEF &&
+                                       v2 != 0xCDCD && i < arraylen - 2)
+                                        NEXT_PAIR(v1, v2, i);
+                                i -= 2; /* prevent from for-loop += 2*/
+                        } else {
+                                /* Configure matched pairs and skip to end */
+                                NEXT_PAIR(v1, v2, i);
+                                while (v2 != 0xDEAD &&
+                                       v2 != 0xCDEF &&
+                                       v2 != 0xCDCD && i < arraylen - 2) {
+                                        _rtl8188e_config_bb_reg(hw, v1, v2);
+                                        NEXT_PAIR(v1, v2, i);
+                                }
+
+                                while (v2 != 0xDEAD && i < arraylen - 2)
+                                        NEXT_PAIR(v1, v2, i);
+                        }
+                }
+        }
+}
+
+static void store_pwrindex_offset(struct ieee80211_hw *hw,
+                                  u32 regaddr, u32 bitmask,
+                                  u32 data)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+
+        if (regaddr == RTXAGC_A_RATE18_06) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][0] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][0] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][0]);
+        }
+        if (regaddr == RTXAGC_A_RATE54_24) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][1] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][1] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][1]);
+        }
+        if (regaddr == RTXAGC_A_CCK1_MCS32) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][6] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][6] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][6]);
+        }
+        if (regaddr == RTXAGC_B_CCK11_A_CCK2_11 && bitmask == 0xffffff00) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][7] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][7] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][7]);
+        }
+        if (regaddr == RTXAGC_A_MCS03_MCS00) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][2] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][2] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][2]);
+        }
+        if (regaddr == RTXAGC_A_MCS07_MCS04) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][3] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][3] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][3]);
+        }
+        if (regaddr == RTXAGC_A_MCS11_MCS08) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][4] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][4] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][4]);
+        }
+        if (regaddr == RTXAGC_A_MCS15_MCS12) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][5] = data;
+                if (get_rf_type(rtlphy) == RF_1T1R)
+                        rtlphy->pwrgroup_cnt++;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][5] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][5]);
+        }
+        if (regaddr == RTXAGC_B_RATE18_06) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][8] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][8] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][8]);
+        }
+        if (regaddr == RTXAGC_B_RATE54_24) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][9] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][9] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][9]);
+        }
+        if (regaddr == RTXAGC_B_CCK1_55_MCS32) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][14] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][14] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][14]);
+        }
+        if (regaddr == RTXAGC_B_CCK11_A_CCK2_11 && bitmask == 0x000000ff) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][15] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][15] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][15]);
+        }
+        if (regaddr == RTXAGC_B_MCS03_MCS00) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][10] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][10] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][10]);
+        }
+        if (regaddr == RTXAGC_B_MCS07_MCS04) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][11] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][11] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][11]);
+        }
+        if (regaddr == RTXAGC_B_MCS11_MCS08) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][12] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][12] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][12]);
+        }
+        if (regaddr == RTXAGC_B_MCS15_MCS12) {
+                rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][13] = data;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "MCSTxPowerLevelOriginalOffset[%d][13] = 0x%x\n",
+                         rtlphy->pwrgroup_cnt,
+                         rtlphy->mcs_offset[rtlphy->pwrgroup_cnt][13]);
+                if (get_rf_type(rtlphy) != RF_1T1R)
+                        rtlphy->pwrgroup_cnt++;
+        }
+}
+
+#define READ_NEXT_RF_PAIR(v1, v2, i)            \
+        do {                                    \
+                i += 2; v1 = a_table[i];        \
+                v2 = a_table[i + 1];            \
+        } while (0)
+
+bool rtl88e_phy_config_rf_with_headerfile(struct ieee80211_hw *hw,
+                                          enum radio_path rfpath)
+{
+        int i;
+        u32 *a_table;
+        u16 a_len;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u32 v1 = 0, v2 = 0;
+
+        a_len = RTL8188EE_RADIOA_1TARRAYLEN;
+        a_table = RTL8188EE_RADIOA_1TARRAY;
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "Radio_A:RTL8188EE_RADIOA_1TARRAY %d\n", a_len);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Radio No %x\n", rfpath);
+        switch (rfpath) {
+        case RF90_PATH_A:
+                for (i = 0; i < a_len; i = i + 2) {
+                        v1 = a_table[i];
+                        v2 = a_table[i + 1];
+                        if (v1 < 0xcdcdcdcd) {
+                                rtl88_config_s(hw, v1, v2);
+                        } else {/*This line is the start line of branch.*/
+                                if (!check_cond(hw, a_table[i])) {
+                                        /* Discard the following (offset, data)
+                                         * pairs
+                                         */
+                                        READ_NEXT_RF_PAIR(v1, v2, i);
+                                        while (v2 != 0xDEAD && v2 != 0xCDEF &&
+                                               v2 != 0xCDCD && i < a_len - 2)
+                                                READ_NEXT_RF_PAIR(v1, v2, i);
+                                        i -= 2; /* prevent from for-loop += 2*/
+                                } else {
+                                        /* Configure matched pairs and skip to
+                                         * end of if-else.
+                                         */
+                                        READ_NEXT_RF_PAIR(v1, v2, i);
+                                        while (v2 != 0xDEAD && v2 != 0xCDEF &&
+                                               v2 != 0xCDCD && i < a_len - 2) {
+                                                rtl88_config_s(hw, v1, v2);
+                                                READ_NEXT_RF_PAIR(v1, v2, i);
+                                        }
+
+                                        while (v2 != 0xDEAD && i < a_len - 2)
+                                                READ_NEXT_RF_PAIR(v1, v2, i);
+                                }
+                        }
+                }
+
+                if (rtlhal->oem_id == RT_CID_819x_HP)
+                        rtl88_config_s(hw, 0x52, 0x7E4BD);
+
+                break;
+
+        case RF90_PATH_B:
+        case RF90_PATH_C:
+        case RF90_PATH_D:
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "switch case not processed\n");
+                break;
+        }
+        return true;
+}
+
+void rtl88e_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+
+        rtlphy->default_initialgain[0] = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1,
+                                                       MASKBYTE0);
+        rtlphy->default_initialgain[1] = rtl_get_bbreg(hw, ROFDM0_XBAGCCORE1,
+                                                       MASKBYTE0);
+        rtlphy->default_initialgain[2] = rtl_get_bbreg(hw, ROFDM0_XCAGCCORE1,
+                                                       MASKBYTE0);
+        rtlphy->default_initialgain[3] = rtl_get_bbreg(hw, ROFDM0_XDAGCCORE1,
+                                                       MASKBYTE0);
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                 "Default initial gain (c50 = 0x%x, c58 = 0x%x, c60 = 0x%x, c68 = 0x%x\n",
+                  rtlphy->default_initialgain[0],
+                  rtlphy->default_initialgain[1],
+                  rtlphy->default_initialgain[2],
+                  rtlphy->default_initialgain[3]);
+
+        rtlphy->framesync = rtl_get_bbreg(hw, ROFDM0_RXDETECTOR3,
+                                          MASKBYTE0);
+        rtlphy->framesync_c34 = rtl_get_bbreg(hw, ROFDM0_RXDETECTOR2,
+                                              MASKDWORD);
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                 "Default framesync (0x%x) = 0x%x\n",
+                 ROFDM0_RXDETECTOR3, rtlphy->framesync);
+}
+
+void rtl88e_phy_get_txpower_level(struct ieee80211_hw *hw, long *powerlevel)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        u8 level;
+        long dbm;
+
+        level = rtlphy->cur_cck_txpwridx;
+        dbm = rtl88e_pwr_idx_dbm(hw, WIRELESS_MODE_B, level);
+        level = rtlphy->cur_ofdm24g_txpwridx;
+        if (rtl88e_pwr_idx_dbm(hw, WIRELESS_MODE_G, level) > dbm)
+                dbm = rtl88e_pwr_idx_dbm(hw, WIRELESS_MODE_G, level);
+        level = rtlphy->cur_ofdm24g_txpwridx;
+        if (rtl88e_pwr_idx_dbm(hw, WIRELESS_MODE_N_24G, level) > dbm)
+                dbm = rtl88e_pwr_idx_dbm(hw, WIRELESS_MODE_N_24G, level);
+        *powerlevel = dbm;
+}
+
+static void _rtl88e_get_txpower_index(struct ieee80211_hw *hw, u8 channel,
+                                      u8 *cckpower, u8 *ofdm, u8 *bw20_pwr,
+                                      u8 *bw40_pwr)
+{
+        struct rtl_efuse *fuse = rtl_efuse(rtl_priv(hw));
+        u8 i = (channel - 1);
+        u8 rf_path = 0;
+        int jj = RF90_PATH_A;
+        int kk = RF90_PATH_B;
+
+        for (rf_path = 0; rf_path < 2; rf_path++) {
+                if (rf_path == jj) {
+                        cckpower[jj] = fuse->txpwrlevel_cck[jj][i];
+                        if (fuse->txpwr_ht20diff[jj][i] > 0x0f) /*-8~7 */
+                                bw20_pwr[jj] = fuse->txpwrlevel_ht40_1s[jj][i] -
+                                        (~(fuse->txpwr_ht20diff[jj][i]) + 1);
+                        else
+                                bw20_pwr[jj] = fuse->txpwrlevel_ht40_1s[jj][i] +
+                                         fuse->txpwr_ht20diff[jj][i];
+                        if (fuse->txpwr_legacyhtdiff[jj][i] > 0xf)
+                                ofdm[jj] = fuse->txpwrlevel_ht40_1s[jj][i] -
+                                        (~(fuse->txpwr_legacyhtdiff[jj][i])+1);
+                        else
+                                ofdm[jj] = fuse->txpwrlevel_ht40_1s[jj][i] +
+                                           fuse->txpwr_legacyhtdiff[jj][i];
+                        bw40_pwr[jj] = fuse->txpwrlevel_ht40_1s[jj][i];
+
+                } else if (rf_path == kk) {
+                        cckpower[kk] = fuse->txpwrlevel_cck[kk][i];
+                        bw20_pwr[kk] = fuse->txpwrlevel_ht40_1s[kk][i] +
+                                       fuse->txpwr_ht20diff[kk][i];
+                        ofdm[kk] = fuse->txpwrlevel_ht40_1s[kk][i] +
+                                        fuse->txpwr_legacyhtdiff[kk][i];
+                        bw40_pwr[kk] = fuse->txpwrlevel_ht40_1s[kk][i];
+                }
+        }
+}
+
+static void _rtl88e_ccxpower_index_check(struct ieee80211_hw *hw,
+                                         u8 channel, u8 *cckpower,
+                                         u8 *ofdm, u8 *bw20_pwr,
+                                         u8 *bw40_pwr)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+
+        rtlphy->cur_cck_txpwridx = cckpower[0];
+        rtlphy->cur_ofdm24g_txpwridx = ofdm[0];
+        rtlphy->cur_bw20_txpwridx = bw20_pwr[0];
+        rtlphy->cur_bw40_txpwridx = bw40_pwr[0];
+}
+
+void rtl88e_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel)
+{
+        struct rtl_efuse *fuse = rtl_efuse(rtl_priv(hw));
+        u8 cckpower[MAX_TX_COUNT]  = {0}, ofdm[MAX_TX_COUNT] = {0};
+        u8 bw20_pwr[MAX_TX_COUNT] = {0}, bw40_pwr[MAX_TX_COUNT] = {0};
+
+        if (fuse->txpwr_fromeprom == false)
+                return;
+        _rtl88e_get_txpower_index(hw, channel, &cckpower[0], &ofdm[0],
+                                  &bw20_pwr[0], &bw40_pwr[0]);
+        _rtl88e_ccxpower_index_check(hw, channel, &cckpower[0], &ofdm[0],
+                                     &bw20_pwr[0], &bw40_pwr[0]);
+        rtl88e_phy_rf6052_set_cck_txpower(hw, &cckpower[0]);
+        rtl88e_phy_rf6052_set_ofdm_txpower(hw, &ofdm[0], &bw20_pwr[0],
+                                           &bw40_pwr[0], channel);
+}
+
+void rtl88e_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        enum io_type iotype;
+
+        if (!is_hal_stop(rtlhal)) {
+                switch (operation) {
+                case SCAN_OPT_BACKUP:
+                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                      HW_VAR_IO_CMD,
+                                                      (u8 *)&iotype);
+                        break;
+                case SCAN_OPT_RESTORE:
+                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                      HW_VAR_IO_CMD,
+                                                      (u8 *)&iotype);
+                        break;
+                default:
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "Unknown Scan Backup operation.\n");
+                        break;
+                }
+        }
+}
+
+void rtl88e_phy_set_bw_mode_callback(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        u8 reg_bw_opmode;
+        u8 reg_prsr_rsc;
+
+        RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE,
+                 "Switch to %s bandwidth\n",
+                 rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20 ?
+                 "20MHz" : "40MHz");
+
+        if (is_hal_stop(rtlhal)) {
+                rtlphy->set_bwmode_inprogress = false;
+                return;
+        }
+
+        reg_bw_opmode = rtl_read_byte(rtlpriv, REG_BWOPMODE);
+        reg_prsr_rsc = rtl_read_byte(rtlpriv, REG_RRSR + 2);
+
+        switch (rtlphy->current_chan_bw) {
+        case HT_CHANNEL_WIDTH_20:
+                reg_bw_opmode |= BW_OPMODE_20MHZ;
+                rtl_write_byte(rtlpriv, REG_BWOPMODE, reg_bw_opmode);
+                break;
+        case HT_CHANNEL_WIDTH_20_40:
+                reg_bw_opmode &= ~BW_OPMODE_20MHZ;
+                rtl_write_byte(rtlpriv, REG_BWOPMODE, reg_bw_opmode);
+                reg_prsr_rsc =
+                    (reg_prsr_rsc & 0x90) | (mac->cur_40_prime_sc << 5);
+                rtl_write_byte(rtlpriv, REG_RRSR + 2, reg_prsr_rsc);
+                break;
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "unknown bandwidth: %#X\n", rtlphy->current_chan_bw);
+                break;
+        }
+
+        switch (rtlphy->current_chan_bw) {
+        case HT_CHANNEL_WIDTH_20:
+                rtl_set_bbreg(hw, RFPGA0_RFMOD, BRFMOD, 0x0);
+                rtl_set_bbreg(hw, RFPGA1_RFMOD, BRFMOD, 0x0);
+        /*      rtl_set_bbreg(hw, RFPGA0_ANALOGPARAMETER2, BIT(10), 1);*/
+                break;
+        case HT_CHANNEL_WIDTH_20_40:
+                rtl_set_bbreg(hw, RFPGA0_RFMOD, BRFMOD, 0x1);
+                rtl_set_bbreg(hw, RFPGA1_RFMOD, BRFMOD, 0x1);
+
+                rtl_set_bbreg(hw, RCCK0_SYSTEM, BCCK_SIDEBAND,
+                              (mac->cur_40_prime_sc >> 1));
+                rtl_set_bbreg(hw, ROFDM1_LSTF, 0xC00, mac->cur_40_prime_sc);
+                /*rtl_set_bbreg(hw, RFPGA0_ANALOGPARAMETER2, BIT(10), 0);*/
+
+                rtl_set_bbreg(hw, 0x818, (BIT(26) | BIT(27)),
+                              (mac->cur_40_prime_sc ==
+                               HAL_PRIME_CHNL_OFFSET_LOWER) ? 2 : 1);
+                break;
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "unknown bandwidth: %#X\n", rtlphy->current_chan_bw);
+                break;
+        }
+        rtl88e_phy_rf6052_set_bandwidth(hw, rtlphy->current_chan_bw);
+        rtlphy->set_bwmode_inprogress = false;
+        RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD, "\n");
+}
+
+void rtl88e_phy_set_bw_mode(struct ieee80211_hw *hw,
+                            enum nl80211_channel_type ch_type)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u8 tmp_bw = rtlphy->current_chan_bw;
+
+        if (rtlphy->set_bwmode_inprogress)
+                return;
+        rtlphy->set_bwmode_inprogress = true;
+        if ((!is_hal_stop(rtlhal)) && !(RT_CANNOT_IO(hw))) {
+                rtl88e_phy_set_bw_mode_callback(hw);
+        } else {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                         "FALSE driver sleep or unload\n");
+                rtlphy->set_bwmode_inprogress = false;
+                rtlphy->current_chan_bw = tmp_bw;
+        }
+}
+
+void rtl88e_phy_sw_chnl_callback(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        u32 delay;
+
+        RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE,
+                 "switch to channel%d\n", rtlphy->current_channel);
+        if (is_hal_stop(rtlhal))
+                return;
+        do {
+                if (!rtlphy->sw_chnl_inprogress)
+                        break;
+                if (!chnl_step_by_step(hw, rtlphy->current_channel,
+                                       &rtlphy->sw_chnl_stage,
+                                       &rtlphy->sw_chnl_step, &delay)) {
+                        if (delay > 0)
+                                mdelay(delay);
+                        else
+                                continue;
+                } else {
+                        rtlphy->sw_chnl_inprogress = false;
+                }
+                break;
+        } while (true);
+        RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, "\n");
+}
+
+u8 rtl88e_phy_sw_chnl(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+
+        if (rtlphy->sw_chnl_inprogress)
+                return 0;
+        if (rtlphy->set_bwmode_inprogress)
+                return 0;
+        RT_ASSERT((rtlphy->current_channel <= 14),
+                  "WIRELESS_MODE_G but channel>14");
+        rtlphy->sw_chnl_inprogress = true;
+        rtlphy->sw_chnl_stage = 0;
+        rtlphy->sw_chnl_step = 0;
+        if (!(is_hal_stop(rtlhal)) && !(RT_CANNOT_IO(hw))) {
+                rtl88e_phy_sw_chnl_callback(hw);
+                RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
+                         "sw_chnl_inprogress false schdule workitem current channel %d\n",
+                         rtlphy->current_channel);
+                rtlphy->sw_chnl_inprogress = false;
+        } else {
+                RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
+                         "sw_chnl_inprogress false driver sleep or unload\n");
+                rtlphy->sw_chnl_inprogress = false;
+        }
+        return 1;
+}
+
+static u8 _rtl88e_phy_path_a_iqk(struct ieee80211_hw *hw, bool config_pathb)
+{
+        u32 reg_eac, reg_e94, reg_e9c;
+        u8 result = 0x00;
+
+        rtl_set_bbreg(hw, 0xe30, MASKDWORD, 0x10008c1c);
+        rtl_set_bbreg(hw, 0xe34, MASKDWORD, 0x30008c1c);
+        rtl_set_bbreg(hw, 0xe38, MASKDWORD, 0x8214032a);
+        rtl_set_bbreg(hw, 0xe3c, MASKDWORD, 0x28160000);
+
+        rtl_set_bbreg(hw, 0xe4c, MASKDWORD, 0x00462911);
+        rtl_set_bbreg(hw, 0xe48, MASKDWORD, 0xf9000000);
+        rtl_set_bbreg(hw, 0xe48, MASKDWORD, 0xf8000000);
+
+        mdelay(IQK_DELAY_TIME);
+
+        reg_eac = rtl_get_bbreg(hw, 0xeac, MASKDWORD);
+        reg_e94 = rtl_get_bbreg(hw, 0xe94, MASKDWORD);
+        reg_e9c = rtl_get_bbreg(hw, 0xe9c, MASKDWORD);
+
+        if (!(reg_eac & BIT(28)) &&
+            (((reg_e94 & 0x03FF0000) >> 16) != 0x142) &&
+            (((reg_e9c & 0x03FF0000) >> 16) != 0x42))
+                result |= 0x01;
+        return result;
+}
+
+static u8 _rtl88e_phy_path_b_iqk(struct ieee80211_hw *hw)
+{
+        u32 reg_eac, reg_eb4, reg_ebc, reg_ec4, reg_ecc;
+        u8 result = 0x00;
+
+        rtl_set_bbreg(hw, 0xe60, MASKDWORD, 0x00000002);
+        rtl_set_bbreg(hw, 0xe60, MASKDWORD, 0x00000000);
+        mdelay(IQK_DELAY_TIME);
+        reg_eac = rtl_get_bbreg(hw, 0xeac, MASKDWORD);
+        reg_eb4 = rtl_get_bbreg(hw, 0xeb4, MASKDWORD);
+        reg_ebc = rtl_get_bbreg(hw, 0xebc, MASKDWORD);
+        reg_ec4 = rtl_get_bbreg(hw, 0xec4, MASKDWORD);
+        reg_ecc = rtl_get_bbreg(hw, 0xecc, MASKDWORD);
+
+        if (!(reg_eac & BIT(31)) &&
+            (((reg_eb4 & 0x03FF0000) >> 16) != 0x142) &&
+            (((reg_ebc & 0x03FF0000) >> 16) != 0x42))
+                result |= 0x01;
+        else
+                return result;
+        if (!(reg_eac & BIT(30)) &&
+            (((reg_ec4 & 0x03FF0000) >> 16) != 0x132) &&
+            (((reg_ecc & 0x03FF0000) >> 16) != 0x36))
+                result |= 0x02;
+        return result;
+}
+
+static u8 _rtl88e_phy_path_a_rx_iqk(struct ieee80211_hw *hw, bool config_pathb)
+{
+        u32 reg_eac, reg_e94, reg_e9c, reg_ea4, u32temp;
+        u8 result = 0x00;
+        int jj = RF90_PATH_A;
+
+        /*Get TXIMR Setting*/
+        /*Modify RX IQK mode table*/
+        rtl_set_bbreg(hw, RFPGA0_IQK, MASKDWORD, 0x00000000);
+        rtl_set_rfreg(hw, jj, RF_WE_LUT, RFREG_OFFSET_MASK, 0x800a0);
+        rtl_set_rfreg(hw, jj, RF_RCK_OS, RFREG_OFFSET_MASK, 0x30000);
+        rtl_set_rfreg(hw, jj, RF_TXPA_G1, RFREG_OFFSET_MASK, 0x0000f);
+        rtl_set_rfreg(hw, jj, RF_TXPA_G2, RFREG_OFFSET_MASK, 0xf117b);
+        rtl_set_bbreg(hw, RFPGA0_IQK, MASKDWORD, 0x80800000);
+
+        /*IQK Setting*/
+        rtl_set_bbreg(hw, RTX_IQK, MASKDWORD, 0x01007c00);
+        rtl_set_bbreg(hw, RRX_IQK, MASKDWORD, 0x81004800);
+
+        /*path a IQK setting*/
+        rtl_set_bbreg(hw, RTX_IQK_TONE_A, MASKDWORD, 0x10008c1c);
+        rtl_set_bbreg(hw, RRX_IQK_TONE_A, MASKDWORD, 0x30008c1c);
+        rtl_set_bbreg(hw, RTX_IQK_PI_A, MASKDWORD, 0x82160804);
+        rtl_set_bbreg(hw, RRX_IQK_PI_A, MASKDWORD, 0x28160000);
+
+        /*LO calibration Setting*/
+        rtl_set_bbreg(hw, RIQK_AGC_RSP, MASKDWORD, 0x0046a911);
+        /*one shot, path A LOK & iqk*/
+        rtl_set_bbreg(hw, RIQK_AGC_PTS, MASKDWORD, 0xf9000000);
+        rtl_set_bbreg(hw, RIQK_AGC_PTS, MASKDWORD, 0xf8000000);
+
+        mdelay(IQK_DELAY_TIME);
+
+        reg_eac = rtl_get_bbreg(hw, RRX_POWER_AFTER_IQK_A_2, MASKDWORD);
+        reg_e94 = rtl_get_bbreg(hw, RTX_POWER_BEFORE_IQK_A, MASKDWORD);
+        reg_e9c = rtl_get_bbreg(hw, RTX_POWER_AFTER_IQK_A, MASKDWORD);
+
+
+        if (!(reg_eac & BIT(28)) &&
+            (((reg_e94 & 0x03FF0000) >> 16) != 0x142) &&
+            (((reg_e9c & 0x03FF0000) >> 16) != 0x42))
+                result |= 0x01;
+        else
+                return result;
+
+        u32temp = 0x80007C00 | (reg_e94&0x3FF0000)  |
+                  ((reg_e9c&0x3FF0000) >> 16);
+        rtl_set_bbreg(hw, RTX_IQK, MASKDWORD, u32temp);
+        /*RX IQK*/
+        /*Modify RX IQK mode table*/
+        rtl_set_bbreg(hw, RFPGA0_IQK, MASKDWORD, 0x00000000);
+        rtl_set_rfreg(hw, jj, RF_WE_LUT, RFREG_OFFSET_MASK, 0x800a0);
+        rtl_set_rfreg(hw, jj, RF_RCK_OS, RFREG_OFFSET_MASK, 0x30000);
+        rtl_set_rfreg(hw, jj, RF_TXPA_G1, RFREG_OFFSET_MASK, 0x0000f);
+        rtl_set_rfreg(hw, jj, RF_TXPA_G2, RFREG_OFFSET_MASK, 0xf7ffa);
+        rtl_set_bbreg(hw, RFPGA0_IQK, MASKDWORD, 0x80800000);
+
+        /*IQK Setting*/
+        rtl_set_bbreg(hw, RRX_IQK, MASKDWORD, 0x01004800);
+
+        /*path a IQK setting*/
+        rtl_set_bbreg(hw, RTX_IQK_TONE_A, MASKDWORD, 0x30008c1c);
+        rtl_set_bbreg(hw, RRX_IQK_TONE_A, MASKDWORD, 0x10008c1c);
+        rtl_set_bbreg(hw, RTX_IQK_PI_A, MASKDWORD, 0x82160c05);
+        rtl_set_bbreg(hw, RRX_IQK_PI_A, MASKDWORD, 0x28160c05);
+
+        /*LO calibration Setting*/
+        rtl_set_bbreg(hw, RIQK_AGC_RSP, MASKDWORD, 0x0046a911);
+        /*one shot, path A LOK & iqk*/
+        rtl_set_bbreg(hw, RIQK_AGC_PTS, MASKDWORD, 0xf9000000);
+        rtl_set_bbreg(hw, RIQK_AGC_PTS, MASKDWORD, 0xf8000000);
+
+        mdelay(IQK_DELAY_TIME);
+
+        reg_eac = rtl_get_bbreg(hw, RRX_POWER_AFTER_IQK_A_2, MASKDWORD);
+        reg_e94 = rtl_get_bbreg(hw, RTX_POWER_BEFORE_IQK_A, MASKDWORD);
+        reg_e9c = rtl_get_bbreg(hw, RTX_POWER_AFTER_IQK_A, MASKDWORD);
+        reg_ea4 = rtl_get_bbreg(hw, RRX_POWER_BEFORE_IQK_A_2, MASKDWORD);
+
+        if (!(reg_eac & BIT(27)) &&
+            (((reg_ea4 & 0x03FF0000) >> 16) != 0x132) &&
+            (((reg_eac & 0x03FF0000) >> 16) != 0x36))
+                result |= 0x02;
+        return result;
+}
+
+static void fill_iqk(struct ieee80211_hw *hw, bool iqk_ok, long result[][8],
+                     u8 final, bool btxonly)
+{
+        u32 oldval_0, x, tx0_a, reg;
+        long y, tx0_c;
+
+        if (final == 0xFF) {
+                return;
+        } else if (iqk_ok) {
+                oldval_0 = (rtl_get_bbreg(hw, ROFDM0_XATXIQIMBAL,
+                                          MASKDWORD) >> 22) & 0x3FF;
+                x = result[final][0];
+                if ((x & 0x00000200) != 0)
+                        x = x | 0xFFFFFC00;
+                tx0_a = (x * oldval_0) >> 8;
+                rtl_set_bbreg(hw, ROFDM0_XATXIQIMBAL, 0x3FF, tx0_a);
+                rtl_set_bbreg(hw, ROFDM0_ECCATHRES, BIT(31),
+                              ((x * oldval_0 >> 7) & 0x1));
+                y = result[final][1];
+                if ((y & 0x00000200) != 0)
+                        y |= 0xFFFFFC00;
+                tx0_c = (y * oldval_0) >> 8;
+                rtl_set_bbreg(hw, ROFDM0_XCTXAFE, 0xF0000000,
+                              ((tx0_c & 0x3C0) >> 6));
+                rtl_set_bbreg(hw, ROFDM0_XATXIQIMBAL, 0x003F0000,
+                              (tx0_c & 0x3F));
+                rtl_set_bbreg(hw, ROFDM0_ECCATHRES, BIT(29),
+                              ((y * oldval_0 >> 7) & 0x1));
+                if (btxonly)
+                        return;
+                reg = result[final][2];
+                rtl_set_bbreg(hw, ROFDM0_XARXIQIMBAL, 0x3FF, reg);
+                reg = result[final][3] & 0x3F;
+                rtl_set_bbreg(hw, ROFDM0_XARXIQIMBAL, 0xFC00, reg);
+                reg = (result[final][3] >> 6) & 0xF;
+                rtl_set_bbreg(hw, 0xca0, 0xF0000000, reg);
+        }
+}
+
+static void save_adda_reg(struct ieee80211_hw *hw,
+                          const u32 *addareg, u32 *backup,
+                          u32 registernum)
+{
+        u32 i;
+
+        for (i = 0; i < registernum; i++)
+                backup[i] = rtl_get_bbreg(hw, addareg[i], MASKDWORD);
+}
+
+static void save_mac_reg(struct ieee80211_hw *hw, const u32 *macreg,
+                         u32 *macbackup)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 i;
+
+        for (i = 0; i < (IQK_MAC_REG_NUM - 1); i++)
+                macbackup[i] = rtl_read_byte(rtlpriv, macreg[i]);
+        macbackup[i] = rtl_read_dword(rtlpriv, macreg[i]);
+}
+
+static void reload_adda(struct ieee80211_hw *hw, const u32 *addareg,
+                        u32 *backup, u32 reg_num)
+{
+        u32 i;
+
+        for (i = 0; i < reg_num; i++)
+                rtl_set_bbreg(hw, addareg[i], MASKDWORD, backup[i]);
+}
+
+static void reload_mac(struct ieee80211_hw *hw, const u32 *macreg,
+                       u32 *macbackup)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 i;
+
+        for (i = 0; i < (IQK_MAC_REG_NUM - 1); i++)
+                rtl_write_byte(rtlpriv, macreg[i], (u8) macbackup[i]);
+        rtl_write_dword(rtlpriv, macreg[i], macbackup[i]);
+}
+
+static void _rtl88e_phy_path_adda_on(struct ieee80211_hw *hw,
+                                     const u32 *addareg, bool is_patha_on,
+                                     bool is2t)
+{
+        u32 pathon;
+        u32 i;
+
+        pathon = is_patha_on ? 0x04db25a4 : 0x0b1b25a4;
+        if (false == is2t) {
+                pathon = 0x0bdb25a0;
+                rtl_set_bbreg(hw, addareg[0], MASKDWORD, 0x0b1b25a0);
+        } else {
+                rtl_set_bbreg(hw, addareg[0], MASKDWORD, pathon);
+        }
+
+        for (i = 1; i < IQK_ADDA_REG_NUM; i++)
+                rtl_set_bbreg(hw, addareg[i], MASKDWORD, pathon);
+}
+
+static void _rtl88e_phy_mac_setting_calibration(struct ieee80211_hw *hw,
+                                                const u32 *macreg,
+                                                u32 *macbackup)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 i = 0;
+
+        rtl_write_byte(rtlpriv, macreg[i], 0x3F);
+
+        for (i = 1; i < (IQK_MAC_REG_NUM - 1); i++)
+                rtl_write_byte(rtlpriv, macreg[i],
+                               (u8) (macbackup[i] & (~BIT(3))));
+        rtl_write_byte(rtlpriv, macreg[i], (u8) (macbackup[i] & (~BIT(5))));
+}
+
+static void _rtl88e_phy_path_a_standby(struct ieee80211_hw *hw)
+{
+        rtl_set_bbreg(hw, 0xe28, MASKDWORD, 0x0);
+        rtl_set_bbreg(hw, 0x840, MASKDWORD, 0x00010000);
+        rtl_set_bbreg(hw, 0xe28, MASKDWORD, 0x80800000);
+}
+
+static void _rtl88e_phy_pi_mode_switch(struct ieee80211_hw *hw, bool pi_mode)
+{
+        u32 mode;
+
+        mode = pi_mode ? 0x01000100 : 0x01000000;
+        rtl_set_bbreg(hw, 0x820, MASKDWORD, mode);
+        rtl_set_bbreg(hw, 0x828, MASKDWORD, mode);
+}
+
+static bool sim_comp(struct ieee80211_hw *hw, long result[][8], u8 c1, u8 c2)
+{
+        u32 i, j, diff, bitmap, bound;
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+
+        u8 final[2] = {0xFF, 0xFF};
+        bool bresult = true, is2t = IS_92C_SERIAL(rtlhal->version);
+
+        if (is2t)
+                bound = 8;
+        else
+                bound = 4;
+
+        bitmap = 0;
+
+        for (i = 0; i < bound; i++) {
+                diff = (result[c1][i] > result[c2][i]) ?
+                       (result[c1][i] - result[c2][i]) :
+                       (result[c2][i] - result[c1][i]);
+
+                if (diff > MAX_TOLERANCE) {
+                        if ((i == 2 || i == 6) && !bitmap) {
+                                if (result[c1][i] + result[c1][i + 1] == 0)
+                                        final[(i / 4)] = c2;
+                                else if (result[c2][i] + result[c2][i + 1] == 0)
+                                        final[(i / 4)] = c1;
+                                else
+                                        bitmap = bitmap | (1 << i);
+                        } else {
+                                bitmap = bitmap | (1 << i);
+                        }
+                }
+        }
+
+        if (bitmap == 0) {
+                for (i = 0; i < (bound / 4); i++) {
+                        if (final[i] != 0xFF) {
+                                for (j = i * 4; j < (i + 1) * 4 - 2; j++)
+                                        result[3][j] = result[final[i]][j];
+                                bresult = false;
+                        }
+                }
+                return bresult;
+        } else if (!(bitmap & 0x0F)) {
+                for (i = 0; i < 4; i++)
+                        result[3][i] = result[c1][i];
+                return false;
+        } else if (!(bitmap & 0xF0) && is2t) {
+                for (i = 4; i < 8; i++)
+                        result[3][i] = result[c1][i];
+                return false;
+        } else {
+                return false;
+        }
+}
+
+static void _rtl88e_phy_iq_calibrate(struct ieee80211_hw *hw,
+                                     long result[][8], u8 t, bool is2t)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        u32 i;
+        u8 patha_ok, pathb_ok;
+        const u32 adda_reg[IQK_ADDA_REG_NUM] = {
+                0x85c, 0xe6c, 0xe70, 0xe74,
+                0xe78, 0xe7c, 0xe80, 0xe84,
+                0xe88, 0xe8c, 0xed0, 0xed4,
+                0xed8, 0xedc, 0xee0, 0xeec
+        };
+        const u32 iqk_mac_reg[IQK_MAC_REG_NUM] = {
+                0x522, 0x550, 0x551, 0x040
+        };
+        const u32 iqk_bb_reg[IQK_BB_REG_NUM] = {
+                ROFDM0_TRXPATHENABLE, ROFDM0_TRMUXPAR, RFPGA0_XCD_RFINTERFACESW,
+                0xb68, 0xb6c, 0x870, 0x860, 0x864, 0x800
+        };
+        const u32 retrycount = 2;
+
+        if (t == 0) {
+                save_adda_reg(hw, adda_reg, rtlphy->adda_backup, 16);
+                save_mac_reg(hw, iqk_mac_reg, rtlphy->iqk_mac_backup);
+                save_adda_reg(hw, iqk_bb_reg, rtlphy->iqk_bb_backup,
+                              IQK_BB_REG_NUM);
+        }
+        _rtl88e_phy_path_adda_on(hw, adda_reg, true, is2t);
+        if (t == 0) {
+                rtlphy->rfpi_enable = (u8) rtl_get_bbreg(hw,
+                                           RFPGA0_XA_HSSIPARAMETER1, BIT(8));
+        }
+
+        if (!rtlphy->rfpi_enable)
+                _rtl88e_phy_pi_mode_switch(hw, true);
+        /*BB Setting*/
+        rtl_set_bbreg(hw, 0x800, BIT(24), 0x00);
+        rtl_set_bbreg(hw, 0xc04, MASKDWORD, 0x03a05600);
+        rtl_set_bbreg(hw, 0xc08, MASKDWORD, 0x000800e4);
+        rtl_set_bbreg(hw, 0x874, MASKDWORD, 0x22204000);
+
+        rtl_set_bbreg(hw, 0x870, BIT(10), 0x01);
+        rtl_set_bbreg(hw, 0x870, BIT(26), 0x01);
+        rtl_set_bbreg(hw, 0x860, BIT(10), 0x00);
+        rtl_set_bbreg(hw, 0x864, BIT(10), 0x00);
+
+        if (is2t) {
+                rtl_set_bbreg(hw, 0x840, MASKDWORD, 0x00010000);
+                rtl_set_bbreg(hw, 0x844, MASKDWORD, 0x00010000);
+        }
+        _rtl88e_phy_mac_setting_calibration(hw, iqk_mac_reg,
+                                            rtlphy->iqk_mac_backup);
+        rtl_set_bbreg(hw, 0xb68, MASKDWORD, 0x0f600000);
+        if (is2t)
+                rtl_set_bbreg(hw, 0xb6c, MASKDWORD, 0x0f600000);
+
+        rtl_set_bbreg(hw, 0xe28, MASKDWORD, 0x80800000);
+        rtl_set_bbreg(hw, 0xe40, MASKDWORD, 0x01007c00);
+        rtl_set_bbreg(hw, 0xe44, MASKDWORD, 0x81004800);
+        for (i = 0; i < retrycount; i++) {
+                patha_ok = _rtl88e_phy_path_a_iqk(hw, is2t);
+                if (patha_ok == 0x01) {
+                        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                                 "Path A Tx IQK Success!!\n");
+                        result[t][0] = (rtl_get_bbreg(hw, 0xe94, MASKDWORD) &
+                                        0x3FF0000) >> 16;
+                        result[t][1] = (rtl_get_bbreg(hw, 0xe9c, MASKDWORD) &
+                                        0x3FF0000) >> 16;
+                        break;
+                }
+        }
+
+        for (i = 0; i < retrycount; i++) {
+                patha_ok = _rtl88e_phy_path_a_rx_iqk(hw, is2t);
+                if (patha_ok == 0x03) {
+                        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                                 "Path A Rx IQK Success!!\n");
+                        result[t][2] = (rtl_get_bbreg(hw, 0xea4, MASKDWORD) &
+                                        0x3FF0000) >> 16;
+                        result[t][3] = (rtl_get_bbreg(hw, 0xeac, MASKDWORD) &
+                                        0x3FF0000) >> 16;
+                        break;
+                } else {
+                        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                                 "Path a RX iqk fail!!!\n");
+                }
+        }
+
+        if (0 == patha_ok) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                         "Path A IQK Success!!\n");
+        }
+        if (is2t) {
+                _rtl88e_phy_path_a_standby(hw);
+                _rtl88e_phy_path_adda_on(hw, adda_reg, false, is2t);
+                for (i = 0; i < retrycount; i++) {
+                        pathb_ok = _rtl88e_phy_path_b_iqk(hw);
+                        if (pathb_ok == 0x03) {
+                                result[t][4] = (rtl_get_bbreg(hw,
+                                                0xeb4, MASKDWORD) &
+                                                0x3FF0000) >> 16;
+                                result[t][5] =
+                                    (rtl_get_bbreg(hw, 0xebc, MASKDWORD) &
+                                                   0x3FF0000) >> 16;
+                                result[t][6] =
+                                    (rtl_get_bbreg(hw, 0xec4, MASKDWORD) &
+                                                   0x3FF0000) >> 16;
+                                result[t][7] =
+                                    (rtl_get_bbreg(hw, 0xecc, MASKDWORD) &
+                                                   0x3FF0000) >> 16;
+                                break;
+                        } else if (i == (retrycount - 1) && pathb_ok == 0x01) {
+                                result[t][4] = (rtl_get_bbreg(hw,
+                                                0xeb4, MASKDWORD) &
+                                                0x3FF0000) >> 16;
+                        }
+                        result[t][5] = (rtl_get_bbreg(hw, 0xebc, MASKDWORD) &
+                                        0x3FF0000) >> 16;
+                }
+        }
+
+        rtl_set_bbreg(hw, 0xe28, MASKDWORD, 0);
+
+        if (t != 0) {
+                if (!rtlphy->rfpi_enable)
+                        _rtl88e_phy_pi_mode_switch(hw, false);
+                reload_adda(hw, adda_reg, rtlphy->adda_backup, 16);
+                reload_mac(hw, iqk_mac_reg, rtlphy->iqk_mac_backup);
+                reload_adda(hw, iqk_bb_reg, rtlphy->iqk_bb_backup,
+                            IQK_BB_REG_NUM);
+
+                rtl_set_bbreg(hw, 0x840, MASKDWORD, 0x00032ed3);
+                if (is2t)
+                        rtl_set_bbreg(hw, 0x844, MASKDWORD, 0x00032ed3);
+                rtl_set_bbreg(hw, 0xe30, MASKDWORD, 0x01008c00);
+                rtl_set_bbreg(hw, 0xe34, MASKDWORD, 0x01008c00);
+        }
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "88ee IQK Finish!!\n");
+}
+
+static void _rtl88e_phy_lc_calibrate(struct ieee80211_hw *hw, bool is2t)
+{
+        u8 tmpreg;
+        u32 rf_a_mode = 0, rf_b_mode = 0, lc_cal;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        int jj = RF90_PATH_A;
+        int kk = RF90_PATH_B;
+
+        tmpreg = rtl_read_byte(rtlpriv, 0xd03);
+
+        if ((tmpreg & 0x70) != 0)
+                rtl_write_byte(rtlpriv, 0xd03, tmpreg & 0x8F);
+        else
+                rtl_write_byte(rtlpriv, REG_TXPAUSE, 0xFF);
+
+        if ((tmpreg & 0x70) != 0) {
+                rf_a_mode = rtl_get_rfreg(hw, jj, 0x00, MASK12BITS);
+
+                if (is2t)
+                        rf_b_mode = rtl_get_rfreg(hw, kk, 0x00,
+                                                  MASK12BITS);
+
+                rtl_set_rfreg(hw, jj, 0x00, MASK12BITS,
+                              (rf_a_mode & 0x8FFFF) | 0x10000);
+
+                if (is2t)
+                        rtl_set_rfreg(hw, kk, 0x00, MASK12BITS,
+                                      (rf_b_mode & 0x8FFFF) | 0x10000);
+        }
+        lc_cal = rtl_get_rfreg(hw, jj, 0x18, MASK12BITS);
+
+        rtl_set_rfreg(hw, jj, 0x18, MASK12BITS, lc_cal | 0x08000);
+
+        mdelay(100);
+
+        if ((tmpreg & 0x70) != 0) {
+                rtl_write_byte(rtlpriv, 0xd03, tmpreg);
+                rtl_set_rfreg(hw, jj, 0x00, MASK12BITS, rf_a_mode);
+
+                if (is2t)
+                        rtl_set_rfreg(hw, kk, 0x00, MASK12BITS,
+                                      rf_b_mode);
+        } else {
+                rtl_write_byte(rtlpriv, REG_TXPAUSE, 0x00);
+        }
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "\n");
+}
+
+static void rfpath_switch(struct ieee80211_hw *hw,
+                          bool bmain, bool is2t)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_efuse *fuse = rtl_efuse(rtl_priv(hw));
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "\n");
+
+        if (is_hal_stop(rtlhal)) {
+                u8 u1btmp;
+                u1btmp = rtl_read_byte(rtlpriv, REG_LEDCFG0);
+                rtl_write_byte(rtlpriv, REG_LEDCFG0, u1btmp | BIT(7));
+                rtl_set_bbreg(hw, rFPGA0_XAB_RFPARAMETER, BIT(13), 0x01);
+        }
+        if (is2t) {
+                if (bmain)
+                        rtl_set_bbreg(hw, RFPGA0_XB_RFINTERFACEOE,
+                                      BIT(5) | BIT(6), 0x1);
+                else
+                        rtl_set_bbreg(hw, RFPGA0_XB_RFINTERFACEOE,
+                                      BIT(5) | BIT(6), 0x2);
+        } else {
+                rtl_set_bbreg(hw, RFPGA0_XAB_RFINTERFACESW, BIT(8) | BIT(9), 0);
+                rtl_set_bbreg(hw, 0x914, MASKLWORD, 0x0201);
+
+                /* We use the RF definition of MAIN and AUX, left antenna and
+                 * right antenna repectively.
+                 * Default output at AUX.
+                 */
+                if (bmain) {
+                        rtl_set_bbreg(hw, RFPGA0_XA_RFINTERFACEOE, BIT(14) |
+                                      BIT(13) | BIT(12), 0);
+                        rtl_set_bbreg(hw, RFPGA0_XB_RFINTERFACEOE, BIT(5) |
+                                      BIT(4) | BIT(3), 0);
+                        if (fuse->antenna_div_type == CGCS_RX_HW_ANTDIV)
+                                rtl_set_bbreg(hw, RCONFIG_RAM64X16, BIT(31), 0);
+                } else {
+                        rtl_set_bbreg(hw, RFPGA0_XA_RFINTERFACEOE, BIT(14) |
+                                      BIT(13) | BIT(12), 1);
+                        rtl_set_bbreg(hw, RFPGA0_XB_RFINTERFACEOE, BIT(5) |
+                                      BIT(4) | BIT(3), 1);
+                        if (fuse->antenna_div_type == CGCS_RX_HW_ANTDIV)
+                                rtl_set_bbreg(hw, RCONFIG_RAM64X16, BIT(31), 1);
+                }
+        }
+}
+
+#undef IQK_ADDA_REG_NUM
+#undef IQK_DELAY_TIME
+
+void rtl88e_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        long result[4][8];
+        u8 i, final;
+        bool patha_ok;
+        long reg_e94, reg_e9c, reg_ea4, reg_eb4, reg_ebc, reg_tmp = 0;
+        bool is12simular, is13simular, is23simular;
+        u32 iqk_bb_reg[9] = {
+                ROFDM0_XARXIQIMBAL,
+                ROFDM0_XBRXIQIMBAL,
+                ROFDM0_ECCATHRES,
+                ROFDM0_AGCRSSITABLE,
+                ROFDM0_XATXIQIMBAL,
+                ROFDM0_XBTXIQIMBAL,
+                ROFDM0_XCTXAFE,
+                ROFDM0_XDTXAFE,
+                ROFDM0_RXIQEXTANTA
+        };
+
+        if (recovery) {
+                reload_adda(hw, iqk_bb_reg, rtlphy->iqk_bb_backup, 9);
+                return;
+        }
+
+        memset(result, 0, 32 * sizeof(long));
+        final = 0xff;
+        patha_ok = false;
+        is12simular = false;
+        is23simular = false;
+        is13simular = false;
+        for (i = 0; i < 3; i++) {
+                if (get_rf_type(rtlphy) == RF_2T2R)
+                        _rtl88e_phy_iq_calibrate(hw, result, i, true);
+                else
+                        _rtl88e_phy_iq_calibrate(hw, result, i, false);
+                if (i == 1) {
+                        is12simular = sim_comp(hw, result, 0, 1);
+                        if (is12simular) {
+                                final = 0;
+                                break;
+                        }
+                }
+                if (i == 2) {
+                        is13simular = sim_comp(hw, result, 0, 2);
+                        if (is13simular) {
+                                final = 0;
+                                break;
+                        }
+                        is23simular = sim_comp(hw, result, 1, 2);
+                        if (is23simular) {
+                                final = 1;
+                        } else {
+                                for (i = 0; i < 8; i++)
+                                        reg_tmp += result[3][i];
+
+                                if (reg_tmp != 0)
+                                        final = 3;
+                                else
+                                        final = 0xFF;
+                        }
+                }
+        }
+        for (i = 0; i < 4; i++) {
+                reg_e94 = result[i][0];
+                reg_e9c = result[i][1];
+                reg_ea4 = result[i][2];
+                reg_eb4 = result[i][4];
+                reg_ebc = result[i][5];
+        }
+        if (final != 0xff) {
+                reg_e94 = result[final][0];
+                rtlphy->reg_e94 = reg_e94;
+                reg_e9c = result[final][1];
+                rtlphy->reg_e9c = reg_e9c;
+                reg_ea4 = result[final][2];
+                reg_eb4 = result[final][4];
+                rtlphy->reg_eb4 = reg_eb4;
+                reg_ebc = result[final][5];
+                rtlphy->reg_ebc = reg_ebc;
+                patha_ok = true;
+        } else {
+                rtlphy->reg_e94 = 0x100;
+                rtlphy->reg_eb4 = 0x100;
+                rtlphy->reg_ebc = 0x0;
+                rtlphy->reg_e9c = 0x0;
+        }
+        if (reg_e94 != 0) /*&&(reg_ea4 != 0) */
+                fill_iqk(hw, patha_ok, result, final, (reg_ea4 == 0));
+        if (final != 0xFF) {
+                for (i = 0; i < IQK_MATRIX_REG_NUM; i++)
+                        rtlphy->iqk_matrix[0].value[0][i] = result[final][i];
+                rtlphy->iqk_matrix[0].iqk_done = true;
+        }
+        save_adda_reg(hw, iqk_bb_reg, rtlphy->iqk_bb_backup, 9);
+}
+
+void rtl88e_phy_lc_calibrate(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_hal *rtlhal = &(rtlpriv->rtlhal);
+        bool start_conttx = false, singletone = false;
+        u32 timeout = 2000, timecount = 0;
+
+        if (start_conttx || singletone)
+                return;
+
+        while (rtlpriv->mac80211.act_scanning && timecount < timeout) {
+                udelay(50);
+                timecount += 50;
+        }
+
+        rtlphy->lck_inprogress = true;
+        RTPRINT(rtlpriv, FINIT, INIT_IQK,
+                "LCK:Start!!! currentband %x delay %d ms\n",
+                 rtlhal->current_bandtype, timecount);
+
+        _rtl88e_phy_lc_calibrate(hw, false);
+
+        rtlphy->lck_inprogress = false;
+}
+
+void rtl88e_phy_set_rfpath_switch(struct ieee80211_hw *hw, bool bmain)
+{
+        rfpath_switch(hw, bmain, false);
+}
+
+bool rtl88e_phy_set_io_cmd(struct ieee80211_hw *hw, enum io_type iotype)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        bool postprocessing = false;
+
+        RT_TRACE(rtlpriv, COMP_CMD, DBG_TRACE,
+                 "-->IO Cmd(%#x), set_io_inprogress(%d)\n",
+                 iotype, rtlphy->set_io_inprogress);
+        do {
+                switch (iotype) {
+                case IO_CMD_RESUME_DM_BY_SCAN:
+                        RT_TRACE(rtlpriv, COMP_CMD, DBG_TRACE,
+                                 "[IO CMD] Resume DM after scan.\n");
+                        postprocessing = true;
+                        break;
+                case IO_CMD_PAUSE_DM_BY_SCAN:
+                        RT_TRACE(rtlpriv, COMP_CMD, DBG_TRACE,
+                                 "[IO CMD] Pause DM before scan.\n");
+                        postprocessing = true;
+                        break;
+                default:
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "switch case not processed\n");
+                        break;
+                }
+        } while (false);
+        if (postprocessing && !rtlphy->set_io_inprogress) {
+                rtlphy->set_io_inprogress = true;
+                rtlphy->current_io_type = iotype;
+        } else {
+                return false;
+        }
+        rtl88e_phy_set_io(hw);
+        RT_TRACE(rtlpriv, COMP_CMD, DBG_TRACE, "IO Type(%#x)\n", iotype);
+        return true;
+}
+
+static void rtl88ee_phy_set_rf_on(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        rtl_write_byte(rtlpriv, REG_SPS0_CTRL, 0x2b);
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN, 0xE3);
+        /*rtl_write_byte(rtlpriv, REG_APSD_CTRL, 0x00);*/
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN, 0xE2);
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN, 0xE3);
+        rtl_write_byte(rtlpriv, REG_TXPAUSE, 0x00);
+}
+
+static void _rtl88ee_phy_set_rf_sleep(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        int jj = RF90_PATH_A;
+
+        rtl_write_byte(rtlpriv, REG_TXPAUSE, 0xFF);
+        rtl_set_rfreg(hw, jj, 0x00, RFREG_OFFSET_MASK, 0x00);
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN, 0xE2);
+        rtl_write_byte(rtlpriv, REG_SPS0_CTRL, 0x22);
+}
+
+static bool _rtl88ee_phy_set_rf_power_state(struct ieee80211_hw *hw,
+                                            enum rf_pwrstate rfpwr_state)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        struct rtl8192_tx_ring *ring = NULL;
+        bool bresult = true;
+        u8 i, queue_id;
+
+        switch (rfpwr_state) {
+        case ERFON:{
+                if ((ppsc->rfpwr_state == ERFOFF) &&
+                    RT_IN_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC)) {
+                        bool rtstatus;
+                        u32 init = 0;
+                        do {
+                                init++;
+                                RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+                                         "IPS Set eRf nic enable\n");
+                                rtstatus = rtl_ps_enable_nic(hw);
+                        } while ((rtstatus != true) && (init < 10));
+                        RT_CLEAR_PS_LEVEL(ppsc,
+                                          RT_RF_OFF_LEVL_HALT_NIC);
+                } else {
+                        RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+                                 "Set ERFON sleeped:%d ms\n",
+                                 jiffies_to_msecs(jiffies - ppsc->
+                                                  last_sleep_jiffies));
+                        ppsc->last_awake_jiffies = jiffies;
+                        rtl88ee_phy_set_rf_on(hw);
+                }
+                if (mac->link_state == MAC80211_LINKED)
+                        rtlpriv->cfg->ops->led_control(hw, LED_CTL_LINK);
+                else
+                        rtlpriv->cfg->ops->led_control(hw, LED_CTL_NO_LINK);
+                break; }
+        case ERFOFF:{
+                for (queue_id = 0, i = 0;
+                     queue_id < RTL_PCI_MAX_TX_QUEUE_COUNT;) {
+                        ring = &pcipriv->dev.tx_ring[queue_id];
+                        if (skb_queue_len(&ring->queue) == 0) {
+                                queue_id++;
+                                continue;
+                        } else {
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                                         "eRf Off/Sleep: %d times TcbBusyQueue[%d] =%d before doze!\n",
+                                         (i + 1), queue_id,
+                                         skb_queue_len(&ring->queue));
+
+                                udelay(10);
+                                i++;
+                        }
+                        if (i >= MAX_DOZE_WAITING_TIMES_9x) {
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                                         "\n ERFSLEEP: %d times TcbBusyQueue[%d] = %d !\n",
+                                          MAX_DOZE_WAITING_TIMES_9x,
+                                          queue_id,
+                                          skb_queue_len(&ring->queue));
+                                break;
+                        }
+                }
+                if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_HALT_NIC) {
+                        RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+                                 "IPS Set eRf nic disable\n");
+                        rtl_ps_disable_nic(hw);
+                        RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC);
+                } else {
+                        if (ppsc->rfoff_reason == RF_CHANGE_BY_IPS) {
+                                rtlpriv->cfg->ops->led_control(hw,
+                                                LED_CTL_NO_LINK);
+                        } else {
+                                rtlpriv->cfg->ops->led_control(hw,
+                                                LED_CTL_POWER_OFF);
+                        }
+                }
+                break; }
+        case ERFSLEEP:{
+                if (ppsc->rfpwr_state == ERFOFF)
+                        break;
+                for (queue_id = 0, i = 0;
+                     queue_id < RTL_PCI_MAX_TX_QUEUE_COUNT;) {
+                        ring = &pcipriv->dev.tx_ring[queue_id];
+                        if (skb_queue_len(&ring->queue) == 0) {
+                                queue_id++;
+                                continue;
+                        } else {
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                                         "eRf Off/Sleep: %d times TcbBusyQueue[%d] =%d before doze!\n",
+                                         (i + 1), queue_id,
+                                         skb_queue_len(&ring->queue));
+
+                                udelay(10);
+                                i++;
+                        }
+                        if (i >= MAX_DOZE_WAITING_TIMES_9x) {
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                                         "\n ERFSLEEP: %d times TcbBusyQueue[%d] = %d !\n",
+                                         MAX_DOZE_WAITING_TIMES_9x,
+                                         queue_id,
+                                         skb_queue_len(&ring->queue));
+                                break;
+                        }
+                }
+                RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+                         "Set ERFSLEEP awaked:%d ms\n",
+                         jiffies_to_msecs(jiffies - ppsc->last_awake_jiffies));
+                ppsc->last_sleep_jiffies = jiffies;
+                _rtl88ee_phy_set_rf_sleep(hw);
+                break; }
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "switch case not processed\n");
+                bresult = false;
+                break;
+        }
+        if (bresult)
+                ppsc->rfpwr_state = rfpwr_state;
+        return bresult;
+}
+
+bool rtl88e_phy_set_rf_power_state(struct ieee80211_hw *hw,
+                                   enum rf_pwrstate rfpwr_state)
+{
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+        bool bresult;
+
+        if (rfpwr_state == ppsc->rfpwr_state)
+                return false;
+        bresult = _rtl88ee_phy_set_rf_power_state(hw, rfpwr_state);
+        return bresult;
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h
new file mode 100644
index 000000000000..f1acd6d27e44
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h
@@ -0,0 +1,236 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92C_PHY_H__
+#define __RTL92C_PHY_H__
+
+/*It must always set to 4, otherwise read efuse table secquence will be wrong.*/
+#define MAX_TX_COUNT                            4
+
+#define MAX_PRECMD_CNT                          16
+#define MAX_RFDEPENDCMD_CNT                     16
+#define MAX_POSTCMD_CNT                         16
+
+#define MAX_DOZE_WAITING_TIMES_9x               64
+
+#define RT_CANNOT_IO(hw)                        false
+#define HIGHPOWER_RADIOA_ARRAYLEN               22
+
+#define IQK_ADDA_REG_NUM                        16
+#define IQK_BB_REG_NUM                          9
+#define MAX_TOLERANCE                           5
+#define IQK_DELAY_TIME                          10
+#define IDX_MAP                                 15
+
+#define APK_BB_REG_NUM                          5
+#define APK_AFE_REG_NUM                         16
+#define APK_CURVE_REG_NUM                       4
+#define PATH_NUM                                2
+
+#define LOOP_LIMIT                              5
+#define MAX_STALL_TIME                          50
+#define ANTENNADIVERSITYVALUE                   0x80
+#define MAX_TXPWR_IDX_NMODE_92S                 63
+#define RESET_CNT_LIMIT                         3
+
+#define IQK_ADDA_REG_NUM                        16
+#define IQK_MAC_REG_NUM                         4
+
+#define RF6052_MAX_PATH                         2
+
+#define CT_OFFSET_MAC_ADDR                      0X16
+
+#define CT_OFFSET_CCK_TX_PWR_IDX                0x5A
+#define CT_OFFSET_HT401S_TX_PWR_IDX             0x60
+#define CT_OFFSET_HT402S_TX_PWR_IDX_DIFF        0x66
+#define CT_OFFSET_HT20_TX_PWR_IDX_DIFF          0x69
+#define CT_OFFSET_OFDM_TX_PWR_IDX_DIFF          0x6C
+
+#define CT_OFFSET_HT40_MAX_PWR_OFFSET           0x6F
+#define CT_OFFSET_HT20_MAX_PWR_OFFSET           0x72
+
+#define CT_OFFSET_CHANNEL_PLAH                  0x75
+#define CT_OFFSET_THERMAL_METER                 0x78
+#define CT_OFFSET_RF_OPTION                     0x79
+#define CT_OFFSET_VERSION                       0x7E
+#define CT_OFFSET_CUSTOMER_ID                   0x7F
+
+#define RTL92C_MAX_PATH_NUM                     2
+
+enum swchnlcmd_id {
+        CMDID_END,
+        CMDID_SET_TXPOWEROWER_LEVEL,
+        CMDID_BBREGWRITE10,
+        CMDID_WRITEPORT_ULONG,
+        CMDID_WRITEPORT_USHORT,
+        CMDID_WRITEPORT_UCHAR,
+        CMDID_RF_WRITEREG,
+};
+
+struct swchnlcmd {
+        enum swchnlcmd_id cmdid;
+        u32 para1;
+        u32 para2;
+        u32 msdelay;
+};
+
+enum hw90_block_e {
+        HW90_BLOCK_MAC = 0,
+        HW90_BLOCK_PHY0 = 1,
+        HW90_BLOCK_PHY1 = 2,
+        HW90_BLOCK_RF = 3,
+        HW90_BLOCK_MAXIMUM = 4,
+};
+
+enum baseband_config_type {
+        BASEBAND_CONFIG_PHY_REG = 0,
+        BASEBAND_CONFIG_AGC_TAB = 1,
+};
+
+enum ra_offset_area {
+        RA_OFFSET_LEGACY_OFDM1,
+        RA_OFFSET_LEGACY_OFDM2,
+        RA_OFFSET_HT_OFDM1,
+        RA_OFFSET_HT_OFDM2,
+        RA_OFFSET_HT_OFDM3,
+        RA_OFFSET_HT_OFDM4,
+        RA_OFFSET_HT_CCK,
+};
+
+enum antenna_path {
+        ANTENNA_NONE,
+        ANTENNA_D,
+        ANTENNA_C,
+        ANTENNA_CD,
+        ANTENNA_B,
+        ANTENNA_BD,
+        ANTENNA_BC,
+        ANTENNA_BCD,
+        ANTENNA_A,
+        ANTENNA_AD,
+        ANTENNA_AC,
+        ANTENNA_ACD,
+        ANTENNA_AB,
+        ANTENNA_ABD,
+        ANTENNA_ABC,
+        ANTENNA_ABCD
+};
+
+struct r_antenna_select_ofdm {
+        u32 r_tx_antenna:4;
+        u32 r_ant_l:4;
+        u32 r_ant_non_ht:4;
+        u32 r_ant_ht1:4;
+        u32 r_ant_ht2:4;
+        u32 r_ant_ht_s1:4;
+        u32 r_ant_non_ht_s1:4;
+        u32 ofdm_txsc:2;
+        u32 reserved:2;
+};
+
+struct r_antenna_select_cck {
+        u8 r_cckrx_enable_2:2;
+        u8 r_cckrx_enable:2;
+        u8 r_ccktx_enable:4;
+};
+
+
+struct efuse_contents {
+        u8 mac_addr[ETH_ALEN];
+        u8 cck_tx_power_idx[6];
+        u8 ht40_1s_tx_power_idx[6];
+        u8 ht40_2s_tx_power_idx_diff[3];
+        u8 ht20_tx_power_idx_diff[3];
+        u8 ofdm_tx_power_idx_diff[3];
+        u8 ht40_max_power_offset[3];
+        u8 ht20_max_power_offset[3];
+        u8 channel_plan;
+        u8 thermal_meter;
+        u8 rf_option[5];
+        u8 version;
+        u8 oem_id;
+        u8 regulatory;
+};
+
+struct tx_power_struct {
+        u8 cck[RTL92C_MAX_PATH_NUM][CHANNEL_MAX_NUMBER];
+        u8 ht40_1s[RTL92C_MAX_PATH_NUM][CHANNEL_MAX_NUMBER];
+        u8 ht40_2s[RTL92C_MAX_PATH_NUM][CHANNEL_MAX_NUMBER];
+        u8 ht20_diff[RTL92C_MAX_PATH_NUM][CHANNEL_MAX_NUMBER];
+        u8 legacy_ht_diff[RTL92C_MAX_PATH_NUM][CHANNEL_MAX_NUMBER];
+        u8 legacy_ht_txpowerdiff;
+        u8 groupht20[RTL92C_MAX_PATH_NUM][CHANNEL_MAX_NUMBER];
+        u8 groupht40[RTL92C_MAX_PATH_NUM][CHANNEL_MAX_NUMBER];
+        u8 pwrgroup_cnt;
+        u32 mcs_original_offset[4][16];
+};
+
+enum _ANT_DIV_TYPE {
+        NO_ANTDIV                       = 0xFF,
+        CG_TRX_HW_ANTDIV                = 0x01,
+        CGCS_RX_HW_ANTDIV               = 0x02,
+        FIXED_HW_ANTDIV                 = 0x03,
+        CG_TRX_SMART_ANTDIV             = 0x04,
+        CGCS_RX_SW_ANTDIV               = 0x05,
+};
+
+extern u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw,
+                                   u32 regaddr, u32 bitmask);
+extern void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,
+                                  u32 regaddr, u32 bitmask, u32 data);
+extern u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw,
+                                   enum radio_path rfpath, u32 regaddr,
+                                   u32 bitmask);
+extern void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw,
+                                  enum radio_path rfpath, u32 regaddr,
+                                  u32 bitmask, u32 data);
+extern bool rtl88e_phy_mac_config(struct ieee80211_hw *hw);
+extern bool rtl88e_phy_bb_config(struct ieee80211_hw *hw);
+extern bool rtl88e_phy_rf_config(struct ieee80211_hw *hw);
+extern void rtl88e_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
+extern void rtl88e_phy_get_txpower_level(struct ieee80211_hw *hw,
+                                         long *powerlevel);
+extern void rtl88e_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
+extern void rtl88e_phy_scan_operation_backup(struct ieee80211_hw *hw,
+                                             u8 operation);
+extern void rtl88e_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
+extern void rtl88e_phy_set_bw_mode(struct ieee80211_hw *hw,
+                                   enum nl80211_channel_type ch_type);
+extern void rtl88e_phy_sw_chnl_callback(struct ieee80211_hw *hw);
+extern u8 rtl88e_phy_sw_chnl(struct ieee80211_hw *hw);
+extern void rtl88e_phy_iq_calibrate(struct ieee80211_hw *hw, bool b_recovery);
+void rtl88e_phy_lc_calibrate(struct ieee80211_hw *hw);
+void rtl88e_phy_set_rfpath_switch(struct ieee80211_hw *hw, bool bmain);
+bool rtl88e_phy_config_rf_with_headerfile(struct ieee80211_hw *hw,
+                                          enum radio_path rfpath);
+bool rtl88e_phy_set_io_cmd(struct ieee80211_hw *hw, enum io_type iotype);
+extern bool rtl88e_phy_set_rf_power_state(struct ieee80211_hw *hw,
+                                          enum rf_pwrstate rfpwr_state);
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseq.c b/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseq.c
new file mode 100644
index 000000000000..6dc4e3a954f6
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseq.c
@@ -0,0 +1,109 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "pwrseqcmd.h"
+#include "pwrseq.h"
+
+/* drivers should parse below arrays and do the corresponding actions */
+/*3 Power on  Array*/
+struct wlan_pwr_cfg rtl8188e_power_on_flow[RTL8188E_TRANS_CARDEMU_TO_ACT_STEPS +
+                                           RTL8188E_TRANS_END_STEPS] = {
+        RTL8188E_TRANS_CARDEMU_TO_ACT
+        RTL8188E_TRANS_END
+};
+
+/*3Radio off GPIO Array */
+struct wlan_pwr_cfg rtl8188e_radio_off_flow[RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS
+                                            + RTL8188E_TRANS_END_STEPS] = {
+        RTL8188E_TRANS_ACT_TO_CARDEMU
+        RTL8188E_TRANS_END
+};
+
+/*3Card Disable Array*/
+struct wlan_pwr_cfg rtl8188e_card_disable_flow
+        [RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS +
+        RTL8188E_TRANS_CARDEMU_TO_PDN_STEPS +
+        RTL8188E_TRANS_END_STEPS] = {
+                RTL8188E_TRANS_ACT_TO_CARDEMU
+                RTL8188E_TRANS_CARDEMU_TO_CARDDIS
+                RTL8188E_TRANS_END
+};
+
+/*3 Card Enable Array*/
+struct wlan_pwr_cfg rtl8188e_card_enable_flow
+        [RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS +
+        RTL8188E_TRANS_CARDEMU_TO_PDN_STEPS +
+        RTL8188E_TRANS_END_STEPS] = {
+                RTL8188E_TRANS_CARDDIS_TO_CARDEMU
+                RTL8188E_TRANS_CARDEMU_TO_ACT
+                RTL8188E_TRANS_END
+};
+
+/*3Suspend Array*/
+struct wlan_pwr_cfg rtl8188e_suspend_flow[RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS
+                                        + RTL8188E_TRANS_CARDEMU_TO_SUS_STEPS
+                                        + RTL8188E_TRANS_END_STEPS] = {
+        RTL8188E_TRANS_ACT_TO_CARDEMU
+        RTL8188E_TRANS_CARDEMU_TO_SUS
+        RTL8188E_TRANS_END
+};
+
+/*3 Resume Array*/
+struct wlan_pwr_cfg rtl8188e_resume_flow[RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS
+                                        + RTL8188E_TRANS_CARDEMU_TO_SUS_STEPS
+                                        + RTL8188E_TRANS_END_STEPS] = {
+        RTL8188E_TRANS_SUS_TO_CARDEMU
+        RTL8188E_TRANS_CARDEMU_TO_ACT
+        RTL8188E_TRANS_END
+};
+
+/*3HWPDN Array*/
+struct wlan_pwr_cfg rtl8188e_hwpdn_flow[RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS
+                                + RTL8188E_TRANS_CARDEMU_TO_PDN_STEPS
+                                + RTL8188E_TRANS_END_STEPS] = {
+        RTL8188E_TRANS_ACT_TO_CARDEMU
+        RTL8188E_TRANS_CARDEMU_TO_PDN
+        RTL8188E_TRANS_END
+};
+
+/*3 Enter LPS */
+struct wlan_pwr_cfg rtl8188e_enter_lps_flow[RTL8188E_TRANS_ACT_TO_LPS_STEPS
+                                        + RTL8188E_TRANS_END_STEPS] = {
+        /*FW behavior*/
+        RTL8188E_TRANS_ACT_TO_LPS
+        RTL8188E_TRANS_END
+};
+
+/*3 Leave LPS */
+struct wlan_pwr_cfg rtl8188e_leave_lps_flow[RTL8188E_TRANS_LPS_TO_ACT_STEPS
+                                        + RTL8188E_TRANS_END_STEPS] = {
+        /*FW behavior*/
+        RTL8188E_TRANS_LPS_TO_ACT
+        RTL8188E_TRANS_END
+};
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseq.h b/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseq.h
new file mode 100644
index 000000000000..028ec6dd52b4
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseq.h
@@ -0,0 +1,327 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL8723E_PWRSEQ_H__
+#define __RTL8723E_PWRSEQ_H__
+
+#include "pwrseqcmd.h"
+/*
+        Check document WM-20110607-Paul-RTL8188E_Power_Architecture-R02.vsd
+        There are 6 HW Power States:
+        0: POFF--Power Off
+        1: PDN--Power Down
+        2: CARDEMU--Card Emulation
+        3: ACT--Active Mode
+        4: LPS--Low Power State
+        5: SUS--Suspend
+
+        The transision from different states are defined below
+        TRANS_CARDEMU_TO_ACT
+        TRANS_ACT_TO_CARDEMU
+        TRANS_CARDEMU_TO_SUS
+        TRANS_SUS_TO_CARDEMU
+        TRANS_CARDEMU_TO_PDN
+        TRANS_ACT_TO_LPS
+        TRANS_LPS_TO_ACT
+
+        TRANS_END
+        PWR SEQ Version: rtl8188e_PwrSeq_V09.h
+*/
+
+#define RTL8188E_TRANS_CARDEMU_TO_ACT_STEPS     10
+#define RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS     10
+#define RTL8188E_TRANS_CARDEMU_TO_SUS_STEPS     10
+#define RTL8188E_TRANS_SUS_TO_CARDEMU_STEPS     10
+#define RTL8188E_TRANS_CARDEMU_TO_PDN_STEPS     10
+#define RTL8188E_TRANS_PDN_TO_CARDEMU_STEPS     10
+#define RTL8188E_TRANS_ACT_TO_LPS_STEPS         15
+#define RTL8188E_TRANS_LPS_TO_ACT_STEPS         15
+#define RTL8188E_TRANS_END_STEPS                1
+
+
+#define RTL8188E_TRANS_CARDEMU_TO_ACT                                   \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value },*/\
+        {0x0006, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /* wait till 0x04[17] = 1    power ready*/                      \
+        PWR_BASEADDR_MAC, PWR_CMD_POLLING, BIT(1), BIT(1)},             \
+        {0x0002, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /* 0x02[1:0] = 0        reset BB*/                              \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(0)|BIT(1), 0},             \
+        {0x0026, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*0x24[23] = 2b'01 schmit trigger */                            \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(7), BIT(7)},               \
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /* 0x04[15] = 0 disable HWPDN (control by DRV)*/                \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(7), 0},                    \
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*0x04[12:11] = 2b'00 disable WL suspend*/                      \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(4)|BIT(3), 0},             \
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*0x04[8] = 1 polling until return 0*/                          \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(0), BIT(0)},               \
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*wait till 0x04[8] = 0*/                                       \
+        PWR_BASEADDR_MAC, PWR_CMD_POLLING, BIT(0), 0},                  \
+        {0x0023, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(4), 0}, /*LDO normal mode*/\
+        {0x0074, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(4), BIT(4)}, /*SDIO Driving*/\
+
+#define RTL8188E_TRANS_ACT_TO_CARDEMU                                   \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value },*/\
+        {0x001F, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0},/*0x1F[7:0] = 0 turn off RF*/\
+        {0x0023, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(4), BIT(4)}, /*LDO Sleep mode*/\
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*0x04[9] = 1 turn off MAC by HW state machine*/                \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(1), BIT(1)},               \
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*wait till 0x04[9] = 0 polling until return 0 to disable*/     \
+        PWR_BASEADDR_MAC, PWR_CMD_POLLING, BIT(1), 0},                  \
+
+
+#define RTL8188E_TRANS_CARDEMU_TO_SUS                                   \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value },*/\
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK,                      \
+        PWR_INTF_USB_MSK|PWR_INTF_SDIO_MSK,                             \
+        /*0x04[12:11] = 2b'01enable WL suspend*/                        \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(3)|BIT(4), BIT(3)},        \
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_PCI_MSK,    \
+        /*0x04[12:11] = 2b'11enable WL suspend for PCIe*/               \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(3)|BIT(4), BIT(3)|BIT(4)},\
+        {0x0007, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK,                      \
+        PWR_INTF_USB_MSK|PWR_INTF_SDIO_MSK,                             \
+        /*  0x04[31:30] = 2b'10 enable enable bandgap mbias in suspend */\
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, BIT(7)},                 \
+        {0x0041, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK,                      \
+        PWR_INTF_USB_MSK|PWR_INTF_SDIO_MSK,                             \
+        /*Clear SIC_EN register 0x40[12] = 1'b0 */                      \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(4), 0},                    \
+        {0xfe10, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK,                      \
+        PWR_INTF_USB_MSK|PWR_INTF_SDIO_MSK,                             \
+        /*Set USB suspend enable local register  0xfe10[4]= 1 */        \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(4), BIT(4)},               \
+        {0x0086, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        /*Set SDIO suspend local register*/                             \
+        PWR_BASEADDR_SDIO, PWR_CMD_WRITE, BIT(0), BIT(0)},              \
+        {0x0086, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        /*wait power state to suspend*/                                 \
+        PWR_BASEADDR_SDIO, PWR_CMD_POLLING, BIT(1), 0},
+
+#define RTL8188E_TRANS_SUS_TO_CARDEMU                                   \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value }, */\
+        {0x0086, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        /*Set SDIO suspend local register*/                             \
+        PWR_BASEADDR_SDIO, PWR_CMD_WRITE, BIT(0), 0},                   \
+        {0x0086, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        /*wait power state to suspend*/                                 \
+        PWR_BASEADDR_SDIO, PWR_CMD_POLLING, BIT(1), BIT(1)},            \
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*0x04[12:11] = 2b'01enable WL suspend*/                        \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(3)|BIT(4), 0},
+
+#define RTL8188E_TRANS_CARDEMU_TO_CARDDIS                               \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value }, */\
+        {0x0026, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*0x24[23] = 2b'01 schmit trigger */                            \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(7), BIT(7)},               \
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK,                      \
+        PWR_INTF_USB_MSK|PWR_INTF_SDIO_MSK,                             \
+        /*0x04[12:11] = 2b'01 enable WL suspend*/                       \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(3)|BIT(4), BIT(3)},        \
+        {0x0007, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK,                      \
+        PWR_INTF_USB_MSK|PWR_INTF_SDIO_MSK,                             \
+        /*  0x04[31:30] = 2b'10 enable enable bandgap mbias in suspend */\
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0},                      \
+        {0x0041, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK,                      \
+        PWR_INTF_USB_MSK|PWR_INTF_SDIO_MSK,                             \
+        /*Clear SIC_EN register 0x40[12] = 1'b0 */                      \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(4), 0},                    \
+        {0xfe10, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_USB_MSK,    \
+        /*Set USB suspend enable local register  0xfe10[4]= 1 */        \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(4), BIT(4)},               \
+        {0x0086, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        /*Set SDIO suspend local register*/                             \
+        PWR_BASEADDR_SDIO, PWR_CMD_WRITE, BIT(0), BIT(0)},              \
+        {0x0086, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        PWR_CMD_POLLING, BIT(1), 0}, /*wait power state to suspend*/
+
+#define RTL8188E_TRANS_CARDDIS_TO_CARDEMU                               \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value }, */\
+        {0x0086, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        PWR_BASEADDR_SDIO,\
+        PWR_CMD_WRITE, BIT(0), 0}, /*Set SDIO suspend local register*/  \
+        {0x0086, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        PWR_BASEADDR_SDIO,\
+        PWR_CMD_POLLING, BIT(1), BIT(1)}, /*wait power state to suspend*/\
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC,                                               \
+        PWR_CMD_WRITE, BIT(3)|BIT(4), 0},                               \
+        /*0x04[12:11] = 2b'01enable WL suspend*/
+
+
+#define RTL8188E_TRANS_CARDEMU_TO_PDN                                   \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value }, */\
+        {0x0006, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(0), 0},/* 0x04[16] = 0*/   \
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(7), BIT(7)},/* 0x04[15] = 1*/
+
+
+#define RTL8188E_TRANS_PDN_TO_CARDEMU                                   \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value }, */\
+        {0x0005, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(7), 0},/* 0x04[15] = 0*/
+
+
+#define RTL8188E_TRANS_ACT_TO_LPS                                       \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value },*/\
+        {0x0522, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0x7F},/*Tx Pause*/       \
+        {0x05F8, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*zero if no pkt is tx*/\
+        PWR_BASEADDR_MAC, PWR_CMD_POLLING, 0xFF, 0},                    \
+        {0x05F9, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*Should be zero if no packet is transmitting*/ \
+        PWR_BASEADDR_MAC, PWR_CMD_POLLING, 0xFF, 0},                    \
+        {0x05FA, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*Should be zero if no packet is transmitting*/                 \
+        PWR_BASEADDR_MAC, PWR_CMD_POLLING, 0xFF, 0},                    \
+        {0x05FB, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*Should be zero if no packet is transmitting*/                 \
+        PWR_BASEADDR_MAC, PWR_CMD_POLLING, 0xFF, 0},                    \
+        {0x0002, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*CCK and OFDM are disabled, and clock are gated*/              \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(0), 0},                    \
+        {0x0002, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_DELAY, 0, PWRSEQ_DELAY_US},/*Delay 1us*/\
+        {0x0100, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0x3F},/*Reset MAC TRX*/  \
+        {0x0101, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*check if removed later*/                                      \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(1), 0},                    \
+        {0x0553, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*Respond TxOK to scheduler*/                                   \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(5), BIT(5)},               \
+
+
+#define RTL8188E_TRANS_LPS_TO_ACT                                       \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value }, */\
+        {0x0080, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_SDIO_MSK,   \
+        PWR_BASEADDR_SDIO, PWR_CMD_WRITE, 0xFF, 0x84}, /*SDIO RPWM*/    \
+        {0xFE58, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_USB_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0x84}, /*USB RPWM*/      \
+        {0x0361, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_PCI_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0x84}, /*PCIe RPWM*/     \
+        {0x0002, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        PWR_BASEADDR_MAC, PWR_CMD_DELAY, 0, PWRSEQ_DELAY_MS}, /*Delay*/ \
+        {0x0008, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*.     0x08[4] = 0              switch TSF to 40M*/            \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(4), 0},                    \
+        {0x0109, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*Polling 0x109[7]= 0  TSF in 40M*/                             \
+        PWR_BASEADDR_MAC, PWR_CMD_POLLING, BIT(7), 0},                  \
+        {0x0029, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*. 0x29[7:6] = 2b'00    enable BB clock*/                      \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(6)|BIT(7), 0},             \
+        {0x0101, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*.     0x101[1] = 1*/\
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(1), BIT(1)},               \
+        {0x0100, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*.     0x100[7:0] = 0xFF        enable WMAC TRX*/\
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0xFF},                   \
+        {0x0002, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,    \
+        /*. 0x02[1:0] = 2b'11  enable BB macro*/\
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, BIT(1)|BIT(0), BIT(1)|BIT(0)}, \
+        {0x0522, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,\
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0}, /*.  0x522 = 0*/
+
+
+#define RTL8188E_TRANS_END                                              \
+        /* format */                                                    \
+        /* { offset, cut_msk, fab_msk|interface_msk, base|cmd, msk, value },*/\
+        {0xFFFF, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,\
+        0, PWR_CMD_END, 0, 0}
+
+extern struct wlan_pwr_cfg rtl8188e_power_on_flow
+                [RTL8188E_TRANS_CARDEMU_TO_ACT_STEPS +
+                RTL8188E_TRANS_END_STEPS];
+extern struct wlan_pwr_cfg rtl8188e_radio_off_flow
+                [RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS +
+                RTL8188E_TRANS_END_STEPS];
+extern struct wlan_pwr_cfg rtl8188e_card_disable_flow
+                [RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS +
+                RTL8188E_TRANS_CARDEMU_TO_PDN_STEPS +
+                RTL8188E_TRANS_END_STEPS];
+extern struct wlan_pwr_cfg rtl8188e_card_enable_flow
+                [RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS +
+                RTL8188E_TRANS_CARDEMU_TO_PDN_STEPS +
+                RTL8188E_TRANS_END_STEPS];
+extern struct wlan_pwr_cfg rtl8188e_suspend_flow
+                [RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS +
+                RTL8188E_TRANS_CARDEMU_TO_SUS_STEPS +
+                RTL8188E_TRANS_END_STEPS];
+extern struct wlan_pwr_cfg rtl8188e_resume_flow
+                [RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS +
+                RTL8188E_TRANS_CARDEMU_TO_SUS_STEPS +
+                RTL8188E_TRANS_END_STEPS];
+extern struct wlan_pwr_cfg rtl8188e_hwpdn_flow
+                [RTL8188E_TRANS_ACT_TO_CARDEMU_STEPS +
+                RTL8188E_TRANS_CARDEMU_TO_PDN_STEPS +
+                RTL8188E_TRANS_END_STEPS];
+extern struct wlan_pwr_cfg rtl8188e_enter_lps_flow
+                [RTL8188E_TRANS_ACT_TO_LPS_STEPS +
+                RTL8188E_TRANS_END_STEPS];
+extern struct wlan_pwr_cfg rtl8188e_leave_lps_flow
+                [RTL8188E_TRANS_LPS_TO_ACT_STEPS +
+                RTL8188E_TRANS_END_STEPS];
+
+/* RTL8723 Power Configuration CMDs for PCIe interface */
+#define Rtl8188E_NIC_PWR_ON_FLOW        rtl8188e_power_on_flow
+#define Rtl8188E_NIC_RF_OFF_FLOW        rtl8188e_radio_off_flow
+#define Rtl8188E_NIC_DISABLE_FLOW       rtl8188e_card_disable_flow
+#define Rtl8188E_NIC_ENABLE_FLOW        rtl8188e_card_enable_flow
+#define Rtl8188E_NIC_SUSPEND_FLOW       rtl8188e_suspend_flow
+#define Rtl8188E_NIC_RESUME_FLOW        rtl8188e_resume_flow
+#define Rtl8188E_NIC_PDN_FLOW           rtl8188e_hwpdn_flow
+#define Rtl8188E_NIC_LPS_ENTER_FLOW     rtl8188e_enter_lps_flow
+#define Rtl8188E_NIC_LPS_LEAVE_FLOW     rtl8188e_leave_lps_flow
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseqcmd.c b/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseqcmd.c
new file mode 100644
index 000000000000..a9cfa13be3a8
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseqcmd.c
@@ -0,0 +1,140 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "pwrseq.h"
+
+
+/*      Description:
+ *              This routine deal with the Power Configuration CMDs
+ *               parsing for RTL8723/RTL8188E Series IC.
+ *      Assumption:
+ *              We should follow specific format which was released from HW SD.
+ *
+ *      2011.07.07, added by Roger.
+ */
+
+bool rtl88_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+                                u8 fab_version, u8 interface_type,
+                                struct wlan_pwr_cfg pwrcfgcmd[])
+{
+        struct wlan_pwr_cfg cmd = {0};
+        bool polling_bit = false;
+        u32 ary_idx = 0;
+        u8 val = 0;
+        u32 offset = 0;
+        u32 polling_count = 0;
+        u32 max_polling_cnt = 5000;
+
+        do {
+                cmd = pwrcfgcmd[ary_idx];
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "rtl88_hal_pwrseqcmdparsing(): offset(%#x), cut_msk(%#x), fab_msk(%#x),"
+                         "interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), val(%#x)\n",
+                         GET_PWR_CFG_OFFSET(cmd),
+                         GET_PWR_CFG_CUT_MASK(cmd),
+                         GET_PWR_CFG_FAB_MASK(cmd),
+                         GET_PWR_CFG_INTF_MASK(cmd),
+                         GET_PWR_CFG_BASE(cmd),
+                         GET_PWR_CFG_CMD(cmd),
+                         GET_PWR_CFG_MASK(cmd),
+                         GET_PWR_CFG_VALUE(cmd));
+
+                if ((GET_PWR_CFG_FAB_MASK(cmd) & fab_version) &&
+                    (GET_PWR_CFG_CUT_MASK(cmd) & cut_version) &&
+                    (GET_PWR_CFG_INTF_MASK(cmd) & interface_type)) {
+                        switch (GET_PWR_CFG_CMD(cmd)) {
+                        case PWR_CMD_READ:
+                                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                                         "rtl88_hal_pwrseqcmdparsing(): PWR_CMD_READ\n");
+                                break;
+                        case PWR_CMD_WRITE: {
+                                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                                         "rtl88_hal_pwrseqcmdparsing(): PWR_CMD_WRITE\n");
+                                offset = GET_PWR_CFG_OFFSET(cmd);
+
+                                        /*Read the val from system register*/
+                                        val = rtl_read_byte(rtlpriv, offset);
+                                        val &= (~(GET_PWR_CFG_MASK(cmd)));
+                                        val |= (GET_PWR_CFG_VALUE(cmd) &
+                                                GET_PWR_CFG_MASK(cmd));
+
+                                        /*Write the val back to sytem register*/
+                                        rtl_write_byte(rtlpriv, offset, val);
+                                }
+                                break;
+                        case PWR_CMD_POLLING:
+                                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                                         "rtl88_hal_pwrseqcmdparsing(): PWR_CMD_POLLING\n");
+                                polling_bit = false;
+                                offset = GET_PWR_CFG_OFFSET(cmd);
+
+                                do {
+                                        val = rtl_read_byte(rtlpriv, offset);
+
+                                        val = val & GET_PWR_CFG_MASK(cmd);
+                                        if (val == (GET_PWR_CFG_VALUE(cmd) &
+                                                    GET_PWR_CFG_MASK(cmd)))
+                                                polling_bit = true;
+                                        else
+                                                udelay(10);
+
+                                        if (polling_count++ > max_polling_cnt) {
+                                                RT_TRACE(rtlpriv, COMP_INIT,
+                                                         DBG_LOUD,
+                                                         "polling fail in pwrseqcmd\n");
+                                                return false;
+                                        }
+                                } while (!polling_bit);
+
+                                break;
+                        case PWR_CMD_DELAY:
+                                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                                         "rtl88_hal_pwrseqcmdparsing(): PWR_CMD_DELAY\n");
+                                if (GET_PWR_CFG_VALUE(cmd) == PWRSEQ_DELAY_US)
+                                        udelay(GET_PWR_CFG_OFFSET(cmd));
+                                else
+                                        mdelay(GET_PWR_CFG_OFFSET(cmd));
+                                break;
+                        case PWR_CMD_END:
+                                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                                         "rtl88_hal_pwrseqcmdparsing(): PWR_CMD_END\n");
+                                return true;
+                                break;
+                        default:
+                                RT_ASSERT(false,
+                                          "rtl88_hal_pwrseqcmdparsing(): Unknown CMD!!\n");
+                                break;
+                        }
+                }
+
+                ary_idx++;
+        } while (1);
+
+        return true;
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseqcmd.h b/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseqcmd.h
new file mode 100644
index 000000000000..d9ae280bb1a2
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/pwrseqcmd.h
@@ -0,0 +1,97 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL8723E_PWRSEQCMD_H__
+#define __RTL8723E_PWRSEQCMD_H__
+
+#include "../wifi.h"
+/*---------------------------------------------*/
+/* The value of cmd: 4 bits */
+/*---------------------------------------------*/
+#define PWR_CMD_READ            0x00
+#define PWR_CMD_WRITE           0x01
+#define PWR_CMD_POLLING         0x02
+#define PWR_CMD_DELAY           0x03
+#define PWR_CMD_END             0x04
+
+/* define the base address of each block */
+#define PWR_BASEADDR_MAC        0x00
+#define PWR_BASEADDR_USB        0x01
+#define PWR_BASEADDR_PCIE       0x02
+#define PWR_BASEADDR_SDIO       0x03
+
+#define PWR_INTF_SDIO_MSK       BIT(0)
+#define PWR_INTF_USB_MSK        BIT(1)
+#define PWR_INTF_PCI_MSK        BIT(2)
+#define PWR_INTF_ALL_MSK        (BIT(0)|BIT(1)|BIT(2)|BIT(3))
+
+#define PWR_FAB_TSMC_MSK        BIT(0)
+#define PWR_FAB_UMC_MSK         BIT(1)
+#define PWR_FAB_ALL_MSK         (BIT(0)|BIT(1)|BIT(2)|BIT(3))
+
+#define PWR_CUT_TESTCHIP_MSK    BIT(0)
+#define PWR_CUT_A_MSK           BIT(1)
+#define PWR_CUT_B_MSK           BIT(2)
+#define PWR_CUT_C_MSK           BIT(3)
+#define PWR_CUT_D_MSK           BIT(4)
+#define PWR_CUT_E_MSK           BIT(5)
+#define PWR_CUT_F_MSK           BIT(6)
+#define PWR_CUT_G_MSK           BIT(7)
+#define PWR_CUT_ALL_MSK         0xFF
+
+enum pwrseq_delay_unit {
+        PWRSEQ_DELAY_US,
+        PWRSEQ_DELAY_MS,
+};
+
+struct wlan_pwr_cfg {
+        u16 offset;
+        u8 cut_msk;
+        u8 fab_msk:4;
+        u8 interface_msk:4;
+        u8 base:4;
+        u8 cmd:4;
+        u8 msk;
+        u8 value;
+};
+
+#define GET_PWR_CFG_OFFSET(__PWR)       (__PWR.offset)
+#define GET_PWR_CFG_CUT_MASK(__PWR)     (__PWR.cut_msk)
+#define GET_PWR_CFG_FAB_MASK(__PWR)     (__PWR.fab_msk)
+#define GET_PWR_CFG_INTF_MASK(__PWR)    (__PWR.interface_msk)
+#define GET_PWR_CFG_BASE(__PWR)         (__PWR.base)
+#define GET_PWR_CFG_CMD(__PWR)          (__PWR.cmd)
+#define GET_PWR_CFG_MASK(__PWR)         (__PWR.msk)
+#define GET_PWR_CFG_VALUE(__PWR)        (__PWR.value)
+
+bool rtl88_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+                                u8 fab_version, u8 interface_type,
+                                struct wlan_pwr_cfg pwrcfgcmd[]);
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/reg.h b/drivers/net/wireless/rtlwifi/rtl8188ee/reg.h
new file mode 100644
index 000000000000..d849abf7d94a
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/reg.h
@@ -0,0 +1,2258 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92C_REG_H__
+#define __RTL92C_REG_H__
+
+#define TXPKT_BUF_SELECT                        0x69
+#define RXPKT_BUF_SELECT                        0xA5
+#define DISABLE_TRXPKT_BUF_ACCESS               0x0
+
+#define REG_SYS_ISO_CTRL                        0x0000
+#define REG_SYS_FUNC_EN                         0x0002
+#define REG_APS_FSMCO                           0x0004
+#define REG_SYS_CLKR                            0x0008
+#define REG_9346CR                              0x000A
+#define REG_EE_VPD                              0x000C
+#define REG_AFE_MISC                            0x0010
+#define REG_SPS0_CTRL                           0x0011
+#define REG_SPS_OCP_CFG                         0x0018
+#define REG_RSV_CTRL                            0x001C
+#define REG_RF_CTRL                             0x001F
+#define REG_LDOA15_CTRL                         0x0020
+#define REG_LDOV12D_CTRL                        0x0021
+#define REG_LDOHCI12_CTRL                       0x0022
+#define REG_LPLDO_CTRL                          0x0023
+#define REG_AFE_XTAL_CTRL                       0x0024
+#define REG_AFE_LDO_CTRL                        0x0027 /* 1.5v for 8188EE test
+                                                        * chip, 1.4v for MP chip
+                                                        */
+#define REG_AFE_PLL_CTRL                        0x0028
+#define REG_EFUSE_CTRL                          0x0030
+#define REG_EFUSE_TEST                          0x0034
+#define REG_PWR_DATA                            0x0038
+#define REG_CAL_TIMER                           0x003C
+#define REG_ACLK_MON                            0x003E
+#define REG_GPIO_MUXCFG                         0x0040
+#define REG_GPIO_IO_SEL                         0x0042
+#define REG_MAC_PINMUX_CFG                      0x0043
+#define REG_GPIO_PIN_CTRL                       0x0044
+#define REG_GPIO_INTM                           0x0048
+#define REG_LEDCFG0                             0x004C
+#define REG_LEDCFG1                             0x004D
+#define REG_LEDCFG2                             0x004E
+#define REG_LEDCFG3                             0x004F
+#define REG_FSIMR                               0x0050
+#define REG_FSISR                               0x0054
+#define REG_HSIMR                               0x0058
+#define REG_HSISR                               0x005c
+#define REG_GPIO_PIN_CTRL_2                     0x0060
+#define REG_GPIO_IO_SEL_2                       0x0062
+#define REG_GPIO_OUTPUT                         0x006c
+#define REG_AFE_XTAL_CTRL_EXT                   0x0078
+#define REG_XCK_OUT_CTRL                        0x007c
+#define REG_MCUFWDL                             0x0080
+#define REG_WOL_EVENT                           0x0081
+#define REG_MCUTSTCFG                           0x0084
+
+
+#define REG_HIMR                                0x00B0
+#define REG_HISR                                0x00B4
+#define REG_HIMRE                               0x00B8
+#define REG_HISRE                               0x00BC
+
+#define REG_EFUSE_ACCESS                        0x00CF
+
+#define REG_BIST_SCAN                           0x00D0
+#define REG_BIST_RPT                            0x00D4
+#define REG_BIST_ROM_RPT                        0x00D8
+#define REG_USB_SIE_INTF                        0x00E0
+#define REG_PCIE_MIO_INTF                       0x00E4
+#define REG_PCIE_MIO_INTD                       0x00E8
+#define REG_HPON_FSM                            0x00EC
+#define REG_SYS_CFG                             0x00F0
+
+#define REG_CR                                  0x0100
+#define REG_PBP                                 0x0104
+#define REG_PKT_BUFF_ACCESS_CTRL                0x0106
+#define REG_TRXDMA_CTRL                         0x010C
+#define REG_TRXFF_BNDY                          0x0114
+#define REG_TRXFF_STATUS                        0x0118
+#define REG_RXFF_PTR                            0x011C
+
+#define REG_CPWM                                0x012F
+#define REG_FWIMR                               0x0130
+#define REG_FWISR                               0x0134
+#define REG_PKTBUF_DBG_CTRL                     0x0140
+#define REG_PKTBUF_DBG_DATA_L                   0x0144
+#define REG_PKTBUF_DBG_DATA_H                   0x0148
+#define REG_RXPKTBUF_CTRL                       (REG_PKTBUF_DBG_CTRL+2)
+
+#define REG_TC0_CTRL                            0x0150
+#define REG_TC1_CTRL                            0x0154
+#define REG_TC2_CTRL                            0x0158
+#define REG_TC3_CTRL                            0x015C
+#define REG_TC4_CTRL                            0x0160
+#define REG_TCUNIT_BASE                         0x0164
+#define REG_MBIST_START                         0x0174
+#define REG_MBIST_DONE                          0x0178
+#define REG_MBIST_FAIL                          0x017C
+#define REG_32K_CTRL                            0x0194
+#define REG_C2HEVT_MSG_NORMAL                   0x01A0
+#define REG_C2HEVT_CLEAR                        0x01AF
+#define REG_C2HEVT_MSG_TEST                     0x01B8
+#define REG_MCUTST_1                            0x01c0
+#define REG_FMETHR                              0x01C8
+#define REG_HMETFR                              0x01CC
+#define REG_HMEBOX_0                            0x01D0
+#define REG_HMEBOX_1                            0x01D4
+#define REG_HMEBOX_2                            0x01D8
+#define REG_HMEBOX_3                            0x01DC
+
+#define REG_LLT_INIT                            0x01E0
+#define REG_BB_ACCEESS_CTRL                     0x01E8
+#define REG_BB_ACCESS_DATA                      0x01EC
+
+#define REG_HMEBOX_EXT_0                        0x01F0
+#define REG_HMEBOX_EXT_1                        0x01F4
+#define REG_HMEBOX_EXT_2                        0x01F8
+#define REG_HMEBOX_EXT_3                        0x01FC
+
+#define REG_RQPN                                0x0200
+#define REG_FIFOPAGE                            0x0204
+#define REG_TDECTRL                             0x0208
+#define REG_TXDMA_OFFSET_CHK                    0x020C
+#define REG_TXDMA_STATUS                        0x0210
+#define REG_RQPN_NPQ                            0x0214
+
+#define REG_RXDMA_AGG_PG_TH                     0x0280
+#define REG_FW_UPD_RDPTR                        0x0284 /* FW shall update this
+                                                * register before FW * write
+                                                * RXPKT_RELEASE_POLL to 1
+                                                */
+#define REG_RXDMA_CONTROL                       0x0286 /* Control the RX DMA.*/
+#define REG_RXPKT_NUM                           0x0287 /* The number of packets
+                                                        * in RXPKTBUF.
+                                                         */
+#define REG_PCIE_CTRL_REG                       0x0300
+#define REG_INT_MIG                             0x0304
+#define REG_BCNQ_DESA                           0x0308
+#define REG_HQ_DESA                             0x0310
+#define REG_MGQ_DESA                            0x0318
+#define REG_VOQ_DESA                            0x0320
+#define REG_VIQ_DESA                            0x0328
+#define REG_BEQ_DESA                            0x0330
+#define REG_BKQ_DESA                            0x0338
+#define REG_RX_DESA                             0x0340
+
+#define REG_DBI                                 0x0348
+#define REG_MDIO                                0x0354
+#define REG_DBG_SEL                             0x0360
+#define REG_PCIE_HRPWM                          0x0361
+#define REG_PCIE_HCPWM                          0x0363
+#define REG_UART_CTRL                           0x0364
+#define REG_WATCH_DOG                           0x0368
+#define REG_UART_TX_DESA                        0x0370
+#define REG_UART_RX_DESA                        0x0378
+
+
+#define REG_HDAQ_DESA_NODEF                     0x0000
+#define REG_CMDQ_DESA_NODEF                     0x0000
+
+#define REG_VOQ_INFORMATION                     0x0400
+#define REG_VIQ_INFORMATION                     0x0404
+#define REG_BEQ_INFORMATION                     0x0408
+#define REG_BKQ_INFORMATION                     0x040C
+#define REG_MGQ_INFORMATION                     0x0410
+#define REG_HGQ_INFORMATION                     0x0414
+#define REG_BCNQ_INFORMATION                    0x0418
+#define REG_TXPKT_EMPTY                         0x041A
+
+
+#define REG_CPU_MGQ_INFORMATION                 0x041C
+#define REG_FWHW_TXQ_CTRL                       0x0420
+#define REG_HWSEQ_CTRL                          0x0423
+#define REG_TXPKTBUF_BCNQ_BDNY                  0x0424
+#define REG_TXPKTBUF_MGQ_BDNY                   0x0425
+#define REG_MULTI_BCNQ_EN                       0x0426
+#define REG_MULTI_BCNQ_OFFSET                   0x0427
+#define REG_SPEC_SIFS                           0x0428
+#define REG_RL                                  0x042A
+#define REG_DARFRC                              0x0430
+#define REG_RARFRC                              0x0438
+#define REG_RRSR                                0x0440
+#define REG_ARFR0                               0x0444
+#define REG_ARFR1                               0x0448
+#define REG_ARFR2                               0x044C
+#define REG_ARFR3                               0x0450
+#define REG_AGGLEN_LMT                          0x0458
+#define REG_AMPDU_MIN_SPACE                     0x045C
+#define REG_TXPKTBUF_WMAC_LBK_BF_HD             0x045D
+#define REG_FAST_EDCA_CTRL                      0x0460
+#define REG_RD_RESP_PKT_TH                      0x0463
+#define REG_INIRTS_RATE_SEL                     0x0480
+#define REG_INIDATA_RATE_SEL                    0x0484
+#define REG_POWER_STATUS                        0x04A4
+#define REG_POWER_STAGE1                        0x04B4
+#define REG_POWER_STAGE2                        0x04B8
+#define REG_PKT_LIFE_TIME                       0x04C0
+#define REG_STBC_SETTING                        0x04C4
+#define REG_PROT_MODE_CTRL                      0x04C8
+#define REG_BAR_MODE_CTRL                       0x04CC
+#define REG_RA_TRY_RATE_AGG_LMT                 0x04CF
+#define REG_EARLY_MODE_CONTROL                  0x04D0
+#define REG_NQOS_SEQ                            0x04DC
+#define REG_QOS_SEQ                             0x04DE
+#define REG_NEED_CPU_HANDLE                     0x04E0
+#define REG_PKT_LOSE_RPT                        0x04E1
+#define REG_PTCL_ERR_STATUS                     0x04E2
+#define REG_TX_RPT_CTRL                         0x04EC
+#define REG_TX_RPT_TIME                         0x04F0
+#define REG_DUMMY                               0x04FC
+
+#define REG_EDCA_VO_PARAM                       0x0500
+#define REG_EDCA_VI_PARAM                       0x0504
+#define REG_EDCA_BE_PARAM                       0x0508
+#define REG_EDCA_BK_PARAM                       0x050C
+#define REG_BCNTCFG                             0x0510
+#define REG_PIFS                                0x0512
+#define REG_RDG_PIFS                            0x0513
+#define REG_SIFS_CTX                            0x0514
+#define REG_SIFS_TRX                            0x0516
+#define REG_AGGR_BREAK_TIME                     0x051A
+#define REG_SLOT                                0x051B
+#define REG_TX_PTCL_CTRL                        0x0520
+#define REG_TXPAUSE                             0x0522
+#define REG_DIS_TXREQ_CLR                       0x0523
+#define REG_RD_CTRL                             0x0524
+#define REG_TBTT_PROHIBIT                       0x0540
+#define REG_RD_NAV_NXT                          0x0544
+#define REG_NAV_PROT_LEN                        0x0546
+#define REG_BCN_CTRL                            0x0550
+#define REG_USTIME_TSF                          0x0551
+#define REG_MBID_NUM                            0x0552
+#define REG_DUAL_TSF_RST                        0x0553
+#define REG_BCN_INTERVAL                        0x0554
+#define REG_MBSSID_BCN_SPACE                    0x0554
+#define REG_DRVERLYINT                          0x0558
+#define REG_BCNDMATIM                           0x0559
+#define REG_ATIMWND                             0x055A
+#define REG_BCN_MAX_ERR                         0x055D
+#define REG_RXTSF_OFFSET_CCK                    0x055E
+#define REG_RXTSF_OFFSET_OFDM                   0x055F
+#define REG_TSFTR                               0x0560
+#define REG_INIT_TSFTR                          0x0564
+#define REG_PSTIMER                             0x0580
+#define REG_TIMER0                              0x0584
+#define REG_TIMER1                              0x0588
+#define REG_ACMHWCTRL                           0x05C0
+#define REG_ACMRSTCTRL                          0x05C1
+#define REG_ACMAVG                              0x05C2
+#define REG_VO_ADMTIME                          0x05C4
+#define REG_VI_ADMTIME                          0x05C6
+#define REG_BE_ADMTIME                          0x05C8
+#define REG_EDCA_RANDOM_GEN                     0x05CC
+#define REG_SCH_TXCMD                           0x05D0
+
+#define REG_APSD_CTRL                           0x0600
+#define REG_BWOPMODE                            0x0603
+#define REG_TCR                                 0x0604
+#define REG_RCR                                 0x0608
+#define REG_RX_PKT_LIMIT                        0x060C
+#define REG_RX_DLK_TIME                         0x060D
+#define REG_RX_DRVINFO_SZ                       0x060F
+
+#define REG_MACID                               0x0610
+#define REG_BSSID                               0x0618
+#define REG_MAR                                 0x0620
+#define REG_MBIDCAMCFG                          0x0628
+
+#define REG_USTIME_EDCA                         0x0638
+#define REG_MAC_SPEC_SIFS                       0x063A
+#define REG_RESP_SIFS_CCK                       0x063C
+#define REG_RESP_SIFS_OFDM                      0x063E
+#define REG_ACKTO                               0x0640
+#define REG_CTS2TO                              0x0641
+#define REG_EIFS                                0x0642
+
+#define REG_NAV_CTRL                            0x0650
+#define REG_BACAMCMD                            0x0654
+#define REG_BACAMCONTENT                        0x0658
+#define REG_LBDLY                               0x0660
+#define REG_FWDLY                               0x0661
+#define REG_RXERR_RPT                           0x0664
+#define REG_TRXPTCL_CTL                         0x0668
+
+#define REG_CAMCMD                              0x0670
+#define REG_CAMWRITE                            0x0674
+#define REG_CAMREAD                             0x0678
+#define REG_CAMDBG                              0x067C
+#define REG_SECCFG                              0x0680
+
+#define REG_WOW_CTRL                            0x0690
+#define REG_PSSTATUS                            0x0691
+#define REG_PS_RX_INFO                          0x0692
+#define REG_UAPSD_TID                           0x0693
+#define REG_LPNAV_CTRL                          0x0694
+#define REG_WKFMCAM_NUM                         0x0698
+#define REG_WKFMCAM_RWD                         0x069C
+#define REG_RXFLTMAP0                           0x06A0
+#define REG_RXFLTMAP1                           0x06A2
+#define REG_RXFLTMAP2                           0x06A4
+#define REG_BCN_PSR_RPT                         0x06A8
+#define REG_CALB32K_CTRL                        0x06AC
+#define REG_PKT_MON_CTRL                        0x06B4
+#define REG_BT_COEX_TABLE                       0x06C0
+#define REG_WMAC_RESP_TXINFO                    0x06D8
+
+#define REG_USB_INFO                            0xFE17
+#define REG_USB_SPECIAL_OPTION                  0xFE55
+#define REG_USB_DMA_AGG_TO                      0xFE5B
+#define REG_USB_AGG_TO                          0xFE5C
+#define REG_USB_AGG_TH                          0xFE5D
+
+#define REG_TEST_USB_TXQS                       0xFE48
+#define REG_TEST_SIE_VID                        0xFE60
+#define REG_TEST_SIE_PID                        0xFE62
+#define REG_TEST_SIE_OPTIONAL                   0xFE64
+#define REG_TEST_SIE_CHIRP_K                    0xFE65
+#define REG_TEST_SIE_PHY                        0xFE66
+#define REG_TEST_SIE_MAC_ADDR                   0xFE70
+#define REG_TEST_SIE_STRING                     0xFE80
+
+#define REG_NORMAL_SIE_VID                      0xFE60
+#define REG_NORMAL_SIE_PID                      0xFE62
+#define REG_NORMAL_SIE_OPTIONAL                 0xFE64
+#define REG_NORMAL_SIE_EP                       0xFE65
+#define REG_NORMAL_SIE_PHY                      0xFE68
+#define REG_NORMAL_SIE_MAC_ADDR                 0xFE70
+#define REG_NORMAL_SIE_STRING                   0xFE80
+
+#define CR9346                                  REG_9346CR
+#define MSR                                     (REG_CR + 2)
+#define ISR                                     REG_HISR
+#define TSFR                                    REG_TSFTR
+
+#define MACIDR0                                 REG_MACID
+#define MACIDR4                                 (REG_MACID + 4)
+
+#define PBP                                     REG_PBP
+
+#define IDR0                                    MACIDR0
+#define IDR4                                    MACIDR4
+
+#define UNUSED_REGISTER                         0x1BF
+#define DCAM                                    UNUSED_REGISTER
+#define PSR                                     UNUSED_REGISTER
+#define BBADDR                                  UNUSED_REGISTER
+#define PHYDATAR                                UNUSED_REGISTER
+
+#define INVALID_BBRF_VALUE                      0x12345678
+
+#define MAX_MSS_DENSITY_2T                      0x13
+#define MAX_MSS_DENSITY_1T                      0x0A
+
+#define CMDEEPROM_EN                            BIT(5)
+#define CMDEEPROM_SEL                           BIT(4)
+#define CMD9346CR_9356SEL                       BIT(4)
+#define AUTOLOAD_EEPROM                         (CMDEEPROM_EN|CMDEEPROM_SEL)
+#define AUTOLOAD_EFUSE                          CMDEEPROM_EN
+
+#define GPIOSEL_GPIO                            0
+#define GPIOSEL_ENBT                            BIT(5)
+
+#define GPIO_IN                                 REG_GPIO_PIN_CTRL
+#define GPIO_OUT                                (REG_GPIO_PIN_CTRL+1)
+#define GPIO_IO_SEL                             (REG_GPIO_PIN_CTRL+2)
+#define GPIO_MOD                                (REG_GPIO_PIN_CTRL+3)
+
+/* 8723/8188E Host System Interrupt Mask Register (offset 0x58, 32 byte) */
+#define HSIMR_GPIO12_0_INT_EN                   BIT(0)
+#define HSIMR_SPS_OCP_INT_EN                    BIT(5)
+#define HSIMR_RON_INT_EN                        BIT(6)
+#define HSIMR_PDN_INT_EN                        BIT(7)
+#define HSIMR_GPIO9_INT_EN                      BIT(25)
+
+
+/* 8723/8188E Host System Interrupt Status Register (offset 0x5C, 32 byte) */
+#define HSISR_GPIO12_0_INT                      BIT(0)
+#define HSISR_SPS_OCP_INT                       BIT(5)
+#define HSISR_RON_INT_EN                        BIT(6)
+#define HSISR_PDNINT                            BIT(7)
+#define HSISR_GPIO9_INT                         BIT(25)
+
+#define MSR_NOLINK                              0x00
+#define MSR_ADHOC                               0x01
+#define MSR_INFRA                               0x02
+#define MSR_AP                                  0x03
+
+#define RRSR_RSC_OFFSET                         21
+#define RRSR_SHORT_OFFSET                       23
+#define RRSR_RSC_BW_40M                         0x600000
+#define RRSR_RSC_UPSUBCHNL                      0x400000
+#define RRSR_RSC_LOWSUBCHNL                     0x200000
+#define RRSR_SHORT                              0x800000
+#define RRSR_1M                                 BIT(0)
+#define RRSR_2M                                 BIT(1)
+#define RRSR_5_5M                               BIT(2)
+#define RRSR_11M                                BIT(3)
+#define RRSR_6M                                 BIT(4)
+#define RRSR_9M                                 BIT(5)
+#define RRSR_12M                                BIT(6)
+#define RRSR_18M                                BIT(7)
+#define RRSR_24M                                BIT(8)
+#define RRSR_36M                                BIT(9)
+#define RRSR_48M                                BIT(10)
+#define RRSR_54M                                BIT(11)
+#define RRSR_MCS0                               BIT(12)
+#define RRSR_MCS1                               BIT(13)
+#define RRSR_MCS2                               BIT(14)
+#define RRSR_MCS3                               BIT(15)
+#define RRSR_MCS4                               BIT(16)
+#define RRSR_MCS5                               BIT(17)
+#define RRSR_MCS6                               BIT(18)
+#define RRSR_MCS7                               BIT(19)
+#define BRSR_ACKSHORTPMB                        BIT(23)
+
+#define RATR_1M                                 0x00000001
+#define RATR_2M                                 0x00000002
+#define RATR_55M                                0x00000004
+#define RATR_11M                                0x00000008
+#define RATR_6M                                 0x00000010
+#define RATR_9M                                 0x00000020
+#define RATR_12M                                0x00000040
+#define RATR_18M                                0x00000080
+#define RATR_24M                                0x00000100
+#define RATR_36M                                0x00000200
+#define RATR_48M                                0x00000400
+#define RATR_54M                                0x00000800
+#define RATR_MCS0                               0x00001000
+#define RATR_MCS1                               0x00002000
+#define RATR_MCS2                               0x00004000
+#define RATR_MCS3                               0x00008000
+#define RATR_MCS4                               0x00010000
+#define RATR_MCS5                               0x00020000
+#define RATR_MCS6                               0x00040000
+#define RATR_MCS7                               0x00080000
+#define RATR_MCS8                               0x00100000
+#define RATR_MCS9                               0x00200000
+#define RATR_MCS10                              0x00400000
+#define RATR_MCS11                              0x00800000
+#define RATR_MCS12                              0x01000000
+#define RATR_MCS13                              0x02000000
+#define RATR_MCS14                              0x04000000
+#define RATR_MCS15                              0x08000000
+
+#define RATE_1M                                 BIT(0)
+#define RATE_2M                                 BIT(1)
+#define RATE_5_5M                               BIT(2)
+#define RATE_11M                                BIT(3)
+#define RATE_6M                                 BIT(4)
+#define RATE_9M                                 BIT(5)
+#define RATE_12M                                BIT(6)
+#define RATE_18M                                BIT(7)
+#define RATE_24M                                BIT(8)
+#define RATE_36M                                BIT(9)
+#define RATE_48M                                BIT(10)
+#define RATE_54M                                BIT(11)
+#define RATE_MCS0                               BIT(12)
+#define RATE_MCS1                               BIT(13)
+#define RATE_MCS2                               BIT(14)
+#define RATE_MCS3                               BIT(15)
+#define RATE_MCS4                               BIT(16)
+#define RATE_MCS5                               BIT(17)
+#define RATE_MCS6                               BIT(18)
+#define RATE_MCS7                               BIT(19)
+#define RATE_MCS8                               BIT(20)
+#define RATE_MCS9                               BIT(21)
+#define RATE_MCS10                              BIT(22)
+#define RATE_MCS11                              BIT(23)
+#define RATE_MCS12                              BIT(24)
+#define RATE_MCS13                              BIT(25)
+#define RATE_MCS14                              BIT(26)
+#define RATE_MCS15                              BIT(27)
+
+#define RATE_ALL_CCK            (RATR_1M | RATR_2M | RATR_55M | RATR_11M)
+#define RATE_ALL_OFDM_AG        (RATR_6M | RATR_9M | RATR_12M | RATR_18M | \
+                                RATR_24M | RATR_36M | RATR_48M | RATR_54M)
+#define RATE_ALL_OFDM_1SS       (RATR_MCS0 | RATR_MCS1 | RATR_MCS2 | \
+                                RATR_MCS3 | RATR_MCS4 | RATR_MCS5 | \
+                                RATR_MCS6 | RATR_MCS7)
+#define RATE_ALL_OFDM_2SS       (RATR_MCS8 | RATR_MCS9 | RATR_MCS10 | \
+                                RATR_MCS11 | RATR_MCS12 | RATR_MCS13 | \
+                                RATR_MCS14 | RATR_MCS15)
+
+#define BW_OPMODE_20MHZ                         BIT(2)
+#define BW_OPMODE_5G                            BIT(1)
+#define BW_OPMODE_11J                           BIT(0)
+
+#define CAM_VALID                               BIT(15)
+#define CAM_NOTVALID                            0x0000
+#define CAM_USEDK                               BIT(5)
+
+#define CAM_NONE                                0x0
+#define CAM_WEP40                               0x01
+#define CAM_TKIP                                0x02
+#define CAM_AES                                 0x04
+#define CAM_WEP104                              0x05
+
+#define TOTAL_CAM_ENTRY                         32
+#define HALF_CAM_ENTRY                          16
+
+#define CAM_WRITE                               BIT(16)
+#define CAM_READ                                0x00000000
+#define CAM_POLLINIG                            BIT(31)
+
+#define SCR_USEDK                               0x01
+#define SCR_TXSEC_ENABLE                        0x02
+#define SCR_RXSEC_ENABLE                        0x04
+
+#define WOW_PMEN                                BIT(0)
+#define WOW_WOMEN                               BIT(1)
+#define WOW_MAGIC                               BIT(2)
+#define WOW_UWF                                 BIT(3)
+
+/*********************************************
+*       8188 IMR/ISR bits
+**********************************************/
+#define IMR_DISABLED                            0x0
+/* IMR DW0(0x0060-0063) Bit 0-31 */
+#define IMR_TXCCK               BIT(30) /* TXRPT interrupt when CCX bit of
+                                         * the packet is set
+                                         */
+#define IMR_PSTIMEOUT           BIT(29) /* Power Save Time Out Interrupt */
+#define IMR_GTINT4              BIT(28) /* When GTIMER4 expires,
+                                         * this bit is set to 1
+                                         */
+#define IMR_GTINT3              BIT(27) /* When GTIMER3 expires,
+                                         * this bit is set to 1
+                                         */
+#define IMR_TBDER               BIT(26) /* Transmit Beacon0 Error */
+#define IMR_TBDOK               BIT(25) /* Transmit Beacon0 OK  */
+#define IMR_TSF_BIT32_TOGGLE    BIT(24) /* TSF Timer BIT32 toggle ind int */
+#define IMR_BCNDMAINT0          BIT(20) /* Beacon DMA Interrupt 0 */
+#define IMR_BCNDOK0             BIT(16) /* Beacon Queue DMA OK0 */
+#define IMR_HSISR_IND_ON_INT    BIT(15) /* HSISR Indicator (HSIMR & HSISR is
+                                         * true, this bit is set to 1)
+                                         */
+#define IMR_BCNDMAINT_E         BIT(14) /* Beacon DMA Int Extension for Win7 */
+#define IMR_ATIMEND             BIT(12) /* CTWidnow End or ATIM Window End */
+#define IMR_HISR1_IND_INT       BIT(11) /* HISR1 Indicator (HISR1 & HIMR1 is
+                                         * true, this bit is set to 1)
+                                         */
+#define IMR_C2HCMD              BIT(10) /* CPU to Host Command INT Status,
+                                         * Write 1 clear
+                                         */
+#define IMR_CPWM2               BIT(9)  /* CPU power Mode exchange INT Status,
+                                         * Write 1 clear
+                                         */
+#define IMR_CPWM                BIT(8)  /* CPU power Mode exchange INT Status,
+                                         * Write 1 clear
+                                         */
+#define IMR_HIGHDOK             BIT(7)  /* High Queue DMA OK    */
+#define IMR_MGNTDOK             BIT(6)  /* Management Queue DMA OK */
+#define IMR_BKDOK               BIT(5)  /* AC_BK DMA OK         */
+#define IMR_BEDOK               BIT(4)  /* AC_BE DMA OK */
+#define IMR_VIDOK               BIT(3)  /* AC_VI DMA OK */
+#define IMR_VODOK               BIT(2)  /* AC_VO DMA OK */
+#define IMR_RDU                 BIT(1)  /* Rx Descriptor Unavailable */
+#define IMR_ROK                 BIT(0)  /* Receive DMA OK */
+
+/* IMR DW1(0x00B4-00B7) Bit 0-31 */
+#define IMR_BCNDMAINT7          BIT(27) /* Beacon DMA Interrupt 7 */
+#define IMR_BCNDMAINT6          BIT(26) /* Beacon DMA Interrupt 6 */
+#define IMR_BCNDMAINT5          BIT(25) /* Beacon DMA Interrupt 5 */
+#define IMR_BCNDMAINT4          BIT(24) /* Beacon DMA Interrupt 4 */
+#define IMR_BCNDMAINT3          BIT(23) /* Beacon DMA Interrupt 3 */
+#define IMR_BCNDMAINT2          BIT(22) /* Beacon DMA Interrupt 2 */
+#define IMR_BCNDMAINT1          BIT(21) /* Beacon DMA Interrupt 1 */
+#define IMR_BCNDOK7             BIT(20) /* Beacon Queue DMA OK Interrup 7 */
+#define IMR_BCNDOK6             BIT(19) /* Beacon Queue DMA OK Interrup 6 */
+#define IMR_BCNDOK5             BIT(18) /* Beacon Queue DMA OK Interrup 5 */
+#define IMR_BCNDOK4             BIT(17) /* Beacon Queue DMA OK Interrup 4 */
+#define IMR_BCNDOK3             BIT(16) /* Beacon Queue DMA OK Interrup 3 */
+#define IMR_BCNDOK2             BIT(15) /* Beacon Queue DMA OK Interrup 2 */
+#define IMR_BCNDOK1             BIT(14) /* Beacon Queue DMA OK Interrup 1 */
+#define IMR_ATIMEND_E           BIT(13) /* ATIM Window End Extension for Win7 */
+#define IMR_TXERR               BIT(11) /* Tx Err Flag Int Status,
+                                         * write 1 clear.
+                                         */
+#define IMR_RXERR               BIT(10) /* Rx Err Flag INT Status,
+                                         * Write 1 clear
+                                         */
+#define IMR_TXFOVW              BIT(9)  /* Transmit FIFO Overflow */
+#define IMR_RXFOVW              BIT(8)  /* Receive FIFO Overflow */
+
+
+#define HWSET_MAX_SIZE                          512
+#define   EFUSE_MAX_SECTION                     64
+#define   EFUSE_REAL_CONTENT_LEN                256
+#define EFUSE_OOB_PROTECT_BYTES                 18 /* PG data exclude header,
+                                                    * dummy 7 bytes frome CP
+                                                    * test and reserved 1byte.
+                                                    */
+
+#define EEPROM_DEFAULT_TSSI                     0x0
+#define EEPROM_DEFAULT_TXPOWERDIFF              0x0
+#define EEPROM_DEFAULT_CRYSTALCAP               0x5
+#define EEPROM_DEFAULT_BOARDTYPE                0x02
+#define EEPROM_DEFAULT_TXPOWER                  0x1010
+#define EEPROM_DEFAULT_HT2T_TXPWR               0x10
+
+#define EEPROM_DEFAULT_LEGACYHTTXPOWERDIFF      0x3
+#define EEPROM_DEFAULT_THERMALMETER             0x18
+#define EEPROM_DEFAULT_ANTTXPOWERDIFF           0x0
+#define EEPROM_DEFAULT_TXPWDIFF_CRYSTALCAP      0x5
+#define EEPROM_DEFAULT_TXPOWERLEVEL             0x22
+#define EEPROM_DEFAULT_HT40_2SDIFF              0x0
+#define EEPROM_DEFAULT_HT20_DIFF                2
+#define EEPROM_DEFAULT_LEGACYHTTXPOWERDIFF      0x3
+#define EEPROM_DEFAULT_HT40_PWRMAXOFFSET        0
+#define EEPROM_DEFAULT_HT20_PWRMAXOFFSET        0
+
+#define RF_OPTION1                              0x79
+#define RF_OPTION2                              0x7A
+#define RF_OPTION3                              0x7B
+#define RF_OPTION4                              0x7C
+
+#define EEPROM_DEFAULT_PID                      0x1234
+#define EEPROM_DEFAULT_VID                      0x5678
+#define EEPROM_DEFAULT_CUSTOMERID               0xAB
+#define EEPROM_DEFAULT_SUBCUSTOMERID            0xCD
+#define EEPROM_DEFAULT_VERSION                  0
+
+#define EEPROM_CHANNEL_PLAN_FCC                 0x0
+#define EEPROM_CHANNEL_PLAN_IC                  0x1
+#define EEPROM_CHANNEL_PLAN_ETSI                0x2
+#define EEPROM_CHANNEL_PLAN_SPAIN               0x3
+#define EEPROM_CHANNEL_PLAN_FRANCE              0x4
+#define EEPROM_CHANNEL_PLAN_MKK                 0x5
+#define EEPROM_CHANNEL_PLAN_MKK1                0x6
+#define EEPROM_CHANNEL_PLAN_ISRAEL              0x7
+#define EEPROM_CHANNEL_PLAN_TELEC               0x8
+#define EEPROM_CHANNEL_PLAN_GLOBAL_DOMAIN       0x9
+#define EEPROM_CHANNEL_PLAN_WORLD_WIDE_13       0xA
+#define EEPROM_CHANNEL_PLAN_NCC                 0xB
+#define EEPROM_CHANNEL_PLAN_BY_HW_MASK          0x80
+
+#define EEPROM_CID_DEFAULT                      0x0
+#define EEPROM_CID_TOSHIBA                      0x4
+#define EEPROM_CID_CCX                          0x10
+#define EEPROM_CID_QMI                          0x0D
+#define EEPROM_CID_WHQL                         0xFE
+
+#define RTL8188E_EEPROM_ID                      0x8129
+
+#define EEPROM_HPON                             0x02
+#define EEPROM_CLK                              0x06
+#define EEPROM_TESTR                            0x08
+
+#define EEPROM_TXPOWERCCK                       0x10
+#define EEPROM_TXPOWERHT40_1S                   0x16
+#define EEPROM_TXPOWERHT20DIFF                  0x1B
+#define EEPROM_TXPOWER_OFDMDIFF                 0x1B
+
+#define EEPROM_TX_PWR_INX                       0x10
+
+#define EEPROM_CHANNELPLAN                      0xB8
+#define EEPROM_XTAL_88E                         0xB9
+#define EEPROM_THERMAL_METER_88E                0xBA
+#define EEPROM_IQK_LCK_88E                      0xBB
+
+#define EEPROM_RF_BOARD_OPTION_88E              0xC1
+#define EEPROM_RF_FEATURE_OPTION_88E            0xC2
+#define EEPROM_RF_BT_SETTING_88E                0xC3
+#define EEPROM_VERSION                          0xC4
+#define EEPROM_CUSTOMER_ID                      0xC5
+#define EEPROM_RF_ANTENNA_OPT_88E               0xC9
+
+#define EEPROM_MAC_ADDR                         0xD0
+#define EEPROM_VID                              0xD6
+#define EEPROM_DID                              0xD8
+#define EEPROM_SVID                             0xDA
+#define EEPROM_SMID                             0xDC
+
+#define STOPBECON                               BIT(6)
+#define STOPHIGHT                               BIT(5)
+#define STOPMGT                                 BIT(4)
+#define STOPVO                                  BIT(3)
+#define STOPVI                                  BIT(2)
+#define STOPBE                                  BIT(1)
+#define STOPBK                                  BIT(0)
+
+#define RCR_APPFCS                              BIT(31)
+#define RCR_APP_MIC                             BIT(30)
+#define RCR_APP_ICV                             BIT(29)
+#define RCR_APP_PHYST_RXFF                      BIT(28)
+#define RCR_APP_BA_SSN                          BIT(27)
+#define RCR_ENMBID                              BIT(24)
+#define RCR_LSIGEN                              BIT(23)
+#define RCR_MFBEN                               BIT(22)
+#define RCR_HTC_LOC_CTRL                        BIT(14)
+#define RCR_AMF                                 BIT(13)
+#define RCR_ACF                                 BIT(12)
+#define RCR_ADF                                 BIT(11)
+#define RCR_AICV                                BIT(9)
+#define RCR_ACRC32                              BIT(8)
+#define RCR_CBSSID_BCN                          BIT(7)
+#define RCR_CBSSID_DATA                         BIT(6)
+#define RCR_CBSSID                              RCR_CBSSID_DATA
+#define RCR_APWRMGT                             BIT(5)
+#define RCR_ADD3                                BIT(4)
+#define RCR_AB                                  BIT(3)
+#define RCR_AM                                  BIT(2)
+#define RCR_APM                                 BIT(1)
+#define RCR_AAP                                 BIT(0)
+#define RCR_MXDMA_OFFSET                        8
+#define RCR_FIFO_OFFSET                         13
+
+#define RSV_CTRL                                0x001C
+#define RD_CTRL                                 0x0524
+
+#define REG_USB_INFO                            0xFE17
+#define REG_USB_SPECIAL_OPTION                  0xFE55
+#define REG_USB_DMA_AGG_TO                      0xFE5B
+#define REG_USB_AGG_TO                          0xFE5C
+#define REG_USB_AGG_TH                          0xFE5D
+
+#define REG_USB_VID                             0xFE60
+#define REG_USB_PID                             0xFE62
+#define REG_USB_OPTIONAL                        0xFE64
+#define REG_USB_CHIRP_K                         0xFE65
+#define REG_USB_PHY                             0xFE66
+#define REG_USB_MAC_ADDR                        0xFE70
+#define REG_USB_HRPWM                           0xFE58
+#define REG_USB_HCPWM                           0xFE57
+
+#define SW18_FPWM                               BIT(3)
+
+#define ISO_MD2PP                               BIT(0)
+#define ISO_UA2USB                              BIT(1)
+#define ISO_UD2CORE                             BIT(2)
+#define ISO_PA2PCIE                             BIT(3)
+#define ISO_PD2CORE                             BIT(4)
+#define ISO_IP2MAC                              BIT(5)
+#define ISO_DIOP                                BIT(6)
+#define ISO_DIOE                                BIT(7)
+#define ISO_EB2CORE                             BIT(8)
+#define ISO_DIOR                                BIT(9)
+
+#define PWC_EV25V                               BIT(14)
+#define PWC_EV12V                               BIT(15)
+
+#define FEN_BBRSTB                              BIT(0)
+#define FEN_BB_GLB_RSTN                         BIT(1)
+#define FEN_USBA                                BIT(2)
+#define FEN_UPLL                                BIT(3)
+#define FEN_USBD                                BIT(4)
+#define FEN_DIO_PCIE                            BIT(5)
+#define FEN_PCIEA                               BIT(6)
+#define FEN_PPLL                                BIT(7)
+#define FEN_PCIED                               BIT(8)
+#define FEN_DIOE                                BIT(9)
+#define FEN_CPUEN                               BIT(10)
+#define FEN_DCORE                               BIT(11)
+#define FEN_ELDR                                BIT(12)
+#define FEN_DIO_RF                              BIT(13)
+#define FEN_HWPDN                               BIT(14)
+#define FEN_MREGEN                              BIT(15)
+
+#define PFM_LDALL                               BIT(0)
+#define PFM_ALDN                                BIT(1)
+#define PFM_LDKP                                BIT(2)
+#define PFM_WOWL                                BIT(3)
+#define ENPDN                                   BIT(4)
+#define PDN_PL                                  BIT(5)
+#define APFM_ONMAC                              BIT(8)
+#define APFM_OFF                                BIT(9)
+#define APFM_RSM                                BIT(10)
+#define AFSM_HSUS                               BIT(11)
+#define AFSM_PCIE                               BIT(12)
+#define APDM_MAC                                BIT(13)
+#define APDM_HOST                               BIT(14)
+#define APDM_HPDN                               BIT(15)
+#define RDY_MACON                               BIT(16)
+#define SUS_HOST                                BIT(17)
+#define ROP_ALD                                 BIT(20)
+#define ROP_PWR                                 BIT(21)
+#define ROP_SPS                                 BIT(22)
+#define SOP_MRST                                BIT(25)
+#define SOP_FUSE                                BIT(26)
+#define SOP_ABG                                 BIT(27)
+#define SOP_AMB                                 BIT(28)
+#define SOP_RCK                                 BIT(29)
+#define SOP_A8M                                 BIT(30)
+#define XOP_BTCK                                BIT(31)
+
+#define ANAD16V_EN                              BIT(0)
+#define ANA8M                                   BIT(1)
+#define MACSLP                                  BIT(4)
+#define LOADER_CLK_EN                           BIT(5)
+#define _80M_SSC_DIS                            BIT(7)
+#define _80M_SSC_EN_HO                          BIT(8)
+#define PHY_SSC_RSTB                            BIT(9)
+#define SEC_CLK_EN                              BIT(10)
+#define MAC_CLK_EN                              BIT(11)
+#define SYS_CLK_EN                              BIT(12)
+#define RING_CLK_EN                             BIT(13)
+
+#define BOOT_FROM_EEPROM                        BIT(4)
+#define EEPROM_EN                               BIT(5)
+
+#define AFE_BGEN                                BIT(0)
+#define AFE_MBEN                                BIT(1)
+#define MAC_ID_EN                               BIT(7)
+
+#define WLOCK_ALL                               BIT(0)
+#define WLOCK_00                                BIT(1)
+#define WLOCK_04                                BIT(2)
+#define WLOCK_08                                BIT(3)
+#define WLOCK_40                                BIT(4)
+#define R_DIS_PRST_0                            BIT(5)
+#define R_DIS_PRST_1                            BIT(6)
+#define LOCK_ALL_EN                             BIT(7)
+
+#define RF_EN                                   BIT(0)
+#define RF_RSTB                                 BIT(1)
+#define RF_SDMRSTB                              BIT(2)
+
+#define LDA15_EN                                BIT(0)
+#define LDA15_STBY                              BIT(1)
+#define LDA15_OBUF                              BIT(2)
+#define LDA15_REG_VOS                           BIT(3)
+#define _LDA15_VOADJ(x)                         (((x) & 0x7) << 4)
+
+#define LDV12_EN                                BIT(0)
+#define LDV12_SDBY                              BIT(1)
+#define LPLDO_HSM                               BIT(2)
+#define LPLDO_LSM_DIS                           BIT(3)
+#define _LDV12_VADJ(x)                          (((x) & 0xF) << 4)
+
+#define XTAL_EN                                 BIT(0)
+#define XTAL_BSEL                               BIT(1)
+#define _XTAL_BOSC(x)                           (((x) & 0x3) << 2)
+#define _XTAL_CADJ(x)                           (((x) & 0xF) << 4)
+#define XTAL_GATE_USB                           BIT(8)
+#define _XTAL_USB_DRV(x)                        (((x) & 0x3) << 9)
+#define XTAL_GATE_AFE                           BIT(11)
+#define _XTAL_AFE_DRV(x)                        (((x) & 0x3) << 12)
+#define XTAL_RF_GATE                            BIT(14)
+#define _XTAL_RF_DRV(x)                         (((x) & 0x3) << 15)
+#define XTAL_GATE_DIG                           BIT(17)
+#define _XTAL_DIG_DRV(x)                        (((x) & 0x3) << 18)
+#define XTAL_BT_GATE                            BIT(20)
+#define _XTAL_BT_DRV(x)                         (((x) & 0x3) << 21)
+#define _XTAL_GPIO(x)                           (((x) & 0x7) << 23)
+
+#define CKDLY_AFE                               BIT(26)
+#define CKDLY_USB                               BIT(27)
+#define CKDLY_DIG                               BIT(28)
+#define CKDLY_BT                                BIT(29)
+
+#define APLL_EN                                 BIT(0)
+#define APLL_320_EN                             BIT(1)
+#define APLL_FREF_SEL                           BIT(2)
+#define APLL_EDGE_SEL                           BIT(3)
+#define APLL_WDOGB                              BIT(4)
+#define APLL_LPFEN                              BIT(5)
+
+#define APLL_REF_CLK_13MHZ                      0x1
+#define APLL_REF_CLK_19_2MHZ                    0x2
+#define APLL_REF_CLK_20MHZ                      0x3
+#define APLL_REF_CLK_25MHZ                      0x4
+#define APLL_REF_CLK_26MHZ                      0x5
+#define APLL_REF_CLK_38_4MHZ                    0x6
+#define APLL_REF_CLK_40MHZ                      0x7
+
+#define APLL_320EN                              BIT(14)
+#define APLL_80EN                               BIT(15)
+#define APLL_1MEN                               BIT(24)
+
+#define ALD_EN                                  BIT(18)
+#define EF_PD                                   BIT(19)
+#define EF_FLAG                                 BIT(31)
+
+#define EF_TRPT                                 BIT(7)
+#define LDOE25_EN                               BIT(31)
+
+#define RSM_EN                                  BIT(0)
+#define TIMER_EN                                BIT(4)
+
+#define TRSW0EN                                 BIT(2)
+#define TRSW1EN                                 BIT(3)
+#define EROM_EN                                 BIT(4)
+#define ENBT                                    BIT(5)
+#define ENUART                                  BIT(8)
+#define UART_910                                BIT(9)
+#define ENPMAC                                  BIT(10)
+#define SIC_SWRST                               BIT(11)
+#define ENSIC                                   BIT(12)
+#define SIC_23                                  BIT(13)
+#define ENHDP                                   BIT(14)
+#define SIC_LBK                                 BIT(15)
+
+#define LED0PL                                  BIT(4)
+#define LED1PL                                  BIT(12)
+#define LED0DIS                                 BIT(7)
+
+#define MCUFWDL_EN                              BIT(0)
+#define MCUFWDL_RDY                             BIT(1)
+#define FWDL_CHKSUM_RPT                         BIT(2)
+#define MACINI_RDY                              BIT(3)
+#define BBINI_RDY                               BIT(4)
+#define RFINI_RDY                               BIT(5)
+#define WINTINI_RDY                             BIT(6)
+#define CPRST                                   BIT(23)
+
+#define XCLK_VLD                                BIT(0)
+#define ACLK_VLD                                BIT(1)
+#define UCLK_VLD                                BIT(2)
+#define PCLK_VLD                                BIT(3)
+#define PCIRSTB                                 BIT(4)
+#define V15_VLD                                 BIT(5)
+#define TRP_B15V_EN                             BIT(7)
+#define SIC_IDLE                                BIT(8)
+#define BD_MAC2                                 BIT(9)
+#define BD_MAC1                                 BIT(10)
+#define IC_MACPHY_MODE                          BIT(11)
+#define VENDOR_ID                               BIT(19)
+#define PAD_HWPD_IDN                            BIT(22)
+#define TRP_VAUX_EN                             BIT(23)
+#define TRP_BT_EN                               BIT(24)
+#define BD_PKG_SEL                              BIT(25)
+#define BD_HCI_SEL                              BIT(26)
+#define TYPE_ID                                 BIT(27)
+
+#define CHIP_VER_RTL_MASK                       0xF000
+#define CHIP_VER_RTL_SHIFT                      12
+
+#define REG_LBMODE                              (REG_CR + 3)
+
+#define HCI_TXDMA_EN                            BIT(0)
+#define HCI_RXDMA_EN                            BIT(1)
+#define TXDMA_EN                                BIT(2)
+#define RXDMA_EN                                BIT(3)
+#define PROTOCOL_EN                             BIT(4)
+#define SCHEDULE_EN                             BIT(5)
+#define MACTXEN                                 BIT(6)
+#define MACRXEN                                 BIT(7)
+#define ENSWBCN                                 BIT(8)
+#define ENSEC                                   BIT(9)
+
+#define _NETTYPE(x)                             (((x) & 0x3) << 16)
+#define MASK_NETTYPE                            0x30000
+#define NT_NO_LINK                              0x0
+#define NT_LINK_AD_HOC                          0x1
+#define NT_LINK_AP                              0x2
+#define NT_AS_AP                                0x3
+
+#define _LBMODE(x)                              (((x) & 0xF) << 24)
+#define MASK_LBMODE                             0xF000000
+#define LOOPBACK_NORMAL                         0x0
+#define LOOPBACK_IMMEDIATELY                    0xB
+#define LOOPBACK_MAC_DELAY                      0x3
+#define LOOPBACK_PHY                            0x1
+#define LOOPBACK_DMA                            0x7
+
+#define GET_RX_PAGE_SIZE(value)         ((value) & 0xF)
+#define GET_TX_PAGE_SIZE(value)         (((value) & 0xF0) >> 4)
+#define _PSRX_MASK                              0xF
+#define _PSTX_MASK                              0xF0
+#define _PSRX(x)                                (x)
+#define _PSTX(x)                                ((x) << 4)
+
+#define PBP_64                                  0x0
+#define PBP_128                                 0x1
+#define PBP_256                                 0x2
+#define PBP_512                                 0x3
+#define PBP_1024                                0x4
+
+#define RXDMA_ARBBW_EN                          BIT(0)
+#define RXSHFT_EN                               BIT(1)
+#define RXDMA_AGG_EN                            BIT(2)
+#define QS_VO_QUEUE                             BIT(8)
+#define QS_VI_QUEUE                             BIT(9)
+#define QS_BE_QUEUE                             BIT(10)
+#define QS_BK_QUEUE                             BIT(11)
+#define QS_MANAGER_QUEUE                        BIT(12)
+#define QS_HIGH_QUEUE                           BIT(13)
+
+#define HQSEL_VOQ                               BIT(0)
+#define HQSEL_VIQ                               BIT(1)
+#define HQSEL_BEQ                               BIT(2)
+#define HQSEL_BKQ                               BIT(3)
+#define HQSEL_MGTQ                              BIT(4)
+#define HQSEL_HIQ                               BIT(5)
+
+#define _TXDMA_HIQ_MAP(x)                       (((x)&0x3) << 14)
+#define _TXDMA_MGQ_MAP(x)                       (((x)&0x3) << 12)
+#define _TXDMA_BKQ_MAP(x)                       (((x)&0x3) << 10)
+#define _TXDMA_BEQ_MAP(x)                       (((x)&0x3) << 8)
+#define _TXDMA_VIQ_MAP(x)                       (((x)&0x3) << 6)
+#define _TXDMA_VOQ_MAP(x)                       (((x)&0x3) << 4)
+
+#define QUEUE_LOW                               1
+#define QUEUE_NORMAL                            2
+#define QUEUE_HIGH                              3
+
+#define _LLT_NO_ACTIVE                          0x0
+#define _LLT_WRITE_ACCESS                       0x1
+#define _LLT_READ_ACCESS                        0x2
+
+#define _LLT_INIT_DATA(x)                       ((x) & 0xFF)
+#define _LLT_INIT_ADDR(x)                       (((x) & 0xFF) << 8)
+#define _LLT_OP(x)                              (((x) & 0x3) << 30)
+#define _LLT_OP_VALUE(x)                        (((x) >> 30) & 0x3)
+
+#define BB_WRITE_READ_MASK                      (BIT(31) | BIT(30))
+#define BB_WRITE_EN                             BIT(30)
+#define BB_READ_EN                              BIT(31)
+
+#define _HPQ(x)                                 ((x) & 0xFF)
+#define _LPQ(x)                                 (((x) & 0xFF) << 8)
+#define _PUBQ(x)                                (((x) & 0xFF) << 16)
+#define _NPQ(x)                                 ((x) & 0xFF)
+
+#define HPQ_PUBLIC_DIS                          BIT(24)
+#define LPQ_PUBLIC_DIS                          BIT(25)
+#define LD_RQPN                                 BIT(31)
+
+#define BCN_VALID                               BIT(16)
+#define BCN_HEAD(x)                             (((x) & 0xFF) << 8)
+#define BCN_HEAD_MASK                           0xFF00
+
+#define BLK_DESC_NUM_SHIFT                      4
+#define BLK_DESC_NUM_MASK                       0xF
+
+#define DROP_DATA_EN                            BIT(9)
+
+#define EN_AMPDU_RTY_NEW                        BIT(7)
+
+#define _INIRTSMCS_SEL(x)                       ((x) & 0x3F)
+
+#define _SPEC_SIFS_CCK(x)                       ((x) & 0xFF)
+#define _SPEC_SIFS_OFDM(x)                      (((x) & 0xFF) << 8)
+
+#define RATE_REG_BITMAP_ALL                     0xFFFFF
+
+#define _RRSC_BITMAP(x)                         ((x) & 0xFFFFF)
+
+#define _RRSR_RSC(x)                            (((x) & 0x3) << 21)
+#define RRSR_RSC_RESERVED                       0x0
+#define RRSR_RSC_UPPER_SUBCHANNEL               0x1
+#define RRSR_RSC_LOWER_SUBCHANNEL               0x2
+#define RRSR_RSC_DUPLICATE_MODE                 0x3
+
+#define USE_SHORT_G1                            BIT(20)
+
+#define _AGGLMT_MCS0(x)                         ((x) & 0xF)
+#define _AGGLMT_MCS1(x)                         (((x) & 0xF) << 4)
+#define _AGGLMT_MCS2(x)                         (((x) & 0xF) << 8)
+#define _AGGLMT_MCS3(x)                         (((x) & 0xF) << 12)
+#define _AGGLMT_MCS4(x)                         (((x) & 0xF) << 16)
+#define _AGGLMT_MCS5(x)                         (((x) & 0xF) << 20)
+#define _AGGLMT_MCS6(x)                         (((x) & 0xF) << 24)
+#define _AGGLMT_MCS7(x)                         (((x) & 0xF) << 28)
+
+#define RETRY_LIMIT_SHORT_SHIFT                 8
+#define RETRY_LIMIT_LONG_SHIFT                  0
+
+#define _DARF_RC1(x)                            ((x) & 0x1F)
+#define _DARF_RC2(x)                            (((x) & 0x1F) << 8)
+#define _DARF_RC3(x)                            (((x) & 0x1F) << 16)
+#define _DARF_RC4(x)                            (((x) & 0x1F) << 24)
+#define _DARF_RC5(x)                            ((x) & 0x1F)
+#define _DARF_RC6(x)                            (((x) & 0x1F) << 8)
+#define _DARF_RC7(x)                            (((x) & 0x1F) << 16)
+#define _DARF_RC8(x)                            (((x) & 0x1F) << 24)
+
+#define _RARF_RC1(x)                            ((x) & 0x1F)
+#define _RARF_RC2(x)                            (((x) & 0x1F) << 8)
+#define _RARF_RC3(x)                            (((x) & 0x1F) << 16)
+#define _RARF_RC4(x)                            (((x) & 0x1F) << 24)
+#define _RARF_RC5(x)                            ((x) & 0x1F)
+#define _RARF_RC6(x)                            (((x) & 0x1F) << 8)
+#define _RARF_RC7(x)                            (((x) & 0x1F) << 16)
+#define _RARF_RC8(x)                            (((x) & 0x1F) << 24)
+
+#define AC_PARAM_TXOP_LIMIT_OFFSET              16
+#define AC_PARAM_ECW_MAX_OFFSET                 12
+#define AC_PARAM_ECW_MIN_OFFSET                 8
+#define AC_PARAM_AIFS_OFFSET                    0
+
+#define _AIFS(x)                                (x)
+#define _ECW_MAX_MIN(x)                         ((x) << 8)
+#define _TXOP_LIMIT(x)                          ((x) << 16)
+
+#define _BCNIFS(x)                              ((x) & 0xFF)
+#define _BCNECW(x)                              ((((x) & 0xF)) << 8)
+
+#define _LRL(x)                                 ((x) & 0x3F)
+#define _SRL(x)                                 (((x) & 0x3F) << 8)
+
+#define _SIFS_CCK_CTX(x)                        ((x) & 0xFF)
+#define _SIFS_CCK_TRX(x)                        (((x) & 0xFF) << 8);
+
+#define _SIFS_OFDM_CTX(x)                       ((x) & 0xFF)
+#define _SIFS_OFDM_TRX(x)                       (((x) & 0xFF) << 8);
+
+#define _TBTT_PROHIBIT_HOLD(x)                  (((x) & 0xFF) << 8)
+
+#define DIS_EDCA_CNT_DWN                        BIT(11)
+
+#define EN_MBSSID                               BIT(1)
+#define EN_TXBCN_RPT                            BIT(2)
+#define EN_BCN_FUNCTION                         BIT(3)
+
+#define TSFTR_RST                               BIT(0)
+#define TSFTR1_RST                              BIT(1)
+
+#define STOP_BCNQ                               BIT(6)
+
+#define DIS_TSF_UDT0_NORMAL_CHIP                BIT(4)
+#define DIS_TSF_UDT0_TEST_CHIP                  BIT(5)
+
+#define ACMHW_HWEN                              BIT(0)
+#define ACMHW_BEQEN                             BIT(1)
+#define ACMHW_VIQEN                             BIT(2)
+#define ACMHW_VOQEN                             BIT(3)
+#define ACMHW_BEQSTATUS                         BIT(4)
+#define ACMHW_VIQSTATUS                         BIT(5)
+#define ACMHW_VOQSTATUS                         BIT(6)
+
+#define APSDOFF                                 BIT(6)
+#define APSDOFF_STATUS                          BIT(7)
+
+#define BW_20MHZ                                BIT(2)
+
+#define RATE_BITMAP_ALL                         0xFFFFF
+
+#define RATE_RRSR_CCK_ONLY_1M                   0xFFFF1
+
+#define TSFRST                                  BIT(0)
+#define DIS_GCLK                                BIT(1)
+#define PAD_SEL                                 BIT(2)
+#define PWR_ST                                  BIT(6)
+#define PWRBIT_OW_EN                            BIT(7)
+#define ACRC                                    BIT(8)
+#define CFENDFORM                               BIT(9)
+#define ICV                                     BIT(10)
+
+#define AAP                                     BIT(0)
+#define APM                                     BIT(1)
+#define AM                                      BIT(2)
+#define AB                                      BIT(3)
+#define ADD3                                    BIT(4)
+#define APWRMGT                                 BIT(5)
+#define CBSSID                                  BIT(6)
+#define CBSSID_DATA                             BIT(6)
+#define CBSSID_BCN                              BIT(7)
+#define ACRC32                                  BIT(8)
+#define AICV                                    BIT(9)
+#define ADF                                     BIT(11)
+#define ACF                                     BIT(12)
+#define AMF                                     BIT(13)
+#define HTC_LOC_CTRL                            BIT(14)
+#define UC_DATA_EN                              BIT(16)
+#define BM_DATA_EN                              BIT(17)
+#define MFBEN                                   BIT(22)
+#define LSIGEN                                  BIT(23)
+#define ENMBID                                  BIT(24)
+#define APP_BASSN                               BIT(27)
+#define APP_PHYSTS                              BIT(28)
+#define APP_ICV                                 BIT(29)
+#define APP_MIC                                 BIT(30)
+#define APP_FCS                                 BIT(31)
+
+#define _MIN_SPACE(x)                           ((x) & 0x7)
+#define _SHORT_GI_PADDING(x)                    (((x) & 0x1F) << 3)
+
+#define RXERR_TYPE_OFDM_PPDU                    0
+#define RXERR_TYPE_OFDM_FALSE_ALARM             1
+#define RXERR_TYPE_OFDM_MPDU_OK                 2
+#define RXERR_TYPE_OFDM_MPDU_FAIL               3
+#define RXERR_TYPE_CCK_PPDU                     4
+#define RXERR_TYPE_CCK_FALSE_ALARM              5
+#define RXERR_TYPE_CCK_MPDU_OK                  6
+#define RXERR_TYPE_CCK_MPDU_FAIL                7
+#define RXERR_TYPE_HT_PPDU                      8
+#define RXERR_TYPE_HT_FALSE_ALARM               9
+#define RXERR_TYPE_HT_MPDU_TOTAL                10
+#define RXERR_TYPE_HT_MPDU_OK                   11
+#define RXERR_TYPE_HT_MPDU_FAIL                 12
+#define RXERR_TYPE_RX_FULL_DROP                 15
+
+#define RXERR_COUNTER_MASK                      0xFFFFF
+#define RXERR_RPT_RST                           BIT(27)
+#define _RXERR_RPT_SEL(type)                    ((type) << 28)
+
+#define SCR_TXUSEDK                             BIT(0)
+#define SCR_RXUSEDK                             BIT(1)
+#define SCR_TXENCENABLE                         BIT(2)
+#define SCR_RXDECENABLE                         BIT(3)
+#define SCR_SKBYA2                              BIT(4)
+#define SCR_NOSKMC                              BIT(5)
+#define SCR_TXBCUSEDK                           BIT(6)
+#define SCR_RXBCUSEDK                           BIT(7)
+
+#define USB_IS_HIGH_SPEED                       0
+#define USB_IS_FULL_SPEED                       1
+#define USB_SPEED_MASK                          BIT(5)
+
+#define USB_NORMAL_SIE_EP_MASK                  0xF
+#define USB_NORMAL_SIE_EP_SHIFT                 4
+
+#define USB_TEST_EP_MASK                        0x30
+#define USB_TEST_EP_SHIFT                       4
+
+#define USB_AGG_EN                              BIT(3)
+
+#define MAC_ADDR_LEN                            6
+#define LAST_ENTRY_OF_TX_PKT_BUFFER             175/*255    88e*/
+
+#define POLLING_LLT_THRESHOLD                   20
+#define POLLING_READY_TIMEOUT_COUNT             3000
+
+#define MAX_MSS_DENSITY_2T                      0x13
+#define MAX_MSS_DENSITY_1T                      0x0A
+
+#define EPROM_CMD_OPERATING_MODE_MASK           ((1<<7)|(1<<6))
+#define EPROM_CMD_CONFIG                        0x3
+#define EPROM_CMD_LOAD                          1
+
+#define HWSET_MAX_SIZE_92S                      HWSET_MAX_SIZE
+
+#define HAL_8192C_HW_GPIO_WPS_BIT               BIT(2)
+
+#define RPMAC_RESET                             0x100
+#define RPMAC_TXSTART                           0x104
+#define RPMAC_TXLEGACYSIG                       0x108
+#define RPMAC_TXHTSIG1                          0x10c
+#define RPMAC_TXHTSIG2                          0x110
+#define RPMAC_PHYDEBUG                          0x114
+#define RPMAC_TXPACKETNUM                       0x118
+#define RPMAC_TXIDLE                            0x11c
+#define RPMAC_TXMACHEADER0                      0x120
+#define RPMAC_TXMACHEADER1                      0x124
+#define RPMAC_TXMACHEADER2                      0x128
+#define RPMAC_TXMACHEADER3                      0x12c
+#define RPMAC_TXMACHEADER4                      0x130
+#define RPMAC_TXMACHEADER5                      0x134
+#define RPMAC_TXDADATYPE                        0x138
+#define RPMAC_TXRANDOMSEED                      0x13c
+#define RPMAC_CCKPLCPPREAMBLE                   0x140
+#define RPMAC_CCKPLCPHEADER                     0x144
+#define RPMAC_CCKCRC16                          0x148
+#define RPMAC_OFDMRXCRC32OK                     0x170
+#define RPMAC_OFDMRXCRC32Er                     0x174
+#define RPMAC_OFDMRXPARITYER                    0x178
+#define RPMAC_OFDMRXCRC8ER                      0x17c
+#define RPMAC_CCKCRXRC16ER                      0x180
+#define RPMAC_CCKCRXRC32ER                      0x184
+#define RPMAC_CCKCRXRC32OK                      0x188
+#define RPMAC_TXSTATUS                          0x18c
+
+#define RFPGA0_RFMOD                            0x800
+
+#define RFPGA0_TXINFO                           0x804
+#define RFPGA0_PSDFUNCTION                      0x808
+
+#define RFPGA0_TXGAINSTAGE                      0x80c
+
+#define RFPGA0_RFTIMING1                        0x810
+#define RFPGA0_RFTIMING2                        0x814
+
+#define RFPGA0_XA_HSSIPARAMETER1                0x820
+#define RFPGA0_XA_HSSIPARAMETER2                0x824
+#define RFPGA0_XB_HSSIPARAMETER1                0x828
+#define RFPGA0_XB_HSSIPARAMETER2                0x82c
+
+#define RFPGA0_XA_LSSIPARAMETER                 0x840
+#define RFPGA0_XB_LSSIPARAMETER                 0x844
+
+#define RFPGA0_RFWAKEUPPARAMETER                0x850
+#define RFPGA0_RFSLEEPUPPARAMETER               0x854
+
+#define RFPGA0_XAB_SWITCHCONTROL                0x858
+#define RFPGA0_XCD_SWITCHCONTROL                0x85c
+
+#define RFPGA0_XA_RFINTERFACEOE                 0x860
+#define RFPGA0_XB_RFINTERFACEOE                 0x864
+
+#define RFPGA0_XAB_RFINTERFACESW                0x870
+#define RFPGA0_XCD_RFINTERFACESW                0x874
+
+#define rFPGA0_XAB_RFPARAMETER                  0x878
+#define rFPGA0_XCD_RFPARAMETER                  0x87c
+
+#define RFPGA0_ANALOGPARAMETER1                 0x880
+#define RFPGA0_ANALOGPARAMETER2                 0x884
+#define RFPGA0_ANALOGPARAMETER3                 0x888
+#define RFPGA0_ANALOGPARAMETER4                 0x88c
+
+#define RFPGA0_XA_LSSIREADBACK                  0x8a0
+#define RFPGA0_XB_LSSIREADBACK                  0x8a4
+#define RFPGA0_XC_LSSIREADBACK                  0x8a8
+#define RFPGA0_XD_LSSIREADBACK                  0x8ac
+
+#define RFPGA0_PSDREPORT                        0x8b4
+#define TRANSCEIVEA_HSPI_READBACK               0x8b8
+#define TRANSCEIVEB_HSPI_READBACK               0x8bc
+#define REG_SC_CNT                              0x8c4
+#define RFPGA0_XAB_RFINTERFACERB                0x8e0
+#define RFPGA0_XCD_RFINTERFACERB                0x8e4
+
+#define RFPGA1_RFMOD                            0x900
+
+#define RFPGA1_TXBLOCK                          0x904
+#define RFPGA1_DEBUGSELECT                      0x908
+#define RFPGA1_TXINFO                           0x90c
+
+#define RCCK0_SYSTEM                            0xa00
+
+#define RCCK0_AFESETTING                        0xa04
+#define RCCK0_CCA                               0xa08
+
+#define RCCK0_RXAGC1                            0xa0c
+#define RCCK0_RXAGC2                            0xa10
+
+#define RCCK0_RXHP                              0xa14
+
+#define RCCK0_DSPPARAMETER1                     0xa18
+#define RCCK0_DSPPARAMETER2                     0xa1c
+
+#define RCCK0_TXFILTER1                         0xa20
+#define RCCK0_TXFILTER2                         0xa24
+#define RCCK0_DEBUGPORT                         0xa28
+#define RCCK0_FALSEALARMREPORT                  0xa2c
+#define RCCK0_TRSSIREPORT                       0xa50
+#define RCCK0_RXREPORT                          0xa54
+#define RCCK0_FACOUNTERLOWER                    0xa5c
+#define RCCK0_FACOUNTERUPPER                    0xa58
+#define RCCK0_CCA_CNT                           0xa60
+
+
+/* PageB(0xB00) */
+#define RPDP_ANTA                               0xb00
+#define RPDP_ANTA_4                             0xb04
+#define RPDP_ANTA_8                             0xb08
+#define RPDP_ANTA_C                             0xb0c
+#define RPDP_ANTA_10                            0xb10
+#define RPDP_ANTA_14                            0xb14
+#define RPDP_ANTA_18                            0xb18
+#define RPDP_ANTA_1C                            0xb1c
+#define RPDP_ANTA_20                            0xb20
+#define RPDP_ANTA_24                            0xb24
+
+#define RCONFIG_PMPD_ANTA                       0xb28
+#define RCONFIG_RAM64X16                        0xb2c
+
+#define RBNDA                                   0xb30
+#define RHSSIPAR                                0xb34
+
+#define RCONFIG_ANTA                            0xb68
+#define RCONFIG_ANTB                            0xb6c
+
+#define RPDP_ANTB                               0xb70
+#define RPDP_ANTB_4                             0xb74
+#define RPDP_ANTB_8                             0xb78
+#define RPDP_ANTB_C                             0xb7c
+#define RPDP_ANTB_10                            0xb80
+#define RPDP_ANTB_14                            0xb84
+#define RPDP_ANTB_18                            0xb88
+#define RPDP_ANTB_1C                            0xb8c
+#define RPDP_ANTB_20                            0xb90
+#define RPDP_ANTB_24                            0xb94
+
+#define RCONFIG_PMPD_ANTB                       0xb98
+
+#define RBNDB                                   0xba0
+
+#define RAPK                                    0xbd8
+#define rPm_Rx0_AntA                            0xbdc
+#define rPm_Rx1_AntA                            0xbe0
+#define rPm_Rx2_AntA                            0xbe4
+#define rPm_Rx3_AntA                            0xbe8
+#define rPm_Rx0_AntB                            0xbec
+#define rPm_Rx1_AntB                            0xbf0
+#define rPm_Rx2_AntB                            0xbf4
+#define rPm_Rx3_AntB                            0xbf8
+
+/*Page C*/
+#define ROFDM0_LSTF                             0xc00
+
+#define ROFDM0_TRXPATHENABLE                    0xc04
+#define ROFDM0_TRMUXPAR                         0xc08
+#define ROFDM0_TRSWISOLATION                    0xc0c
+
+#define ROFDM0_XARXAFE                          0xc10
+#define ROFDM0_XARXIQIMBAL                      0xc14
+#define ROFDM0_XBRXAFE                          0xc18
+#define ROFDM0_XBRXIQIMBAL                      0xc1c
+#define ROFDM0_XCRXAFE                          0xc20
+#define ROFDM0_XCRXIQIMBAL                      0xc24
+#define ROFDM0_XDRXAFE                          0xc28
+#define ROFDM0_XDRXIQIMBAL                      0xc2c
+
+#define ROFDM0_RXDETECTOR1                      0xc30
+#define ROFDM0_RXDETECTOR2                      0xc34
+#define ROFDM0_RXDETECTOR3                      0xc38
+#define ROFDM0_RXDETECTOR4                      0xc3c
+
+#define ROFDM0_RXDSP                            0xc40
+#define ROFDM0_CFOANDDAGC                       0xc44
+#define ROFDM0_CCADROPTHRES                     0xc48
+#define ROFDM0_ECCATHRES                        0xc4c
+
+#define ROFDM0_XAAGCCORE1                       0xc50
+#define ROFDM0_XAAGCCORE2                       0xc54
+#define ROFDM0_XBAGCCORE1                       0xc58
+#define ROFDM0_XBAGCCORE2                       0xc5c
+#define ROFDM0_XCAGCCORE1                       0xc60
+#define ROFDM0_XCAGCCORE2                       0xc64
+#define ROFDM0_XDAGCCORE1                       0xc68
+#define ROFDM0_XDAGCCORE2                       0xc6c
+
+#define ROFDM0_AGCPARAMETER1                    0xc70
+#define ROFDM0_AGCPARAMETER2                    0xc74
+#define ROFDM0_AGCRSSITABLE                     0xc78
+#define ROFDM0_HTSTFAGC                         0xc7c
+
+#define ROFDM0_XATXIQIMBAL                      0xc80
+#define ROFDM0_XATXAFE                          0xc84
+#define ROFDM0_XBTXIQIMBAL                      0xc88
+#define ROFDM0_XBTXAFE                          0xc8c
+#define ROFDM0_XCTXIQIMBAL                      0xc90
+#define ROFDM0_XCTXAFE                          0xc94
+#define ROFDM0_XDTXIQIMBAL                      0xc98
+#define ROFDM0_XDTXAFE                          0xc9c
+
+#define ROFDM0_RXIQEXTANTA                      0xca0
+#define ROFDM0_TXCOEFF1                         0xca4
+#define ROFDM0_TXCOEFF2                         0xca8
+#define ROFDM0_TXCOEFF3                         0xcac
+#define ROFDM0_TXCOEFF4                         0xcb0
+#define ROFDM0_TXCOEFF5                         0xcb4
+#define ROFDM0_TXCOEFF6                         0xcb8
+
+#define ROFDM0_RXHPPARAMETER                    0xce0
+#define ROFDM0_TXPSEUDONOISEWGT                 0xce4
+#define ROFDM0_FRAMESYNC                        0xcf0
+#define ROFDM0_DFSREPORT                        0xcf4
+
+
+#define ROFDM1_LSTF                             0xd00
+#define ROFDM1_TRXPATHENABLE                    0xd04
+
+#define ROFDM1_CF0                              0xd08
+#define ROFDM1_CSI1                             0xd10
+#define ROFDM1_SBD                              0xd14
+#define ROFDM1_CSI2                             0xd18
+#define ROFDM1_CFOTRACKING                      0xd2c
+#define ROFDM1_TRXMESAURE1                      0xd34
+#define ROFDM1_INTFDET                          0xd3c
+#define ROFDM1_PSEUDONOISESTATEAB               0xd50
+#define ROFDM1_PSEUDONOISESTATECD               0xd54
+#define ROFDM1_RXPSEUDONOISEWGT                 0xd58
+
+#define ROFDM_PHYCOUNTER1                       0xda0
+#define ROFDM_PHYCOUNTER2                       0xda4
+#define ROFDM_PHYCOUNTER3                       0xda8
+
+#define ROFDM_SHORTCFOAB                        0xdac
+#define ROFDM_SHORTCFOCD                        0xdb0
+#define ROFDM_LONGCFOAB                         0xdb4
+#define ROFDM_LONGCFOCD                         0xdb8
+#define ROFDM_TAILCF0AB                         0xdbc
+#define ROFDM_TAILCF0CD                         0xdc0
+#define ROFDM_PWMEASURE1                        0xdc4
+#define ROFDM_PWMEASURE2                        0xdc8
+#define ROFDM_BWREPORT                          0xdcc
+#define ROFDM_AGCREPORT                         0xdd0
+#define ROFDM_RXSNR                             0xdd4
+#define ROFDM_RXEVMCSI                          0xdd8
+#define ROFDM_SIGREPORT                         0xddc
+
+#define RTXAGC_A_RATE18_06                      0xe00
+#define RTXAGC_A_RATE54_24                      0xe04
+#define RTXAGC_A_CCK1_MCS32                     0xe08
+#define RTXAGC_A_MCS03_MCS00                    0xe10
+#define RTXAGC_A_MCS07_MCS04                    0xe14
+#define RTXAGC_A_MCS11_MCS08                    0xe18
+#define RTXAGC_A_MCS15_MCS12                    0xe1c
+
+#define RTXAGC_B_RATE18_06                      0x830
+#define RTXAGC_B_RATE54_24                      0x834
+#define RTXAGC_B_CCK1_55_MCS32                  0x838
+#define RTXAGC_B_MCS03_MCS00                    0x83c
+#define RTXAGC_B_MCS07_MCS04                    0x848
+#define RTXAGC_B_MCS11_MCS08                    0x84c
+#define RTXAGC_B_MCS15_MCS12                    0x868
+#define RTXAGC_B_CCK11_A_CCK2_11                0x86c
+
+#define RFPGA0_IQK                              0xe28
+#define RTX_IQK_TONE_A                          0xe30
+#define RRX_IQK_TONE_A                          0xe34
+#define RTX_IQK_PI_A                            0xe38
+#define RRX_IQK_PI_A                            0xe3c
+
+#define RTX_IQK                                 0xe40
+#define RRX_IQK                                 0xe44
+#define RIQK_AGC_PTS                            0xe48
+#define RIQK_AGC_RSP                            0xe4c
+#define RTX_IQK_TONE_B                          0xe50
+#define RRX_IQK_TONE_B                          0xe54
+#define RTX_IQK_PI_B                            0xe58
+#define RRX_IQK_PI_B                            0xe5c
+#define RIQK_AGC_CONT                           0xe60
+
+#define RBLUE_TOOTH                             0xe6c
+#define RRX_WAIT_CCA                            0xe70
+#define RTX_CCK_RFON                            0xe74
+#define RTX_CCK_BBON                            0xe78
+#define RTX_OFDM_RFON                           0xe7c
+#define RTX_OFDM_BBON                           0xe80
+#define RTX_TO_RX                               0xe84
+#define RTX_TO_TX                               0xe88
+#define RRX_CCK                                 0xe8c
+
+#define RTX_POWER_BEFORE_IQK_A                  0xe94
+#define RTX_POWER_AFTER_IQK_A                   0xe9c
+
+#define RRX_POWER_BEFORE_IQK_A                  0xea0
+#define RRX_POWER_BEFORE_IQK_A_2                0xea4
+#define RRX_POWER_AFTER_IQK_A                   0xea8
+#define RRX_POWER_AFTER_IQK_A_2                 0xeac
+
+#define RTX_POWER_BEFORE_IQK_B                  0xeb4
+#define RTX_POWER_AFTER_IQK_B                   0xebc
+
+#define RRX_POWER_BEFORE_IQK_B                  0xec0
+#define RRX_POWER_BEFORE_IQK_B_2                0xec4
+#define RRX_POWER_AFTER_IQK_B                   0xec8
+#define RRX_POWER_AFTER_IQK_B_2                 0xecc
+
+#define RRX_OFDM                                0xed0
+#define RRX_WAIT_RIFS                           0xed4
+#define RRX_TO_RX                               0xed8
+#define RSTANDBY                                0xedc
+#define RSLEEP                                  0xee0
+#define RPMPD_ANAEN                             0xeec
+
+#define RZEBRA1_HSSIENABLE                      0x0
+#define RZEBRA1_TRXENABLE1                      0x1
+#define RZEBRA1_TRXENABLE2                      0x2
+#define RZEBRA1_AGC                             0x4
+#define RZEBRA1_CHARGEPUMP                      0x5
+#define RZEBRA1_CHANNEL                         0x7
+
+#define RZEBRA1_TXGAIN                          0x8
+#define RZEBRA1_TXLPF                           0x9
+#define RZEBRA1_RXLPF                           0xb
+#define RZEBRA1_RXHPFCORNER                     0xc
+
+#define RGLOBALCTRL                             0
+#define RRTL8256_TXLPF                          19
+#define RRTL8256_RXLPF                          11
+#define RRTL8258_TXLPF                          0x11
+#define RRTL8258_RXLPF                          0x13
+#define RRTL8258_RSSILPF                        0xa
+
+#define RF_AC                                   0x00
+
+#define RF_IQADJ_G1                             0x01
+#define RF_IQADJ_G2                             0x02
+#define RF_POW_TRSW                             0x05
+
+#define RF_GAIN_RX                              0x06
+#define RF_GAIN_TX                              0x07
+
+#define RF_TXM_IDAC                             0x08
+#define RF_BS_IQGEN                             0x0F
+
+#define RF_MODE1                                0x10
+#define RF_MODE2                                0x11
+
+#define RF_RX_AGC_HP                            0x12
+#define RF_TX_AGC                               0x13
+#define RF_BIAS                                 0x14
+#define RF_IPA                                  0x15
+#define RF_POW_ABILITY                          0x17
+#define RF_MODE_AG                              0x18
+#define RRFCHANNEL                              0x18
+#define RF_CHNLBW                               0x18
+#define RF_TOP                                  0x19
+
+#define RF_RX_G1                                0x1A
+#define RF_RX_G2                                0x1B
+
+#define RF_RX_BB2                               0x1C
+#define RF_RX_BB1                               0x1D
+
+#define RF_RCK1                                 0x1E
+#define RF_RCK2                                 0x1F
+
+#define RF_TX_G1                                0x20
+#define RF_TX_G2                                0x21
+#define RF_TX_G3                                0x22
+
+#define RF_TX_BB1                               0x23
+#define RF_T_METER                              0x42
+
+#define RF_SYN_G1                               0x25
+#define RF_SYN_G2                               0x26
+#define RF_SYN_G3                               0x27
+#define RF_SYN_G4                               0x28
+#define RF_SYN_G5                               0x29
+#define RF_SYN_G6                               0x2A
+#define RF_SYN_G7                               0x2B
+#define RF_SYN_G8                               0x2C
+
+#define RF_RCK_OS                               0x30
+#define RF_TXPA_G1                              0x31
+#define RF_TXPA_G2                              0x32
+#define RF_TXPA_G3                              0x33
+
+#define RF_TX_BIAS_A                            0x35
+#define RF_TX_BIAS_D                            0x36
+#define RF_LOBF_9                               0x38
+#define RF_RXRF_A3                              0x3C
+#define RF_TRSW                                 0x3F
+
+#define RF_TXRF_A2                              0x41
+#define RF_TXPA_G4                              0x46
+#define RF_TXPA_A4                              0x4B
+
+#define RF_WE_LUT                               0xEF
+
+#define BBBRESETB                               0x100
+#define BGLOBALRESETB                           0x200
+#define BOFDMTXSTART                            0x4
+#define BCCKTXSTART                             0x8
+#define BCRC32DEBUG                             0x100
+#define BPMACLOOPBACK                           0x10
+#define BTXLSIG                                 0xffffff
+#define BOFDMTXRATE                             0xf
+#define BOFDMTXRESERVED                         0x10
+#define BOFDMTXLENGTH                           0x1ffe0
+#define BOFDMTXPARITY                           0x20000
+#define BTXHTSIG1                               0xffffff
+#define BTXHTMCSRATE                            0x7f
+#define BTXHTBW                                 0x80
+#define BTXHTLENGTH                             0xffff00
+#define BTXHTSIG2                               0xffffff
+#define BTXHTSMOOTHING                          0x1
+#define BTXHTSOUNDING                           0x2
+#define BTXHTRESERVED                           0x4
+#define BTXHTAGGREATION                         0x8
+#define BTXHTSTBC                               0x30
+#define BTXHTADVANCECODING                      0x40
+#define BTXHTSHORTGI                            0x80
+#define BTXHTNUMBERHT_LTF                       0x300
+#define BTXHTCRC8                               0x3fc00
+#define BCOUNTERRESET                           0x10000
+#define BNUMOFOFDMTX                            0xffff
+#define BNUMOFCCKTX                             0xffff0000
+#define BTXIDLEINTERVAL                         0xffff
+#define BOFDMSERVICE                            0xffff0000
+#define BTXMACHEADER                            0xffffffff
+#define BTXDATAINIT                             0xff
+#define BTXHTMODE                               0x100
+#define BTXDATATYPE                             0x30000
+#define BTXRANDOMSEED                           0xffffffff
+#define BCCKTXPREAMBLE                          0x1
+#define BCCKTXSFD                               0xffff0000
+#define BCCKTXSIG                               0xff
+#define BCCKTXSERVICE                           0xff00
+#define BCCKLENGTHEXT                           0x8000
+#define BCCKTXLENGHT                            0xffff0000
+#define BCCKTXCRC16                             0xffff
+#define BCCKTXSTATUS                            0x1
+#define BOFDMTXSTATUS                           0x2
+#define IS_BB_REG_OFFSET_92S(_offset)   \
+        ((_offset >= 0x800) && (_offset <= 0xfff))
+
+#define BRFMOD                                  0x1
+#define BJAPANMODE                              0x2
+#define BCCKTXSC                                0x30
+#define BCCKEN                                  0x1000000
+#define BOFDMEN                                 0x2000000
+
+#define BOFDMRXADCPHASE                         0x10000
+#define BOFDMTXDACPHASE                         0x40000
+#define BXATXAGC                                0x3f
+
+#define BXBTXAGC                                0xf00
+#define BXCTXAGC                                0xf000
+#define BXDTXAGC                                0xf0000
+
+#define BPASTART                                0xf0000000
+#define BTRSTART                                0x00f00000
+#define BRFSTART                                0x0000f000
+#define BBBSTART                                0x000000f0
+#define BBBCCKSTART                             0x0000000f
+#define BPAEND                                  0xf
+#define BTREND                                  0x0f000000
+#define BRFEND                                  0x000f0000
+#define BCCAMASK                                0x000000f0
+#define BR2RCCAMASK                             0x00000f00
+#define BHSSI_R2TDELAY                          0xf8000000
+#define BHSSI_T2RDELAY                          0xf80000
+#define BCONTXHSSI                              0x400
+#define BIGFROMCCK                              0x200
+#define BAGCADDRESS                             0x3f
+#define BRXHPTX                                 0x7000
+#define BRXHP2RX                                0x38000
+#define BRXHPCCKINI                             0xc0000
+#define BAGCTXCODE                              0xc00000
+#define BAGCRXCODE                              0x300000
+
+#define B3WIREDATALENGTH                        0x800
+#define B3WIREADDREAALENGTH                     0x400
+
+#define B3WIRERFPOWERDOWN                       0x1
+#define B5GPAPEPOLARITY                         0x40000000
+#define B2GPAPEPOLARITY                         0x80000000
+#define BRFSW_TXDEFAULTANT                      0x3
+#define BRFSW_TXOPTIONANT                       0x30
+#define BRFSW_RXDEFAULTANT                      0x300
+#define BRFSW_RXOPTIONANT                       0x3000
+#define BRFSI_3WIREDATA                         0x1
+#define BRFSI_3WIRECLOCK                        0x2
+#define BRFSI_3WIRELOAD                         0x4
+#define BRFSI_3WIRERW                           0x8
+#define BRFSI_3WIRE                             0xf
+
+#define BRFSI_RFENV                             0x10
+
+#define BRFSI_TRSW                              0x20
+#define BRFSI_TRSWB                             0x40
+#define BRFSI_ANTSW                             0x100
+#define BRFSI_ANTSWB                            0x200
+#define BRFSI_PAPE                              0x400
+#define BRFSI_PAPE5G                            0x800
+#define BBANDSELECT                             0x1
+#define BHTSIG2_GI                              0x80
+#define BHTSIG2_SMOOTHING                       0x01
+#define BHTSIG2_SOUNDING                        0x02
+#define BHTSIG2_AGGREATON                       0x08
+#define BHTSIG2_STBC                            0x30
+#define BHTSIG2_ADVCODING                       0x40
+#define BHTSIG2_NUMOFHTLTF                      0x300
+#define BHTSIG2_CRC8                            0x3fc
+#define BHTSIG1_MCS                             0x7f
+#define BHTSIG1_BANDWIDTH                       0x80
+#define BHTSIG1_HTLENGTH                        0xffff
+#define BLSIG_RATE                              0xf
+#define BLSIG_RESERVED                          0x10
+#define BLSIG_LENGTH                            0x1fffe
+#define BLSIG_PARITY                            0x20
+#define BCCKRXPHASE                             0x4
+
+#define BLSSIREADADDRESS                        0x7f800000
+#define BLSSIREADEDGE                           0x80000000
+
+#define BLSSIREADBACKDATA                       0xfffff
+
+#define BLSSIREADOKFLAG                         0x1000
+#define BCCKSAMPLERATE                          0x8
+#define BREGULATOR0STANDBY                      0x1
+#define BREGULATORPLLSTANDBY                    0x2
+#define BREGULATOR1STANDBY                      0x4
+#define BPLLPOWERUP                             0x8
+#define BDPLLPOWERUP                            0x10
+#define BDA10POWERUP                            0x20
+#define BAD7POWERUP                             0x200
+#define BDA6POWERUP                             0x2000
+#define BXTALPOWERUP                            0x4000
+#define B40MDCLKPOWERUP                         0x8000
+#define BDA6DEBUGMODE                           0x20000
+#define BDA6SWING                               0x380000
+
+#define BADCLKPHASE                             0x4000000
+#define B80MCLKDELAY                            0x18000000
+#define BAFEWATCHDOGENABLE                      0x20000000
+
+#define BXTALCAP01                              0xc0000000
+#define BXTALCAP23                              0x3
+#define BXTALCAP92X                             0x0f000000
+#define BXTALCAP                                0x0f000000
+
+#define BINTDIFCLKENABLE                        0x400
+#define BEXTSIGCLKENABLE                        0x800
+#define BBANDGAP_MBIAS_POWERUP                  0x10000
+#define BAD11SH_GAIN                            0xc0000
+#define BAD11NPUT_RANGE                         0x700000
+#define BAD110P_CURRENT                         0x3800000
+#define BLPATH_LOOPBACK                         0x4000000
+#define BQPATH_LOOPBACK                         0x8000000
+#define BAFE_LOOPBACK                           0x10000000
+#define BDA10_SWING                             0x7e0
+#define BDA10_REVERSE                           0x800
+#define BDA_CLK_SOURCE                          0x1000
+#define BDA7INPUT_RANGE                         0x6000
+#define BDA7_GAIN                               0x38000
+#define BDA7OUTPUT_CM_MODE                      0x40000
+#define BDA7INPUT_CM_MODE                       0x380000
+#define BDA7CURRENT                             0xc00000
+#define BREGULATOR_ADJUST                       0x7000000
+#define BAD11POWERUP_ATTX                       0x1
+#define BDA10PS_ATTX                            0x10
+#define BAD11POWERUP_ATRX                       0x100
+#define BDA10PS_ATRX                            0x1000
+#define BCCKRX_AGC_FORMAT                       0x200
+#define BPSDFFT_SAMPLE_POINT                    0xc000
+#define BPSD_AVERAGE_NUM                        0x3000
+#define BIQPATH_CONTROL                         0xc00
+#define BPSD_FREQ                               0x3ff
+#define BPSD_ANTENNA_PATH                       0x30
+#define BPSD_IQ_SWITCH                          0x40
+#define BPSD_RX_TRIGGER                         0x400000
+#define BPSD_TX_TRIGGERCW                       0x80000000
+#define BPSD_SINE_TONE_SCALE                    0x7f000000
+#define BPSD_REPORT                             0xffff
+
+#define BOFDM_TXSC                              0x30000000
+#define BCCK_TXON                               0x1
+#define BOFDM_TXON                              0x2
+#define BDEBUG_PAGE                             0xfff
+#define BDEBUG_ITEM                             0xff
+#define BANTL                                   0x10
+#define BANT_NONHT                              0x100
+#define BANT_HT1                                0x1000
+#define BANT_HT2                                0x10000
+#define BANT_HT1S1                              0x100000
+#define BANT_NONHTS1                            0x1000000
+
+#define BCCK_BBMODE                             0x3
+#define BCCK_TXPOWERSAVING                      0x80
+#define BCCK_RXPOWERSAVING                      0x40
+
+#define BCCK_SIDEBAND                           0x10
+
+#define BCCK_SCRAMBLE                           0x8
+#define BCCK_ANTDIVERSITY                       0x8000
+#define BCCK_CARRIER_RECOVERY                   0x4000
+#define BCCK_TXRATE                             0x3000
+#define BCCK_DCCANCEL                           0x0800
+#define BCCK_ISICANCEL                          0x0400
+#define BCCK_MATCH_FILTER                       0x0200
+#define BCCK_EQUALIZER                          0x0100
+#define BCCK_PREAMBLE_DETECT                    0x800000
+#define BCCK_FAST_FALSECCA                      0x400000
+#define BCCK_CH_ESTSTART                        0x300000
+#define BCCK_CCA_COUNT                          0x080000
+#define BCCK_CS_LIM                             0x070000
+#define BCCK_BIST_MODE                          0x80000000
+#define BCCK_CCAMASK                            0x40000000
+#define BCCK_TX_DAC_PHASE                       0x4
+#define BCCK_RX_ADC_PHASE                       0x20000000
+#define BCCKR_CP_MODE                           0x0100
+#define BCCK_TXDC_OFFSET                        0xf0
+#define BCCK_RXDC_OFFSET                        0xf
+#define BCCK_CCA_MODE                           0xc000
+#define BCCK_FALSECS_LIM                        0x3f00
+#define BCCK_CS_RATIO                           0xc00000
+#define BCCK_CORGBIT_SEL                        0x300000
+#define BCCK_PD_LIM                             0x0f0000
+#define BCCK_NEWCCA                             0x80000000
+#define BCCK_RXHP_OF_IG                         0x8000
+#define BCCK_RXIG                               0x7f00
+#define BCCK_LNA_POLARITY                       0x800000
+#define BCCK_RX1ST_BAIN                         0x7f0000
+#define BCCK_RF_EXTEND                          0x20000000
+#define BCCK_RXAGC_SATLEVEL                     0x1f000000
+#define BCCK_RXAGC_SATCOUNT                     0xe0
+#define BCCKRXRFSETTLE                          0x1f
+#define BCCK_FIXED_RXAGC                        0x8000
+#define BCCK_ANTENNA_POLARITY                   0x2000
+#define BCCK_TXFILTER_TYPE                      0x0c00
+#define BCCK_RXAGC_REPORTTYPE                   0x0300
+#define BCCK_RXDAGC_EN                          0x80000000
+#define BCCK_RXDAGC_PERIOD                      0x20000000
+#define BCCK_RXDAGC_SATLEVEL                    0x1f000000
+#define BCCK_TIMING_RECOVERY                    0x800000
+#define BCCK_TXC0                               0x3f0000
+#define BCCK_TXC1                               0x3f000000
+#define BCCK_TXC2                               0x3f
+#define BCCK_TXC3                               0x3f00
+#define BCCK_TXC4                               0x3f0000
+#define BCCK_TXC5                               0x3f000000
+#define BCCK_TXC6                               0x3f
+#define BCCK_TXC7                               0x3f00
+#define BCCK_DEBUGPORT                          0xff0000
+#define BCCK_DAC_DEBUG                          0x0f000000
+#define BCCK_FALSEALARM_ENABLE                  0x8000
+#define BCCK_FALSEALARM_READ                    0x4000
+#define BCCK_TRSSI                              0x7f
+#define BCCK_RXAGC_REPORT                       0xfe
+#define BCCK_RXREPORT_ANTSEL                    0x80000000
+#define BCCK_RXREPORT_MFOFF                     0x40000000
+#define BCCK_RXREPORT_SQLOSS                    0x20000000
+#define BCCK_RXREPORT_PKTLOSS                   0x10000000
+#define BCCK_RXREPORT_LOCKEDBIT                 0x08000000
+#define BCCK_RXREPORT_RATEERROR                 0x04000000
+#define BCCK_RXREPORT_RXRATE                    0x03000000
+#define BCCK_RXFA_COUNTER_LOWER                 0xff
+#define BCCK_RXFA_COUNTER_UPPER                 0xff000000
+#define BCCK_RXHPAGC_START                      0xe000
+#define BCCK_RXHPAGC_FINAL                      0x1c00
+#define BCCK_RXFALSEALARM_ENABLE                0x8000
+#define BCCK_FACOUNTER_FREEZE                   0x4000
+#define BCCK_TXPATH_SEL                         0x10000000
+#define BCCK_DEFAULT_RXPATH                     0xc000000
+#define BCCK_OPTION_RXPATH                      0x3000000
+
+#define BNUM_OFSTF                              0x3
+#define BSHIFT_L                                0xc0
+#define BGI_TH                                  0xc
+#define BRXPATH_A                               0x1
+#define BRXPATH_B                               0x2
+#define BRXPATH_C                               0x4
+#define BRXPATH_D                               0x8
+#define BTXPATH_A                               0x1
+#define BTXPATH_B                               0x2
+#define BTXPATH_C                               0x4
+#define BTXPATH_D                               0x8
+#define BTRSSI_FREQ                             0x200
+#define BADC_BACKOFF                            0x3000
+#define BDFIR_BACKOFF                           0xc000
+#define BTRSSI_LATCH_PHASE                      0x10000
+#define BRX_LDC_OFFSET                          0xff
+#define BRX_QDC_OFFSET                          0xff00
+#define BRX_DFIR_MODE                           0x1800000
+#define BRX_DCNF_TYPE                           0xe000000
+#define BRXIQIMB_A                              0x3ff
+#define BRXIQIMB_B                              0xfc00
+#define BRXIQIMB_C                              0x3f0000
+#define BRXIQIMB_D                              0xffc00000
+#define BDC_DC_NOTCH                            0x60000
+#define BRXNB_NOTCH                             0x1f000000
+#define BPD_TH                                  0xf
+#define BPD_TH_OPT2                             0xc000
+#define BPWED_TH                                0x700
+#define BIFMF_WIN_L                             0x800
+#define BPD_OPTION                              0x1000
+#define BMF_WIN_L                               0xe000
+#define BBW_SEARCH_L                            0x30000
+#define BWIN_ENH_L                              0xc0000
+#define BBW_TH                                  0x700000
+#define BED_TH2                                 0x3800000
+#define BBW_OPTION                              0x4000000
+#define BRADIO_TH                               0x18000000
+#define BWINDOW_L                               0xe0000000
+#define BSBD_OPTION                             0x1
+#define BFRAME_TH                               0x1c
+#define BFS_OPTION                              0x60
+#define BDC_SLOPE_CHECK                         0x80
+#define BFGUARD_COUNTER_DC_L                    0xe00
+#define BFRAME_WEIGHT_SHORT                     0x7000
+#define BSUB_TUNE                               0xe00000
+#define BFRAME_DC_LENGTH                        0xe000000
+#define BSBD_START_OFFSET                       0x30000000
+#define BFRAME_TH_2                             0x7
+#define BFRAME_GI2_TH                           0x38
+#define BGI2_SYNC_EN                            0x40
+#define BSARCH_SHORT_EARLY                      0x300
+#define BSARCH_SHORT_LATE                       0xc00
+#define BSARCH_GI2_LATE                         0x70000
+#define BCFOANTSUM                              0x1
+#define BCFOACC                                 0x2
+#define BCFOSTARTOFFSET                         0xc
+#define BCFOLOOPBACK                            0x70
+#define BCFOSUMWEIGHT                           0x80
+#define BDAGCENABLE                             0x10000
+#define BTXIQIMB_A                              0x3ff
+#define BTXIQIMB_B                              0xfc00
+#define BTXIQIMB_C                              0x3f0000
+#define BTXIQIMB_D                              0xffc00000
+#define BTXIDCOFFSET                            0xff
+#define BTXIQDCOFFSET                           0xff00
+#define BTXDFIRMODE                             0x10000
+#define BTXPESUDO_NOISEON                       0x4000000
+#define BTXPESUDO_NOISE_A                       0xff
+#define BTXPESUDO_NOISE_B                       0xff00
+#define BTXPESUDO_NOISE_C                       0xff0000
+#define BTXPESUDO_NOISE_D                       0xff000000
+#define BCCA_DROPOPTION                         0x20000
+#define BCCA_DROPTHRES                          0xfff00000
+#define BEDCCA_H                                0xf
+#define BEDCCA_L                                0xf0
+#define BLAMBDA_ED                              0x300
+#define BRX_INITIALGAIN                         0x7f
+#define BRX_ANTDIV_EN                           0x80
+#define BRX_AGC_ADDRESS_FOR_LNA                 0x7f00
+#define BRX_HIGHPOWER_FLOW                      0x8000
+#define BRX_AGC_FREEZE_THRES                    0xc0000
+#define BRX_FREEZESTEP_AGC1                     0x300000
+#define BRX_FREEZESTEP_AGC2                     0xc00000
+#define BRX_FREEZESTEP_AGC3                     0x3000000
+#define BRX_FREEZESTEP_AGC0                     0xc000000
+#define BRXRSSI_CMP_EN                          0x10000000
+#define BRXQUICK_AGCEN                          0x20000000
+#define BRXAGC_FREEZE_THRES_MODE                0x40000000
+#define BRX_OVERFLOW_CHECKTYPE                  0x80000000
+#define BRX_AGCSHIFT                            0x7f
+#define BTRSW_TRI_ONLY                          0x80
+#define BPOWER_THRES                            0x300
+#define BRXAGC_EN                               0x1
+#define BRXAGC_TOGETHER_EN                      0x2
+#define BRXAGC_MIN                              0x4
+#define BRXHP_INI                               0x7
+#define BRXHP_TRLNA                             0x70
+#define BRXHP_RSSI                              0x700
+#define BRXHP_BBP1                              0x7000
+#define BRXHP_BBP2                              0x70000
+#define BRXHP_BBP3                              0x700000
+#define BRSSI_H                                 0x7f0000
+#define BRSSI_GEN                               0x7f000000
+#define BRXSETTLE_TRSW                          0x7
+#define BRXSETTLE_LNA                           0x38
+#define BRXSETTLE_RSSI                          0x1c0
+#define BRXSETTLE_BBP                           0xe00
+#define BRXSETTLE_RXHP                          0x7000
+#define BRXSETTLE_ANTSW_RSSI                    0x38000
+#define BRXSETTLE_ANTSW                         0xc0000
+#define BRXPROCESS_TIME_DAGC                    0x300000
+#define BRXSETTLE_HSSI                          0x400000
+#define BRXPROCESS_TIME_BBPPW                   0x800000
+#define BRXANTENNA_POWER_SHIFT                  0x3000000
+#define BRSSI_TABLE_SELECT                      0xc000000
+#define BRXHP_FINAL                             0x7000000
+#define BRXHPSETTLE_BBP                         0x7
+#define BRXHTSETTLE_HSSI                        0x8
+#define BRXHTSETTLE_RXHP                        0x70
+#define BRXHTSETTLE_BBPPW                       0x80
+#define BRXHTSETTLE_IDLE                        0x300
+#define BRXHTSETTLE_RESERVED                    0x1c00
+#define BRXHT_RXHP_EN                           0x8000
+#define BRXAGC_FREEZE_THRES                     0x30000
+#define BRXAGC_TOGETHEREN                       0x40000
+#define BRXHTAGC_MIN                            0x80000
+#define BRXHTAGC_EN                             0x100000
+#define BRXHTDAGC_EN                            0x200000
+#define BRXHT_RXHP_BBP                          0x1c00000
+#define BRXHT_RXHP_FINAL                        0xe0000000
+#define BRXPW_RADIO_TH                          0x3
+#define BRXPW_RADIO_EN                          0x4
+#define BRXMF_HOLD                              0x3800
+#define BRXPD_DELAY_TH1                         0x38
+#define BRXPD_DELAY_TH2                         0x1c0
+#define BRXPD_DC_COUNT_MAX                      0x600
+#define BRXPD_DELAY_TH                          0x8000
+#define BRXPROCESS_DELAY                        0xf0000
+#define BRXSEARCHRANGE_GI2_EARLY                0x700000
+#define BRXFRAME_FUARD_COUNTER_L                0x3800000
+#define BRXSGI_GUARD_L                          0xc000000
+#define BRXSGI_SEARCH_L                         0x30000000
+#define BRXSGI_TH                               0xc0000000
+#define BDFSCNT0                                0xff
+#define BDFSCNT1                                0xff00
+#define BDFSFLAG                                0xf0000
+#define BMF_WEIGHT_SUM                          0x300000
+#define BMINIDX_TH                              0x7f000000
+#define BDAFORMAT                               0x40000
+#define BTXCH_EMU_ENABLE                        0x01000000
+#define BTRSW_ISOLATION_A                       0x7f
+#define BTRSW_ISOLATION_B                       0x7f00
+#define BTRSW_ISOLATION_C                       0x7f0000
+#define BTRSW_ISOLATION_D                       0x7f000000
+#define BEXT_LNA_GAIN                           0x7c00
+
+#define BSTBC_EN                                0x4
+#define BANTENNA_MAPPING                        0x10
+#define BNSS                                    0x20
+#define BCFO_ANTSUM_ID                          0x200
+#define BPHY_COUNTER_RESET                      0x8000000
+#define BCFO_REPORT_GET                         0x4000000
+#define BOFDM_CONTINUE_TX                       0x10000000
+#define BOFDM_SINGLE_CARRIER                    0x20000000
+#define BOFDM_SINGLE_TONE                       0x40000000
+#define BHT_DETECT                              0x100
+#define BCFOEN                                  0x10000
+#define BCFOVALUE                               0xfff00000
+#define BSIGTONE_RE                             0x3f
+#define BSIGTONE_IM                             0x7f00
+#define BCOUNTER_CCA                            0xffff
+#define BCOUNTER_PARITYFAIL                     0xffff0000
+#define BCOUNTER_RATEILLEGAL                    0xffff
+#define BCOUNTER_CRC8FAIL                       0xffff0000
+#define BCOUNTER_MCSNOSUPPORT                   0xffff
+#define BCOUNTER_FASTSYNC                       0xffff
+#define BSHORTCFO                               0xfff
+#define BSHORTCFOT_LENGTH                       12
+#define BSHORTCFOF_LENGTH                       11
+#define BLONGCFO                                0x7ff
+#define BLONGCFOT_LENGTH                        11
+#define BLONGCFOF_LENGTH                        11
+#define BTAILCFO                                0x1fff
+#define BTAILCFOT_LENGTH                        13
+#define BTAILCFOF_LENGTH                        12
+#define BNOISE_EN_PWDB                          0xffff
+#define BCC_POWER_DB                            0xffff0000
+#define BMOISE_PWDB                             0xffff
+#define BPOWERMEAST_LENGTH                      10
+#define BPOWERMEASF_LENGTH                      3
+#define BRX_HT_BW                               0x1
+#define BRXSC                                   0x6
+#define BRX_HT                                  0x8
+#define BNB_INTF_DET_ON                         0x1
+#define BINTF_WIN_LEN_CFG                       0x30
+#define BNB_INTF_TH_CFG                         0x1c0
+#define BRFGAIN                                 0x3f
+#define BTABLESEL                               0x40
+#define BTRSW                                   0x80
+#define BRXSNR_A                                0xff
+#define BRXSNR_B                                0xff00
+#define BRXSNR_C                                0xff0000
+#define BRXSNR_D                                0xff000000
+#define BSNR_EVMT_LENGTH                        8
+#define BSNR_EVMF_LENGTH                        1
+#define BCSI1ST                                 0xff
+#define BCSI2ND                                 0xff00
+#define BRXEVM1ST                               0xff0000
+#define BRXEVM2ND                               0xff000000
+#define BSIGEVM                                 0xff
+#define BPWDB                                   0xff00
+#define BSGIEN                                  0x10000
+
+#define BSFACTOR_QMA1                           0xf
+#define BSFACTOR_QMA2                           0xf0
+#define BSFACTOR_QMA3                           0xf00
+#define BSFACTOR_QMA4                           0xf000
+#define BSFACTOR_QMA5                           0xf0000
+#define BSFACTOR_QMA6                           0xf0000
+#define BSFACTOR_QMA7                           0xf00000
+#define BSFACTOR_QMA8                           0xf000000
+#define BSFACTOR_QMA9                           0xf0000000
+#define BCSI_SCHEME                             0x100000
+
+#define BNOISE_LVL_TOP_SET                      0x3
+#define BCHSMOOTH                               0x4
+#define BCHSMOOTH_CFG1                          0x38
+#define BCHSMOOTH_CFG2                          0x1c0
+#define BCHSMOOTH_CFG3                          0xe00
+#define BCHSMOOTH_CFG4                          0x7000
+#define BMRCMODE                                0x800000
+#define BTHEVMCFG                               0x7000000
+
+#define BLOOP_FIT_TYPE                          0x1
+#define BUPD_CFO                                0x40
+#define BUPD_CFO_OFFDATA                        0x80
+#define BADV_UPD_CFO                            0x100
+#define BADV_TIME_CTRL                          0x800
+#define BUPD_CLKO                               0x1000
+#define BFC                                     0x6000
+#define BTRACKING_MODE                          0x8000
+#define BPHCMP_ENABLE                           0x10000
+#define BUPD_CLKO_LTF                           0x20000
+#define BCOM_CH_CFO                             0x40000
+#define BCSI_ESTI_MODE                          0x80000
+#define BADV_UPD_EQZ                            0x100000
+#define BUCHCFG                                 0x7000000
+#define BUPDEQZ                                 0x8000000
+
+#define BRX_PESUDO_NOISE_ON                     0x20000000
+#define BRX_PESUDO_NOISE_A                      0xff
+#define BRX_PESUDO_NOISE_B                      0xff00
+#define BRX_PESUDO_NOISE_C                      0xff0000
+#define BRX_PESUDO_NOISE_D                      0xff000000
+#define BRX_PESUDO_NOISESTATE_A                 0xffff
+#define BRX_PESUDO_NOISESTATE_B                 0xffff0000
+#define BRX_PESUDO_NOISESTATE_C                 0xffff
+#define BRX_PESUDO_NOISESTATE_D                 0xffff0000
+
+#define BZEBRA1_HSSIENABLE                      0x8
+#define BZEBRA1_TRXCONTROL                      0xc00
+#define BZEBRA1_TRXGAINSETTING                  0x07f
+#define BZEBRA1_RXCOUNTER                       0xc00
+#define BZEBRA1_TXCHANGEPUMP                    0x38
+#define BZEBRA1_RXCHANGEPUMP                    0x7
+#define BZEBRA1_CHANNEL_NUM                     0xf80
+#define BZEBRA1_TXLPFBW                         0x400
+#define BZEBRA1_RXLPFBW                         0x600
+
+#define BRTL8256REG_MODE_CTRL1                  0x100
+#define BRTL8256REG_MODE_CTRL0                  0x40
+#define BRTL8256REG_TXLPFBW                     0x18
+#define BRTL8256REG_RXLPFBW                     0x600
+
+#define BRTL8258_TXLPFBW                        0xc
+#define BRTL8258_RXLPFBW                        0xc00
+#define BRTL8258_RSSILPFBW                      0xc0
+
+#define BBYTE0                                  0x1
+#define BBYTE1                                  0x2
+#define BBYTE2                                  0x4
+#define BBYTE3                                  0x8
+#define BWORD0                                  0x3
+#define BWORD1                                  0xc
+#define BWORD                                   0xf
+
+#define MASKBYTE0                               0xff
+#define MASKBYTE1                               0xff00
+#define MASKBYTE2                               0xff0000
+#define MASKBYTE3                               0xff000000
+#define MASKHWORD                               0xffff0000
+#define MASKLWORD                               0x0000ffff
+#define MASKDWORD                               0xffffffff
+#define MASK12BITS                              0xfff
+#define MASKH4BITS                              0xf0000000
+#define MASKOFDM_D                              0xffc00000
+#define MASKCCK                                 0x3f3f3f3f
+
+#define MASK4BITS                               0x0f
+#define MASK20BITS                              0xfffff
+#define RFREG_OFFSET_MASK                       0xfffff
+
+#define BENABLE                                 0x1
+#define BDISABLE                                0x0
+
+#define LEFT_ANTENNA                            0x0
+#define RIGHT_ANTENNA                           0x1
+
+#define TCHECK_TXSTATUS                         500
+#define TUPDATE_RXCOUNTER                       100
+
+#define REG_UN_USED_REGISTER                    0x01bf
+
+/* WOL bit information */
+#define HAL92C_WOL_PTK_UPDATE_EVENT             BIT(0)
+#define HAL92C_WOL_GTK_UPDATE_EVENT             BIT(1)
+#define HAL92C_WOL_DISASSOC_EVENT               BIT(2)
+#define HAL92C_WOL_DEAUTH_EVENT                 BIT(3)
+#define HAL92C_WOL_FW_DISCONNECT_EVENT          BIT(4)
+
+#define         WOL_REASON_PTK_UPDATE           BIT(0)
+#define         WOL_REASON_GTK_UPDATE           BIT(1)
+#define         WOL_REASON_DISASSOC             BIT(2)
+#define         WOL_REASON_DEAUTH               BIT(3)
+#define         WOL_REASON_FW_DISCONNECT        BIT(4)
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/rf.c b/drivers/net/wireless/rtlwifi/rtl8188ee/rf.c
new file mode 100644
index 000000000000..4faafdbab9c6
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/rf.c
@@ -0,0 +1,467 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "../wifi.h"
+#include "reg.h"
+#include "def.h"
+#include "phy.h"
+#include "rf.h"
+#include "dm.h"
+
+void rtl88e_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw, u8 bandwidth)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+
+        switch (bandwidth) {
+        case HT_CHANNEL_WIDTH_20:
+                rtlphy->rfreg_chnlval[0] = ((rtlphy->rfreg_chnlval[0] &
+                                             0xfffff3ff) | BIT(10) | BIT(11));
+                rtl_set_rfreg(hw, RF90_PATH_A, RF_CHNLBW, RFREG_OFFSET_MASK,
+                              rtlphy->rfreg_chnlval[0]);
+                break;
+        case HT_CHANNEL_WIDTH_20_40:
+                rtlphy->rfreg_chnlval[0] = ((rtlphy->rfreg_chnlval[0] &
+                                             0xfffff3ff) | BIT(10));
+                rtl_set_rfreg(hw, RF90_PATH_A, RF_CHNLBW, RFREG_OFFSET_MASK,
+                              rtlphy->rfreg_chnlval[0]);
+                break;
+        default:
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "unknown bandwidth: %#X\n", bandwidth);
+                break;
+        }
+}
+
+void rtl88e_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+                                       u8 *plevel)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        u32 tx_agc[2] = {0, 0}, tmpval;
+        bool turbo_scanoff = false;
+        u8 idx1, idx2;
+        u8 *ptr;
+        u8 direction;
+        u32 pwrtrac_value;
+
+        if (rtlefuse->eeprom_regulatory != 0)
+                turbo_scanoff = true;
+
+        if (mac->act_scanning == true) {
+                tx_agc[RF90_PATH_A] = 0x3f3f3f3f;
+                tx_agc[RF90_PATH_B] = 0x3f3f3f3f;
+
+                if (turbo_scanoff) {
+                        for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+                                tx_agc[idx1] = plevel[idx1] |
+                                               (plevel[idx1] << 8) |
+                                               (plevel[idx1] << 16) |
+                                               (plevel[idx1] << 24);
+                        }
+                }
+        } else {
+                for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+                        tx_agc[idx1] = plevel[idx1] | (plevel[idx1] << 8) |
+                                       (plevel[idx1] << 16) |
+                                       (plevel[idx1] << 24);
+                }
+
+                if (rtlefuse->eeprom_regulatory == 0) {
+                        tmpval = (rtlphy->mcs_offset[0][6]) +
+                                 (rtlphy->mcs_offset[0][7] << 8);
+                        tx_agc[RF90_PATH_A] += tmpval;
+
+                        tmpval = (rtlphy->mcs_offset[0][14]) +
+                                 (rtlphy->mcs_offset[0][15] << 24);
+                        tx_agc[RF90_PATH_B] += tmpval;
+                }
+        }
+
+        for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+                ptr = (u8 *)(&(tx_agc[idx1]));
+                for (idx2 = 0; idx2 < 4; idx2++) {
+                        if (*ptr > RF6052_MAX_TX_PWR)
+                                *ptr = RF6052_MAX_TX_PWR;
+                        ptr++;
+                }
+        }
+        rtl88e_dm_txpower_track_adjust(hw, 1, &direction, &pwrtrac_value);
+        if (direction == 1) {
+                tx_agc[0] += pwrtrac_value;
+                tx_agc[1] += pwrtrac_value;
+        } else if (direction == 2) {
+                tx_agc[0] -= pwrtrac_value;
+                tx_agc[1] -= pwrtrac_value;
+        }
+        tmpval = tx_agc[RF90_PATH_A] & 0xff;
+        rtl_set_bbreg(hw, RTXAGC_A_CCK1_MCS32, MASKBYTE1, tmpval);
+
+        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                "CCK PWR 1M (rf-A) = 0x%x (reg 0x%x)\n", tmpval,
+                RTXAGC_A_CCK1_MCS32);
+
+        tmpval = tx_agc[RF90_PATH_A] >> 8;
+
+        rtl_set_bbreg(hw, RTXAGC_B_CCK11_A_CCK2_11, 0xffffff00, tmpval);
+
+        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                "CCK PWR 2~11M (rf-A) = 0x%x (reg 0x%x)\n", tmpval,
+                 RTXAGC_B_CCK11_A_CCK2_11);
+
+        tmpval = tx_agc[RF90_PATH_B] >> 24;
+        rtl_set_bbreg(hw, RTXAGC_B_CCK11_A_CCK2_11, MASKBYTE0, tmpval);
+
+        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                "CCK PWR 11M (rf-B) = 0x%x (reg 0x%x)\n", tmpval,
+                 RTXAGC_B_CCK11_A_CCK2_11);
+
+        tmpval = tx_agc[RF90_PATH_B] & 0x00ffffff;
+        rtl_set_bbreg(hw, RTXAGC_B_CCK1_55_MCS32, 0xffffff00, tmpval);
+
+        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                "CCK PWR 1~5.5M (rf-B) = 0x%x (reg 0x%x)\n", tmpval,
+                 RTXAGC_B_CCK1_55_MCS32);
+}
+
+static void rtl88e_phy_get_power_base(struct ieee80211_hw *hw,
+                                      u8 *pwrlvlofdm, u8 *pwrlvlbw20,
+                                      u8 *pwrlvlbw40, u8 channel,
+                                      u32 *ofdmbase, u32 *mcsbase)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        u32 base0, base1;
+        u8 i, powerlevel[2];
+
+        for (i = 0; i < 2; i++) {
+                base0 = pwrlvlofdm[i];
+
+                base0 = (base0 << 24) | (base0 << 16) |
+                             (base0 << 8) | base0;
+                *(ofdmbase + i) = base0;
+                RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                        "[OFDM power base index rf(%c) = 0x%x]\n",
+                        ((i == 0) ? 'A' : 'B'), *(ofdmbase + i));
+        }
+
+        for (i = 0; i < 2; i++) {
+                if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20)
+                        powerlevel[i] = pwrlvlbw20[i];
+                else
+                        powerlevel[i] = pwrlvlbw40[i];
+                base1 = powerlevel[i];
+                base1 = (base1 << 24) |
+                    (base1 << 16) | (base1 << 8) | base1;
+
+                *(mcsbase + i) = base1;
+
+                RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                        "[MCS power base index rf(%c) = 0x%x]\n",
+                        ((i == 0) ? 'A' : 'B'), *(mcsbase + i));
+        }
+}
+
+static void get_txpwr_by_reg(struct ieee80211_hw *hw, u8 chan, u8 index,
+                             u32 *base0, u32 *base1, u32 *outval)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        u8 i, chg = 0, pwr_lim[4], pwr_diff = 0, cust_pwr_dif;
+        u32 writeval, cust_lim, rf, tmp;
+        u8 ch = chan - 1;
+        u8 j;
+
+        for (rf = 0; rf < 2; rf++) {
+                j = index + (rf ? 8 : 0);
+                tmp = ((index < 2) ? base0[rf] : base1[rf]);
+                switch (rtlefuse->eeprom_regulatory) {
+                case 0:
+                        chg = 0;
+
+                        writeval = rtlphy->mcs_offset[chg][j] + tmp;
+
+                        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                                "RTK better performance, "
+                                "writeval(%c) = 0x%x\n",
+                                ((rf == 0) ? 'A' : 'B'), writeval);
+                        break;
+                case 1:
+                        if (rtlphy->pwrgroup_cnt == 1) {
+                                chg = 0;
+                        } else {
+                                chg = chan / 3;
+                                if (chan == 14)
+                                        chg = 5;
+                        }
+                        writeval = rtlphy->mcs_offset[chg][j] + tmp;
+
+                        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                                "Realtek regulatory, 20MHz, writeval(%c) = 0x%x\n",
+                                 ((rf == 0) ? 'A' : 'B'), writeval);
+                        break;
+                case 2:
+                        writeval = ((index < 2) ? base0[rf] : base1[rf]);
+
+                        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                                "Better regulatory, writeval(%c) = 0x%x\n",
+                                 ((rf == 0) ? 'A' : 'B'), writeval);
+                        break;
+                case 3:
+                        chg = 0;
+
+                        if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20_40) {
+                                RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                                        "customer's limit, 40MHz rf(%c) = 0x%x\n",
+                                         ((rf == 0) ? 'A' : 'B'),
+                                         rtlefuse->pwrgroup_ht40[rf][ch]);
+                        } else {
+                                RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                                        "customer's limit, 20MHz rf(%c) = 0x%x\n",
+                                         ((rf == 0) ? 'A' : 'B'),
+                                         rtlefuse->pwrgroup_ht20[rf][ch]);
+                        }
+
+                        if (index < 2)
+                                pwr_diff = rtlefuse->txpwr_legacyhtdiff[rf][ch];
+                        else if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20)
+                                pwr_diff = rtlefuse->txpwr_ht20diff[rf][ch];
+
+                        if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20_40)
+                                cust_pwr_dif = rtlefuse->pwrgroup_ht40[rf][ch];
+                        else
+                                cust_pwr_dif = rtlefuse->pwrgroup_ht20[rf][ch];
+
+                        if (pwr_diff > cust_pwr_dif)
+                                pwr_diff = 0;
+                        else
+                                pwr_diff = cust_pwr_dif - pwr_diff;
+
+                        for (i = 0; i < 4; i++) {
+                                pwr_lim[i] = (u8)((rtlphy->mcs_offset[chg][j] &
+                                             (0x7f << (i * 8))) >> (i * 8));
+
+                                if (pwr_lim[i] > pwr_diff)
+                                        pwr_lim[i] = pwr_diff;
+                        }
+
+                        cust_lim = (pwr_lim[3] << 24) | (pwr_lim[2] << 16) |
+                                   (pwr_lim[1] << 8) | (pwr_lim[0]);
+
+                        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                                "Customer's limit rf(%c) = 0x%x\n",
+                                ((rf == 0) ? 'A' : 'B'), cust_lim);
+
+                        writeval = cust_lim + tmp;
+
+                        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                                "Customer, writeval rf(%c) = 0x%x\n",
+                                ((rf == 0) ? 'A' : 'B'), writeval);
+                        break;
+                default:
+                        chg = 0;
+                        writeval = rtlphy->mcs_offset[chg][j] + tmp;
+
+                        RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                                "RTK better performance, writeval "
+                                "rf(%c) = 0x%x\n",
+                                ((rf == 0) ? 'A' : 'B'), writeval);
+                        break;
+                }
+
+                if (rtlpriv->dm.dynamic_txhighpower_lvl == TXHIGHPWRLEVEL_BT1)
+                        writeval = writeval - 0x06060606;
+                else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+                         TXHIGHPWRLEVEL_BT2)
+                        writeval -= 0x0c0c0c0c;
+                *(outval + rf) = writeval;
+        }
+}
+
+static void write_ofdm_pwr(struct ieee80211_hw *hw, u8 index, u32 *pvalue)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u16 regoffset_a[6] = {
+                RTXAGC_A_RATE18_06, RTXAGC_A_RATE54_24,
+                RTXAGC_A_MCS03_MCS00, RTXAGC_A_MCS07_MCS04,
+                RTXAGC_A_MCS11_MCS08, RTXAGC_A_MCS15_MCS12
+        };
+        u16 regoffset_b[6] = {
+                RTXAGC_B_RATE18_06, RTXAGC_B_RATE54_24,
+                RTXAGC_B_MCS03_MCS00, RTXAGC_B_MCS07_MCS04,
+                RTXAGC_B_MCS11_MCS08, RTXAGC_B_MCS15_MCS12
+        };
+        u8 i, rf, pwr_val[4];
+        u32 writeval;
+        u16 regoffset;
+
+        for (rf = 0; rf < 2; rf++) {
+                writeval = pvalue[rf];
+                for (i = 0; i < 4; i++) {
+                        pwr_val[i] = (u8) ((writeval & (0x7f <<
+                                     (i * 8))) >> (i * 8));
+
+                        if (pwr_val[i] > RF6052_MAX_TX_PWR)
+                                pwr_val[i] = RF6052_MAX_TX_PWR;
+                }
+                writeval = (pwr_val[3] << 24) | (pwr_val[2] << 16) |
+                           (pwr_val[1] << 8) | pwr_val[0];
+
+                if (rf == 0)
+                        regoffset = regoffset_a[index];
+                else
+                        regoffset = regoffset_b[index];
+                rtl_set_bbreg(hw, regoffset, MASKDWORD, writeval);
+
+                RTPRINT(rtlpriv, FPHY, PHY_TXPWR,
+                        "Set 0x%x = %08x\n", regoffset, writeval);
+        }
+}
+
+void rtl88e_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
+                                        u8 *pwrlvlofdm,
+                                        u8 *pwrlvlbw20,
+                                        u8 *pwrlvlbw40, u8 chan)
+{
+        u32 writeval[2], base0[2], base1[2];
+        u8 index;
+        u8 direction;
+        u32 pwrtrac_value;
+
+        rtl88e_phy_get_power_base(hw, pwrlvlofdm, pwrlvlbw20,
+                                  pwrlvlbw40, chan, &base0[0],
+                                  &base1[0]);
+
+        rtl88e_dm_txpower_track_adjust(hw, 1, &direction, &pwrtrac_value);
+
+        for (index = 0; index < 6; index++) {
+                get_txpwr_by_reg(hw, chan, index, &base0[0], &base1[0],
+                                 &writeval[0]);
+                if (direction == 1) {
+                        writeval[0] += pwrtrac_value;
+                        writeval[1] += pwrtrac_value;
+                } else if (direction == 2) {
+                        writeval[0] -= pwrtrac_value;
+                        writeval[1] -= pwrtrac_value;
+                }
+                write_ofdm_pwr(hw, index, &writeval[0]);
+        }
+}
+
+static bool rf6052_conf_para(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        u32 u4val = 0;
+        u8 rfpath;
+        bool rtstatus = true;
+        struct bb_reg_def *pphyreg;
+
+        for (rfpath = 0; rfpath < rtlphy->num_total_rfpath; rfpath++) {
+                pphyreg = &rtlphy->phyreg_def[rfpath];
+
+                switch (rfpath) {
+                case RF90_PATH_A:
+                case RF90_PATH_C:
+                        u4val = rtl_get_bbreg(hw, pphyreg->rfintfs,
+                                                    BRFSI_RFENV);
+                        break;
+                case RF90_PATH_B:
+                case RF90_PATH_D:
+                        u4val = rtl_get_bbreg(hw, pphyreg->rfintfs,
+                                                    BRFSI_RFENV << 16);
+                        break;
+                }
+
+                rtl_set_bbreg(hw, pphyreg->rfintfe, BRFSI_RFENV << 16, 0x1);
+                udelay(1);
+
+                rtl_set_bbreg(hw, pphyreg->rfintfo, BRFSI_RFENV, 0x1);
+                udelay(1);
+
+                rtl_set_bbreg(hw, pphyreg->rfhssi_para2,
+                              B3WIREADDREAALENGTH, 0x0);
+                udelay(1);
+
+                rtl_set_bbreg(hw, pphyreg->rfhssi_para2, B3WIREDATALENGTH, 0x0);
+                udelay(1);
+
+                switch (rfpath) {
+                case RF90_PATH_A:
+                        rtstatus = rtl88e_phy_config_rf_with_headerfile(hw,
+                                        (enum radio_path)rfpath);
+                        break;
+                case RF90_PATH_B:
+                        rtstatus = rtl88e_phy_config_rf_with_headerfile(hw,
+                                        (enum radio_path)rfpath);
+                        break;
+                case RF90_PATH_C:
+                        break;
+                case RF90_PATH_D:
+                        break;
+                }
+
+                switch (rfpath) {
+                case RF90_PATH_A:
+                case RF90_PATH_C:
+                        rtl_set_bbreg(hw, pphyreg->rfintfs, BRFSI_RFENV, u4val);
+                        break;
+                case RF90_PATH_B:
+                case RF90_PATH_D:
+                        rtl_set_bbreg(hw, pphyreg->rfintfs, BRFSI_RFENV << 16,
+                                      u4val);
+                        break;
+                }
+
+                if (rtstatus != true) {
+                        RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                                 "Radio[%d] Fail!!", rfpath);
+                        return false;
+                }
+        }
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "\n");
+        return rtstatus;
+}
+
+bool rtl88e_phy_rf6052_config(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+
+        if (rtlphy->rf_type == RF_1T1R)
+                rtlphy->num_total_rfpath = 1;
+        else
+                rtlphy->num_total_rfpath = 2;
+
+        return rf6052_conf_para(hw);
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/rf.h b/drivers/net/wireless/rtlwifi/rtl8188ee/rf.h
new file mode 100644
index 000000000000..a39a2a3dbcc9
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/rf.h
@@ -0,0 +1,46 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92C_RF_H__
+#define __RTL92C_RF_H__
+
+#define RF6052_MAX_TX_PWR               0x3F
+#define RF6052_MAX_REG                  0x3F
+
+void rtl88e_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw,
+                                     u8 bandwidth);
+void rtl88e_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+                                       u8 *ppowerlevel);
+void rtl88e_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
+                                        u8 *ppowerlevel_ofdm,
+                                        u8 *ppowerlevel_bw20,
+                                        u8 *ppowerlevel_bw40, u8 channel);
+bool rtl88e_phy_rf6052_config(struct ieee80211_hw *hw);
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
new file mode 100644
index 000000000000..c254693a1e6a
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
@@ -0,0 +1,400 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "../wifi.h"
+#include "../core.h"
+#include "../pci.h"
+#include "reg.h"
+#include "def.h"
+#include "phy.h"
+#include "dm.h"
+#include "hw.h"
+#include "sw.h"
+#include "trx.h"
+#include "led.h"
+#include "table.h"
+
+#include <linux/vmalloc.h>
+#include <linux/module.h>
+
+static void rtl88e_init_aspm_vars(struct ieee80211_hw *hw)
+{
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+        /*close ASPM for AMD defaultly */
+        rtlpci->const_amdpci_aspm = 0;
+
+        /* ASPM PS mode.
+         * 0 - Disable ASPM,
+         * 1 - Enable ASPM without Clock Req,
+         * 2 - Enable ASPM with Clock Req,
+         * 3 - Alwyas Enable ASPM with Clock Req,
+         * 4 - Always Enable ASPM without Clock Req.
+         * set defult to RTL8192CE:3 RTL8192E:2
+         */
+        rtlpci->const_pci_aspm = 3;
+
+        /*Setting for PCI-E device */
+        rtlpci->const_devicepci_aspm_setting = 0x03;
+
+        /*Setting for PCI-E bridge */
+        rtlpci->const_hostpci_aspm_setting = 0x02;
+
+        /* In Hw/Sw Radio Off situation.
+         * 0 - Default,
+         * 1 - From ASPM setting without low Mac Pwr,
+         * 2 - From ASPM setting with low Mac Pwr,
+         * 3 - Bus D3
+         * set default to RTL8192CE:0 RTL8192SE:2
+         */
+        rtlpci->const_hwsw_rfoff_d3 = 0;
+
+        /* This setting works for those device with
+         * backdoor ASPM setting such as EPHY setting.
+         * 0 - Not support ASPM,
+         * 1 - Support ASPM,
+         * 2 - According to chipset.
+         */
+        rtlpci->const_support_pciaspm = 1;
+}
+
+int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
+{
+        int err = 0;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        u8 tid;
+
+        rtl8188ee_bt_reg_init(hw);
+
+        rtlpriv->dm.dm_initialgain_enable = 1;
+        rtlpriv->dm.dm_flag = 0;
+        rtlpriv->dm.disable_framebursting = 0;
+        rtlpriv->dm.thermalvalue = 0;
+        rtlpci->transmit_config = CFENDFORM | BIT(15);
+
+        /* compatible 5G band 88ce just 2.4G band & smsp */
+        rtlpriv->rtlhal.current_bandtype = BAND_ON_2_4G;
+        rtlpriv->rtlhal.bandset = BAND_ON_2_4G;
+        rtlpriv->rtlhal.macphymode = SINGLEMAC_SINGLEPHY;
+
+        rtlpci->receive_config = (RCR_APPFCS |
+                                  RCR_APP_MIC |
+                                  RCR_APP_ICV |
+                                  RCR_APP_PHYST_RXFF |
+                                  RCR_HTC_LOC_CTRL |
+                                  RCR_AMF |
+                                  RCR_ACF |
+                                  RCR_ADF |
+                                  RCR_AICV |
+                                  RCR_ACRC32 |
+                                  RCR_AB |
+                                  RCR_AM |
+                                  RCR_APM |
+                                  0);
+
+        rtlpci->irq_mask[0] =
+                                (u32) (IMR_PSTIMEOUT    |
+                                IMR_HSISR_IND_ON_INT    |
+                                IMR_C2HCMD              |
+                                IMR_HIGHDOK             |
+                                IMR_MGNTDOK             |
+                                IMR_BKDOK               |
+                                IMR_BEDOK               |
+                                IMR_VIDOK               |
+                                IMR_VODOK               |
+                                IMR_RDU                 |
+                                IMR_ROK                 |
+                                0);
+        rtlpci->irq_mask[1] = (u32) (IMR_RXFOVW | 0);
+        rtlpci->sys_irq_mask = (u32) (HSIMR_PDN_INT_EN | HSIMR_RON_INT_EN);
+
+        /* for debug level */
+        rtlpriv->dbg.global_debuglevel = rtlpriv->cfg->mod_params->debug;
+        /* for LPS & IPS */
+        rtlpriv->psc.inactiveps = rtlpriv->cfg->mod_params->inactiveps;
+        rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
+        rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
+        if (!rtlpriv->psc.inactiveps)
+                pr_info("rtl8188ee: Power Save off (module option)\n");
+        if (!rtlpriv->psc.fwctrl_lps)
+                pr_info("rtl8188ee: FW Power Save off (module option)\n");
+        rtlpriv->psc.reg_fwctrl_lps = 3;
+        rtlpriv->psc.reg_max_lps_awakeintvl = 5;
+        /* for ASPM, you can close aspm through
+         * set const_support_pciaspm = 0
+         */
+        rtl88e_init_aspm_vars(hw);
+
+        if (rtlpriv->psc.reg_fwctrl_lps == 1)
+                rtlpriv->psc.fwctrl_psmode = FW_PS_MIN_MODE;
+        else if (rtlpriv->psc.reg_fwctrl_lps == 2)
+                rtlpriv->psc.fwctrl_psmode = FW_PS_MAX_MODE;
+        else if (rtlpriv->psc.reg_fwctrl_lps == 3)
+                rtlpriv->psc.fwctrl_psmode = FW_PS_DTIM_MODE;
+
+        /* for firmware buf */
+        rtlpriv->rtlhal.pfirmware = vmalloc(0x8000);
+        if (!rtlpriv->rtlhal.pfirmware) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Can't alloc buffer for fw.\n");
+                return 1;
+        }
+
+        rtlpriv->cfg->fw_name = "rtlwifi/rtl8188efw.bin";
+        rtlpriv->max_fw_size = 0x8000;
+        pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
+        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
+                                      rtlpriv->io.dev, GFP_KERNEL, hw,
+                                      rtl_fw_cb);
+        if (err) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Failed to request firmware!\n");
+                return 1;
+        }
+
+        /* for early mode */
+        rtlpriv->rtlhal.earlymode_enable = false;
+        rtlpriv->rtlhal.max_earlymode_num = 10;
+        for (tid = 0; tid < 8; tid++)
+                skb_queue_head_init(&rtlpriv->mac80211.skb_waitq[tid]);
+
+        /*low power */
+        rtlpriv->psc.low_power_enable = false;
+        if (rtlpriv->psc.low_power_enable) {
+                init_timer(&rtlpriv->works.fw_clockoff_timer);
+                setup_timer(&rtlpriv->works.fw_clockoff_timer,
+                            rtl88ee_fw_clk_off_timer_callback,
+                            (unsigned long)hw);
+        }
+
+        init_timer(&rtlpriv->works.fast_antenna_training_timer);
+        setup_timer(&rtlpriv->works.fast_antenna_training_timer,
+                    rtl88e_dm_fast_antenna_training_callback,
+                    (unsigned long)hw);
+        return err;
+}
+
+void rtl88e_deinit_sw_vars(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        if (rtlpriv->rtlhal.pfirmware) {
+                vfree(rtlpriv->rtlhal.pfirmware);
+                rtlpriv->rtlhal.pfirmware = NULL;
+        }
+
+        if (rtlpriv->psc.low_power_enable)
+                del_timer_sync(&rtlpriv->works.fw_clockoff_timer);
+
+        del_timer_sync(&rtlpriv->works.fast_antenna_training_timer);
+}
+
+static struct rtl_hal_ops rtl8188ee_hal_ops = {
+        .init_sw_vars = rtl88e_init_sw_vars,
+        .deinit_sw_vars = rtl88e_deinit_sw_vars,
+        .read_eeprom_info = rtl88ee_read_eeprom_info,
+        .interrupt_recognized = rtl88ee_interrupt_recognized,/*need check*/
+        .hw_init = rtl88ee_hw_init,
+        .hw_disable = rtl88ee_card_disable,
+        .hw_suspend = rtl88ee_suspend,
+        .hw_resume = rtl88ee_resume,
+        .enable_interrupt = rtl88ee_enable_interrupt,
+        .disable_interrupt = rtl88ee_disable_interrupt,
+        .set_network_type = rtl88ee_set_network_type,
+        .set_chk_bssid = rtl88ee_set_check_bssid,
+        .set_qos = rtl88ee_set_qos,
+        .set_bcn_reg = rtl88ee_set_beacon_related_registers,
+        .set_bcn_intv = rtl88ee_set_beacon_interval,
+        .update_interrupt_mask = rtl88ee_update_interrupt_mask,
+        .get_hw_reg = rtl88ee_get_hw_reg,
+        .set_hw_reg = rtl88ee_set_hw_reg,
+        .update_rate_tbl = rtl88ee_update_hal_rate_tbl,
+        .fill_tx_desc = rtl88ee_tx_fill_desc,
+        .fill_tx_cmddesc = rtl88ee_tx_fill_cmddesc,
+        .query_rx_desc = rtl88ee_rx_query_desc,
+        .set_channel_access = rtl88ee_update_channel_access_setting,
+        .radio_onoff_checking = rtl88ee_gpio_radio_on_off_checking,
+        .set_bw_mode = rtl88e_phy_set_bw_mode,
+        .switch_channel = rtl88e_phy_sw_chnl,
+        .dm_watchdog = rtl88e_dm_watchdog,
+        .scan_operation_backup = rtl88e_phy_scan_operation_backup,
+        .set_rf_power_state = rtl88e_phy_set_rf_power_state,
+        .led_control = rtl88ee_led_control,
+        .set_desc = rtl88ee_set_desc,
+        .get_desc = rtl88ee_get_desc,
+        .tx_polling = rtl88ee_tx_polling,
+        .enable_hw_sec = rtl88ee_enable_hw_security_config,
+        .set_key = rtl88ee_set_key,
+        .init_sw_leds = rtl88ee_init_sw_leds,
+        .allow_all_destaddr = rtl88ee_allow_all_destaddr,
+        .get_bbreg = rtl88e_phy_query_bb_reg,
+        .set_bbreg = rtl88e_phy_set_bb_reg,
+        .get_rfreg = rtl88e_phy_query_rf_reg,
+        .set_rfreg = rtl88e_phy_set_rf_reg,
+};
+
+static struct rtl_mod_params rtl88ee_mod_params = {
+        .sw_crypto = false,
+        .inactiveps = true,
+        .swctrl_lps = false,
+        .fwctrl_lps = true,
+        .debug = DBG_EMERG,
+};
+
+static struct rtl_hal_cfg rtl88ee_hal_cfg = {
+        .bar_id = 2,
+        .write_readback = true,
+        .name = "rtl88e_pci",
+        .ops = &rtl8188ee_hal_ops,
+        .mod_params = &rtl88ee_mod_params,
+
+        .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
+        .maps[SYS_FUNC_EN] = REG_SYS_FUNC_EN,
+        .maps[SYS_CLK] = REG_SYS_CLKR,
+        .maps[MAC_RCR_AM] = AM,
+        .maps[MAC_RCR_AB] = AB,
+        .maps[MAC_RCR_ACRC32] = ACRC32,
+        .maps[MAC_RCR_ACF] = ACF,
+        .maps[MAC_RCR_AAP] = AAP,
+
+        .maps[EFUSE_ACCESS] = REG_EFUSE_ACCESS,
+
+        .maps[EFUSE_TEST] = REG_EFUSE_TEST,
+        .maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
+        .maps[EFUSE_CLK] = 0,
+        .maps[EFUSE_CLK_CTRL] = REG_EFUSE_CTRL,
+        .maps[EFUSE_PWC_EV12V] = PWC_EV12V,
+        .maps[EFUSE_FEN_ELDR] = FEN_ELDR,
+        .maps[EFUSE_LOADER_CLK_EN] = LOADER_CLK_EN,
+        .maps[EFUSE_ANA8M] = ANA8M,
+        .maps[EFUSE_HWSET_MAX_SIZE] = HWSET_MAX_SIZE,
+        .maps[EFUSE_MAX_SECTION_MAP] = EFUSE_MAX_SECTION,
+        .maps[EFUSE_REAL_CONTENT_SIZE] = EFUSE_REAL_CONTENT_LEN,
+        .maps[EFUSE_OOB_PROTECT_BYTES_LEN] = EFUSE_OOB_PROTECT_BYTES,
+
+        .maps[RWCAM] = REG_CAMCMD,
+        .maps[WCAMI] = REG_CAMWRITE,
+        .maps[RCAMO] = REG_CAMREAD,
+        .maps[CAMDBG] = REG_CAMDBG,
+        .maps[SECR] = REG_SECCFG,
+        .maps[SEC_CAM_NONE] = CAM_NONE,
+        .maps[SEC_CAM_WEP40] = CAM_WEP40,
+        .maps[SEC_CAM_TKIP] = CAM_TKIP,
+        .maps[SEC_CAM_AES] = CAM_AES,
+        .maps[SEC_CAM_WEP104] = CAM_WEP104,
+
+        .maps[RTL_IMR_BCNDMAINT6] = IMR_BCNDMAINT6,
+        .maps[RTL_IMR_BCNDMAINT5] = IMR_BCNDMAINT5,
+        .maps[RTL_IMR_BCNDMAINT4] = IMR_BCNDMAINT4,
+        .maps[RTL_IMR_BCNDMAINT3] = IMR_BCNDMAINT3,
+        .maps[RTL_IMR_BCNDMAINT2] = IMR_BCNDMAINT2,
+        .maps[RTL_IMR_BCNDMAINT1] = IMR_BCNDMAINT1,
+/*      .maps[RTL_IMR_BCNDOK8] = IMR_BCNDOK8,     */   /*need check*/
+        .maps[RTL_IMR_BCNDOK7] = IMR_BCNDOK7,
+        .maps[RTL_IMR_BCNDOK6] = IMR_BCNDOK6,
+        .maps[RTL_IMR_BCNDOK5] = IMR_BCNDOK5,
+        .maps[RTL_IMR_BCNDOK4] = IMR_BCNDOK4,
+        .maps[RTL_IMR_BCNDOK3] = IMR_BCNDOK3,
+        .maps[RTL_IMR_BCNDOK2] = IMR_BCNDOK2,
+        .maps[RTL_IMR_BCNDOK1] = IMR_BCNDOK1,
+/*      .maps[RTL_IMR_TIMEOUT2] = IMR_TIMEOUT2,*/
+/*      .maps[RTL_IMR_TIMEOUT1] = IMR_TIMEOUT1,*/
+
+        .maps[RTL_IMR_TXFOVW] = IMR_TXFOVW,
+        .maps[RTL_IMR_PSTIMEOUT] = IMR_PSTIMEOUT,
+        .maps[RTL_IMR_BCNINT] = IMR_BCNDMAINT0,
+        .maps[RTL_IMR_RXFOVW] = IMR_RXFOVW,
+        .maps[RTL_IMR_RDU] = IMR_RDU,
+        .maps[RTL_IMR_ATIMEND] = IMR_ATIMEND,
+        .maps[RTL_IMR_BDOK] = IMR_BCNDOK0,
+        .maps[RTL_IMR_MGNTDOK] = IMR_MGNTDOK,
+        .maps[RTL_IMR_TBDER] = IMR_TBDER,
+        .maps[RTL_IMR_HIGHDOK] = IMR_HIGHDOK,
+        .maps[RTL_IMR_TBDOK] = IMR_TBDOK,
+        .maps[RTL_IMR_BKDOK] = IMR_BKDOK,
+        .maps[RTL_IMR_BEDOK] = IMR_BEDOK,
+        .maps[RTL_IMR_VIDOK] = IMR_VIDOK,
+        .maps[RTL_IMR_VODOK] = IMR_VODOK,
+        .maps[RTL_IMR_ROK] = IMR_ROK,
+        .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNDMAINT0 | IMR_TBDOK | IMR_TBDER),
+
+        .maps[RTL_RC_CCK_RATE1M] = DESC92C_RATE1M,
+        .maps[RTL_RC_CCK_RATE2M] = DESC92C_RATE2M,
+        .maps[RTL_RC_CCK_RATE5_5M] = DESC92C_RATE5_5M,
+        .maps[RTL_RC_CCK_RATE11M] = DESC92C_RATE11M,
+        .maps[RTL_RC_OFDM_RATE6M] = DESC92C_RATE6M,
+        .maps[RTL_RC_OFDM_RATE9M] = DESC92C_RATE9M,
+        .maps[RTL_RC_OFDM_RATE12M] = DESC92C_RATE12M,
+        .maps[RTL_RC_OFDM_RATE18M] = DESC92C_RATE18M,
+        .maps[RTL_RC_OFDM_RATE24M] = DESC92C_RATE24M,
+        .maps[RTL_RC_OFDM_RATE36M] = DESC92C_RATE36M,
+        .maps[RTL_RC_OFDM_RATE48M] = DESC92C_RATE48M,
+        .maps[RTL_RC_OFDM_RATE54M] = DESC92C_RATE54M,
+
+        .maps[RTL_RC_HT_RATEMCS7] = DESC92C_RATEMCS7,
+        .maps[RTL_RC_HT_RATEMCS15] = DESC92C_RATEMCS15,
+};
+
+static DEFINE_PCI_DEVICE_TABLE(rtl88ee_pci_ids) = {
+        {RTL_PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8179, rtl88ee_hal_cfg)},
+        {},
+};
+
+MODULE_DEVICE_TABLE(pci, rtl88ee_pci_ids);
+
+MODULE_AUTHOR("zhiyuan_yang     <zhiyuan_yang@realsil.com.cn>");
+MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
+MODULE_AUTHOR("Larry Finger     <Larry.Finger@lwfinger.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Realtek 8188E 802.11n PCI wireless");
+MODULE_FIRMWARE("rtlwifi/rtl8188efw.bin");
+
+module_param_named(swenc, rtl88ee_mod_params.sw_crypto, bool, 0444);
+module_param_named(debug, rtl88ee_mod_params.debug, int, 0444);
+module_param_named(ips, rtl88ee_mod_params.inactiveps, bool, 0444);
+module_param_named(swlps, rtl88ee_mod_params.swctrl_lps, bool, 0444);
+module_param_named(fwlps, rtl88ee_mod_params.fwctrl_lps, bool, 0444);
+MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
+MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
+
+static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
+
+static struct pci_driver rtl88ee_driver = {
+        .name = KBUILD_MODNAME,
+        .id_table = rtl88ee_pci_ids,
+        .probe = rtl_pci_probe,
+        .remove = rtl_pci_disconnect,
+        .driver.pm = &rtlwifi_pm_ops,
+};
+
+module_pci_driver(rtl88ee_driver);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.h b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.h
new file mode 100644
index 000000000000..85e02b3bdff8
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.h
@@ -0,0 +1,36 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92CE_SW_H__
+#define __RTL92CE_SW_H__
+
+int rtl88e_init_sw_vars(struct ieee80211_hw *hw);
+void rtl88e_deinit_sw_vars(struct ieee80211_hw *hw);
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/table.c b/drivers/net/wireless/rtlwifi/rtl8188ee/table.c
new file mode 100644
index 000000000000..fad373f97b2c
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/table.c
@@ -0,0 +1,643 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Created on  2010/ 5/18,  1:41
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "table.h"
+
+u32 RTL8188EEPHY_REG_1TARRAY[] = {
+                0x800, 0x80040000,
+                0x804, 0x00000003,
+                0x808, 0x0000FC00,
+                0x80C, 0x0000000A,
+                0x810, 0x10001331,
+                0x814, 0x020C3D10,
+                0x818, 0x02200385,
+                0x81C, 0x00000000,
+                0x820, 0x01000100,
+                0x824, 0x00390204,
+                0x828, 0x00000000,
+                0x82C, 0x00000000,
+                0x830, 0x00000000,
+                0x834, 0x00000000,
+                0x838, 0x00000000,
+                0x83C, 0x00000000,
+                0x840, 0x00010000,
+                0x844, 0x00000000,
+                0x848, 0x00000000,
+                0x84C, 0x00000000,
+                0x850, 0x00000000,
+                0x854, 0x00000000,
+                0x858, 0x569A11A9,
+                0x85C, 0x01000014,
+                0x860, 0x66F60110,
+                0x864, 0x061F0649,
+                0x868, 0x00000000,
+                0x86C, 0x27272700,
+                0x870, 0x07000760,
+                0x874, 0x25004000,
+                0x878, 0x00000808,
+                0x87C, 0x00000000,
+                0x880, 0xB0000C1C,
+                0x884, 0x00000001,
+                0x888, 0x00000000,
+                0x88C, 0xCCC000C0,
+                0x890, 0x00000800,
+                0x894, 0xFFFFFFFE,
+                0x898, 0x40302010,
+                0x89C, 0x00706050,
+                0x900, 0x00000000,
+                0x904, 0x00000023,
+                0x908, 0x00000000,
+                0x90C, 0x81121111,
+                0x910, 0x00000002,
+                0x914, 0x00000201,
+                0xA00, 0x00D047C8,
+                0xA04, 0x80FF000C,
+                0xA08, 0x8C838300,
+                0xA0C, 0x2E7F120F,
+                0xA10, 0x9500BB78,
+                0xA14, 0x1114D028,
+                0xA18, 0x00881117,
+                0xA1C, 0x89140F00,
+                0xA20, 0x1A1B0000,
+                0xA24, 0x090E1317,
+                0xA28, 0x00000204,
+                0xA2C, 0x00D30000,
+                0xA70, 0x101FBF00,
+                0xA74, 0x00000007,
+                0xA78, 0x00000900,
+                0xA7C, 0x225B0606,
+                0xA80, 0x218075B1,
+                0xB2C, 0x80000000,
+                0xC00, 0x48071D40,
+                0xC04, 0x03A05611,
+                0xC08, 0x000000E4,
+                0xC0C, 0x6C6C6C6C,
+                0xC10, 0x08800000,
+                0xC14, 0x40000100,
+                0xC18, 0x08800000,
+                0xC1C, 0x40000100,
+                0xC20, 0x00000000,
+                0xC24, 0x00000000,
+                0xC28, 0x00000000,
+                0xC2C, 0x00000000,
+                0xC30, 0x69E9AC47,
+                0xC34, 0x469652AF,
+                0xC38, 0x49795994,
+                0xC3C, 0x0A97971C,
+                0xC40, 0x1F7C403F,
+                0xC44, 0x000100B7,
+                0xC48, 0xEC020107,
+                0xC4C, 0x007F037F,
+                0xC50, 0x69553420,
+                0xC54, 0x43BC0094,
+                0xC58, 0x00013169,
+                0xC5C, 0x00250492,
+                0xC60, 0x00000000,
+                0xC64, 0x7112848B,
+                0xC68, 0x47C00BFF,
+                0xC6C, 0x00000036,
+                0xC70, 0x2C7F000D,
+                0xC74, 0x020610DB,
+                0xC78, 0x0000001F,
+                0xC7C, 0x00B91612,
+                0xC80, 0x390000E4,
+                0xC84, 0x20F60000,
+                0xC88, 0x40000100,
+                0xC8C, 0x20200000,
+                0xC90, 0x00091521,
+                0xC94, 0x00000000,
+                0xC98, 0x00121820,
+                0xC9C, 0x00007F7F,
+                0xCA0, 0x00000000,
+                0xCA4, 0x000300A0,
+                0xCA8, 0x00000000,
+                0xCAC, 0x00000000,
+                0xCB0, 0x00000000,
+                0xCB4, 0x00000000,
+                0xCB8, 0x00000000,
+                0xCBC, 0x28000000,
+                0xCC0, 0x00000000,
+                0xCC4, 0x00000000,
+                0xCC8, 0x00000000,
+                0xCCC, 0x00000000,
+                0xCD0, 0x00000000,
+                0xCD4, 0x00000000,
+                0xCD8, 0x64B22427,
+                0xCDC, 0x00766932,
+                0xCE0, 0x00222222,
+                0xCE4, 0x00000000,
+                0xCE8, 0x37644302,
+                0xCEC, 0x2F97D40C,
+                0xD00, 0x00000740,
+                0xD04, 0x00020401,
+                0xD08, 0x0000907F,
+                0xD0C, 0x20010201,
+                0xD10, 0xA0633333,
+                0xD14, 0x3333BC43,
+                0xD18, 0x7A8F5B6F,
+                0xD2C, 0xCC979975,
+                0xD30, 0x00000000,
+                0xD34, 0x80608000,
+                0xD38, 0x00000000,
+                0xD3C, 0x00127353,
+                0xD40, 0x00000000,
+                0xD44, 0x00000000,
+                0xD48, 0x00000000,
+                0xD4C, 0x00000000,
+                0xD50, 0x6437140A,
+                0xD54, 0x00000000,
+                0xD58, 0x00000282,
+                0xD5C, 0x30032064,
+                0xD60, 0x4653DE68,
+                0xD64, 0x04518A3C,
+                0xD68, 0x00002101,
+                0xD6C, 0x2A201C16,
+                0xD70, 0x1812362E,
+                0xD74, 0x322C2220,
+                0xD78, 0x000E3C24,
+                0xE00, 0x2D2D2D2D,
+                0xE04, 0x2D2D2D2D,
+                0xE08, 0x0390272D,
+                0xE10, 0x2D2D2D2D,
+                0xE14, 0x2D2D2D2D,
+                0xE18, 0x2D2D2D2D,
+                0xE1C, 0x2D2D2D2D,
+                0xE28, 0x00000000,
+                0xE30, 0x1000DC1F,
+                0xE34, 0x10008C1F,
+                0xE38, 0x02140102,
+                0xE3C, 0x681604C2,
+                0xE40, 0x01007C00,
+                0xE44, 0x01004800,
+                0xE48, 0xFB000000,
+                0xE4C, 0x000028D1,
+                0xE50, 0x1000DC1F,
+                0xE54, 0x10008C1F,
+                0xE58, 0x02140102,
+                0xE5C, 0x28160D05,
+                0xE60, 0x00000008,
+                0xE68, 0x001B25A4,
+                0xE6C, 0x00C00014,
+                0xE70, 0x00C00014,
+                0xE74, 0x01000014,
+                0xE78, 0x01000014,
+                0xE7C, 0x01000014,
+                0xE80, 0x01000014,
+                0xE84, 0x00C00014,
+                0xE88, 0x01000014,
+                0xE8C, 0x00C00014,
+                0xED0, 0x00C00014,
+                0xED4, 0x00C00014,
+                0xED8, 0x00C00014,
+                0xEDC, 0x00000014,
+                0xEE0, 0x00000014,
+                0xEEC, 0x01C00014,
+                0xF14, 0x00000003,
+                0xF4C, 0x00000000,
+                0xF00, 0x00000300,
+
+};
+
+u32 RTL8188EEPHY_REG_ARRAY_PG[] = {
+                0xE00, 0xFFFFFFFF, 0x06070809,
+                0xE04, 0xFFFFFFFF, 0x02020405,
+                0xE08, 0x0000FF00, 0x00000006,
+                0x86C, 0xFFFFFF00, 0x00020400,
+                0xE10, 0xFFFFFFFF, 0x08090A0B,
+                0xE14, 0xFFFFFFFF, 0x01030607,
+                0xE18, 0xFFFFFFFF, 0x08090A0B,
+                0xE1C, 0xFFFFFFFF, 0x01030607,
+                0xE00, 0xFFFFFFFF, 0x00000000,
+                0xE04, 0xFFFFFFFF, 0x00000000,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x00000000,
+                0xE14, 0xFFFFFFFF, 0x00000000,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+                0xE00, 0xFFFFFFFF, 0x02020202,
+                0xE04, 0xFFFFFFFF, 0x00020202,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x04040404,
+                0xE14, 0xFFFFFFFF, 0x00020404,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+                0xE00, 0xFFFFFFFF, 0x02020202,
+                0xE04, 0xFFFFFFFF, 0x00020202,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x04040404,
+                0xE14, 0xFFFFFFFF, 0x00020404,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+                0xE00, 0xFFFFFFFF, 0x00000000,
+                0xE04, 0xFFFFFFFF, 0x00000000,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x00000000,
+                0xE14, 0xFFFFFFFF, 0x00000000,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+                0xE00, 0xFFFFFFFF, 0x02020202,
+                0xE04, 0xFFFFFFFF, 0x00020202,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x04040404,
+                0xE14, 0xFFFFFFFF, 0x00020404,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+                0xE00, 0xFFFFFFFF, 0x00000000,
+                0xE04, 0xFFFFFFFF, 0x00000000,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x00000000,
+                0xE14, 0xFFFFFFFF, 0x00000000,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+                0xE00, 0xFFFFFFFF, 0x00000000,
+                0xE04, 0xFFFFFFFF, 0x00000000,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x00000000,
+                0xE14, 0xFFFFFFFF, 0x00000000,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+                0xE00, 0xFFFFFFFF, 0x00000000,
+                0xE04, 0xFFFFFFFF, 0x00000000,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x00000000,
+                0xE14, 0xFFFFFFFF, 0x00000000,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+                0xE00, 0xFFFFFFFF, 0x00000000,
+                0xE04, 0xFFFFFFFF, 0x00000000,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x00000000,
+                0xE14, 0xFFFFFFFF, 0x00000000,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+                0xE00, 0xFFFFFFFF, 0x00000000,
+                0xE04, 0xFFFFFFFF, 0x00000000,
+                0xE08, 0x0000FF00, 0x00000000,
+                0x86C, 0xFFFFFF00, 0x00000000,
+                0xE10, 0xFFFFFFFF, 0x00000000,
+                0xE14, 0xFFFFFFFF, 0x00000000,
+                0xE18, 0xFFFFFFFF, 0x00000000,
+                0xE1C, 0xFFFFFFFF, 0x00000000,
+
+};
+
+u32 RTL8188EE_RADIOA_1TARRAY[] = {
+                0x000, 0x00030000,
+                0x008, 0x00084000,
+                0x018, 0x00000407,
+                0x019, 0x00000012,
+                0x01E, 0x00080009,
+                0x01F, 0x00000880,
+                0x02F, 0x0001A060,
+                0x03F, 0x00000000,
+                0x042, 0x000060C0,
+                0x057, 0x000D0000,
+                0x058, 0x000BE180,
+                0x067, 0x00001552,
+                0x083, 0x00000000,
+                0x0B0, 0x000FF8FC,
+                0x0B1, 0x00054400,
+                0x0B2, 0x000CCC19,
+                0x0B4, 0x00043003,
+                0x0B6, 0x0004953E,
+                0x0B7, 0x0001C718,
+                0x0B8, 0x000060FF,
+                0x0B9, 0x00080001,
+                0x0BA, 0x00040000,
+                0x0BB, 0x00000400,
+                0x0BF, 0x000C0000,
+                0x0C2, 0x00002400,
+                0x0C3, 0x00000009,
+                0x0C4, 0x00040C91,
+                0x0C5, 0x00099999,
+                0x0C6, 0x000000A3,
+                0x0C7, 0x00088820,
+                0x0C8, 0x00076C06,
+                0x0C9, 0x00000000,
+                0x0CA, 0x00080000,
+                0x0DF, 0x00000180,
+                0x0EF, 0x000001A0,
+                0x051, 0x0006B27D,
+                0x052, 0x0007E49D,
+                0x053, 0x00000073,
+                0x056, 0x00051FF3,
+                0x035, 0x00000086,
+                0x035, 0x00000186,
+                0x035, 0x00000286,
+                0x036, 0x00001C25,
+                0x036, 0x00009C25,
+                0x036, 0x00011C25,
+                0x036, 0x00019C25,
+                0x0B6, 0x00048538,
+                0x018, 0x00000C07,
+                0x05A, 0x0004BD00,
+                0x019, 0x000739D0,
+                0x034, 0x0000ADF3,
+                0x034, 0x00009DF0,
+                0x034, 0x00008DED,
+                0x034, 0x00007DEA,
+                0x034, 0x00006DE7,
+                0x034, 0x000054EE,
+                0x034, 0x000044EB,
+                0x034, 0x000034E8,
+                0x034, 0x0000246B,
+                0x034, 0x00001468,
+                0x034, 0x0000006D,
+                0x000, 0x00030159,
+                0x084, 0x00068200,
+                0x086, 0x000000CE,
+                0x087, 0x00048A00,
+                0x08E, 0x00065540,
+                0x08F, 0x00088000,
+                0x0EF, 0x000020A0,
+                0x03B, 0x000F02B0,
+                0x03B, 0x000EF7B0,
+                0x03B, 0x000D4FB0,
+                0x03B, 0x000CF060,
+                0x03B, 0x000B0090,
+                0x03B, 0x000A0080,
+                0x03B, 0x00090080,
+                0x03B, 0x0008F780,
+                0x03B, 0x000722B0,
+                0x03B, 0x0006F7B0,
+                0x03B, 0x00054FB0,
+                0x03B, 0x0004F060,
+                0x03B, 0x00030090,
+                0x03B, 0x00020080,
+                0x03B, 0x00010080,
+                0x03B, 0x0000F780,
+                0x0EF, 0x000000A0,
+                0x000, 0x00010159,
+                0x018, 0x0000F407,
+                0xFFE, 0x00000000,
+                0xFFE, 0x00000000,
+                0x01F, 0x00080003,
+                0xFFE, 0x00000000,
+                0xFFE, 0x00000000,
+                0x01E, 0x00000001,
+                0x01F, 0x00080000,
+                0x000, 0x00033E60,
+
+};
+
+u32 RTL8188EEMAC_1T_ARRAY[] = {
+                0x026, 0x00000041,
+                0x027, 0x00000035,
+                0x428, 0x0000000A,
+                0x429, 0x00000010,
+                0x430, 0x00000000,
+                0x431, 0x00000001,
+                0x432, 0x00000002,
+                0x433, 0x00000004,
+                0x434, 0x00000005,
+                0x435, 0x00000006,
+                0x436, 0x00000007,
+                0x437, 0x00000008,
+                0x438, 0x00000000,
+                0x439, 0x00000000,
+                0x43A, 0x00000001,
+                0x43B, 0x00000002,
+                0x43C, 0x00000004,
+                0x43D, 0x00000005,
+                0x43E, 0x00000006,
+                0x43F, 0x00000007,
+                0x440, 0x0000005D,
+                0x441, 0x00000001,
+                0x442, 0x00000000,
+                0x444, 0x00000015,
+                0x445, 0x000000F0,
+                0x446, 0x0000000F,
+                0x447, 0x00000000,
+                0x458, 0x00000041,
+                0x459, 0x000000A8,
+                0x45A, 0x00000072,
+                0x45B, 0x000000B9,
+                0x460, 0x00000066,
+                0x461, 0x00000066,
+                0x480, 0x00000008,
+                0x4C8, 0x000000FF,
+                0x4C9, 0x00000008,
+                0x4CC, 0x000000FF,
+                0x4CD, 0x000000FF,
+                0x4CE, 0x00000001,
+                0x4D3, 0x00000001,
+                0x500, 0x00000026,
+                0x501, 0x000000A2,
+                0x502, 0x0000002F,
+                0x503, 0x00000000,
+                0x504, 0x00000028,
+                0x505, 0x000000A3,
+                0x506, 0x0000005E,
+                0x507, 0x00000000,
+                0x508, 0x0000002B,
+                0x509, 0x000000A4,
+                0x50A, 0x0000005E,
+                0x50B, 0x00000000,
+                0x50C, 0x0000004F,
+                0x50D, 0x000000A4,
+                0x50E, 0x00000000,
+                0x50F, 0x00000000,
+                0x512, 0x0000001C,
+                0x514, 0x0000000A,
+                0x516, 0x0000000A,
+                0x525, 0x0000004F,
+                0x550, 0x00000010,
+                0x551, 0x00000010,
+                0x559, 0x00000002,
+                0x55D, 0x000000FF,
+                0x605, 0x00000030,
+                0x608, 0x0000000E,
+                0x609, 0x0000002A,
+                0x620, 0x000000FF,
+                0x621, 0x000000FF,
+                0x622, 0x000000FF,
+                0x623, 0x000000FF,
+                0x624, 0x000000FF,
+                0x625, 0x000000FF,
+                0x626, 0x000000FF,
+                0x627, 0x000000FF,
+                0x652, 0x00000020,
+                0x63C, 0x0000000A,
+                0x63D, 0x0000000A,
+                0x63E, 0x0000000E,
+                0x63F, 0x0000000E,
+                0x640, 0x00000040,
+                0x66E, 0x00000005,
+                0x700, 0x00000021,
+                0x701, 0x00000043,
+                0x702, 0x00000065,
+                0x703, 0x00000087,
+                0x708, 0x00000021,
+                0x709, 0x00000043,
+                0x70A, 0x00000065,
+                0x70B, 0x00000087,
+
+};
+
+u32 RTL8188EEAGCTAB_1TARRAY[] = {
+                0xC78, 0xFB000001,
+                0xC78, 0xFB010001,
+                0xC78, 0xFB020001,
+                0xC78, 0xFB030001,
+                0xC78, 0xFB040001,
+                0xC78, 0xFB050001,
+                0xC78, 0xFA060001,
+                0xC78, 0xF9070001,
+                0xC78, 0xF8080001,
+                0xC78, 0xF7090001,
+                0xC78, 0xF60A0001,
+                0xC78, 0xF50B0001,
+                0xC78, 0xF40C0001,
+                0xC78, 0xF30D0001,
+                0xC78, 0xF20E0001,
+                0xC78, 0xF10F0001,
+                0xC78, 0xF0100001,
+                0xC78, 0xEF110001,
+                0xC78, 0xEE120001,
+                0xC78, 0xED130001,
+                0xC78, 0xEC140001,
+                0xC78, 0xEB150001,
+                0xC78, 0xEA160001,
+                0xC78, 0xE9170001,
+                0xC78, 0xE8180001,
+                0xC78, 0xE7190001,
+                0xC78, 0xE61A0001,
+                0xC78, 0xE51B0001,
+                0xC78, 0xE41C0001,
+                0xC78, 0xE31D0001,
+                0xC78, 0xE21E0001,
+                0xC78, 0xE11F0001,
+                0xC78, 0x8A200001,
+                0xC78, 0x89210001,
+                0xC78, 0x88220001,
+                0xC78, 0x87230001,
+                0xC78, 0x86240001,
+                0xC78, 0x85250001,
+                0xC78, 0x84260001,
+                0xC78, 0x83270001,
+                0xC78, 0x82280001,
+                0xC78, 0x6B290001,
+                0xC78, 0x6A2A0001,
+                0xC78, 0x692B0001,
+                0xC78, 0x682C0001,
+                0xC78, 0x672D0001,
+                0xC78, 0x662E0001,
+                0xC78, 0x652F0001,
+                0xC78, 0x64300001,
+                0xC78, 0x63310001,
+                0xC78, 0x62320001,
+                0xC78, 0x61330001,
+                0xC78, 0x46340001,
+                0xC78, 0x45350001,
+                0xC78, 0x44360001,
+                0xC78, 0x43370001,
+                0xC78, 0x42380001,
+                0xC78, 0x41390001,
+                0xC78, 0x403A0001,
+                0xC78, 0x403B0001,
+                0xC78, 0x403C0001,
+                0xC78, 0x403D0001,
+                0xC78, 0x403E0001,
+                0xC78, 0x403F0001,
+                0xC78, 0xFB400001,
+                0xC78, 0xFB410001,
+                0xC78, 0xFB420001,
+                0xC78, 0xFB430001,
+                0xC78, 0xFB440001,
+                0xC78, 0xFB450001,
+                0xC78, 0xFB460001,
+                0xC78, 0xFB470001,
+                0xC78, 0xFB480001,
+                0xC78, 0xFA490001,
+                0xC78, 0xF94A0001,
+                0xC78, 0xF84B0001,
+                0xC78, 0xF74C0001,
+                0xC78, 0xF64D0001,
+                0xC78, 0xF54E0001,
+                0xC78, 0xF44F0001,
+                0xC78, 0xF3500001,
+                0xC78, 0xF2510001,
+                0xC78, 0xF1520001,
+                0xC78, 0xF0530001,
+                0xC78, 0xEF540001,
+                0xC78, 0xEE550001,
+                0xC78, 0xED560001,
+                0xC78, 0xEC570001,
+                0xC78, 0xEB580001,
+                0xC78, 0xEA590001,
+                0xC78, 0xE95A0001,
+                0xC78, 0xE85B0001,
+                0xC78, 0xE75C0001,
+                0xC78, 0xE65D0001,
+                0xC78, 0xE55E0001,
+                0xC78, 0xE45F0001,
+                0xC78, 0xE3600001,
+                0xC78, 0xE2610001,
+                0xC78, 0xC3620001,
+                0xC78, 0xC2630001,
+                0xC78, 0xC1640001,
+                0xC78, 0x8B650001,
+                0xC78, 0x8A660001,
+                0xC78, 0x89670001,
+                0xC78, 0x88680001,
+                0xC78, 0x87690001,
+                0xC78, 0x866A0001,
+                0xC78, 0x856B0001,
+                0xC78, 0x846C0001,
+                0xC78, 0x676D0001,
+                0xC78, 0x666E0001,
+                0xC78, 0x656F0001,
+                0xC78, 0x64700001,
+                0xC78, 0x63710001,
+                0xC78, 0x62720001,
+                0xC78, 0x61730001,
+                0xC78, 0x60740001,
+                0xC78, 0x46750001,
+                0xC78, 0x45760001,
+                0xC78, 0x44770001,
+                0xC78, 0x43780001,
+                0xC78, 0x42790001,
+                0xC78, 0x417A0001,
+                0xC78, 0x407B0001,
+                0xC78, 0x407C0001,
+                0xC78, 0x407D0001,
+                0xC78, 0x407E0001,
+                0xC78, 0x407F0001,
+};
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/table.h b/drivers/net/wireless/rtlwifi/rtl8188ee/table.h
new file mode 100644
index 000000000000..c1218e835129
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/table.h
@@ -0,0 +1,47 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Created on  2010/ 5/18,  1:41
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92CE_TABLE__H_
+#define __RTL92CE_TABLE__H_
+
+#include <linux/types.h>
+#define  RTL8188EEPHY_REG_1TARRAYLEN    382
+extern u32 RTL8188EEPHY_REG_1TARRAY[];
+#define RTL8188EEPHY_REG_ARRAY_PGLEN    264
+extern u32 RTL8188EEPHY_REG_ARRAY_PG[];
+#define RTL8188EE_RADIOA_1TARRAYLEN     190
+extern u32 RTL8188EE_RADIOA_1TARRAY[];
+#define RTL8188EEMAC_1T_ARRAYLEN        180
+extern u32 RTL8188EEMAC_1T_ARRAY[];
+#define RTL8188EEAGCTAB_1TARRAYLEN      256
+extern u32 RTL8188EEAGCTAB_1TARRAY[];
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
new file mode 100644
index 000000000000..a8871d66d56a
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -0,0 +1,817 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#include "../wifi.h"
+#include "../pci.h"
+#include "../base.h"
+#include "../stats.h"
+#include "reg.h"
+#include "def.h"
+#include "phy.h"
+#include "trx.h"
+#include "led.h"
+#include "dm.h"
+
+static u8 _rtl88ee_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
+{
+        __le16 fc = rtl_get_fc(skb);
+
+        if (unlikely(ieee80211_is_beacon(fc)))
+                return QSLT_BEACON;
+        if (ieee80211_is_mgmt(fc) || ieee80211_is_ctl(fc))
+                return QSLT_MGNT;
+
+        return skb->priority;
+}
+
+static void _rtl88ee_query_rxphystatus(struct ieee80211_hw *hw,
+                        struct rtl_stats *pstatus, u8 *pdesc,
+                        struct rx_fwinfo_88e *p_drvinfo,
+                        bool bpacket_match_bssid,
+                        bool bpacket_toself, bool packet_beacon)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtlpriv);
+        struct phy_sts_cck_8192s_t *cck_buf;
+        struct phy_status_rpt *phystrpt = (struct phy_status_rpt *)p_drvinfo;
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        char rx_pwr_all = 0, rx_pwr[4];
+        u8 rf_rx_num = 0, evm, pwdb_all;
+        u8 i, max_spatial_stream;
+        u32 rssi, total_rssi = 0;
+        bool is_cck = pstatus->is_cck;
+        u8 lan_idx, vga_idx;
+
+        /* Record it for next packet processing */
+        pstatus->packet_matchbssid = bpacket_match_bssid;
+        pstatus->packet_toself = bpacket_toself;
+        pstatus->packet_beacon = packet_beacon;
+        pstatus->rx_mimo_sig_qual[0] = -1;
+        pstatus->rx_mimo_sig_qual[1] = -1;
+
+        if (is_cck) {
+                u8 cck_hipwr;
+                u8 cck_agc_rpt;
+                /* CCK Driver info Structure is not the same as OFDM packet. */
+                cck_buf = (struct phy_sts_cck_8192s_t *)p_drvinfo;
+                cck_agc_rpt = cck_buf->cck_agc_rpt;
+
+                /* (1)Hardware does not provide RSSI for CCK
+                 * (2)PWDB, Average PWDB cacluated by
+                 * hardware (for rate adaptive)
+                 */
+                if (ppsc->rfpwr_state == ERFON)
+                        cck_hipwr = rtl_get_bbreg(hw, RFPGA0_XA_HSSIPARAMETER2,
+                                                  BIT(9));
+                else
+                        cck_hipwr = false;
+
+                lan_idx = ((cck_agc_rpt & 0xE0) >> 5);
+                vga_idx = (cck_agc_rpt & 0x1f);
+                switch (lan_idx) {
+                case 7:
+                        if (vga_idx <= 27)
+                                rx_pwr_all = -100 + 2 * (27 - vga_idx);
+                        else
+                                rx_pwr_all = -100;
+                        break;
+                case 6:
+                        rx_pwr_all = -48 + 2 * (2 - vga_idx); /*VGA_idx = 2~0*/
+                        break;
+                case 5:
+                        rx_pwr_all = -42 + 2 * (7 - vga_idx); /*VGA_idx = 7~5*/
+                        break;
+                case 4:
+                        rx_pwr_all = -36 + 2 * (7 - vga_idx); /*VGA_idx = 7~4*/
+                        break;
+                case 3:
+                        rx_pwr_all = -24 + 2 * (7 - vga_idx); /*VGA_idx = 7~0*/
+                        break;
+                case 2:
+                        if (cck_hipwr)
+                                rx_pwr_all = -12 + 2 * (5 - vga_idx);
+                        else
+                                rx_pwr_all = -6 + 2 * (5 - vga_idx);
+                        break;
+                case 1:
+                        rx_pwr_all = 8 - 2 * vga_idx;
+                        break;
+                case 0:
+                        rx_pwr_all = 14 - 2 * vga_idx;
+                        break;
+                default:
+                        break;
+                }
+                rx_pwr_all += 6;
+                pwdb_all = rtl_query_rxpwrpercentage(rx_pwr_all);
+                /* CCK gain is smaller than OFDM/MCS gain,
+                 * so we add gain diff by experiences,
+                 * the val is 6
+                 */
+                pwdb_all += 6;
+                if (pwdb_all > 100)
+                        pwdb_all = 100;
+                /* modify the offset to make the same
+                 * gain index with OFDM.
+                 */
+                if (pwdb_all > 34 && pwdb_all <= 42)
+                        pwdb_all -= 2;
+                else if (pwdb_all > 26 && pwdb_all <= 34)
+                        pwdb_all -= 6;
+                else if (pwdb_all > 14 && pwdb_all <= 26)
+                        pwdb_all -= 8;
+                else if (pwdb_all > 4 && pwdb_all <= 14)
+                        pwdb_all -= 4;
+                if (cck_hipwr == false) {
+                        if (pwdb_all >= 80)
+                                pwdb_all = ((pwdb_all - 80)<<1) +
+                                           ((pwdb_all - 80)>>1) + 80;
+                        else if ((pwdb_all <= 78) && (pwdb_all >= 20))
+                                pwdb_all += 3;
+                        if (pwdb_all > 100)
+                                pwdb_all = 100;
+                }
+
+                pstatus->rx_pwdb_all = pwdb_all;
+                pstatus->recvsignalpower = rx_pwr_all;
+
+                /* (3) Get Signal Quality (EVM) */
+                if (bpacket_match_bssid) {
+                        u8 sq;
+
+                        if (pstatus->rx_pwdb_all > 40) {
+                                sq = 100;
+                        } else {
+                                sq = cck_buf->sq_rpt;
+                                if (sq > 64)
+                                        sq = 0;
+                                else if (sq < 20)
+                                        sq = 100;
+                                else
+                                        sq = ((64 - sq) * 100) / 44;
+                        }
+
+                        pstatus->signalquality = sq;
+                        pstatus->rx_mimo_sig_qual[0] = sq;
+                        pstatus->rx_mimo_sig_qual[1] = -1;
+                }
+        } else {
+                rtlpriv->dm.rfpath_rxenable[0] =
+                    rtlpriv->dm.rfpath_rxenable[1] = true;
+
+                /* (1)Get RSSI for HT rate */
+                for (i = RF90_PATH_A; i < RF6052_MAX_PATH; i++) {
+                        /* we will judge RF RX path now. */
+                        if (rtlpriv->dm.rfpath_rxenable[i])
+                                rf_rx_num++;
+
+                        rx_pwr[i] = ((p_drvinfo->gain_trsw[i] & 0x3f) * 2)-110;
+
+                        /* Translate DBM to percentage. */
+                        rssi = rtl_query_rxpwrpercentage(rx_pwr[i]);
+                        total_rssi += rssi;
+
+                        /* Get Rx snr value in DB */
+                        rtlpriv->stats.rx_snr_db[i] = p_drvinfo->rxsnr[i] / 2;
+
+                        /* Record Signal Strength for next packet */
+                        if (bpacket_match_bssid)
+                                pstatus->rx_mimo_signalstrength[i] = (u8) rssi;
+                }
+
+                /* (2)PWDB, Average PWDB cacluated by
+                 * hardware (for rate adaptive)
+                 */
+                rx_pwr_all = ((p_drvinfo->pwdb_all >> 1) & 0x7f) - 110;
+
+                pwdb_all = rtl_query_rxpwrpercentage(rx_pwr_all);
+                pstatus->rx_pwdb_all = pwdb_all;
+                pstatus->rxpower = rx_pwr_all;
+                pstatus->recvsignalpower = rx_pwr_all;
+
+                /* (3)EVM of HT rate */
+                if (pstatus->is_ht && pstatus->rate >= DESC92C_RATEMCS8 &&
+                    pstatus->rate <= DESC92C_RATEMCS15)
+                        max_spatial_stream = 2;
+                else
+                        max_spatial_stream = 1;
+
+                for (i = 0; i < max_spatial_stream; i++) {
+                        evm = rtl_evm_db_to_percentage(p_drvinfo->rxevm[i]);
+
+                        if (bpacket_match_bssid) {
+                                /* Fill value in RFD, Get the first
+                                 * spatial stream only
+                                 */
+                                if (i == 0)
+                                        pstatus->signalquality = evm & 0xff;
+                                pstatus->rx_mimo_sig_qual[i] = evm & 0xff;
+                        }
+                }
+        }
+
+        /* UI BSS List signal strength(in percentage),
+         * make it good looking, from 0~100.
+         */
+        if (is_cck)
+                pstatus->signalstrength = (u8)(rtl_signal_scale_mapping(hw,
+                                          pwdb_all));
+        else if (rf_rx_num != 0)
+                pstatus->signalstrength = (u8)(rtl_signal_scale_mapping(hw,
+                                          total_rssi /= rf_rx_num));
+        /*HW antenna diversity*/
+        rtldm->fat_table.antsel_rx_keep_0 = phystrpt->ant_sel;
+        rtldm->fat_table.antsel_rx_keep_1 = phystrpt->ant_sel_b;
+        rtldm->fat_table.antsel_rx_keep_2 = phystrpt->antsel_rx_keep_2;
+}
+
+static void _rtl88ee_smart_antenna(struct ieee80211_hw *hw,
+        struct rtl_stats *pstatus)
+{
+        struct rtl_dm *rtldm = rtl_dm(rtl_priv(hw));
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        u8 ant_mux;
+        struct fast_ant_training *pfat = &(rtldm->fat_table);
+
+        if (rtlefuse->antenna_div_type == CG_TRX_SMART_ANTDIV) {
+                if (pfat->fat_state == FAT_TRAINING_STATE) {
+                        if (pstatus->packet_toself) {
+                                ant_mux = (pfat->antsel_rx_keep_2 << 2) |
+                                                (pfat->antsel_rx_keep_1 << 1) |
+                                                 pfat->antsel_rx_keep_0;
+                                pfat->ant_sum[ant_mux] += pstatus->rx_pwdb_all;
+                                pfat->ant_cnt[ant_mux]++;
+                        }
+                }
+        } else if ((rtlefuse->antenna_div_type == CG_TRX_HW_ANTDIV) ||
+                   (rtlefuse->antenna_div_type == CGCS_RX_HW_ANTDIV)) {
+                if (pstatus->packet_toself || pstatus->packet_matchbssid) {
+                        ant_mux = (pfat->antsel_rx_keep_2 << 2) |
+                                  (pfat->antsel_rx_keep_1 << 1) |
+                                   pfat->antsel_rx_keep_0;
+                        rtl88e_dm_ant_sel_statistics(hw, ant_mux, 0,
+                                                     pstatus->rx_pwdb_all);
+                }
+        }
+}
+
+static void _rtl88ee_translate_rx_signal_stuff(struct ieee80211_hw *hw,
+                struct sk_buff *skb, struct rtl_stats *pstatus,
+                u8 *pdesc, struct rx_fwinfo_88e *p_drvinfo)
+{
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
+        struct ieee80211_hdr *hdr;
+        u8 *tmp_buf;
+        u8 *praddr;
+        u8 *psaddr;
+        __le16 fc;
+        u16 type, ufc;
+        bool match_bssid, packet_toself, packet_beacon, addr;
+
+        tmp_buf = skb->data + pstatus->rx_drvinfo_size + pstatus->rx_bufshift;
+
+        hdr = (struct ieee80211_hdr *)tmp_buf;
+        fc = hdr->frame_control;
+        ufc = le16_to_cpu(fc);
+        type = WLAN_FC_GET_TYPE(fc);
+        praddr = hdr->addr1;
+        psaddr = ieee80211_get_SA(hdr);
+        memcpy(pstatus->psaddr, psaddr, ETH_ALEN);
+
+        addr = (!compare_ether_addr(mac->bssid, (ufc & IEEE80211_FCTL_TODS) ?
+                hdr->addr1 : (ufc & IEEE80211_FCTL_FROMDS) ?
+                hdr->addr2 : hdr->addr3));
+        match_bssid = ((IEEE80211_FTYPE_CTL != type) && (!pstatus->hwerror) &&
+                       (!pstatus->crc) && (!pstatus->icv)) && addr;
+
+        addr = (!compare_ether_addr(praddr, rtlefuse->dev_addr));
+        packet_toself = match_bssid && addr;
+
+        if (ieee80211_is_beacon(fc))
+                packet_beacon = true;
+
+        _rtl88ee_query_rxphystatus(hw, pstatus, pdesc, p_drvinfo,
+                                   match_bssid, packet_toself, packet_beacon);
+        _rtl88ee_smart_antenna(hw, pstatus);
+        rtl_process_phyinfo(hw, tmp_buf, pstatus);
+}
+
+static void insert_em(struct rtl_tcb_desc *ptcb_desc, u8 *virtualaddress)
+{
+        u32 dwtmp = 0;
+
+        memset(virtualaddress, 0, 8);
+
+        SET_EARLYMODE_PKTNUM(virtualaddress, ptcb_desc->empkt_num);
+        if (ptcb_desc->empkt_num == 1) {
+                dwtmp = ptcb_desc->empkt_len[0];
+        } else {
+                dwtmp = ptcb_desc->empkt_len[0];
+                dwtmp += ((dwtmp % 4) ? (4 - dwtmp % 4) : 0) + 4;
+                dwtmp += ptcb_desc->empkt_len[1];
+        }
+        SET_EARLYMODE_LEN0(virtualaddress, dwtmp);
+
+        if (ptcb_desc->empkt_num <= 3) {
+                dwtmp = ptcb_desc->empkt_len[2];
+        } else {
+                dwtmp = ptcb_desc->empkt_len[2];
+                dwtmp += ((dwtmp % 4) ? (4 - dwtmp % 4) : 0) + 4;
+                dwtmp += ptcb_desc->empkt_len[3];
+        }
+        SET_EARLYMODE_LEN1(virtualaddress, dwtmp);
+        if (ptcb_desc->empkt_num <= 5) {
+                dwtmp = ptcb_desc->empkt_len[4];
+        } else {
+                dwtmp = ptcb_desc->empkt_len[4];
+                dwtmp += ((dwtmp % 4) ? (4 - dwtmp % 4) : 0) + 4;
+                dwtmp += ptcb_desc->empkt_len[5];
+        }
+        SET_EARLYMODE_LEN2_1(virtualaddress, dwtmp & 0xF);
+        SET_EARLYMODE_LEN2_2(virtualaddress, dwtmp >> 4);
+        if (ptcb_desc->empkt_num <= 7) {
+                dwtmp = ptcb_desc->empkt_len[6];
+        } else {
+                dwtmp = ptcb_desc->empkt_len[6];
+                dwtmp += ((dwtmp % 4) ? (4 - dwtmp % 4) : 0) + 4;
+                dwtmp += ptcb_desc->empkt_len[7];
+        }
+        SET_EARLYMODE_LEN3(virtualaddress, dwtmp);
+        if (ptcb_desc->empkt_num <= 9) {
+                dwtmp = ptcb_desc->empkt_len[8];
+        } else {
+                dwtmp = ptcb_desc->empkt_len[8];
+                dwtmp += ((dwtmp % 4) ? (4 - dwtmp % 4) : 0) + 4;
+                dwtmp += ptcb_desc->empkt_len[9];
+        }
+        SET_EARLYMODE_LEN4(virtualaddress, dwtmp);
+}
+
+bool rtl88ee_rx_query_desc(struct ieee80211_hw *hw,
+                           struct rtl_stats *status,
+                           struct ieee80211_rx_status *rx_status,
+                           u8 *pdesc, struct sk_buff *skb)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rx_fwinfo_88e *p_drvinfo;
+        struct ieee80211_hdr *hdr;
+
+        u32 phystatus = GET_RX_DESC_PHYST(pdesc);
+        status->packet_report_type = (u8)GET_RX_STATUS_DESC_RPT_SEL(pdesc);
+        if (status->packet_report_type == TX_REPORT2)
+                status->length = (u16) GET_RX_RPT2_DESC_PKT_LEN(pdesc);
+        else
+                status->length = (u16) GET_RX_DESC_PKT_LEN(pdesc);
+        status->rx_drvinfo_size = (u8) GET_RX_DESC_DRV_INFO_SIZE(pdesc) *
+                                       RX_DRV_INFO_SIZE_UNIT;
+        status->rx_bufshift = (u8) (GET_RX_DESC_SHIFT(pdesc) & 0x03);
+        status->icv = (u16) GET_RX_DESC_ICV(pdesc);
+        status->crc = (u16) GET_RX_DESC_CRC32(pdesc);
+        status->hwerror = (status->crc | status->icv);
+        status->decrypted = !GET_RX_DESC_SWDEC(pdesc);
+        status->rate = (u8) GET_RX_DESC_RXMCS(pdesc);
+        status->shortpreamble = (u16) GET_RX_DESC_SPLCP(pdesc);
+        status->isampdu = (bool) (GET_RX_DESC_PAGGR(pdesc) == 1);
+        status->isfirst_ampdu = (bool) ((GET_RX_DESC_PAGGR(pdesc) == 1) &&
+                                        (GET_RX_DESC_FAGGR(pdesc) == 1));
+        if (status->packet_report_type == NORMAL_RX)
+                status->timestamp_low = GET_RX_DESC_TSFL(pdesc);
+        status->rx_is40Mhzpacket = (bool) GET_RX_DESC_BW(pdesc);
+        status->is_ht = (bool)GET_RX_DESC_RXHT(pdesc);
+
+        status->is_cck = RTL8188_RX_HAL_IS_CCK_RATE(status->rate);
+
+        status->macid = GET_RX_DESC_MACID(pdesc);
+        if (GET_RX_STATUS_DESC_MAGIC_MATCH(pdesc))
+                status->wake_match = BIT(2);
+        else if (GET_RX_STATUS_DESC_MAGIC_MATCH(pdesc))
+                status->wake_match = BIT(1);
+        else if (GET_RX_STATUS_DESC_UNICAST_MATCH(pdesc))
+                status->wake_match = BIT(0);
+        else
+                status->wake_match = 0;
+        if (status->wake_match)
+                RT_TRACE(rtlpriv, COMP_RXDESC, DBG_LOUD,
+                         "Get Wakeup Packet!! WakeMatch =%d\n",
+                         status->wake_match);
+        rx_status->freq = hw->conf.chandef.chan->center_freq;
+        rx_status->band = hw->conf.chandef.chan->band;
+
+        if (status->crc)
+                rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
+
+        if (status->rx_is40Mhzpacket)
+                rx_status->flag |= RX_FLAG_40MHZ;
+
+        if (status->is_ht)
+                rx_status->flag |= RX_FLAG_HT;
+
+        rx_status->flag |= RX_FLAG_MACTIME_START;
+
+        /* hw will set status->decrypted true, if it finds the
+         * frame is open data frame or mgmt frame.
+         * So hw will not decryption robust managment frame
+         * for IEEE80211w but still set status->decrypted
+         * true, so here we should set it back to undecrypted
+         * for IEEE80211w frame, and mac80211 sw will help
+         * to decrypt it
+         */
+        if (status->decrypted) {
+                hdr = (struct ieee80211_hdr *)(skb->data +
+                       status->rx_drvinfo_size + status->rx_bufshift);
+
+                if (!hdr) {
+                        /* During testing, hdr was NULL */
+                        return false;
+                }
+                if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
+                    (ieee80211_has_protected(hdr->frame_control)))
+                        rx_status->flag &= ~RX_FLAG_DECRYPTED;
+                else
+                        rx_status->flag |= RX_FLAG_DECRYPTED;
+        }
+
+        /* rate_idx: index of data rate into band's
+         * supported rates or MCS index if HT rates
+         * are use (RX_FLAG_HT)
+         * Notice: this is diff with windows define
+         */
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   status->rate, false);
+
+        rx_status->mactime = status->timestamp_low;
+        if (phystatus == true) {
+                p_drvinfo = (struct rx_fwinfo_88e *)(skb->data +
+                                                     status->rx_bufshift);
+
+                _rtl88ee_translate_rx_signal_stuff(hw, skb, status, pdesc,
+                                                   p_drvinfo);
+        }
+
+        /*rx_status->qual = status->signal; */
+        rx_status->signal = status->recvsignalpower + 10;
+        /*rx_status->noise = -status->noise; */
+        if (status->packet_report_type == TX_REPORT2) {
+                status->macid_valid_entry[0] =
+                         GET_RX_RPT2_DESC_MACID_VALID_1(pdesc);
+                status->macid_valid_entry[1] =
+                         GET_RX_RPT2_DESC_MACID_VALID_2(pdesc);
+        }
+        return true;
+}
+
+void rtl88ee_tx_fill_desc(struct ieee80211_hw *hw,
+                          struct ieee80211_hdr *hdr, u8 *pdesc_tx,
+                          struct ieee80211_tx_info *info,
+                          struct ieee80211_sta *sta,
+                          struct sk_buff *skb,
+                          u8 hw_queue, struct rtl_tcb_desc *ptcb_desc)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
+        u8 *pdesc = (u8 *)pdesc_tx;
+        u16 seq_number;
+        __le16 fc = hdr->frame_control;
+        unsigned int buf_len = 0;
+        unsigned int skb_len = skb->len;
+        u8 fw_qsel = _rtl88ee_map_hwqueue_to_fwqueue(skb, hw_queue);
+        bool firstseg = ((hdr->seq_ctrl &
+                            cpu_to_le16(IEEE80211_SCTL_FRAG)) == 0);
+        bool lastseg = ((hdr->frame_control &
+                           cpu_to_le16(IEEE80211_FCTL_MOREFRAGS)) == 0);
+        dma_addr_t mapping;
+        u8 bw_40 = 0;
+        u8 short_gi = 0;
+
+        if (mac->opmode == NL80211_IFTYPE_STATION) {
+                bw_40 = mac->bw_40;
+        } else if (mac->opmode == NL80211_IFTYPE_AP ||
+                mac->opmode == NL80211_IFTYPE_ADHOC) {
+                if (sta)
+                        bw_40 = sta->ht_cap.cap &
+                                IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        }
+        seq_number = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
+        rtl_get_tcb_desc(hw, info, sta, skb, ptcb_desc);
+        /* reserve 8 byte for AMPDU early mode */
+        if (rtlhal->earlymode_enable) {
+                skb_push(skb, EM_HDR_LEN);
+                memset(skb->data, 0, EM_HDR_LEN);
+        }
+        buf_len = skb->len;
+        mapping = pci_map_single(rtlpci->pdev, skb->data, skb->len,
+                                 PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
+        CLEAR_PCI_TX_DESC_CONTENT(pdesc, sizeof(struct tx_desc_88e));
+        if (ieee80211_is_nullfunc(fc) || ieee80211_is_ctl(fc)) {
+                firstseg = true;
+                lastseg = true;
+        }
+        if (firstseg) {
+                if (rtlhal->earlymode_enable) {
+                        SET_TX_DESC_PKT_OFFSET(pdesc, 1);
+                        SET_TX_DESC_OFFSET(pdesc, USB_HWDESC_HEADER_LEN +
+                                           EM_HDR_LEN);
+                        if (ptcb_desc->empkt_num) {
+                                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                                         "Insert 8 byte.pTcb->EMPktNum:%d\n",
+                                         ptcb_desc->empkt_num);
+                                insert_em(ptcb_desc, (u8 *)(skb->data));
+                        }
+                } else {
+                        SET_TX_DESC_OFFSET(pdesc, USB_HWDESC_HEADER_LEN);
+                }
+
+                ptcb_desc->use_driver_rate = true;
+                SET_TX_DESC_TX_RATE(pdesc, ptcb_desc->hw_rate);
+                if (ptcb_desc->hw_rate > DESC92C_RATEMCS0)
+                        short_gi = (ptcb_desc->use_shortgi) ? 1 : 0;
+                else
+                        short_gi = (ptcb_desc->use_shortpreamble) ? 1 : 0;
+                SET_TX_DESC_DATA_SHORTGI(pdesc, short_gi);
+
+                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
+                        SET_TX_DESC_AGG_ENABLE(pdesc, 1);
+                        SET_TX_DESC_MAX_AGG_NUM(pdesc, 0x14);
+                }
+                SET_TX_DESC_SEQ(pdesc, seq_number);
+                SET_TX_DESC_RTS_ENABLE(pdesc, ((ptcb_desc->rts_enable &&
+                                              !ptcb_desc->cts_enable) ? 1 : 0));
+                SET_TX_DESC_HW_RTS_ENABLE(pdesc, 0);
+                SET_TX_DESC_CTS2SELF(pdesc, ((ptcb_desc->cts_enable) ? 1 : 0));
+                SET_TX_DESC_RTS_STBC(pdesc, ((ptcb_desc->rts_stbc) ? 1 : 0));
+
+                SET_TX_DESC_RTS_RATE(pdesc, ptcb_desc->rts_rate);
+                SET_TX_DESC_RTS_BW(pdesc, 0);
+                SET_TX_DESC_RTS_SC(pdesc, ptcb_desc->rts_sc);
+                SET_TX_DESC_RTS_SHORT(pdesc,
+                        ((ptcb_desc->rts_rate <= DESC92C_RATE54M) ?
+                        (ptcb_desc->rts_use_shortpreamble ? 1 : 0) :
+                        (ptcb_desc->rts_use_shortgi ? 1 : 0)));
+
+                if (ptcb_desc->btx_enable_sw_calc_duration)
+                        SET_TX_DESC_NAV_USE_HDR(pdesc, 1);
+
+                if (bw_40) {
+                        if (ptcb_desc->packet_bw) {
+                                SET_TX_DESC_DATA_BW(pdesc, 1);
+                                SET_TX_DESC_TX_SUB_CARRIER(pdesc, 3);
+                        } else {
+                                SET_TX_DESC_DATA_BW(pdesc, 0);
+                                SET_TX_DESC_TX_SUB_CARRIER(pdesc,
+                                                   mac->cur_40_prime_sc);
+                        }
+                } else {
+                        SET_TX_DESC_DATA_BW(pdesc, 0);
+                        SET_TX_DESC_TX_SUB_CARRIER(pdesc, 0);
+                }
+
+                SET_TX_DESC_LINIP(pdesc, 0);
+                SET_TX_DESC_PKT_SIZE(pdesc, (u16) skb_len);
+                if (sta) {
+                        u8 ampdu_density = sta->ht_cap.ampdu_density;
+                        SET_TX_DESC_AMPDU_DENSITY(pdesc, ampdu_density);
+                }
+                if (info->control.hw_key) {
+                        struct ieee80211_key_conf *keyconf;
+                        keyconf = info->control.hw_key;
+                        switch (keyconf->cipher) {
+                        case WLAN_CIPHER_SUITE_WEP40:
+                        case WLAN_CIPHER_SUITE_WEP104:
+                        case WLAN_CIPHER_SUITE_TKIP:
+                                SET_TX_DESC_SEC_TYPE(pdesc, 0x1);
+                                break;
+                        case WLAN_CIPHER_SUITE_CCMP:
+                                SET_TX_DESC_SEC_TYPE(pdesc, 0x3);
+                                break;
+                        default:
+                                SET_TX_DESC_SEC_TYPE(pdesc, 0x0);
+                                break;
+                        }
+                }
+
+                SET_TX_DESC_QUEUE_SEL(pdesc, fw_qsel);
+                SET_TX_DESC_DATA_RATE_FB_LIMIT(pdesc, 0x1F);
+                SET_TX_DESC_RTS_RATE_FB_LIMIT(pdesc, 0xF);
+                SET_TX_DESC_DISABLE_FB(pdesc, ptcb_desc->disable_ratefallback ?
+                                       1 : 0);
+                SET_TX_DESC_USE_RATE(pdesc, ptcb_desc->use_driver_rate ? 1 : 0);
+
+                /* Set TxRate and RTSRate in TxDesc  */
+                /* This prevent Tx initial rate of new-coming packets */
+                /* from being overwritten by retried  packet rate.*/
+                if (!ptcb_desc->use_driver_rate) {
+                        /*SET_TX_DESC_RTS_RATE(pdesc, 0x08); */
+                        /* SET_TX_DESC_TX_RATE(pdesc, 0x0b); */
+                }
+                if (ieee80211_is_data_qos(fc)) {
+                        if (mac->rdg_en) {
+                                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                                         "Enable RDG function.\n");
+                                SET_TX_DESC_RDG_ENABLE(pdesc, 1);
+                                SET_TX_DESC_HTC(pdesc, 1);
+                        }
+                }
+        }
+
+        SET_TX_DESC_FIRST_SEG(pdesc, (firstseg ? 1 : 0));
+        SET_TX_DESC_LAST_SEG(pdesc, (lastseg ? 1 : 0));
+        SET_TX_DESC_TX_BUFFER_SIZE(pdesc, (u16) buf_len);
+        SET_TX_DESC_TX_BUFFER_ADDRESS(pdesc, mapping);
+        if (rtlpriv->dm.useramask) {
+                SET_TX_DESC_RATE_ID(pdesc, ptcb_desc->ratr_index);
+                SET_TX_DESC_MACID(pdesc, ptcb_desc->mac_id);
+        } else {
+                SET_TX_DESC_RATE_ID(pdesc, 0xC + ptcb_desc->ratr_index);
+                SET_TX_DESC_MACID(pdesc, ptcb_desc->ratr_index);
+        }
+        if (ieee80211_is_data_qos(fc))
+                SET_TX_DESC_QOS(pdesc, 1);
+
+        if (!ieee80211_is_data_qos(fc))
+                SET_TX_DESC_HWSEQ_EN(pdesc, 1);
+        SET_TX_DESC_MORE_FRAG(pdesc, (lastseg ? 0 : 1));
+        if (is_multicast_ether_addr(ieee80211_get_DA(hdr)) ||
+            is_broadcast_ether_addr(ieee80211_get_DA(hdr)))
+                SET_TX_DESC_BMC(pdesc, 1);
+
+        rtl88e_dm_set_tx_ant_by_tx_info(hw, pdesc, ptcb_desc->mac_id);
+        RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE, "\n");
+}
+
+void rtl88ee_tx_fill_cmddesc(struct ieee80211_hw *hw,
+                             u8 *pdesc, bool firstseg,
+                             bool lastseg, struct sk_buff *skb)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        u8 fw_queue = QSLT_BEACON;
+
+        dma_addr_t mapping = pci_map_single(rtlpci->pdev,
+                                            skb->data, skb->len,
+                                            PCI_DMA_TODEVICE);
+
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)(skb->data);
+        __le16 fc = hdr->frame_control;
+
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
+        CLEAR_PCI_TX_DESC_CONTENT(pdesc, TX_DESC_SIZE);
+
+        if (firstseg)
+                SET_TX_DESC_OFFSET(pdesc, USB_HWDESC_HEADER_LEN);
+
+        SET_TX_DESC_TX_RATE(pdesc, DESC92C_RATE1M);
+
+        SET_TX_DESC_SEQ(pdesc, 0);
+
+        SET_TX_DESC_LINIP(pdesc, 0);
+
+        SET_TX_DESC_QUEUE_SEL(pdesc, fw_queue);
+
+        SET_TX_DESC_FIRST_SEG(pdesc, 1);
+        SET_TX_DESC_LAST_SEG(pdesc, 1);
+
+        SET_TX_DESC_TX_BUFFER_SIZE(pdesc, (u16)(skb->len));
+
+        SET_TX_DESC_TX_BUFFER_ADDRESS(pdesc, mapping);
+
+        SET_TX_DESC_RATE_ID(pdesc, 7);
+        SET_TX_DESC_MACID(pdesc, 0);
+
+        SET_TX_DESC_OWN(pdesc, 1);
+
+        SET_TX_DESC_PKT_SIZE((u8 *)pdesc, (u16)(skb->len));
+
+        SET_TX_DESC_FIRST_SEG(pdesc, 1);
+        SET_TX_DESC_LAST_SEG(pdesc, 1);
+
+        SET_TX_DESC_OFFSET(pdesc, 0x20);
+
+        SET_TX_DESC_USE_RATE(pdesc, 1);
+
+        if (!ieee80211_is_data_qos(fc))
+                SET_TX_DESC_HWSEQ_EN(pdesc, 1);
+
+        RT_PRINT_DATA(rtlpriv, COMP_CMD, DBG_LOUD,
+                      "H2C Tx Cmd Content\n",
+                      pdesc, TX_DESC_SIZE);
+}
+
+void rtl88ee_set_desc(u8 *pdesc, bool istx, u8 desc_name, u8 *val)
+{
+        if (istx == true) {
+                switch (desc_name) {
+                case HW_DESC_OWN:
+                        SET_TX_DESC_OWN(pdesc, 1);
+                        break;
+                case HW_DESC_TX_NEXTDESC_ADDR:
+                        SET_TX_DESC_NEXT_DESC_ADDRESS(pdesc, *(u32 *)val);
+                        break;
+                default:
+                        RT_ASSERT(false, "ERR txdesc :%d not processed\n",
+                                  desc_name);
+                        break;
+                }
+        } else {
+                switch (desc_name) {
+                case HW_DESC_RXOWN:
+                        SET_RX_DESC_OWN(pdesc, 1);
+                        break;
+                case HW_DESC_RXBUFF_ADDR:
+                        SET_RX_DESC_BUFF_ADDR(pdesc, *(u32 *)val);
+                        break;
+                case HW_DESC_RXPKT_LEN:
+                        SET_RX_DESC_PKT_LEN(pdesc, *(u32 *)val);
+                        break;
+                case HW_DESC_RXERO:
+                        SET_RX_DESC_EOR(pdesc, 1);
+                        break;
+                default:
+                        RT_ASSERT(false, "ERR rxdesc :%d not processed\n",
+                                  desc_name);
+                        break;
+                }
+        }
+}
+
+u32 rtl88ee_get_desc(u8 *pdesc, bool istx, u8 desc_name)
+{
+        u32 ret = 0;
+
+        if (istx == true) {
+                switch (desc_name) {
+                case HW_DESC_OWN:
+                        ret = GET_TX_DESC_OWN(pdesc);
+                        break;
+                case HW_DESC_TXBUFF_ADDR:
+                        ret = GET_TX_DESC_TX_BUFFER_ADDRESS(pdesc);
+                        break;
+                default:
+                        RT_ASSERT(false, "ERR txdesc :%d not processed\n",
+                                  desc_name);
+                        break;
+                }
+        } else {
+                switch (desc_name) {
+                case HW_DESC_OWN:
+                        ret = GET_RX_DESC_OWN(pdesc);
+                        break;
+                case HW_DESC_RXPKT_LEN:
+                        ret = GET_RX_DESC_PKT_LEN(pdesc);
+                        break;
+                default:
+                        RT_ASSERT(false, "ERR rxdesc :%d not processed\n",
+                                  desc_name);
+                        break;
+                }
+        }
+        return ret;
+}
+
+void rtl88ee_tx_polling(struct ieee80211_hw *hw, u8 hw_queue)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        if (hw_queue == BEACON_QUEUE) {
+                rtl_write_word(rtlpriv, REG_PCIE_CTRL_REG, BIT(4));
+        } else {
+                rtl_write_word(rtlpriv, REG_PCIE_CTRL_REG,
+                               BIT(0) << (hw_queue));
+        }
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.h b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.h
new file mode 100644
index 000000000000..d3a02e73f53a
--- /dev/null
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.h
@@ -0,0 +1,795 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009-2013  Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * wlanfae <wlanfae@realtek.com>
+ * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
+ * Hsinchu 300, Taiwan.
+ *
+ * Larry Finger <Larry.Finger@lwfinger.net>
+ *
+ *****************************************************************************/
+
+#ifndef __RTL92CE_TRX_H__
+#define __RTL92CE_TRX_H__
+
+#define TX_DESC_SIZE                            64
+#define TX_DESC_AGGR_SUBFRAME_SIZE              32
+
+#define RX_DESC_SIZE                            32
+#define RX_DRV_INFO_SIZE_UNIT                   8
+
+#define TX_DESC_NEXT_DESC_OFFSET                40
+#define USB_HWDESC_HEADER_LEN                   32
+#define CRCLENGTH                               4
+
+#define SET_TX_DESC_PKT_SIZE(__pdesc, __val)            \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 0, 16, __val)
+#define SET_TX_DESC_OFFSET(__pdesc, __val)              \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 16, 8, __val)
+#define SET_TX_DESC_BMC(__pdesc, __val)                 \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 24, 1, __val)
+#define SET_TX_DESC_HTC(__pdesc, __val)                 \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 25, 1, __val)
+#define SET_TX_DESC_LAST_SEG(__pdesc, __val)            \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 26, 1, __val)
+#define SET_TX_DESC_FIRST_SEG(__pdesc, __val)           \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 27, 1, __val)
+#define SET_TX_DESC_LINIP(__pdesc, __val)               \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 28, 1, __val)
+#define SET_TX_DESC_NO_ACM(__pdesc, __val)              \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 29, 1, __val)
+#define SET_TX_DESC_GF(__pdesc, __val)                  \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 30, 1, __val)
+#define SET_TX_DESC_OWN(__pdesc, __val)                 \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 31, 1, __val)
+
+#define GET_TX_DESC_PKT_SIZE(__pdesc)                   \
+        LE_BITS_TO_4BYTE(__pdesc, 0, 16)
+#define GET_TX_DESC_OFFSET(__pdesc)                     \
+        LE_BITS_TO_4BYTE(__pdesc, 16, 8)
+#define GET_TX_DESC_BMC(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc, 24, 1)
+#define GET_TX_DESC_HTC(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc, 25, 1)
+#define GET_TX_DESC_LAST_SEG(__pdesc)                   \
+        LE_BITS_TO_4BYTE(__pdesc, 26, 1)
+#define GET_TX_DESC_FIRST_SEG(__pdesc)                  \
+        LE_BITS_TO_4BYTE(__pdesc, 27, 1)
+#define GET_TX_DESC_LINIP(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc, 28, 1)
+#define GET_TX_DESC_NO_ACM(__pdesc)                     \
+        LE_BITS_TO_4BYTE(__pdesc, 29, 1)
+#define GET_TX_DESC_GF(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc, 30, 1)
+#define GET_TX_DESC_OWN(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc, 31, 1)
+
+#define SET_TX_DESC_MACID(__pdesc, __val)               \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 0, 6, __val)
+#define SET_TX_DESC_QUEUE_SEL(__pdesc, __val)           \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 8, 5, __val)
+#define SET_TX_DESC_RDG_NAV_EXT(__pdesc, __val)         \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 13, 1, __val)
+#define SET_TX_DESC_LSIG_TXOP_EN(__pdesc, __val)        \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 14, 1, __val)
+#define SET_TX_DESC_PIFS(__pdesc, __val)                \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 15, 1, __val)
+#define SET_TX_DESC_RATE_ID(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 16, 4, __val)
+#define SET_TX_DESC_NAV_USE_HDR(__pdesc, __val) \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 20, 1, __val)
+#define SET_TX_DESC_EN_DESC_ID(__pdesc, __val)          \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 21, 1, __val)
+#define SET_TX_DESC_SEC_TYPE(__pdesc, __val)            \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 22, 2, __val)
+#define SET_TX_DESC_PKT_OFFSET(__pdesc, __val)          \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 26, 5, __val)
+#define SET_TX_DESC_PADDING_LEN(__pdesc, __val)         \
+        SET_BITS_TO_LE_4BYTE(__pdesc+4, 24, 8, __val)
+
+#define GET_TX_DESC_MACID(__pdesc)                              \
+        LE_BITS_TO_4BYTE(__pdesc+4, 0, 5)
+#define GET_TX_DESC_AGG_ENABLE(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+4, 5, 1)
+#define GET_TX_DESC_AGG_BREAK(__pdesc)                          \
+        LE_BITS_TO_4BYTE(__pdesc+4, 6, 1)
+#define GET_TX_DESC_RDG_ENABLE(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+4, 7, 1)
+#define GET_TX_DESC_QUEUE_SEL(__pdesc)                          \
+        LE_BITS_TO_4BYTE(__pdesc+4, 8, 5)
+#define GET_TX_DESC_RDG_NAV_EXT(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc+4, 13, 1)
+#define GET_TX_DESC_LSIG_TXOP_EN(__pdesc)                       \
+        LE_BITS_TO_4BYTE(__pdesc+4, 14, 1)
+#define GET_TX_DESC_PIFS(__pdesc)                               \
+        LE_BITS_TO_4BYTE(__pdesc+4, 15, 1)
+#define GET_TX_DESC_RATE_ID(__pdesc)                            \
+        LE_BITS_TO_4BYTE(__pdesc+4, 16, 4)
+#define GET_TX_DESC_NAV_USE_HDR(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc+4, 20, 1)
+#define GET_TX_DESC_EN_DESC_ID(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+4, 21, 1)
+#define GET_TX_DESC_SEC_TYPE(__pdesc)                           \
+        LE_BITS_TO_4BYTE(__pdesc+4, 22, 2)
+#define GET_TX_DESC_PKT_OFFSET(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+4, 24, 8)
+
+#define SET_TX_DESC_RTS_RC(__pdesc, __val)                      \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 0, 6, __val)
+#define SET_TX_DESC_DATA_RC(__pdesc, __val)                     \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 6, 6, __val)
+#define SET_TX_DESC_AGG_ENABLE(__pdesc, __val)                  \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 12, 1, __val)
+#define SET_TX_DESC_RDG_ENABLE(__pdesc, __val)                  \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 13, 1, __val)
+#define SET_TX_DESC_BAR_RTY_TH(__pdesc, __val)                  \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 14, 2, __val)
+#define SET_TX_DESC_AGG_BREAK(__pdesc, __val)                   \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 16, 1, __val)
+#define SET_TX_DESC_MORE_FRAG(__pdesc, __val)                   \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 17, 1, __val)
+#define SET_TX_DESC_RAW(__pdesc, __val)                         \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 18, 1, __val)
+#define SET_TX_DESC_CCX(__pdesc, __val)                         \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 19, 1, __val)
+#define SET_TX_DESC_AMPDU_DENSITY(__pdesc, __val)               \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 20, 3, __val)
+#define SET_TX_DESC_BT_INT(__pdesc, __val)                      \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 23, 1, __val)
+#define SET_TX_DESC_ANTSEL_A(__pdesc, __val)                    \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 24, 1, __val)
+#define SET_TX_DESC_ANTSEL_B(__pdesc, __val)                    \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 25, 1, __val)
+#define SET_TX_DESC_TX_ANT_CCK(__pdesc, __val)                  \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 26, 2, __val)
+#define SET_TX_DESC_TX_ANTL(__pdesc, __val)                     \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 28, 2, __val)
+#define SET_TX_DESC_TX_ANT_HT(__pdesc, __val)                   \
+        SET_BITS_TO_LE_4BYTE(__pdesc+8, 30, 2, __val)
+
+#define GET_TX_DESC_RTS_RC(__pdesc)                             \
+        LE_BITS_TO_4BYTE(__pdesc+8, 0, 6)
+#define GET_TX_DESC_DATA_RC(__pdesc)                            \
+        LE_BITS_TO_4BYTE(__pdesc+8, 6, 6)
+#define GET_TX_DESC_BAR_RTY_TH(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+8, 14, 2)
+#define GET_TX_DESC_MORE_FRAG(__pdesc)                          \
+        LE_BITS_TO_4BYTE(__pdesc+8, 17, 1)
+#define GET_TX_DESC_RAW(__pdesc)                                \
+        LE_BITS_TO_4BYTE(__pdesc+8, 18, 1)
+#define GET_TX_DESC_CCX(__pdesc)                                \
+        LE_BITS_TO_4BYTE(__pdesc+8, 19, 1)
+#define GET_TX_DESC_AMPDU_DENSITY(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc+8, 20, 3)
+#define GET_TX_DESC_ANTSEL_A(__pdesc)                           \
+        LE_BITS_TO_4BYTE(__pdesc+8, 24, 1)
+#define GET_TX_DESC_ANTSEL_B(__pdesc)                           \
+        LE_BITS_TO_4BYTE(__pdesc+8, 25, 1)
+#define GET_TX_DESC_TX_ANT_CCK(__pdesc)                 \
+        LE_BITS_TO_4BYTE(__pdesc+8, 26, 2)
+#define GET_TX_DESC_TX_ANTL(__pdesc)                            \
+        LE_BITS_TO_4BYTE(__pdesc+8, 28, 2)
+#define GET_TX_DESC_TX_ANT_HT(__pdesc)                          \
+        LE_BITS_TO_4BYTE(__pdesc+8, 30, 2)
+
+#define SET_TX_DESC_NEXT_HEAP_PAGE(__pdesc, __val)      \
+        SET_BITS_TO_LE_4BYTE(__pdesc+12, 0, 8, __val)
+#define SET_TX_DESC_TAIL_PAGE(__pdesc, __val)           \
+        SET_BITS_TO_LE_4BYTE(__pdesc+12, 8, 8, __val)
+#define SET_TX_DESC_SEQ(__pdesc, __val)                 \
+        SET_BITS_TO_LE_4BYTE(__pdesc+12, 16, 12, __val)
+#define SET_TX_DESC_CPU_HANDLE(__pdesc, __val)                  \
+        SET_BITS_TO_LE_4BYTE(__pdesc+12, 28, 1, __val)
+#define SET_TX_DESC_TAG1(__pdesc, __val)                        \
+        SET_BITS_TO_LE_4BYTE(__pdesc+12, 29, 1, __val)
+#define SET_TX_DESC_TRIGGER_INT(__pdesc, __val)                 \
+        SET_BITS_TO_LE_4BYTE(__pdesc+12, 30, 1, __val)
+#define SET_TX_DESC_HWSEQ_EN(__pdesc, __val)                    \
+        SET_BITS_TO_LE_4BYTE(__pdesc+12, 31, 1, __val)
+
+
+#define GET_TX_DESC_NEXT_HEAP_PAGE(__pdesc)             \
+        LE_BITS_TO_4BYTE(__pdesc+12, 0, 8)
+#define GET_TX_DESC_TAIL_PAGE(__pdesc)                          \
+        LE_BITS_TO_4BYTE(__pdesc+12, 8, 8)
+#define GET_TX_DESC_SEQ(__pdesc)                                        \
+        LE_BITS_TO_4BYTE(__pdesc+12, 16, 12)
+
+
+#define SET_TX_DESC_RTS_RATE(__pdesc, __val)            \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 0, 5, __val)
+#define SET_TX_DESC_AP_DCFE(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 5, 1, __val)
+#define SET_TX_DESC_QOS(__pdesc, __val)                 \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 6, 1, __val)
+#define SET_TX_DESC_HWSEQ_SSN(__pdesc, __val)           \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 7, 1, __val)
+#define SET_TX_DESC_USE_RATE(__pdesc, __val)            \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 8, 1, __val)
+#define SET_TX_DESC_DISABLE_RTS_FB(__pdesc, __val)      \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 9, 1, __val)
+#define SET_TX_DESC_DISABLE_FB(__pdesc, __val)          \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 10, 1, __val)
+#define SET_TX_DESC_CTS2SELF(__pdesc, __val)            \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 11, 1, __val)
+#define SET_TX_DESC_RTS_ENABLE(__pdesc, __val)          \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 12, 1, __val)
+#define SET_TX_DESC_HW_RTS_ENABLE(__pdesc, __val)       \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 13, 1, __val)
+#define SET_TX_DESC_PORT_ID(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 14, 1, __val)
+#define SET_TX_DESC_PWR_STATUS(__pdesc, __val)          \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 15, 3, __val)
+#define SET_TX_DESC_WAIT_DCTS(__pdesc, __val)           \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 18, 1, __val)
+#define SET_TX_DESC_CTS2AP_EN(__pdesc, __val)           \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 19, 1, __val)
+#define SET_TX_DESC_TX_SUB_CARRIER(__pdesc, __val)      \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 20, 2, __val)
+#define SET_TX_DESC_TX_STBC(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 22, 2, __val)
+#define SET_TX_DESC_DATA_SHORT(__pdesc, __val)          \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 24, 1, __val)
+#define SET_TX_DESC_DATA_BW(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 25, 1, __val)
+#define SET_TX_DESC_RTS_SHORT(__pdesc, __val)           \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 26, 1, __val)
+#define SET_TX_DESC_RTS_BW(__pdesc, __val)              \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 27, 1, __val)
+#define SET_TX_DESC_RTS_SC(__pdesc, __val)              \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 28, 2, __val)
+#define SET_TX_DESC_RTS_STBC(__pdesc, __val)            \
+        SET_BITS_TO_LE_4BYTE(__pdesc+16, 30, 2, __val)
+
+#define GET_TX_DESC_RTS_RATE(__pdesc)                   \
+        LE_BITS_TO_4BYTE(__pdesc+16, 0, 5)
+#define GET_TX_DESC_AP_DCFE(__pdesc)                    \
+        LE_BITS_TO_4BYTE(__pdesc+16, 5, 1)
+#define GET_TX_DESC_QOS(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc+16, 6, 1)
+#define GET_TX_DESC_HWSEQ_EN(__pdesc)                   \
+        LE_BITS_TO_4BYTE(__pdesc+16, 7, 1)
+#define GET_TX_DESC_USE_RATE(__pdesc)                   \
+        LE_BITS_TO_4BYTE(__pdesc+16, 8, 1)
+#define GET_TX_DESC_DISABLE_RTS_FB(__pdesc)             \
+        LE_BITS_TO_4BYTE(__pdesc+16, 9, 1)
+#define GET_TX_DESC_DISABLE_FB(__pdesc)                 \
+        LE_BITS_TO_4BYTE(__pdesc+16, 10, 1)
+#define GET_TX_DESC_CTS2SELF(__pdesc)                   \
+        LE_BITS_TO_4BYTE(__pdesc+16, 11, 1)
+#define GET_TX_DESC_RTS_ENABLE(__pdesc)                 \
+        LE_BITS_TO_4BYTE(__pdesc+16, 12, 1)
+#define GET_TX_DESC_HW_RTS_ENABLE(__pdesc)              \
+        LE_BITS_TO_4BYTE(__pdesc+16, 13, 1)
+#define GET_TX_DESC_PORT_ID(__pdesc)                    \
+        LE_BITS_TO_4BYTE(__pdesc+16, 14, 1)
+#define GET_TX_DESC_WAIT_DCTS(__pdesc)                  \
+        LE_BITS_TO_4BYTE(__pdesc+16, 18, 1)
+#define GET_TX_DESC_CTS2AP_EN(__pdesc)                  \
+        LE_BITS_TO_4BYTE(__pdesc+16, 19, 1)
+#define GET_TX_DESC_TX_SUB_CARRIER(__pdesc)             \
+        LE_BITS_TO_4BYTE(__pdesc+16, 20, 2)
+#define GET_TX_DESC_TX_STBC(__pdesc)                    \
+        LE_BITS_TO_4BYTE(__pdesc+16, 22, 2)
+#define GET_TX_DESC_DATA_SHORT(__pdesc)                 \
+        LE_BITS_TO_4BYTE(__pdesc+16, 24, 1)
+#define GET_TX_DESC_DATA_BW(__pdesc)                    \
+        LE_BITS_TO_4BYTE(__pdesc+16, 25, 1)
+#define GET_TX_DESC_RTS_SHORT(__pdesc)                  \
+        LE_BITS_TO_4BYTE(__pdesc+16, 26, 1)
+#define GET_TX_DESC_RTS_BW(__pdesc)                     \
+        LE_BITS_TO_4BYTE(__pdesc+16, 27, 1)
+#define GET_TX_DESC_RTS_SC(__pdesc)                     \
+        LE_BITS_TO_4BYTE(__pdesc+16, 28, 2)
+#define GET_TX_DESC_RTS_STBC(__pdesc)                   \
+        LE_BITS_TO_4BYTE(__pdesc+16, 30, 2)
+
+#define SET_TX_DESC_TX_RATE(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc+20, 0, 6, __val)
+#define SET_TX_DESC_DATA_SHORTGI(__pdesc, __val)        \
+        SET_BITS_TO_LE_4BYTE(__pdesc+20, 6, 1, __val)
+#define SET_TX_DESC_CCX_TAG(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc+20, 7, 1, __val)
+#define SET_TX_DESC_DATA_RATE_FB_LIMIT(__pdesc, __val)  \
+        SET_BITS_TO_LE_4BYTE(__pdesc+20, 8, 5, __val)
+#define SET_TX_DESC_RTS_RATE_FB_LIMIT(__pdesc, __val)   \
+        SET_BITS_TO_LE_4BYTE(__pdesc+20, 13, 4, __val)
+#define SET_TX_DESC_RETRY_LIMIT_ENABLE(__pdesc, __val)  \
+        SET_BITS_TO_LE_4BYTE(__pdesc+20, 17, 1, __val)
+#define SET_TX_DESC_DATA_RETRY_LIMIT(__pdesc, __val)    \
+        SET_BITS_TO_LE_4BYTE(__pdesc+20, 18, 6, __val)
+#define SET_TX_DESC_USB_TXAGG_NUM(__pdesc, __val)       \
+        SET_BITS_TO_LE_4BYTE(__pdesc+20, 24, 8, __val)
+
+#define GET_TX_DESC_TX_RATE(__pdesc)                    \
+        LE_BITS_TO_4BYTE(__pdesc+20, 0, 6)
+#define GET_TX_DESC_DATA_SHORTGI(__pdesc)               \
+        LE_BITS_TO_4BYTE(__pdesc+20, 6, 1)
+#define GET_TX_DESC_CCX_TAG(__pdesc)                    \
+        LE_BITS_TO_4BYTE(__pdesc+20, 7, 1)
+#define GET_TX_DESC_DATA_RATE_FB_LIMIT(__pdesc)         \
+        LE_BITS_TO_4BYTE(__pdesc+20, 8, 5)
+#define GET_TX_DESC_RTS_RATE_FB_LIMIT(__pdesc)          \
+        LE_BITS_TO_4BYTE(__pdesc+20, 13, 4)
+#define GET_TX_DESC_RETRY_LIMIT_ENABLE(__pdesc)         \
+        LE_BITS_TO_4BYTE(__pdesc+20, 17, 1)
+#define GET_TX_DESC_DATA_RETRY_LIMIT(__pdesc)           \
+        LE_BITS_TO_4BYTE(__pdesc+20, 18, 6)
+#define GET_TX_DESC_USB_TXAGG_NUM(__pdesc)              \
+        LE_BITS_TO_4BYTE(__pdesc+20, 24, 8)
+
+#define SET_TX_DESC_TXAGC_A(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc+24, 0, 5, __val)
+#define SET_TX_DESC_TXAGC_B(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc+24, 5, 5, __val)
+#define SET_TX_DESC_USE_MAX_LEN(__pdesc, __val)         \
+        SET_BITS_TO_LE_4BYTE(__pdesc+24, 10, 1, __val)
+#define SET_TX_DESC_MAX_AGG_NUM(__pdesc, __val)         \
+        SET_BITS_TO_LE_4BYTE(__pdesc+24, 11, 5, __val)
+#define SET_TX_DESC_MCSG1_MAX_LEN(__pdesc, __val)       \
+        SET_BITS_TO_LE_4BYTE(__pdesc+24, 16, 4, __val)
+#define SET_TX_DESC_MCSG2_MAX_LEN(__pdesc, __val)       \
+        SET_BITS_TO_LE_4BYTE(__pdesc+24, 20, 4, __val)
+#define SET_TX_DESC_MCSG3_MAX_LEN(__pdesc, __val)       \
+        SET_BITS_TO_LE_4BYTE(__pdesc+24, 24, 4, __val)
+#define SET_TX_DESC_MCS7_SGI_MAX_LEN(__pdesc, __val)    \
+        SET_BITS_TO_LE_4BYTE(__pdesc+24, 28, 4, __val)
+
+#define GET_TX_DESC_TXAGC_A(__pdesc)                    \
+        LE_BITS_TO_4BYTE(__pdesc+24, 0, 5)
+#define GET_TX_DESC_TXAGC_B(__pdesc)                    \
+        LE_BITS_TO_4BYTE(__pdesc+24, 5, 5)
+#define GET_TX_DESC_USE_MAX_LEN(__pdesc)                \
+        LE_BITS_TO_4BYTE(__pdesc+24, 10, 1)
+#define GET_TX_DESC_MAX_AGG_NUM(__pdesc)                \
+        LE_BITS_TO_4BYTE(__pdesc+24, 11, 5)
+#define GET_TX_DESC_MCSG1_MAX_LEN(__pdesc)              \
+        LE_BITS_TO_4BYTE(__pdesc+24, 16, 4)
+#define GET_TX_DESC_MCSG2_MAX_LEN(__pdesc)              \
+        LE_BITS_TO_4BYTE(__pdesc+24, 20, 4)
+#define GET_TX_DESC_MCSG3_MAX_LEN(__pdesc)              \
+        LE_BITS_TO_4BYTE(__pdesc+24, 24, 4)
+#define GET_TX_DESC_MCS7_SGI_MAX_LEN(__pdesc)           \
+        LE_BITS_TO_4BYTE(__pdesc+24, 28, 4)
+
+#define SET_TX_DESC_TX_BUFFER_SIZE(__pdesc, __val)      \
+        SET_BITS_TO_LE_4BYTE(__pdesc+28, 0, 16, __val)
+#define SET_TX_DESC_SW_OFFSET30(__pdesc, __val)         \
+        SET_BITS_TO_LE_4BYTE(__pdesc+28, 16, 8, __val)
+#define SET_TX_DESC_SW_OFFSET31(__pdesc, __val)         \
+        SET_BITS_TO_LE_4BYTE(__pdesc+28, 24, 4, __val)
+#define SET_TX_DESC_ANTSEL_C(__pdesc, __val)            \
+        SET_BITS_TO_LE_4BYTE(__pdesc+28, 29, 1, __val)
+#define SET_TX_DESC_NULL_0(__pdesc, __val)              \
+        SET_BITS_TO_LE_4BYTE(__pdesc+28, 30, 1, __val)
+#define SET_TX_DESC_NULL_1(__pdesc, __val)              \
+        SET_BITS_TO_LE_4BYTE(__pdesc+28, 30, 1, __val)
+
+#define GET_TX_DESC_TX_BUFFER_SIZE(__pdesc)             \
+        LE_BITS_TO_4BYTE(__pdesc+28, 0, 16)
+
+
+#define SET_TX_DESC_TX_BUFFER_ADDRESS(__pdesc, __val)   \
+        SET_BITS_TO_LE_4BYTE(__pdesc+32, 0, 32, __val)
+#define SET_TX_DESC_TX_BUFFER_ADDRESS64(__pdesc, __val) \
+        SET_BITS_TO_LE_4BYTE(__pdesc+36, 0, 32, __val)
+
+#define GET_TX_DESC_TX_BUFFER_ADDRESS(__pdesc)          \
+        LE_BITS_TO_4BYTE(__pdesc+32, 0, 32)
+#define GET_TX_DESC_TX_BUFFER_ADDRESS64(__pdesc)        \
+        LE_BITS_TO_4BYTE(__pdesc+36, 0, 32)
+
+#define SET_TX_DESC_NEXT_DESC_ADDRESS(__pdesc, __val)   \
+        SET_BITS_TO_LE_4BYTE(__pdesc+40, 0, 32, __val)
+#define SET_TX_DESC_NEXT_DESC_ADDRESS64(__pdesc, __val) \
+        SET_BITS_TO_LE_4BYTE(__pdesc+44, 0, 32, __val)
+
+#define GET_TX_DESC_NEXT_DESC_ADDRESS(__pdesc)          \
+        LE_BITS_TO_4BYTE(__pdesc+40, 0, 32)
+#define GET_TX_DESC_NEXT_DESC_ADDRESS64(__pdesc)        \
+        LE_BITS_TO_4BYTE(__pdesc+44, 0, 32)
+
+#define GET_RX_DESC_PKT_LEN(__pdesc)                    \
+        LE_BITS_TO_4BYTE(__pdesc, 0, 14)
+#define GET_RX_DESC_CRC32(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc, 14, 1)
+#define GET_RX_DESC_ICV(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc, 15, 1)
+#define GET_RX_DESC_DRV_INFO_SIZE(__pdesc)              \
+        LE_BITS_TO_4BYTE(__pdesc, 16, 4)
+#define GET_RX_DESC_SECURITY(__pdesc)                   \
+        LE_BITS_TO_4BYTE(__pdesc, 20, 3)
+#define GET_RX_DESC_QOS(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc, 23, 1)
+#define GET_RX_DESC_SHIFT(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc, 24, 2)
+#define GET_RX_DESC_PHYST(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc, 26, 1)
+#define GET_RX_DESC_SWDEC(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc, 27, 1)
+#define GET_RX_DESC_LS(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc, 28, 1)
+#define GET_RX_DESC_FS(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc, 29, 1)
+#define GET_RX_DESC_EOR(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc, 30, 1)
+#define GET_RX_DESC_OWN(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc, 31, 1)
+
+#define SET_RX_DESC_PKT_LEN(__pdesc, __val)             \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 0, 14, __val)
+#define SET_RX_DESC_EOR(__pdesc, __val)                 \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 30, 1, __val)
+#define SET_RX_DESC_OWN(__pdesc, __val)                 \
+        SET_BITS_TO_LE_4BYTE(__pdesc, 31, 1, __val)
+
+#define GET_RX_DESC_MACID(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc+4, 0, 6)
+#define GET_RX_DESC_PAGGR(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc+4, 14, 1)
+#define GET_RX_DESC_FAGGR(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc+4, 15, 1)
+#define GET_RX_DESC_A1_FIT(__pdesc)                     \
+        LE_BITS_TO_4BYTE(__pdesc+4, 16, 4)
+#define GET_RX_DESC_A2_FIT(__pdesc)                     \
+        LE_BITS_TO_4BYTE(__pdesc+4, 20, 4)
+#define GET_RX_DESC_PAM(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc+4, 24, 1)
+#define GET_RX_DESC_PWR(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc+4, 25, 1)
+#define GET_RX_DESC_MD(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+4, 26, 1)
+#define GET_RX_DESC_MF(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+4, 27, 1)
+#define GET_RX_DESC_TYPE(__pdesc)                       \
+        LE_BITS_TO_4BYTE(__pdesc+4, 28, 2)
+#define GET_RX_DESC_MC(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+4, 30, 1)
+#define GET_RX_DESC_BC(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+4, 31, 1)
+#define GET_RX_DESC_SEQ(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc+8, 0, 12)
+#define GET_RX_DESC_FRAG(__pdesc)                       \
+        LE_BITS_TO_4BYTE(__pdesc+8, 12, 4)
+
+#define GET_RX_DESC_RXMCS(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc+12, 0, 6)
+#define GET_RX_DESC_RXHT(__pdesc)                       \
+        LE_BITS_TO_4BYTE(__pdesc+12, 6, 1)
+#define GET_RX_STATUS_DESC_RX_GF(__pdesc)               \
+        LE_BITS_TO_4BYTE(__pdesc+12, 7, 1)
+#define GET_RX_DESC_SPLCP(__pdesc)                      \
+        LE_BITS_TO_4BYTE(__pdesc+12, 8, 1)
+#define GET_RX_DESC_BW(__pdesc)                         \
+        LE_BITS_TO_4BYTE(__pdesc+12, 9, 1)
+#define GET_RX_DESC_HTC(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc+12, 10, 1)
+#define GET_RX_STATUS_DESC_EOSP(__pdesc)                \
+        LE_BITS_TO_4BYTE(__pdesc+12, 11, 1)
+#define GET_RX_STATUS_DESC_BSSID_FIT(__pdesc)           \
+        LE_BITS_TO_4BYTE(__pdesc+12, 12, 2)
+#define GET_RX_STATUS_DESC_RPT_SEL(__pdesc)             \
+        LE_BITS_TO_4BYTE(__pdesc+12, 14, 2)
+
+#define GET_RX_STATUS_DESC_PATTERN_MATCH(__pdesc)       \
+        LE_BITS_TO_4BYTE(__pdesc+12, 29, 1)
+#define GET_RX_STATUS_DESC_UNICAST_MATCH(__pdesc)       \
+        LE_BITS_TO_4BYTE(__pdesc+12, 30, 1)
+#define GET_RX_STATUS_DESC_MAGIC_MATCH(__pdesc)         \
+        LE_BITS_TO_4BYTE(__pdesc+12, 31, 1)
+
+#define GET_RX_DESC_IV1(__pdesc)                        \
+        LE_BITS_TO_4BYTE(__pdesc+16, 0, 32)
+#define GET_RX_DESC_TSFL(__pdesc)                       \
+        LE_BITS_TO_4BYTE(__pdesc+20, 0, 32)
+
+#define GET_RX_DESC_BUFF_ADDR(__pdesc)                  \
+        LE_BITS_TO_4BYTE(__pdesc+24, 0, 32)
+#define GET_RX_DESC_BUFF_ADDR64(__pdesc)                \
+        LE_BITS_TO_4BYTE(__pdesc+28, 0, 32)
+
+#define SET_RX_DESC_BUFF_ADDR(__pdesc, __val)   \
+        SET_BITS_TO_LE_4BYTE(__pdesc+24, 0, 32, __val)
+#define SET_RX_DESC_BUFF_ADDR64(__pdesc, __val) \
+        SET_BITS_TO_LE_4BYTE(__pdesc+28, 0, 32, __val)
+
+/* TX report 2 format in Rx desc*/
+
+#define GET_RX_RPT2_DESC_PKT_LEN(__status)      \
+        LE_BITS_TO_4BYTE(__status, 0, 9)
+#define GET_RX_RPT2_DESC_MACID_VALID_1(__status)        \
+        LE_BITS_TO_4BYTE(__status+16, 0, 32)
+#define GET_RX_RPT2_DESC_MACID_VALID_2(__status)        \
+        LE_BITS_TO_4BYTE(__status+20, 0, 32)
+
+#define SET_EARLYMODE_PKTNUM(__paddr, __value)  \
+        SET_BITS_TO_LE_4BYTE(__paddr, 0, 4, __value)
+#define SET_EARLYMODE_LEN0(__paddr, __value)    \
+        SET_BITS_TO_LE_4BYTE(__paddr, 4, 12, __value)
+#define SET_EARLYMODE_LEN1(__paddr, __value)    \
+        SET_BITS_TO_LE_4BYTE(__paddr, 16, 12, __value)
+#define SET_EARLYMODE_LEN2_1(__paddr, __value)  \
+        SET_BITS_TO_LE_4BYTE(__paddr, 28, 4, __value)
+#define SET_EARLYMODE_LEN2_2(__paddr, __value)  \
+        SET_BITS_TO_LE_4BYTE(__paddr+4, 0, 8, __value)
+#define SET_EARLYMODE_LEN3(__paddr, __value)    \
+        SET_BITS_TO_LE_4BYTE(__paddr+4, 8, 12, __value)
+#define SET_EARLYMODE_LEN4(__paddr, __value)    \
+        SET_BITS_TO_LE_4BYTE(__paddr+4, 20, 12, __value)
+
+#define CLEAR_PCI_TX_DESC_CONTENT(__pdesc, _size)               \
+do {                                                            \
+        if (_size > TX_DESC_NEXT_DESC_OFFSET)                   \
+                memset(__pdesc, 0, TX_DESC_NEXT_DESC_OFFSET);   \
+        else                                                    \
+                memset(__pdesc, 0, _size);                      \
+} while (0)
+
+#define RTL8188_RX_HAL_IS_CCK_RATE(rxmcs)\
+        (rxmcs == DESC92C_RATE1M ||\
+         rxmcs == DESC92C_RATE2M ||\
+         rxmcs == DESC92C_RATE5_5M ||\
+         rxmcs == DESC92C_RATE11M)
+
+struct phy_rx_agc_info_t {
+        #if __LITTLE_ENDIAN
+                u8      gain:7, trsw:1;
+        #else
+                u8      trsw:1, gain:7;
+        #endif
+};
+struct phy_status_rpt {
+        struct phy_rx_agc_info_t path_agc[2];
+        u8      ch_corr[2];
+        u8      cck_sig_qual_ofdm_pwdb_all;
+        u8      cck_agc_rpt_ofdm_cfosho_a;
+        u8      cck_rpt_b_ofdm_cfosho_b;
+        u8      rsvd_1;
+        u8      noise_power_db_msb;
+        u8      path_cfotail[2];
+        u8      pcts_mask[2];
+        u8      stream_rxevm[2];
+        u8      path_rxsnr[2];
+        u8      noise_power_db_lsb;
+        u8      rsvd_2[3];
+        u8      stream_csi[2];
+        u8      stream_target_csi[2];
+        u8      sig_evm;
+        u8      rsvd_3;
+#if __LITTLE_ENDIAN
+        u8      antsel_rx_keep_2:1;     /*ex_intf_flg:1;*/
+        u8      sgi_en:1;
+        u8      rxsc:2;
+        u8      idle_long:1;
+        u8      r_ant_train_en:1;
+        u8      ant_sel_b:1;
+        u8      ant_sel:1;
+#else   /* _BIG_ENDIAN_ */
+        u8      ant_sel:1;
+        u8      ant_sel_b:1;
+        u8      r_ant_train_en:1;
+        u8      idle_long:1;
+        u8      rxsc:2;
+        u8      sgi_en:1;
+        u8      antsel_rx_keep_2:1;     /*ex_intf_flg:1;*/
+#endif
+} __packed;
+
+struct rx_fwinfo_88e {
+        u8 gain_trsw[4];
+        u8 pwdb_all;
+        u8 cfosho[4];
+        u8 cfotail[4];
+        char rxevm[2];
+        char rxsnr[4];
+        u8 pdsnr[2];
+        u8 csi_current[2];
+        u8 csi_target[2];
+        u8 sigevm;
+        u8 max_ex_pwr;
+        u8 ex_intf_flag:1;
+        u8 sgi_en:1;
+        u8 rxsc:2;
+        u8 reserve:4;
+} __packed;
+
+struct tx_desc_88e {
+        u32 pktsize:16;
+        u32 offset:8;
+        u32 bmc:1;
+        u32 htc:1;
+        u32 lastseg:1;
+        u32 firstseg:1;
+        u32 linip:1;
+        u32 noacm:1;
+        u32 gf:1;
+        u32 own:1;
+
+        u32 macid:6;
+        u32 rsvd0:2;
+        u32 queuesel:5;
+        u32 rd_nav_ext:1;
+        u32 lsig_txop_en:1;
+        u32 pifs:1;
+        u32 rateid:4;
+        u32 nav_usehdr:1;
+        u32 en_descid:1;
+        u32 sectype:2;
+        u32 pktoffset:8;
+
+        u32 rts_rc:6;
+        u32 data_rc:6;
+        u32 agg_en:1;
+        u32 rdg_en:1;
+        u32 bar_retryht:2;
+        u32 agg_break:1;
+        u32 morefrag:1;
+        u32 raw:1;
+        u32 ccx:1;
+        u32 ampdudensity:3;
+        u32 bt_int:1;
+        u32 ant_sela:1;
+        u32 ant_selb:1;
+        u32 txant_cck:2;
+        u32 txant_l:2;
+        u32 txant_ht:2;
+
+        u32 nextheadpage:8;
+        u32 tailpage:8;
+        u32 seq:12;
+        u32 cpu_handle:1;
+        u32 tag1:1;
+        u32 trigger_int:1;
+        u32 hwseq_en:1;
+
+        u32 rtsrate:5;
+        u32 apdcfe:1;
+        u32 qos:1;
+        u32 hwseq_ssn:1;
+        u32 userrate:1;
+        u32 dis_rtsfb:1;
+        u32 dis_datafb:1;
+        u32 cts2self:1;
+        u32 rts_en:1;
+        u32 hwrts_en:1;
+        u32 portid:1;
+        u32 pwr_status:3;
+        u32 waitdcts:1;
+        u32 cts2ap_en:1;
+        u32 txsc:2;
+        u32 stbc:2;
+        u32 txshort:1;
+        u32 txbw:1;
+        u32 rtsshort:1;
+        u32 rtsbw:1;
+        u32 rtssc:2;
+        u32 rtsstbc:2;
+
+        u32 txrate:6;
+        u32 shortgi:1;
+        u32 ccxt:1;
+        u32 txrate_fb_lmt:5;
+        u32 rtsrate_fb_lmt:4;
+        u32 retrylmt_en:1;
+        u32 txretrylmt:6;
+        u32 usb_txaggnum:8;
+
+        u32 txagca:5;
+        u32 txagcb:5;
+        u32 usemaxlen:1;
+        u32 maxaggnum:5;
+        u32 mcsg1maxlen:4;
+        u32 mcsg2maxlen:4;
+        u32 mcsg3maxlen:4;
+        u32 mcs7sgimaxlen:4;
+
+        u32 txbuffersize:16;
+        u32 sw_offset30:8;
+        u32 sw_offset31:4;
+        u32 rsvd1:1;
+        u32 antsel_c:1;
+        u32 null_0:1;
+        u32 null_1:1;
+
+        u32 txbuffaddr;
+        u32 txbufferaddr64;
+        u32 nextdescaddress;
+        u32 nextdescaddress64;
+
+        u32 reserve_pass_pcie_mm_limit[4];
+} __packed;
+
+struct rx_desc_88e {
+        u32 length:14;
+        u32 crc32:1;
+        u32 icverror:1;
+        u32 drv_infosize:4;
+        u32 security:3;
+        u32 qos:1;
+        u32 shift:2;
+        u32 phystatus:1;
+        u32 swdec:1;
+        u32 lastseg:1;
+        u32 firstseg:1;
+        u32 eor:1;
+        u32 own:1;
+
+        u32 macid:6;
+        u32 tid:4;
+        u32 hwrsvd:5;
+        u32 paggr:1;
+        u32 faggr:1;
+        u32 a1_fit:4;
+        u32 a2_fit:4;
+        u32 pam:1;
+        u32 pwr:1;
+        u32 moredata:1;
+        u32 morefrag:1;
+        u32 type:2;
+        u32 mc:1;
+        u32 bc:1;
+
+        u32 seq:12;
+        u32 frag:4;
+        u32 nextpktlen:14;
+        u32 nextind:1;
+        u32 rsvd:1;
+
+        u32 rxmcs:6;
+        u32 rxht:1;
+        u32 amsdu:1;
+        u32 splcp:1;
+        u32 bandwidth:1;
+        u32 htc:1;
+        u32 tcpchk_rpt:1;
+        u32 ipcchk_rpt:1;
+        u32 tcpchk_valid:1;
+        u32 hwpcerr:1;
+        u32 hwpcind:1;
+        u32 iv0:16;
+
+        u32 iv1;
+
+        u32 tsfl;
+
+        u32 bufferaddress;
+        u32 bufferaddress64;
+
+} __packed;
+
+void rtl88ee_tx_fill_desc(struct ieee80211_hw *hw,
+                          struct ieee80211_hdr *hdr, u8 *pdesc_tx,
+                          struct ieee80211_tx_info *info,
+                          struct ieee80211_sta *sta,
+                          struct sk_buff *skb,
+                          u8 hw_queue, struct rtl_tcb_desc *ptcb_desc);
+bool rtl88ee_rx_query_desc(struct ieee80211_hw *hw,
+                           struct rtl_stats *status,
+                           struct ieee80211_rx_status *rx_status,
+                           u8 *pdesc, struct sk_buff *skb);
+void rtl88ee_set_desc(u8 *pdesc, bool istx, u8 desc_name, u8 *val);
+u32 rtl88ee_get_desc(u8 *pdesc, bool istx, u8 desc_name);
+void rtl88ee_tx_polling(struct ieee80211_hw *hw, u8 hw_queue);
+void rtl88ee_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
+                             bool b_firstseg, bool b_lastseg,
+                             struct sk_buff *skb);
+
+#endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
index b793a659a465..926e2a34c766 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
@@ -174,8 +174,8 @@ static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
         dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
         dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
         dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_range_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_range_min = DM_DIG_MIN;
+        dm_digtable->rx_gain_max = DM_DIG_MAX;
+        dm_digtable->rx_gain_min = DM_DIG_MIN;
         dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
         dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
         dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
@@ -300,11 +300,11 @@ static void rtl92c_dm_ctrl_initgain_by_rssi(struct ieee80211_hw *hw)
         }
 
         if ((digtable->rssi_val_min + 10 - digtable->back_val) >
-            digtable->rx_gain_range_max)
-                digtable->cur_igvalue = digtable->rx_gain_range_max;
+            digtable->rx_gain_max)
+                digtable->cur_igvalue = digtable->rx_gain_max;
         else if ((digtable->rssi_val_min + 10 -
-                  digtable->back_val) < digtable->rx_gain_range_min)
-                digtable->cur_igvalue = digtable->rx_gain_range_min;
+                  digtable->back_val) < digtable->rx_gain_min)
+                digtable->cur_igvalue = digtable->rx_gain_min;
         else
                 digtable->cur_igvalue = digtable->rssi_val_min + 10 -
                     digtable->back_val;
@@ -1147,75 +1147,6 @@ void rtl92c_dm_init_rate_adaptive_mask(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(rtl92c_dm_init_rate_adaptive_mask);
 
-static void rtl92c_dm_refresh_rate_adaptive_mask(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        struct rate_adaptive *p_ra = &(rtlpriv->ra);
-        u32 low_rssi_thresh, high_rssi_thresh;
-        struct ieee80211_sta *sta = NULL;
-
-        if (is_hal_stop(rtlhal)) {
-                RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
-                         "<---- driver is going to unload\n");
-                return;
-        }
-
-        if (!rtlpriv->dm.useramask) {
-                RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
-                         "<---- driver does not control rate adaptive mask\n");
-                return;
-        }
-
-        if (mac->link_state == MAC80211_LINKED &&
-            mac->opmode == NL80211_IFTYPE_STATION) {
-                switch (p_ra->pre_ratr_state) {
-                case DM_RATR_STA_HIGH:
-                        high_rssi_thresh = 50;
-                        low_rssi_thresh = 20;
-                        break;
-                case DM_RATR_STA_MIDDLE:
-                        high_rssi_thresh = 55;
-                        low_rssi_thresh = 20;
-                        break;
-                case DM_RATR_STA_LOW:
-                        high_rssi_thresh = 50;
-                        low_rssi_thresh = 25;
-                        break;
-                default:
-                        high_rssi_thresh = 50;
-                        low_rssi_thresh = 20;
-                        break;
-                }
-
-                if (rtlpriv->dm.undec_sm_pwdb > (long)high_rssi_thresh)
-                        p_ra->ratr_state = DM_RATR_STA_HIGH;
-                else if (rtlpriv->dm.undec_sm_pwdb > (long)low_rssi_thresh)
-                        p_ra->ratr_state = DM_RATR_STA_MIDDLE;
-                else
-                        p_ra->ratr_state = DM_RATR_STA_LOW;
-
-                if (p_ra->pre_ratr_state != p_ra->ratr_state) {
-                        RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD, "RSSI = %ld\n",
-                                 rtlpriv->dm.undec_sm_pwdb);
-                        RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
-                                 "RSSI_LEVEL = %d\n", p_ra->ratr_state);
-                        RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
-                                 "PreState = %d, CurState = %d\n",
-                                 p_ra->pre_ratr_state, p_ra->ratr_state);
-
-                        rcu_read_lock();
-                        sta = ieee80211_find_sta(mac->vif, mac->bssid);
-                        rtlpriv->cfg->ops->update_rate_tbl(hw, sta,
-                                        p_ra->ratr_state);
-
-                        p_ra->pre_ratr_state = p_ra->ratr_state;
-                        rcu_read_unlock();
-                }
-        }
-}
-
 static void rtl92c_dm_init_dynamic_bb_powersaving(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1437,6 +1368,9 @@ void rtl92c_dm_watchdog(struct ieee80211_hw *hw)
         rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_FWLPS_RF_ON,
                                       (u8 *) (&fw_ps_awake));
 
+        if (ppsc->p2p_ps_info.p2p_ps_mode)
+                fw_ps_awake = false;
+
         if ((ppsc->rfpwr_state == ERFON) && ((!fw_current_inpsmode) &&
                                              fw_ps_awake)
             && (!ppsc->rfchange_inprogress)) {
@@ -1446,7 +1380,7 @@ void rtl92c_dm_watchdog(struct ieee80211_hw *hw)
                 rtl92c_dm_dynamic_bb_powersaving(hw);
                 rtl92c_dm_dynamic_txpower(hw);
                 rtl92c_dm_check_txpower_tracking(hw);
-                rtl92c_dm_refresh_rate_adaptive_mask(hw);
+                /* rtl92c_dm_refresh_rate_adaptive_mask(hw); */
                 rtl92c_dm_bt_coexist(hw);
                 rtl92c_dm_check_edca_turbo(hw);
         }
@@ -1651,7 +1585,7 @@ static void rtl92c_bt_set_normal(struct ieee80211_hw *hw)
         }
 }
 
-static void rtl92c_bt_ant_isolation(struct ieee80211_hw *hw)
+static void rtl92c_bt_ant_isolation(struct ieee80211_hw *hw, u8 tmp1byte)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
@@ -1673,9 +1607,9 @@ static void rtl92c_bt_ant_isolation(struct ieee80211_hw *hw)
                             BT_RSSI_STATE_SPECIAL_LOW)) {
                         rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG, 0xa0);
                 } else if (rtlpcipriv->bt_coexist.bt_service == BT_PAN) {
-                        rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG, 0x00);
+                        rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG, tmp1byte);
                 } else {
-                        rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG, 0x00);
+                        rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG, tmp1byte);
                 }
         }
 
@@ -1726,12 +1660,17 @@ static void rtl92c_check_bt_change(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        u8 tmp1byte = 0;
 
+        if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version) &&
+            rtlpcipriv->bt_coexist.bt_coexistence)
+                tmp1byte |= BIT(5);
         if (rtlpcipriv->bt_coexist.bt_cur_state) {
                 if (rtlpcipriv->bt_coexist.bt_ant_isolation)
-                        rtl92c_bt_ant_isolation(hw);
+                        rtl92c_bt_ant_isolation(hw, tmp1byte);
         } else {
-                rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG, 0x00);
+                rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG, tmp1byte);
                 rtlpriv->cfg->ops->set_rfreg(hw, RF90_PATH_A, 0x1e, 0xf0,
                                 rtlpcipriv->bt_coexist.bt_rfreg_origin_1e);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index 883f23ae9519..04a41628ceed 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -552,7 +552,9 @@ void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode)
         RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, "FW LPS mode = %d\n", mode);
 
         SET_H2CCMD_PWRMODE_PARM_MODE(u1_h2c_set_pwrmode, mode);
-        SET_H2CCMD_PWRMODE_PARM_SMART_PS(u1_h2c_set_pwrmode, 1);
+        SET_H2CCMD_PWRMODE_PARM_SMART_PS(u1_h2c_set_pwrmode,
+                                         (rtlpriv->mac80211.p2p) ?
+                                         ppsc->smart_ps : 1);
         SET_H2CCMD_PWRMODE_PARM_BCN_PASS_TIME(u1_h2c_set_pwrmode,
                                               ppsc->reg_max_lps_awakeintvl);
 
@@ -808,3 +810,98 @@ void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus)
         rtl92c_fill_h2c_cmd(hw, H2C_JOINBSSRPT, 1, u1_joinbssrpt_parm);
 }
 EXPORT_SYMBOL(rtl92c_set_fw_joinbss_report_cmd);
+
+static void rtl92c_set_p2p_ctw_period_cmd(struct ieee80211_hw *hw, u8 ctwindow)
+{
+        u8 u1_ctwindow_period[1] = {ctwindow};
+
+        rtl92c_fill_h2c_cmd(hw, H2C_P2P_PS_CTW_CMD, 1, u1_ctwindow_period);
+}
+
+void rtl92c_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *rtlps = rtl_psc(rtl_priv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_p2p_ps_info *p2pinfo = &(rtlps->p2p_ps_info);
+        struct p2p_ps_offload_t *p2p_ps_offload = &rtlhal->p2p_ps_offload;
+        u8      i;
+        u16     ctwindow;
+        u32     start_time, tsf_low;
+
+        switch (p2p_ps_state) {
+        case P2P_PS_DISABLE:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_DISABLE\n");
+                memset(p2p_ps_offload, 0, sizeof(struct p2p_ps_offload_t));
+                break;
+        case P2P_PS_ENABLE:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_ENABLE\n");
+                /* update CTWindow value. */
+                if (p2pinfo->ctwindow > 0) {
+                        p2p_ps_offload->ctwindow_en = 1;
+                        ctwindow = p2pinfo->ctwindow;
+                        rtl92c_set_p2p_ctw_period_cmd(hw, ctwindow);
+                }
+                /* hw only support 2 set of NoA */
+                for (i = 0; i < p2pinfo->noa_num; i++) {
+                        /* To control the register setting for which NOA*/
+                        rtl_write_byte(rtlpriv, 0x5cf, (i << 4));
+                        if (i == 0)
+                                p2p_ps_offload->noa0_en = 1;
+                        else
+                                p2p_ps_offload->noa1_en = 1;
+
+                        /* config P2P NoA Descriptor Register */
+                        rtl_write_dword(rtlpriv, 0x5E0,
+                                        p2pinfo->noa_duration[i]);
+                        rtl_write_dword(rtlpriv, 0x5E4,
+                                        p2pinfo->noa_interval[i]);
+
+                        /*Get Current TSF value */
+                        tsf_low = rtl_read_dword(rtlpriv, REG_TSFTR);
+
+                        start_time = p2pinfo->noa_start_time[i];
+                        if (p2pinfo->noa_count_type[i] != 1) {
+                                while (start_time <= (tsf_low+(50*1024))) {
+                                        start_time += p2pinfo->noa_interval[i];
+                                        if (p2pinfo->noa_count_type[i] != 255)
+                                                p2pinfo->noa_count_type[i]--;
+                                }
+                        }
+                        rtl_write_dword(rtlpriv, 0x5E8, start_time);
+                        rtl_write_dword(rtlpriv, 0x5EC,
+                                        p2pinfo->noa_count_type[i]);
+                }
+
+                if ((p2pinfo->opp_ps == 1) || (p2pinfo->noa_num > 0)) {
+                        /* rst p2p circuit */
+                        rtl_write_byte(rtlpriv, REG_DUAL_TSF_RST, BIT(4));
+
+                        p2p_ps_offload->offload_en = 1;
+
+                        if (P2P_ROLE_GO == rtlpriv->mac80211.p2p) {
+                                p2p_ps_offload->role = 1;
+                                p2p_ps_offload->allstasleep = 0;
+                        } else {
+                                p2p_ps_offload->role = 0;
+                        }
+
+                        p2p_ps_offload->discovery = 0;
+                }
+                break;
+        case P2P_PS_SCAN:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_SCAN\n");
+                p2p_ps_offload->discovery = 1;
+                break;
+        case P2P_PS_SCAN_DONE:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_SCAN_DONE\n");
+                p2p_ps_offload->discovery = 0;
+                p2pinfo->p2p_ps_state = P2P_PS_ENABLE;
+                break;
+        default:
+                break;
+        }
+
+        rtl92c_fill_h2c_cmd(hw, H2C_P2P_PS_OFFLOAD, 1, (u8 *)p2p_ps_offload);
+}
+EXPORT_SYMBOL_GPL(rtl92c_set_p2p_ps_offload_cmd);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
index 780ea5b1e24c..15b2055e6212 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
@@ -67,6 +67,9 @@ enum rtl8192c_h2c_cmd {
         H2C_RSVDPAGE = 3,
         H2C_RSSI_REPORT = 5,
         H2C_RA_MASK = 6,
+        H2C_MACID_PS_MODE = 7,
+        H2C_P2P_PS_OFFLOAD = 8,
+        H2C_P2P_PS_CTW_CMD = 32,
         MAX_H2CCMD
 };
 
@@ -95,5 +98,6 @@ void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
 void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 void usb_writeN_async(struct rtl_priv *rtlpriv, u32 addr, void *data, u16 len);
+void rtl92c_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index 1b65db7fd651..a82b30a1996c 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -475,6 +475,9 @@ void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
 
                         break;
                 }
+        case HW_VAR_H2C_FW_P2P_PS_OFFLOAD:
+                rtl92c_set_p2p_ps_offload_cmd(hw, (*(u8 *)val));
+                break;
         case HW_VAR_AID:{
                         u16 u2btmp;
                         u2btmp = rtl_read_word(rtlpriv, REG_BCN_PSR_RPT);
@@ -505,6 +508,40 @@ void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                         break;
 
                 }
+        case HW_VAR_FW_LPS_ACTION: {
+                        bool enter_fwlps = *((bool *)val);
+                        u8 rpwm_val, fw_pwrmode;
+                        bool fw_current_inps;
+
+                        if (enter_fwlps) {
+                                rpwm_val = 0x02;        /* RF off */
+                                fw_current_inps = true;
+                                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                HW_VAR_FW_PSMODE_STATUS,
+                                                (u8 *)(&fw_current_inps));
+                                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                HW_VAR_H2C_FW_PWRMODE,
+                                                (u8 *)(&ppsc->fwctrl_psmode));
+
+                                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                HW_VAR_SET_RPWM,
+                                                (u8 *)(&rpwm_val));
+                        } else {
+                                rpwm_val = 0x0C;        /* RF on */
+                                fw_pwrmode = FW_PS_ACTIVE_MODE;
+                                fw_current_inps = false;
+                                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                HW_VAR_SET_RPWM,
+                                                (u8 *)(&rpwm_val));
+                                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                HW_VAR_H2C_FW_PWRMODE,
+                                                (u8 *)(&fw_pwrmode));
+
+                                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                HW_VAR_FW_PSMODE_STATUS,
+                                                (u8 *)(&fw_current_inps));
+                        }
+                break; }
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "switch case not processed\n");
@@ -1105,7 +1142,8 @@ static int _rtl92ce_set_media_status(struct ieee80211_hw *hw,
             type == NL80211_IFTYPE_STATION) {
                 _rtl92ce_stop_tx_beacon(hw);
                 _rtl92ce_enable_bcn_sub_func(hw);
-        } else if (type == NL80211_IFTYPE_ADHOC || type == NL80211_IFTYPE_AP) {
+        } else if (type == NL80211_IFTYPE_ADHOC || type == NL80211_IFTYPE_AP ||
+                   type == NL80211_IFTYPE_MESH_POINT) {
                 _rtl92ce_resume_tx_beacon(hw);
                 _rtl92ce_disable_bcn_sub_func(hw);
         } else {
@@ -1137,6 +1175,11 @@ static int _rtl92ce_set_media_status(struct ieee80211_hw *hw,
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to AP!\n");
                 break;
+        case NL80211_IFTYPE_MESH_POINT:
+                bt_msr |= MSR_ADHOC;
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+                         "Set Network type to Mesh Point!\n");
+                break;
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "Network type %d not supported!\n", type);
@@ -1184,7 +1227,8 @@ int rtl92ce_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
                 return -EOPNOTSUPP;
 
         if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
-                if (type != NL80211_IFTYPE_AP)
+                if (type != NL80211_IFTYPE_AP &&
+                    type != NL80211_IFTYPE_MESH_POINT)
                         rtl92ce_set_check_bssid(hw, true);
         } else {
                 rtl92ce_set_check_bssid(hw, false);
@@ -1459,7 +1503,7 @@ static void _rtl92ce_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                 }
 
                 for (i = 0; i < 14; i++) {
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF(%d)-Ch(%d) [CCK / HT40_1S / HT40_2S] = [0x%x / 0x%x / 0x%x]\n",
                                 rf_path, i,
                                 rtlefuse->txpwrlevel_cck[rf_path][i],
@@ -1500,11 +1544,11 @@ static void _rtl92ce_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                                       & 0xf0) >> 4);
                         }
 
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF-%d pwrgroup_ht20[%d] = 0x%x\n",
                                 rf_path, i,
                                 rtlefuse->pwrgroup_ht20[rf_path][i]);
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF-%d pwrgroup_ht40[%d] = 0x%x\n",
                                 rf_path, i,
                                 rtlefuse->pwrgroup_ht40[rf_path][i]);
@@ -1545,19 +1589,19 @@ static void _rtl92ce_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
             rtlefuse->txpwr_legacyhtdiff[RF90_PATH_A][7];
 
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-A Ht20 to HT40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_ht20diff[RF90_PATH_A][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-A Legacy to Ht40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_legacyhtdiff[RF90_PATH_A][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-B Ht20 to HT40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_ht20diff[RF90_PATH_B][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-B Legacy to HT40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_legacyhtdiff[RF90_PATH_B][i]);
 
@@ -1565,7 +1609,7 @@ static void _rtl92ce_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                 rtlefuse->eeprom_regulatory = (hwinfo[RF_OPTION1] & 0x7);
         else
                 rtlefuse->eeprom_regulatory = 0;
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "eeprom_regulatory = 0x%x\n", rtlefuse->eeprom_regulatory);
 
         if (!autoload_fail) {
@@ -1575,7 +1619,7 @@ static void _rtl92ce_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                 rtlefuse->eeprom_tssi[RF90_PATH_A] = EEPROM_DEFAULT_TSSI;
                 rtlefuse->eeprom_tssi[RF90_PATH_B] = EEPROM_DEFAULT_TSSI;
         }
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower, "TSSI_A = 0x%x, TSSI_B = 0x%x\n",
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER, "TSSI_A = 0x%x, TSSI_B = 0x%x\n",
                 rtlefuse->eeprom_tssi[RF90_PATH_A],
                 rtlefuse->eeprom_tssi[RF90_PATH_B]);
 
@@ -1589,7 +1633,7 @@ static void _rtl92ce_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                 rtlefuse->apk_thermalmeterignore = true;
 
         rtlefuse->thermalmeter[0] = rtlefuse->eeprom_thermalmeter;
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "thermalmeter = 0x%x\n", rtlefuse->eeprom_thermalmeter);
 }
 
@@ -1629,6 +1673,21 @@ static void _rtl92ce_read_adapter_info(struct ieee80211_hw *hw)
         if (rtlefuse->autoload_failflag)
                 return;
 
+        rtlefuse->eeprom_vid = *(u16 *)&hwinfo[EEPROM_VID];
+        rtlefuse->eeprom_did = *(u16 *)&hwinfo[EEPROM_DID];
+        rtlefuse->eeprom_svid = *(u16 *)&hwinfo[EEPROM_SVID];
+        rtlefuse->eeprom_smid = *(u16 *)&hwinfo[EEPROM_SMID];
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROMId = 0x%4x\n", eeprom_id);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
+
         for (i = 0; i < 6; i += 2) {
                 usvalue = *(u16 *)&hwinfo[EEPROM_MAC_ADDR + i];
                 *((u16 *) (&rtlefuse->dev_addr[i])) = usvalue;
@@ -1766,6 +1825,9 @@ static void rtl92ce_update_hal_rate_table(struct ieee80211_hw *hw,
                 ratr_value = sta->supp_rates[1] << 4;
         else
                 ratr_value = sta->supp_rates[0];
+        if (mac->opmode == NL80211_IFTYPE_ADHOC)
+                ratr_value = 0xfff;
+
         ratr_value |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
                         sta->ht_cap.mcs.rx_mask[0] << 12);
         switch (wirelessmode) {
@@ -1860,7 +1922,8 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
 
         sta_entry = (struct rtl_sta_info *) sta->drv_priv;
         wirelessmode = sta_entry->wireless_mode;
-        if (mac->opmode == NL80211_IFTYPE_STATION)
+        if (mac->opmode == NL80211_IFTYPE_STATION ||
+            mac->opmode == NL80211_IFTYPE_MESH_POINT)
                 curtxbw_40mhz = mac->bw_40;
         else if (mac->opmode == NL80211_IFTYPE_AP ||
                 mac->opmode == NL80211_IFTYPE_ADHOC)
@@ -1870,6 +1933,8 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
                 ratr_bitmap = sta->supp_rates[1] << 4;
         else
                 ratr_bitmap = sta->supp_rates[0];
+        if (mac->opmode == NL80211_IFTYPE_ADHOC)
+                ratr_bitmap = 0xfff;
         ratr_bitmap |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
                         sta->ht_cap.mcs.rx_mask[0] << 12);
         switch (wirelessmode) {
@@ -2135,7 +2200,8 @@ void rtl92ce_set_key(struct ieee80211_hw *hw, u32 key_index,
                                 macaddr = cam_const_broad;
                                 entry_id = key_index;
                         } else {
-                                if (mac->opmode == NL80211_IFTYPE_AP) {
+                                if (mac->opmode == NL80211_IFTYPE_AP ||
+                                    mac->opmode == NL80211_IFTYPE_MESH_POINT) {
                                         entry_id = rtl_cam_get_free_entry(hw,
                                                                  p_macaddr);
                                         if (entry_id >=  TOTAL_CAM_ENTRY) {
@@ -2157,7 +2223,8 @@ void rtl92ce_set_key(struct ieee80211_hw *hw, u32 key_index,
                         RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
                                  "delete one entry, entry_id is %d\n",
                                  entry_id);
-                        if (mac->opmode == NL80211_IFTYPE_AP)
+                        if (mac->opmode == NL80211_IFTYPE_AP ||
+                            mac->opmode == NL80211_IFTYPE_MESH_POINT)
                                 rtl_cam_del_entry(hw, p_macaddr);
                         rtl_cam_delete_one_entry(hw, p_macaddr, entry_id);
                 } else {
@@ -2338,3 +2405,24 @@ void rtl92ce_suspend(struct ieee80211_hw *hw)
 void rtl92ce_resume(struct ieee80211_hw *hw)
 {
 }
+
+/* Turn on AAP (RCR:bit 0) for promicuous mode. */
+void rtl92ce_allow_all_destaddr(struct ieee80211_hw *hw,
+        bool allow_all_da, bool write_into_reg)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+        if (allow_all_da) {/* Set BIT0 */
+                rtlpci->receive_config |= RCR_AAP;
+        } else {/* Clear BIT0 */
+                rtlpci->receive_config &= ~RCR_AAP;
+        }
+
+        if (write_into_reg)
+                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
+
+        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
+                 "receive_config=0x%08X, write_into_reg=%d\n",
+                 rtlpci->receive_config, write_into_reg);
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h
index 52a3aea9b3de..2d063b0c7760 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h
@@ -61,6 +61,8 @@ void rtl92ce_update_interrupt_mask(struct ieee80211_hw *hw,
 void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val);
 void rtl92ce_update_hal_rate_tbl(struct ieee80211_hw *hw,
                                  struct ieee80211_sta *sta, u8 rssi_level);
+void rtl92ce_update_hal_rate_tbl(struct ieee80211_hw *hw,
+                                 struct ieee80211_sta *sta, u8 rssi_level);
 void rtl92ce_update_channel_access_setting(struct ieee80211_hw *hw);
 bool rtl92ce_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 *valid);
 void rtl92ce_enable_hw_security_config(struct ieee80211_hw *hw);
@@ -74,5 +76,7 @@ void rtl8192ce_bt_reg_init(struct ieee80211_hw *hw);
 void rtl8192ce_bt_hw_init(struct ieee80211_hw *hw);
 void rtl92ce_suspend(struct ieee80211_hw *hw);
 void rtl92ce_resume(struct ieee80211_hw *hw);
+void rtl92ce_allow_all_destaddr(struct ieee80211_hw *hw,
+                                bool allow_all_da, bool write_into_reg);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h b/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h
index e4d738f6166d..bd4aef74c056 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h
@@ -544,6 +544,7 @@
 #define IMR_WLANOFF                             BIT(0)
 
 #define EFUSE_REAL_CONTENT_LEN                  512
+#define EFUSE_OOB_PROTECT_BYTES                 15
 
 #define EEPROM_DEFAULT_TSSI                     0x0
 #define EEPROM_DEFAULT_TXPOWERDIFF              0x0
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index 49f663bd93ff..14203561b6ee 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -228,6 +228,7 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .enable_hw_sec = rtl92ce_enable_hw_security_config,
         .set_key = rtl92ce_set_key,
         .init_sw_leds = rtl92ce_init_sw_leds,
+        .allow_all_destaddr = rtl92ce_allow_all_destaddr,
         .get_bbreg = rtl92c_phy_query_bb_reg,
         .set_bbreg = rtl92c_phy_set_bb_reg,
         .set_rfreg = rtl92ce_phy_set_rf_reg,
@@ -278,6 +279,7 @@ static struct rtl_hal_cfg rtl92ce_hal_cfg = {
         .maps[EFUSE_HWSET_MAX_SIZE] = HWSET_MAX_SIZE,
         .maps[EFUSE_MAX_SECTION_MAP] = EFUSE_MAX_SECTION,
         .maps[EFUSE_REAL_CONTENT_SIZE] = EFUSE_REAL_CONTENT_LEN,
+        .maps[EFUSE_OOB_PROTECT_BYTES_LEN] = EFUSE_OOB_PROTECT_BYTES,
 
         .maps[RWCAM] = REG_CAMCMD,
         .maps[WCAMI] = REG_CAMWRITE,
@@ -309,7 +311,7 @@ static struct rtl_hal_cfg rtl92ce_hal_cfg = {
 
         .maps[RTL_IMR_TXFOVW] = IMR_TXFOVW,
         .maps[RTL_IMR_PSTIMEOUT] = IMR_PSTIMEOUT,
-        .maps[RTL_IMR_BcnInt] = IMR_BCNINT,
+        .maps[RTL_IMR_BCNINT] = IMR_BCNINT,
         .maps[RTL_IMR_RXFOVW] = IMR_RXFOVW,
         .maps[RTL_IMR_RDU] = IMR_RDU,
         .maps[RTL_IMR_ATIMEND] = IMR_ATIMEND,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index 27e4ebd51091..6ad23b413eb3 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../pci.h"
 #include "../base.h"
+#include "../stats.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -42,7 +43,7 @@ static u8 _rtl92ce_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
 
         if (unlikely(ieee80211_is_beacon(fc)))
                 return QSLT_BEACON;
-        if (ieee80211_is_mgmt(fc))
+        if (ieee80211_is_mgmt(fc) || ieee80211_is_ctl(fc))
                 return QSLT_MGNT;
 
         return skb->priority;
@@ -78,16 +79,6 @@ static u8 _rtl92c_evm_db_to_percentage(char value)
         return ret_val;
 }
 
-static long _rtl92ce_translate_todbm(struct ieee80211_hw *hw,
-                                     u8 signal_strength_index)
-{
-        long signal_power;
-
-        signal_power = (long)((signal_strength_index + 1) >> 1);
-        signal_power -= 95;
-        return signal_power;
-}
-
 static long _rtl92ce_signal_scale_mapping(struct ieee80211_hw *hw,
                 long currsig)
 {
@@ -139,7 +130,6 @@ static void _rtl92ce_query_rxphystatus(struct ieee80211_hw *hw,
         pstats->packet_toself = packet_toself;
         pstats->is_cck = is_cck_rate;
         pstats->packet_beacon = packet_beacon;
-        pstats->is_cck = is_cck_rate;
         pstats->rx_mimo_sig_qual[0] = -1;
         pstats->rx_mimo_sig_qual[1] = -1;
 
@@ -192,10 +182,30 @@ static void _rtl92ce_query_rxphystatus(struct ieee80211_hw *hw,
                         }
                 }
 
-                pwdb_all = _rtl92c_query_rxpwrpercentage(rx_pwr_all);
+                pwdb_all = rtl_query_rxpwrpercentage(rx_pwr_all);
+                /* CCK gain is smaller than OFDM/MCS gain,
+                 * so we add gain diff by experiences,
+                 * the val is 6
+                 */
+                pwdb_all += 6;
+                if (pwdb_all > 100)
+                        pwdb_all = 100;
+                /* modify the offset to make the same
+                 * gain index with OFDM.
+                 */
+                if (pwdb_all > 34 && pwdb_all <= 42)
+                        pwdb_all -= 2;
+                else if (pwdb_all > 26 && pwdb_all <= 34)
+                        pwdb_all -= 6;
+                else if (pwdb_all > 14 && pwdb_all <= 26)
+                        pwdb_all -= 8;
+                else if (pwdb_all > 4 && pwdb_all <= 14)
+                        pwdb_all -= 4;
+
                 pstats->rx_pwdb_all = pwdb_all;
                 pstats->recvsignalpower = rx_pwr_all;
 
+                /* (3) Get Signal Quality (EVM) */
                 if (packet_match_bssid) {
                         u8 sq;
                         if (pstats->rx_pwdb_all > 40)
@@ -217,29 +227,38 @@ static void _rtl92ce_query_rxphystatus(struct ieee80211_hw *hw,
         } else {
                 rtlpriv->dm.rfpath_rxenable[0] =
                     rtlpriv->dm.rfpath_rxenable[1] = true;
+                /* (1)Get RSSI for HT rate */
                 for (i = RF90_PATH_A; i < RF90_PATH_MAX; i++) {
+                        /* we will judge RF RX path now. */
                         if (rtlpriv->dm.rfpath_rxenable[i])
                                 rf_rx_num++;
 
                         rx_pwr[i] =
                             ((p_drvinfo->gain_trsw[i] & 0x3f) * 2) - 110;
+                        /* Translate DBM to percentage. */
                         rssi = _rtl92c_query_rxpwrpercentage(rx_pwr[i]);
                         total_rssi += rssi;
+                        /* Get Rx snr value in DB */
                         rtlpriv->stats.rx_snr_db[i] =
                             (long)(p_drvinfo->rxsnr[i] / 2);
 
+                        /* Record Signal Strength for next packet */
                         if (packet_match_bssid)
                                 pstats->rx_mimo_signalstrength[i] = (u8) rssi;
                 }
 
+                /* (2)PWDB, Average PWDB cacluated by
+                 * hardware (for rate adaptive)
+                 */
                 rx_pwr_all = ((p_drvinfo->pwdb_all >> 1) & 0x7f) - 110;
                 pwdb_all = _rtl92c_query_rxpwrpercentage(rx_pwr_all);
                 pstats->rx_pwdb_all = pwdb_all;
                 pstats->rxpower = rx_pwr_all;
                 pstats->recvsignalpower = rx_pwr_all;
 
-                if (pdesc->rxht && pdesc->rxmcs >= DESC92_RATEMCS8 &&
-                    pdesc->rxmcs <= DESC92_RATEMCS15)
+                /* (3)EVM of HT rate */
+                if (pstats->is_ht && pstats->rate >= DESC92_RATEMCS8 &&
+                    pstats->rate <= DESC92_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
@@ -248,6 +267,9 @@ static void _rtl92ce_query_rxphystatus(struct ieee80211_hw *hw,
                         evm = _rtl92c_evm_db_to_percentage(p_drvinfo->rxevm[i]);
 
                         if (packet_match_bssid) {
+                                /* Fill value in RFD, Get the first
+                                 * spatial stream only
+                                 */
                                 if (i == 0)
                                         pstats->signalquality =
                                             (u8) (evm & 0xff);
@@ -256,6 +278,9 @@ static void _rtl92ce_query_rxphystatus(struct ieee80211_hw *hw,
                 }
         }
 
+        /* UI BSS List signal strength(in percentage),
+         * make it good looking, from 0~100.
+         */
         if (is_cck_rate)
                 pstats->signalstrength =
                     (u8) (_rtl92ce_signal_scale_mapping(hw, pwdb_all));
@@ -265,215 +290,6 @@ static void _rtl92ce_query_rxphystatus(struct ieee80211_hw *hw,
                           (hw, total_rssi /= rf_rx_num));
 }
 
-static void _rtl92ce_process_ui_rssi(struct ieee80211_hw *hw,
-                struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_phy *rtlphy = &(rtlpriv->phy);
-        u8 rfpath;
-        u32 last_rssi, tmpval;
-
-        if (pstats->packet_toself || pstats->packet_beacon) {
-                rtlpriv->stats.rssi_calculate_cnt++;
-
-                if (rtlpriv->stats.ui_rssi.total_num++ >=
-                    PHY_RSSI_SLID_WIN_MAX) {
-
-                        rtlpriv->stats.ui_rssi.total_num =
-                            PHY_RSSI_SLID_WIN_MAX;
-                        last_rssi =
-                            rtlpriv->stats.ui_rssi.elements[rtlpriv->
-                                                    stats.ui_rssi.index];
-                        rtlpriv->stats.ui_rssi.total_val -= last_rssi;
-                }
-
-                rtlpriv->stats.ui_rssi.total_val += pstats->signalstrength;
-                rtlpriv->stats.ui_rssi.elements[rtlpriv->stats.ui_rssi.
-                                                index++] =
-                    pstats->signalstrength;
-
-                if (rtlpriv->stats.ui_rssi.index >= PHY_RSSI_SLID_WIN_MAX)
-                        rtlpriv->stats.ui_rssi.index = 0;
-
-                tmpval = rtlpriv->stats.ui_rssi.total_val /
-                    rtlpriv->stats.ui_rssi.total_num;
-                rtlpriv->stats.signal_strength =
-                    _rtl92ce_translate_todbm(hw, (u8) tmpval);
-                pstats->rssi = rtlpriv->stats.signal_strength;
-        }
-
-        if (!pstats->is_cck && pstats->packet_toself) {
-                for (rfpath = RF90_PATH_A; rfpath < rtlphy->num_total_rfpath;
-                     rfpath++) {
-                        if (rtlpriv->stats.rx_rssi_percentage[rfpath] == 0) {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    pstats->rx_mimo_signalstrength[rfpath];
-
-                        }
-
-                        if (pstats->rx_mimo_signalstrength[rfpath] >
-                            rtlpriv->stats.rx_rssi_percentage[rfpath]) {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    ((rtlpriv->stats.
-                                      rx_rssi_percentage[rfpath] *
-                                      (RX_SMOOTH_FACTOR - 1)) +
-                                     (pstats->rx_mimo_signalstrength[rfpath])) /
-                                    (RX_SMOOTH_FACTOR);
-
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    rtlpriv->stats.rx_rssi_percentage[rfpath] +
-                                    1;
-                        } else {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    ((rtlpriv->stats.
-                                      rx_rssi_percentage[rfpath] *
-                                      (RX_SMOOTH_FACTOR - 1)) +
-                                     (pstats->rx_mimo_signalstrength[rfpath])) /
-                                    (RX_SMOOTH_FACTOR);
-                        }
-
-                }
-        }
-}
-
-static void _rtl92ce_update_rxsignalstatistics(struct ieee80211_hw *hw,
-                                               struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        int weighting = 0;
-
-        if (rtlpriv->stats.recv_signal_power == 0)
-                rtlpriv->stats.recv_signal_power = pstats->recvsignalpower;
-
-        if (pstats->recvsignalpower > rtlpriv->stats.recv_signal_power)
-                weighting = 5;
-
-        else if (pstats->recvsignalpower < rtlpriv->stats.recv_signal_power)
-                weighting = (-5);
-
-        rtlpriv->stats.recv_signal_power =
-            (rtlpriv->stats.recv_signal_power * 5 +
-             pstats->recvsignalpower + weighting) / 6;
-}
-
-static void _rtl92ce_process_pwdb(struct ieee80211_hw *hw,
-                struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        long undec_sm_pwdb;
-
-        if (mac->opmode == NL80211_IFTYPE_ADHOC) {
-                return;
-        } else {
-                undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb;
-        }
-
-        if (pstats->packet_toself || pstats->packet_beacon) {
-                if (undec_sm_pwdb < 0)
-                        undec_sm_pwdb = pstats->rx_pwdb_all;
-
-                if (pstats->rx_pwdb_all > (u32) undec_sm_pwdb) {
-                        undec_sm_pwdb = (((undec_sm_pwdb) *
-                              (RX_SMOOTH_FACTOR - 1)) +
-                             (pstats->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
-
-                        undec_sm_pwdb += 1;
-                } else {
-                        undec_sm_pwdb = (((undec_sm_pwdb) *
-                              (RX_SMOOTH_FACTOR - 1)) +
-                             (pstats->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
-                }
-
-                rtlpriv->dm.undec_sm_pwdb = undec_sm_pwdb;
-                _rtl92ce_update_rxsignalstatistics(hw, pstats);
-        }
-}
-
-static void _rtl92ce_process_ui_link_quality(struct ieee80211_hw *hw,
-                                             struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 last_evm, n_spatialstream, tmpval;
-
-        if (pstats->signalquality != 0) {
-                if (pstats->packet_toself || pstats->packet_beacon) {
-
-                        if (rtlpriv->stats.ui_link_quality.total_num++ >=
-                            PHY_LINKQUALITY_SLID_WIN_MAX) {
-                                rtlpriv->stats.ui_link_quality.total_num =
-                                    PHY_LINKQUALITY_SLID_WIN_MAX;
-                                last_evm =
-                                    rtlpriv->stats.
-                                    ui_link_quality.elements[rtlpriv->
-                                                          stats.ui_link_quality.
-                                                          index];
-                                rtlpriv->stats.ui_link_quality.total_val -=
-                                    last_evm;
-                        }
-
-                        rtlpriv->stats.ui_link_quality.total_val +=
-                            pstats->signalquality;
-                        rtlpriv->stats.ui_link_quality.elements[rtlpriv->stats.
-                                                                ui_link_quality.
-                                                                index++] =
-                            pstats->signalquality;
-
-                        if (rtlpriv->stats.ui_link_quality.index >=
-                            PHY_LINKQUALITY_SLID_WIN_MAX)
-                                rtlpriv->stats.ui_link_quality.index = 0;
-
-                        tmpval = rtlpriv->stats.ui_link_quality.total_val /
-                            rtlpriv->stats.ui_link_quality.total_num;
-                        rtlpriv->stats.signal_quality = tmpval;
-
-                        rtlpriv->stats.last_sigstrength_inpercent = tmpval;
-
-                        for (n_spatialstream = 0; n_spatialstream < 2;
-                             n_spatialstream++) {
-                                if (pstats->
-                                    rx_mimo_sig_qual[n_spatialstream] != -1) {
-                                        if (rtlpriv->stats.
-                                            rx_evm_percentage[n_spatialstream]
-                                            == 0) {
-                                                rtlpriv->stats.
-                                                   rx_evm_percentage
-                                                   [n_spatialstream] =
-                                                   pstats->rx_mimo_sig_qual
-                                                   [n_spatialstream];
-                                        }
-
-                                        rtlpriv->stats.
-                                            rx_evm_percentage[n_spatialstream] =
-                                            ((rtlpriv->
-                                              stats.rx_evm_percentage
-                                              [n_spatialstream] *
-                                              (RX_SMOOTH_FACTOR - 1)) +
-                                             (pstats->rx_mimo_sig_qual
-                                              [n_spatialstream] * 1)) /
-                                            (RX_SMOOTH_FACTOR);
-                                }
-                        }
-                }
-        } else {
-                ;
-        }
-}
-
-static void _rtl92ce_process_phyinfo(struct ieee80211_hw *hw,
-                                     u8 *buffer,
-                                     struct rtl_stats *pcurrent_stats)
-{
-
-        if (!pcurrent_stats->packet_matchbssid &&
-            !pcurrent_stats->packet_beacon)
-                return;
-
-        _rtl92ce_process_ui_rssi(hw, pcurrent_stats);
-        _rtl92ce_process_pwdb(hw, pcurrent_stats);
-        _rtl92ce_process_ui_link_quality(hw, pcurrent_stats);
-}
-
 static void _rtl92ce_translate_rx_signal_stuff(struct ieee80211_hw *hw,
                                                struct sk_buff *skb,
                                                struct rtl_stats *pstats,
@@ -516,7 +332,7 @@ static void _rtl92ce_translate_rx_signal_stuff(struct ieee80211_hw *hw,
                                    packet_matchbssid, packet_toself,
                                    packet_beacon);
 
-        _rtl92ce_process_phyinfo(hw, tmp_buf, pstats);
+        rtl_process_phyinfo(hw, tmp_buf, pstats);
 }
 
 bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
@@ -526,7 +342,7 @@ bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
 {
         struct rx_fwinfo_92c *p_drvinfo;
         struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
-
+        struct ieee80211_hdr *hdr;
         u32 phystatus = GET_RX_DESC_PHYST(pdesc);
         stats->length = (u16) GET_RX_DESC_PKT_LEN(pdesc);
         stats->rx_drvinfo_size = (u8) GET_RX_DESC_DRV_INFO_SIZE(pdesc) *
@@ -539,37 +355,60 @@ bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
         stats->rate = (u8) GET_RX_DESC_RXMCS(pdesc);
         stats->shortpreamble = (u16) GET_RX_DESC_SPLCP(pdesc);
         stats->isampdu = (bool) (GET_RX_DESC_PAGGR(pdesc) == 1);
-        stats->isampdu = (bool) ((GET_RX_DESC_PAGGR(pdesc) == 1)
+        stats->isfirst_ampdu = (bool) ((GET_RX_DESC_PAGGR(pdesc) == 1)
                                    && (GET_RX_DESC_FAGGR(pdesc) == 1));
         stats->timestamp_low = GET_RX_DESC_TSFL(pdesc);
         stats->rx_is40Mhzpacket = (bool) GET_RX_DESC_BW(pdesc);
+        stats->is_ht = (bool)GET_RX_DESC_RXHT(pdesc);
+
+        stats->is_cck = RX_HAL_IS_CCK_RATE(pdesc);
 
         rx_status->freq = hw->conf.chandef.chan->center_freq;
         rx_status->band = hw->conf.chandef.chan->band;
 
-        if (GET_RX_DESC_CRC32(pdesc))
-                rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
+        hdr = (struct ieee80211_hdr *)(skb->data + stats->rx_drvinfo_size
+                        + stats->rx_bufshift);
 
-        if (!GET_RX_DESC_SWDEC(pdesc))
-                rx_status->flag |= RX_FLAG_DECRYPTED;
+        if (stats->crc)
+                rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
 
-        if (GET_RX_DESC_BW(pdesc))
+        if (stats->rx_is40Mhzpacket)
                 rx_status->flag |= RX_FLAG_40MHZ;
 
-        if (GET_RX_DESC_RXHT(pdesc))
+        if (stats->is_ht)
                 rx_status->flag |= RX_FLAG_HT;
 
         rx_status->flag |= RX_FLAG_MACTIME_START;
 
-        if (stats->decrypted)
-                rx_status->flag |= RX_FLAG_DECRYPTED;
-
+        /* hw will set stats->decrypted true, if it finds the
+         * frame is open data frame or mgmt frame.
+         * So hw will not decryption robust managment frame
+         * for IEEE80211w but still set status->decrypted
+         * true, so here we should set it back to undecrypted
+         * for IEEE80211w frame, and mac80211 sw will help
+         * to decrypt it
+         */
+        if (stats->decrypted) {
+                if (!hdr) {
+                        /* In testing, hdr was NULL here */
+                        return false;
+                }
+                if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
+                    (ieee80211_has_protected(hdr->frame_control)))
+                        rx_status->flag &= ~RX_FLAG_DECRYPTED;
+                else
+                        rx_status->flag |= RX_FLAG_DECRYPTED;
+        }
+        /* rate_idx: index of data rate into band's
+         * supported rates or MCS index if HT rates
+         * are use (RX_FLAG_HT)
+         * Notice: this is diff with windows define
+         */
         rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                                (bool)GET_RX_DESC_RXHT(pdesc),
-                                (u8)GET_RX_DESC_RXMCS(pdesc),
-                                (bool)GET_RX_DESC_PAGGR(pdesc));
+                                stats->is_ht, stats->rate,
+                                stats->isfirst_ampdu);
 
-        rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
+        rx_status->mactime = stats->timestamp_low;
         if (phystatus) {
                 p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
                                                      stats->rx_bufshift);
@@ -580,7 +419,7 @@ bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
         }
 
         /*rx_status->qual = stats->signal; */
-        rx_status->signal = stats->rssi + 10;
+        rx_status->signal = stats->recvsignalpower + 10;
         /*rx_status->noise = -stats->noise; */
 
         return true;
@@ -624,7 +463,8 @@ void rtl92ce_tx_fill_desc(struct ieee80211_hw *hw,
         if (mac->opmode == NL80211_IFTYPE_STATION) {
                 bw_40 = mac->bw_40;
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
-                mac->opmode == NL80211_IFTYPE_ADHOC) {
+                   mac->opmode == NL80211_IFTYPE_ADHOC ||
+                   mac->opmode == NL80211_IFTYPE_MESH_POINT) {
                 if (sta)
                         bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
         }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index b1ccff474c79..3d0498e69c8c 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -202,7 +202,7 @@ static void _rtl92cu_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                         }
                 }
                 for (i = 0; i < 14; i++) {
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF(%d)-Ch(%d) [CCK / HT40_1S / HT40_2S] = [0x%x / 0x%x / 0x%x]\n", rf_path, i,
                                 rtlefuse->txpwrlevel_cck[rf_path][i],
                                 rtlefuse->txpwrlevel_ht40_1s[rf_path][i],
@@ -238,11 +238,11 @@ static void _rtl92cu_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                                     ((rtlefuse->eeprom_pwrlimit_ht40[index]
                                       & 0xf0) >> 4);
                         }
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF-%d pwrgroup_ht20[%d] = 0x%x\n",
                                 rf_path, i,
                                 rtlefuse->pwrgroup_ht20[rf_path][i]);
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF-%d pwrgroup_ht40[%d] = 0x%x\n",
                                 rf_path, i,
                                 rtlefuse->pwrgroup_ht40[rf_path][i]);
@@ -273,26 +273,26 @@ static void _rtl92cu_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
         rtlefuse->legacy_ht_txpowerdiff =
             rtlefuse->txpwr_legacyhtdiff[RF90_PATH_A][7];
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-A Ht20 to HT40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_ht20diff[RF90_PATH_A][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-A Legacy to Ht40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_legacyhtdiff[RF90_PATH_A][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-B Ht20 to HT40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_ht20diff[RF90_PATH_B][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-B Legacy to HT40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_legacyhtdiff[RF90_PATH_B][i]);
         if (!autoload_fail)
                 rtlefuse->eeprom_regulatory = (hwinfo[RF_OPTION1] & 0x7);
         else
                 rtlefuse->eeprom_regulatory = 0;
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "eeprom_regulatory = 0x%x\n", rtlefuse->eeprom_regulatory);
         if (!autoload_fail) {
                 rtlefuse->eeprom_tssi[RF90_PATH_A] = hwinfo[EEPROM_TSSI_A];
@@ -301,7 +301,7 @@ static void _rtl92cu_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                 rtlefuse->eeprom_tssi[RF90_PATH_A] = EEPROM_DEFAULT_TSSI;
                 rtlefuse->eeprom_tssi[RF90_PATH_B] = EEPROM_DEFAULT_TSSI;
         }
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "TSSI_A = 0x%x, TSSI_B = 0x%x\n",
                 rtlefuse->eeprom_tssi[RF90_PATH_A],
                 rtlefuse->eeprom_tssi[RF90_PATH_B]);
@@ -316,7 +316,7 @@ static void _rtl92cu_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
         if (rtlefuse->eeprom_thermalmeter == 0x1f || autoload_fail)
                 rtlefuse->apk_thermalmeterignore = true;
         rtlefuse->thermalmeter[0] = rtlefuse->eeprom_thermalmeter;
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "thermalmeter = 0x%x\n", rtlefuse->eeprom_thermalmeter);
 }
 
@@ -1377,74 +1377,57 @@ void rtl92cu_card_disable(struct ieee80211_hw *hw)
 
 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
 {
-        /* dummy routine needed for callback from rtl_op_configure_filter() */
-}
-
-/*========================================================================== */
-
-static void _rtl92cu_set_check_bssid(struct ieee80211_hw *hw,
-                              enum nl80211_iftype type)
-{
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
         struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
-        struct rtl_phy *rtlphy = &(rtlpriv->phy);
-        u8 filterout_non_associated_bssid = false;
+        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
 
-        switch (type) {
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_STATION:
-                filterout_non_associated_bssid = true;
-                break;
-        case NL80211_IFTYPE_UNSPECIFIED:
-        case NL80211_IFTYPE_AP:
-        default:
-                break;
-        }
-        if (filterout_non_associated_bssid) {
+        if (rtlpriv->psc.rfpwr_state != ERFON)
+                return;
+
+        if (check_bssid) {
+                u8 tmp;
                 if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        switch (rtlphy->current_io_type) {
-                        case IO_CMD_RESUME_DM_BY_SCAN:
-                                reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* enable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
-                                break;
-                        case IO_CMD_PAUSE_DM_BY_SCAN:
-                                reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* disable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
-                                break;
-                        }
+                        reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+                        tmp = BIT(4);
                 } else {
-                        reg_rcr |= (RCR_CBSSID);
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, 0, (BIT(4)|BIT(5)));
+                        reg_rcr |= RCR_CBSSID;
+                        tmp = BIT(4) | BIT(5);
                 }
-        } else if (filterout_non_associated_bssid == false) {
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                                              (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, 0, tmp);
+        } else {
+                u8 tmp;
                 if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
+                        reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+                        tmp = BIT(4);
                 } else {
-                        reg_rcr &= (~RCR_CBSSID);
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, (BIT(4)|BIT(5)), 0);
+                        reg_rcr &= ~RCR_CBSSID;
+                        tmp = BIT(4) | BIT(5);
                 }
+                reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                              HW_VAR_RCR, (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, tmp, 0);
         }
 }
 
+/*========================================================================== */
+
 int rtl92cu_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
 {
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
         if (_rtl92cu_set_media_status(hw, type))
                 return -EOPNOTSUPP;
-        _rtl92cu_set_check_bssid(hw, type);
+
+        if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
+                if (type != NL80211_IFTYPE_AP)
+                        rtl92cu_set_check_bssid(hw, true);
+        } else {
+                rtl92cu_set_check_bssid(hw, false);
+        }
+
         return 0;
 }
 
@@ -2058,8 +2041,6 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
                                (shortgi_rate << 4) | (shortgi_rate);
         }
         rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
-        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
-                 rtl_read_dword(rtlpriv, REG_ARFR0));
 }
 
 void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index a73a17bc56dd..23d640a4debd 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -223,7 +223,7 @@ static struct rtl_hal_cfg rtl92cu_hal_cfg = {
 
         .maps[RTL_IMR_TXFOVW] = IMR_TXFOVW,
         .maps[RTL_IMR_PSTIMEOUT] = IMR_PSTIMEOUT,
-        .maps[RTL_IMR_BcnInt] = IMR_BCNINT,
+        .maps[RTL_IMR_BCNINT] = IMR_BCNINT,
         .maps[RTL_IMR_RXFOVW] = IMR_RXFOVW,
         .maps[RTL_IMR_RDU] = IMR_RDU,
         .maps[RTL_IMR_ATIMEND] = IMR_ATIMEND,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index f0dada530153..763cf1defab5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -434,7 +434,7 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
                  (u32)hdr->addr1[2], (u32)hdr->addr1[3],
                  (u32)hdr->addr1[4], (u32)hdr->addr1[5]);
         memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
-        ieee80211_rx_irqsafe(hw, skb);
+        ieee80211_rx(hw, skb);
 }
 
 void  rtl8192cu_rx_hdl(struct ieee80211_hw *hw, struct sk_buff * skb)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
index 5251fb8a111e..19a765532603 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
@@ -171,8 +171,8 @@ static void rtl92d_dm_diginit(struct ieee80211_hw *hw)
         de_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
         de_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
         de_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        de_digtable->rx_gain_range_max = DM_DIG_FA_UPPER;
-        de_digtable->rx_gain_range_min = DM_DIG_FA_LOWER;
+        de_digtable->rx_gain_max = DM_DIG_FA_UPPER;
+        de_digtable->rx_gain_min = DM_DIG_FA_LOWER;
         de_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
         de_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
         de_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
@@ -444,8 +444,8 @@ static void rtl92d_dm_dig(struct ieee80211_hw *hw)
                  "dm_DIG() Before: large_fa_hit=%d, forbidden_igi=%x\n",
                  de_digtable->large_fa_hit, de_digtable->forbidden_igi);
         RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
-                 "dm_DIG() Before: Recover_cnt=%d, rx_gain_range_min=%x\n",
-                 de_digtable->recover_cnt, de_digtable->rx_gain_range_min);
+                 "dm_DIG() Before: Recover_cnt=%d, rx_gain_min=%x\n",
+                 de_digtable->recover_cnt, de_digtable->rx_gain_min);
 
         /* deal with abnorally large false alarm */
         if (falsealm_cnt->cnt_all > 10000) {
@@ -459,9 +459,9 @@ static void rtl92d_dm_dig(struct ieee80211_hw *hw)
                 }
                 if (de_digtable->large_fa_hit >= 3) {
                         if ((de_digtable->forbidden_igi + 1) > DM_DIG_MAX)
-                                de_digtable->rx_gain_range_min = DM_DIG_MAX;
+                                de_digtable->rx_gain_min = DM_DIG_MAX;
                         else
-                                de_digtable->rx_gain_range_min =
+                                de_digtable->rx_gain_min =
                                     (de_digtable->forbidden_igi + 1);
                         de_digtable->recover_cnt = 3600;        /* 3600=2hr */
                 }
@@ -475,12 +475,12 @@ static void rtl92d_dm_dig(struct ieee80211_hw *hw)
                                     DM_DIG_FA_LOWER) {
                                         de_digtable->forbidden_igi =
                                                          DM_DIG_FA_LOWER;
-                                        de_digtable->rx_gain_range_min =
+                                        de_digtable->rx_gain_min =
                                                          DM_DIG_FA_LOWER;
 
                                 } else {
                                         de_digtable->forbidden_igi--;
-                                        de_digtable->rx_gain_range_min =
+                                        de_digtable->rx_gain_min =
                                             (de_digtable->forbidden_igi + 1);
                                 }
                         } else if (de_digtable->large_fa_hit == 3) {
@@ -492,13 +492,13 @@ static void rtl92d_dm_dig(struct ieee80211_hw *hw)
                  "dm_DIG() After: large_fa_hit=%d, forbidden_igi=%x\n",
                  de_digtable->large_fa_hit, de_digtable->forbidden_igi);
         RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
-                 "dm_DIG() After: recover_cnt=%d, rx_gain_range_min=%x\n",
-                 de_digtable->recover_cnt, de_digtable->rx_gain_range_min);
+                 "dm_DIG() After: recover_cnt=%d, rx_gain_min=%x\n",
+                 de_digtable->recover_cnt, de_digtable->rx_gain_min);
 
         if (value_igi > DM_DIG_MAX)
                 value_igi = DM_DIG_MAX;
-        else if (value_igi < de_digtable->rx_gain_range_min)
-                value_igi = de_digtable->rx_gain_range_min;
+        else if (value_igi < de_digtable->rx_gain_min)
+                value_igi = de_digtable->rx_gain_min;
         de_digtable->cur_igvalue = value_igi;
         rtl92d_dm_write_dig(hw);
         if (rtlpriv->rtlhal.current_bandtype != BAND_ON_5G)
@@ -1071,9 +1071,9 @@ static void rtl92d_dm_txpower_tracking_callback_thermalmeter(
                         }
                         ele_d = (ofdmswing_table[(u8) ofdm_index[0]] &
                                                  0xFFC00000) >> 22;
-                        val_x = rtlphy->iqk_matrix_regsetting
+                        val_x = rtlphy->iqk_matrix
                                                 [indexforchannel].value[0][0];
-                        val_y = rtlphy->iqk_matrix_regsetting
+                        val_y = rtlphy->iqk_matrix
                                                 [indexforchannel].value[0][1];
                         if (val_x != 0) {
                                 if ((val_x & 0x00000200) != 0)
@@ -1175,9 +1175,9 @@ static void rtl92d_dm_txpower_tracking_callback_thermalmeter(
                         if (is2t) {
                                 ele_d = (ofdmswing_table[(u8) ofdm_index[1]] &
                                                 0xFFC00000) >> 22;
-                                val_x = rtlphy->iqk_matrix_regsetting
+                                val_x = rtlphy->iqk_matrix
                                                 [indexforchannel].value[0][4];
-                                val_y = rtlphy->iqk_matrix_regsetting
+                                val_y = rtlphy->iqk_matrix
                                                 [indexforchannel].value[0][5];
                                 if (val_x != 0) {
                                         if ((val_x & 0x00000200) != 0)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
index aa5b42521bb4..7dd8f6de0550 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
@@ -1183,7 +1183,7 @@ void rtl92d_linked_set_reg(struct ieee80211_hw *hw)
         u8 channel = rtlphy->current_channel;
 
         indexforchannel = rtl92d_get_rightchnlplace_for_iqk(channel);
-        if (!rtlphy->iqk_matrix_regsetting[indexforchannel].iqk_done) {
+        if (!rtlphy->iqk_matrix[indexforchannel].iqk_done) {
                 RT_TRACE(rtlpriv, COMP_SCAN | COMP_INIT, DBG_DMESG,
                          "Do IQK for channel:%d\n", channel);
                 rtl92d_phy_iq_calibrate(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
index 33041bd4da81..840bac5fa2f8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
@@ -2479,9 +2479,9 @@ void rtl92d_phy_iq_calibrate(struct ieee80211_hw *hw)
                                   rtlphy->current_channel);
 
                 for (i = 0; i < IQK_MATRIX_REG_NUM; i++)
-                        rtlphy->iqk_matrix_regsetting[indexforchannel].
+                        rtlphy->iqk_matrix[indexforchannel].
                                 value[0][i] = result[final_candidate][i];
-                rtlphy->iqk_matrix_regsetting[indexforchannel].iqk_done =
+                rtlphy->iqk_matrix[indexforchannel].iqk_done =
                         true;
 
                 RT_TRACE(rtlpriv, COMP_SCAN | COMP_MLME, DBG_LOUD,
@@ -2501,8 +2501,8 @@ void rtl92d_phy_reload_iqk_setting(struct ieee80211_hw *hw, u8 channel)
         indexforchannel = rtl92d_get_rightchnlplace_for_iqk(channel);
         RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, "indexforchannel %d done %d\n",
                  indexforchannel,
-                 rtlphy->iqk_matrix_regsetting[indexforchannel].iqk_done);
-        if (0 && !rtlphy->iqk_matrix_regsetting[indexforchannel].iqk_done &&
+                 rtlphy->iqk_matrix[indexforchannel].iqk_done);
+        if (0 && !rtlphy->iqk_matrix[indexforchannel].iqk_done &&
                 rtlphy->need_iqk) {
                 /* Re Do IQK. */
                 RT_TRACE(rtlpriv, COMP_SCAN | COMP_INIT, DBG_LOUD,
@@ -2516,23 +2516,23 @@ void rtl92d_phy_reload_iqk_setting(struct ieee80211_hw *hw, u8 channel)
                         RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
                                  "Just Read IQK Matrix reg for channel:%d....\n",
                                  channel);
-                        if ((rtlphy->iqk_matrix_regsetting[indexforchannel].
+                        if ((rtlphy->iqk_matrix[indexforchannel].
                              value[0] != NULL)
                                 /*&&(regea4 != 0) */)
                                 _rtl92d_phy_patha_fill_iqk_matrix(hw, true,
-                                        rtlphy->iqk_matrix_regsetting[
+                                        rtlphy->iqk_matrix[
                                         indexforchannel].value, 0,
-                                        (rtlphy->iqk_matrix_regsetting[
+                                        (rtlphy->iqk_matrix[
                                         indexforchannel].value[0][2] == 0));
                         if (IS_92D_SINGLEPHY(rtlhal->version)) {
-                                if ((rtlphy->iqk_matrix_regsetting[
+                                if ((rtlphy->iqk_matrix[
                                         indexforchannel].value[0][4] != 0)
                                         /*&&(regec4 != 0) */)
                                         _rtl92d_phy_pathb_fill_iqk_matrix(hw,
                                                 true,
-                                                rtlphy->iqk_matrix_regsetting[
+                                                rtlphy->iqk_matrix[
                                                 indexforchannel].value, 0,
-                                                (rtlphy->iqk_matrix_regsetting[
+                                                (rtlphy->iqk_matrix[
                                                 indexforchannel].value[0][6]
                                                 == 0));
                         }
@@ -2830,20 +2830,20 @@ void rtl92d_phy_reset_iqk_result(struct ieee80211_hw *hw)
 
         RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                  "settings regs %d default regs %d\n",
-                 (int)(sizeof(rtlphy->iqk_matrix_regsetting) /
+                 (int)(sizeof(rtlphy->iqk_matrix) /
                        sizeof(struct iqk_matrix_regs)),
                  IQK_MATRIX_REG_NUM);
         /* 0xe94, 0xe9c, 0xea4, 0xeac, 0xeb4, 0xebc, 0xec4, 0xecc */
         for (i = 0; i < IQK_MATRIX_SETTINGS_NUM; i++) {
-                rtlphy->iqk_matrix_regsetting[i].value[0][0] = 0x100;
-                rtlphy->iqk_matrix_regsetting[i].value[0][2] = 0x100;
-                rtlphy->iqk_matrix_regsetting[i].value[0][4] = 0x100;
-                rtlphy->iqk_matrix_regsetting[i].value[0][6] = 0x100;
-                rtlphy->iqk_matrix_regsetting[i].value[0][1] = 0x0;
-                rtlphy->iqk_matrix_regsetting[i].value[0][3] = 0x0;
-                rtlphy->iqk_matrix_regsetting[i].value[0][5] = 0x0;
-                rtlphy->iqk_matrix_regsetting[i].value[0][7] = 0x0;
-                rtlphy->iqk_matrix_regsetting[i].iqk_done = false;
+                rtlphy->iqk_matrix[i].value[0][0] = 0x100;
+                rtlphy->iqk_matrix[i].value[0][2] = 0x100;
+                rtlphy->iqk_matrix[i].value[0][4] = 0x100;
+                rtlphy->iqk_matrix[i].value[0][6] = 0x100;
+                rtlphy->iqk_matrix[i].value[0][1] = 0x0;
+                rtlphy->iqk_matrix[i].value[0][3] = 0x0;
+                rtlphy->iqk_matrix[i].value[0][5] = 0x0;
+                rtlphy->iqk_matrix[i].value[0][7] = 0x0;
+                rtlphy->iqk_matrix[i].iqk_done = false;
         }
 }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/reg.h b/drivers/net/wireless/rtlwifi/rtl8192de/reg.h
index ebb1d5f5e7b5..b7498c5bafc5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/reg.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/reg.h
@@ -543,7 +543,7 @@
 #define IMR_TIMEOUT1                    BIT(16)
 #define IMR_TXFOVW                      BIT(15)
 #define IMR_PSTIMEOUT                   BIT(14)
-#define IMR_BcnInt                      BIT(13)
+#define IMR_BCNINT                      BIT(13)
 #define IMR_RXFOVW                      BIT(12)
 #define IMR_RDU                         BIT(11)
 #define IMR_ATIMEND                     BIT(10)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index 03c6d18b2e07..c18c04bf0c13 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -166,7 +166,7 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
                 rtlpriv->psc.fwctrl_psmode = FW_PS_DTIM_MODE;
 
         /* for early mode */
-        rtlpriv->rtlhal.earlymode_enable = true;
+        rtlpriv->rtlhal.earlymode_enable = false;
         for (tid = 0; tid < 8; tid++)
                 skb_queue_head_init(&rtlpriv->mac80211.skb_waitq[tid]);
 
@@ -319,7 +319,7 @@ static struct rtl_hal_cfg rtl92de_hal_cfg = {
 
         .maps[RTL_IMR_TXFOVW] = IMR_TXFOVW,
         .maps[RTL_IMR_PSTIMEOUT] = IMR_PSTIMEOUT,
-        .maps[RTL_IMR_BcnInt] = IMR_BcnInt,
+        .maps[RTL_IMR_BCNINT] = IMR_BCNINT,
         .maps[RTL_IMR_RXFOVW] = IMR_RXFOVW,
         .maps[RTL_IMR_RDU] = IMR_RDU,
         .maps[RTL_IMR_ATIMEND] = IMR_ATIMEND,
@@ -333,7 +333,7 @@ static struct rtl_hal_cfg rtl92de_hal_cfg = {
         .maps[RTL_IMR_VIDOK] = IMR_VIDOK,
         .maps[RTL_IMR_VODOK] = IMR_VODOK,
         .maps[RTL_IMR_ROK] = IMR_ROK,
-        .maps[RTL_IBSS_INT_MASKS] = (IMR_BcnInt | IMR_TBDOK | IMR_TBDER),
+        .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 
         .maps[RTL_RC_CCK_RATE1M] = DESC92_RATE1M,
         .maps[RTL_RC_CCK_RATE2M] = DESC92_RATE2M,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/def.h b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
index 2d255e02d795..83c98674bfd3 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
@@ -36,9 +36,6 @@
 #define SHORT_SLOT_TIME                         9
 #define NON_SHORT_SLOT_TIME                     20
 
-/* Rx smooth factor */
-#define RX_SMOOTH_FACTOR                        20
-
 /* Queue Select Value in TxDesc */
 #define QSLT_BK                                 0x2
 #define QSLT_BE                                 0x0
@@ -49,10 +46,6 @@
 #define QSLT_MGNT                               0x12
 #define QSLT_CMD                                0x13
 
-#define PHY_RSSI_SLID_WIN_MAX                   100
-#define PHY_LINKQUALITY_SLID_WIN_MAX            20
-#define PHY_BEACON_RSSI_SLID_WIN_MAX            10
-
 /* Tx Desc */
 #define TX_DESC_SIZE_RTL8192S                   (16 * 4)
 #define TX_CMDDESC_SIZE_RTL8192S                (16 * 4)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
index e551fe5f9ccd..b3a2d5ec59e6 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
@@ -163,6 +163,7 @@ static void _rtl92s_dm_txpowertracking_callback_thermalmeter(
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
         u8 thermalvalue = 0;
+        u32 fw_cmd = 0;
 
         rtlpriv->dm.txpower_trackinginit = true;
 
@@ -175,7 +176,19 @@ static void _rtl92s_dm_txpowertracking_callback_thermalmeter(
 
         if (thermalvalue) {
                 rtlpriv->dm.thermalvalue = thermalvalue;
-                rtl92s_phy_set_fw_cmd(hw, FW_CMD_TXPWR_TRACK_THERMAL);
+                if (hal_get_firmwareversion(rtlpriv) >= 0x35) {
+                        rtl92s_phy_set_fw_cmd(hw, FW_CMD_TXPWR_TRACK_THERMAL);
+                } else {
+                        fw_cmd = (FW_TXPWR_TRACK_THERMAL |
+                                 (rtlpriv->efuse.thermalmeter[0] << 8) |
+                                 (thermalvalue << 16));
+
+                        RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+                                 "Write to FW Thermal Val = 0x%x\n", fw_cmd);
+
+                        rtl_write_dword(rtlpriv, WFM5, fw_cmd);
+                        rtl92s_phy_chk_fwcmd_iodone(hw);
+                }
         }
 
         rtlpriv->dm.txpowercount = 0;
@@ -217,11 +230,10 @@ static void _rtl92s_dm_refresh_rateadaptive_mask(struct ieee80211_hw *hw)
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rate_adaptive *ra = &(rtlpriv->ra);
-
+        struct ieee80211_sta *sta = NULL;
         u32 low_rssi_thresh = 0;
         u32 middle_rssi_thresh = 0;
         u32 high_rssi_thresh = 0;
-        struct ieee80211_sta *sta = NULL;
 
         if (is_hal_stop(rtlhal))
                 return;
@@ -229,14 +241,12 @@ static void _rtl92s_dm_refresh_rateadaptive_mask(struct ieee80211_hw *hw)
         if (!rtlpriv->dm.useramask)
                 return;
 
-        if (!rtlpriv->dm.inform_fw_driverctrldm) {
+        if (hal_get_firmwareversion(rtlpriv) >= 61 &&
+            !rtlpriv->dm.inform_fw_driverctrldm) {
                 rtl92s_phy_set_fw_cmd(hw, FW_CMD_CTRL_DM_BY_DRIVER);
                 rtlpriv->dm.inform_fw_driverctrldm = true;
         }
 
-        rcu_read_lock();
-        if (mac->opmode == NL80211_IFTYPE_STATION)
-                sta = get_sta(hw, mac->vif, mac->bssid);
         if ((mac->link_state == MAC80211_LINKED) &&
             (mac->opmode == NL80211_IFTYPE_STATION)) {
                 switch (ra->pre_ratr_state) {
@@ -285,12 +295,16 @@ static void _rtl92s_dm_refresh_rateadaptive_mask(struct ieee80211_hw *hw)
                                  rtlpriv->dm.undec_sm_pwdb, ra->ratr_state,
                                  ra->pre_ratr_state, ra->ratr_state);
 
-                        rtlpriv->cfg->ops->update_rate_tbl(hw, sta,
+                        rcu_read_lock();
+                        sta = rtl_find_sta(hw, mac->bssid);
+                        if (sta)
+                                rtlpriv->cfg->ops->update_rate_tbl(hw, sta,
                                                            ra->ratr_state);
+                        rcu_read_unlock();
+
                         ra->pre_ratr_state = ra->ratr_state;
                 }
         }
-        rcu_read_unlock();
 }
 
 static void _rtl92s_dm_switch_baseband_mrc(struct ieee80211_hw *hw)
@@ -370,7 +384,8 @@ static void _rtl92s_dm_init_rate_adaptive_mask(struct ieee80211_hw *hw)
         ra->ratr_state = DM_RATR_STA_MAX;
         ra->pre_ratr_state = DM_RATR_STA_MAX;
 
-        if (rtlpriv->dm.dm_type == DM_TYPE_BYDRIVER)
+        if (rtlpriv->dm.dm_type == DM_TYPE_BYDRIVER &&
+            hal_get_firmwareversion(rtlpriv) >= 60)
                 rtlpriv->dm.useramask = true;
         else
                 rtlpriv->dm.useramask = false;
@@ -457,13 +472,13 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
                                 digtable->back_val = DM_DIG_BACKOFF;
 
                         if ((digtable->rssi_val + 10 - digtable->back_val) >
-                                digtable->rx_gain_range_max)
+                                digtable->rx_gain_max)
                                 digtable->cur_igvalue =
-                                                digtable->rx_gain_range_max;
+                                                digtable->rx_gain_max;
                         else if ((digtable->rssi_val + 10 - digtable->back_val)
-                                 < digtable->rx_gain_range_min)
+                                 < digtable->rx_gain_min)
                                 digtable->cur_igvalue =
-                                                digtable->rx_gain_range_min;
+                                                digtable->rx_gain_min;
                         else
                                 digtable->cur_igvalue = digtable->rssi_val + 10
                                         - digtable->back_val;
@@ -475,7 +490,7 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
 
                         if (falsealm_cnt->cnt_all > 16000)
                                 digtable->cur_igvalue =
-                                                 digtable->rx_gain_range_max;
+                                                 digtable->rx_gain_max;
                 /* connected -> connected or disconnected -> disconnected  */
                 } else {
                         /* Firmware control DIG, do nothing in driver dm */
@@ -677,9 +692,9 @@ static void _rtl92s_dm_init_dig(struct ieee80211_hw *hw)
         /* for dig debug rssi value */
         digtable->rssi_val = 50;
         digtable->back_val = DM_DIG_BACKOFF;
-        digtable->rx_gain_range_max = DM_DIG_MAX;
+        digtable->rx_gain_max = DM_DIG_MAX;
 
-        digtable->rx_gain_range_min = DM_DIG_MIN;
+        digtable->rx_gain_min = DM_DIG_MIN;
 
         digtable->backoffval_range_max = DM_DIG_BACKOFF_MAX;
         digtable->backoffval_range_min = DM_DIG_BACKOFF_MIN;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 084e7773bce2..4f461786a7eb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -400,6 +400,39 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
 
                         break;
                 }
+        case HW_VAR_FW_LPS_ACTION: {
+                bool enter_fwlps = *((bool *)val);
+                u8 rpwm_val, fw_pwrmode;
+                bool fw_current_inps;
+
+                if (enter_fwlps) {
+                        rpwm_val = 0x02;        /* RF off */
+                        fw_current_inps = true;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_FW_PSMODE_STATUS,
+                                        (u8 *)(&fw_current_inps));
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_H2C_FW_PWRMODE,
+                                        (u8 *)(&ppsc->fwctrl_psmode));
+
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_SET_RPWM,
+                                        (u8 *)(&rpwm_val));
+                } else {
+                        rpwm_val = 0x0C;        /* RF on */
+                        fw_pwrmode = FW_PS_ACTIVE_MODE;
+                        fw_current_inps = false;
+                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SET_RPWM,
+                                        (u8 *)(&rpwm_val));
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_H2C_FW_PWRMODE,
+                                        (u8 *)(&fw_pwrmode));
+
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_FW_PSMODE_STATUS,
+                                        (u8 *)(&fw_current_inps));
+                }
+                break; }
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "switch case not processed\n");
@@ -438,7 +471,7 @@ void rtl92se_enable_hw_security_config(struct ieee80211_hw *hw)
 
 }
 
-static u8 _rtl92ce_halset_sysclk(struct ieee80211_hw *hw, u8 data)
+static u8 _rtl92se_halset_sysclk(struct ieee80211_hw *hw, u8 data)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         u8 waitcount = 100;
@@ -547,7 +580,7 @@ static void _rtl92se_macconfig_before_fwdownload(struct ieee80211_hw *hw)
                 tmpu1b &= ~(BIT(6) | BIT(7));
 
                 /* Set failed, return to prevent hang. */
-                if (!_rtl92ce_halset_sysclk(hw, tmpu1b))
+                if (!_rtl92se_halset_sysclk(hw, tmpu1b))
                         return;
         }
 
@@ -650,7 +683,7 @@ static void _rtl92se_macconfig_before_fwdownload(struct ieee80211_hw *hw)
 
         tmpu1b = rtl_read_byte(rtlpriv, (SYS_CLKR + 1));
         tmpu1b = ((tmpu1b | BIT(7)) & (~BIT(6)));
-        if (!_rtl92ce_halset_sysclk(hw, tmpu1b))
+        if (!_rtl92se_halset_sysclk(hw, tmpu1b))
                 return; /* Set failed, return to prevent hang. */
 
         rtl_write_word(rtlpriv, CMDR, 0x07FC);
@@ -967,6 +1000,15 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
                 return rtstatus;
         }
 
+        /* because last function modify RCR, so we update
+         * rcr var here, or TP will unstable for receive_config
+         * is wrong, RX RCR_ACRC32 will cause TP unstabel & Rx
+         * RCR_APP_ICV will cause mac80211 unassoc for cisco 1252
+         */
+        rtlpci->receive_config = rtl_read_dword(rtlpriv, RCR);
+        rtlpci->receive_config &= ~(RCR_ACRC32 | RCR_AICV);
+        rtl_write_dword(rtlpriv, RCR, rtlpci->receive_config);
+
         /* Make sure BB/RF write OK. We should prevent enter IPS. radio off. */
         /* We must set flag avoid BB/RF config period later!! */
         rtl_write_dword(rtlpriv, CMDR, 0x37FC);
@@ -982,25 +1024,6 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
 
         rtlphy->rf_mode = RF_OP_BY_SW_3WIRE;
 
-        /* RF Power Save */
-#if 0
-        /* H/W or S/W RF OFF before sleep. */
-        if (rtlpriv->psc.rfoff_reason > RF_CHANGE_BY_PS) {
-                u32 rfoffreason = rtlpriv->psc.rfoff_reason;
-
-                rtlpriv->psc.rfoff_reason = RF_CHANGE_BY_INIT;
-                rtlpriv->psc.rfpwr_state = ERFON;
-                /* FIXME: check spinlocks if this block is uncommented */
-                rtl_ps_set_rf_state(hw, ERFOFF, rfoffreason);
-        } else {
-                /* gpio radio on/off is out of adapter start */
-                if (rtlpriv->psc.hwradiooff == false) {
-                        rtlpriv->psc.rfpwr_state = ERFON;
-                        rtlpriv->psc.rfoff_reason = 0;
-                }
-        }
-#endif
-
         /* Before RF-R/W we must execute the IO from Scott's suggestion. */
         rtl_write_byte(rtlpriv, AFE_XTAL_CTRL + 1, 0xDB);
         if (rtlhal->version == VERSION_8192S_ACUT)
@@ -1058,7 +1081,22 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
 
         /* We enable high power and RA related mechanism after NIC
          * initialized. */
-        rtl92s_phy_set_fw_cmd(hw, FW_CMD_RA_INIT);
+        if (hal_get_firmwareversion(rtlpriv) >= 0x35) {
+                /* Fw v.53 and later. */
+                rtl92s_phy_set_fw_cmd(hw, FW_CMD_RA_INIT);
+        } else if (hal_get_firmwareversion(rtlpriv) == 0x34) {
+                /* Fw v.52. */
+                rtl_write_dword(rtlpriv, WFM5, FW_RA_INIT);
+                rtl92s_phy_chk_fwcmd_iodone(hw);
+        } else {
+                /* Compatible earlier FW version. */
+                rtl_write_dword(rtlpriv, WFM5, FW_RA_RESET);
+                rtl92s_phy_chk_fwcmd_iodone(hw);
+                rtl_write_dword(rtlpriv, WFM5, FW_RA_ACTIVE);
+                rtl92s_phy_chk_fwcmd_iodone(hw);
+                rtl_write_dword(rtlpriv, WFM5, FW_RA_REFRESH);
+                rtl92s_phy_chk_fwcmd_iodone(hw);
+        }
 
         /* Add to prevent ASPM bug. */
         /* Always enable hst and NIC clock request. */
@@ -1229,7 +1267,6 @@ void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
         synchronize_irq(rtlpci->pdev->irq);
 }
 
-
 static u8 _rtl92s_set_sysclk(struct ieee80211_hw *hw, u8 data)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1754,7 +1791,7 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
                 }
 
                 for (i = 0; i < 14; i++) {
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF(%d)-Ch(%d) [CCK / HT40_1S / HT40_2S] = [0x%x / 0x%x / 0x%x]\n",
                                 rf_path, i,
                                 rtlefuse->txpwrlevel_cck[rf_path][i],
@@ -1791,11 +1828,11 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
                                 ((rtlefuse->eeprom_pwrgroup[rf_path][index] &
                                 0xf0) >> 4);
 
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF-%d pwrgroup_ht20[%d] = 0x%x\n",
                                 rf_path, i,
                                 rtlefuse->pwrgroup_ht20[rf_path][i]);
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF-%d pwrgroup_ht40[%d] = 0x%x\n",
                                 rf_path, i,
                                 rtlefuse->pwrgroup_ht40[rf_path][i]);
@@ -1850,27 +1887,27 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
                         rtlefuse->eeprom_regulatory =
                                  (hwinfo[EEPROM_REGULATORY] & 0x1);
         }
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "eeprom_regulatory = 0x%x\n", rtlefuse->eeprom_regulatory);
 
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-A Ht20 to HT40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_ht20diff[RF90_PATH_A][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-A Legacy to Ht40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_legacyhtdiff[RF90_PATH_A][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-B Ht20 to HT40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_ht20diff[RF90_PATH_B][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-B Legacy to HT40 Diff[%d] = 0x%x\n",
                         i, rtlefuse->txpwr_legacyhtdiff[RF90_PATH_B][i]);
 
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "TxPwrSafetyFlag = %d\n", rtlefuse->txpwr_safetyflag);
 
         /* Read RF-indication and Tx Power gain
@@ -1880,7 +1917,7 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
         rtlefuse->legacy_httxpowerdiff =
                 rtlefuse->txpwr_legacyhtdiff[RF90_PATH_A][0];
 
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "TxPowerDiff = %#x\n", rtlefuse->eeprom_txpowerdiff);
 
         /* Get TSSI value for each path. */
@@ -1889,7 +1926,7 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
         usvalue = hwinfo[EEPROM_TSSI_B];
         rtlefuse->eeprom_tssi[RF90_PATH_B] = (u8)(usvalue & 0xff);
 
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower, "TSSI_A = 0x%x, TSSI_B = 0x%x\n",
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER, "TSSI_A = 0x%x, TSSI_B = 0x%x\n",
                 rtlefuse->eeprom_tssi[RF90_PATH_A],
                 rtlefuse->eeprom_tssi[RF90_PATH_B]);
 
@@ -1897,7 +1934,7 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
         /* and read ThermalMeter from EEPROM */
         tempval = hwinfo[EEPROM_THERMALMETER];
         rtlefuse->eeprom_thermalmeter = tempval;
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "thermalmeter = 0x%x\n", rtlefuse->eeprom_thermalmeter);
 
         /* ThermalMeter, BIT(0)~3 for RFIC1, BIT(4)~7 for RFIC2 */
@@ -1914,7 +1951,7 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
         /* Version ID, Channel plan */
         rtlefuse->eeprom_channelplan = hwinfo[EEPROM_CHANNELPLAN];
         rtlefuse->txpwr_fromeprom = true;
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "EEPROM ChannelPlan = 0x%4x\n", rtlefuse->eeprom_channelplan);
 
         /* Read Customer ID or Board Type!!! */
@@ -1999,6 +2036,8 @@ static void rtl92se_update_hal_rate_table(struct ieee80211_hw *hw,
                 ratr_value = sta->supp_rates[1] << 4;
         else
                 ratr_value = sta->supp_rates[0];
+        if (mac->opmode == NL80211_IFTYPE_ADHOC)
+                ratr_value = 0xfff;
         ratr_value |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
                         sta->ht_cap.mcs.rx_mask[0] << 12);
         switch (wirelessmode) {
@@ -2112,6 +2151,8 @@ static void rtl92se_update_hal_rate_mask(struct ieee80211_hw *hw,
                 ratr_bitmap = sta->supp_rates[1] << 4;
         else
                 ratr_bitmap = sta->supp_rates[0];
+        if (mac->opmode == NL80211_IFTYPE_ADHOC)
+                ratr_bitmap = 0xfff;
         ratr_bitmap |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
                         sta->ht_cap.mcs.rx_mask[0] << 12);
         switch (wirelessmode) {
@@ -2200,6 +2241,7 @@ static void rtl92se_update_hal_rate_mask(struct ieee80211_hw *hw,
                         ratr_bitmap &= 0x0f8ff0ff;
                 break;
         }
+        sta_entry->ratr_index = ratr_index;
 
         if (rtlpriv->rtlhal.version >= VERSION_8192S_BCUT)
                 ratr_bitmap &= 0x0FFFFFFF;
@@ -2438,23 +2480,9 @@ void rtl92se_set_key(struct ieee80211_hw *hw, u32 key_index, u8 *p_macaddr,
                                 rtl_cam_del_entry(hw, p_macaddr);
                         rtl_cam_delete_one_entry(hw, p_macaddr, entry_id);
                 } else {
-                        RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
-                                 "The insert KEY length is %d\n",
-                                 rtlpriv->sec.key_len[PAIRWISE_KEYIDX]);
-                        RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
-                                 "The insert KEY is %x %x\n",
-                                 rtlpriv->sec.key_buf[0][0],
-                                 rtlpriv->sec.key_buf[0][1]);
-
                         RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
                                  "add one entry\n");
                         if (is_pairwise) {
-                                RT_PRINT_DATA(rtlpriv, COMP_SEC, DBG_LOUD,
-                                              "Pairwise Key content",
-                                              rtlpriv->sec.pairwise_key,
-                                              rtlpriv->sec.
-                                              key_len[PAIRWISE_KEYIDX]);
-
                                 RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
                                          "set Pairwise key\n");
 
@@ -2502,3 +2530,23 @@ void rtl92se_resume(struct ieee80211_hw *hw)
                 pci_write_config_dword(rtlpci->pdev, 0x40,
                         val & 0xffff00ff);
 }
+
+/* Turn on AAP (RCR:bit 0) for promicuous mode. */
+void rtl92se_allow_all_destaddr(struct ieee80211_hw *hw,
+                                bool allow_all_da, bool write_into_reg)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+        if (allow_all_da) /* Set BIT0 */
+                rtlpci->receive_config |= RCR_AAP;
+        else /* Clear BIT0 */
+                rtlpci->receive_config &= ~RCR_AAP;
+
+        if (write_into_reg)
+                rtl_write_dword(rtlpriv, RCR, rtlpci->receive_config);
+
+        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
+                 "receive_config=0x%08X, write_into_reg=%d\n",
+                 rtlpci->receive_config, write_into_reg);
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.h b/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
index a8e068c76e47..da48aa8cbe6f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
@@ -74,6 +74,7 @@ void rtl92se_set_key(struct ieee80211_hw *hw,
                      u8 enc_algo, bool is_wepkey, bool clear_all);
 void rtl92se_suspend(struct ieee80211_hw *hw);
 void rtl92se_resume(struct ieee80211_hw *hw);
+void rtl92se_allow_all_destaddr(struct ieee80211_hw *hw,
+                                bool allow_all_da, bool write_into_reg);
 
 #endif
-
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
index 67404975e00b..9c092e6eb3fe 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
@@ -1307,6 +1307,8 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw)
         if (is_hal_stop(rtlhal))
                 return;
 
+        if (hal_get_firmwareversion(rtlpriv) < 0x34)
+                goto skip;
         /* We re-map RA related CMD IO to combinational ones */
         /* if FW version is v.52 or later. */
         switch (rtlhal->current_fwcmd_io) {
@@ -1320,6 +1322,7 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw)
                 break;
         }
 
+skip:
         switch (rtlhal->current_fwcmd_io) {
         case FW_CMD_RA_RESET:
                 RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_RESET\n");
@@ -1440,7 +1443,7 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
         struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
         u32     fw_param = FW_CMD_IO_PARA_QUERY(rtlpriv);
         u16     fw_cmdmap = FW_CMD_IO_QUERY(rtlpriv);
-        bool bPostProcessing = false;
+        bool postprocessing = false;
 
         RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
                  "Set FW Cmd(%#x), set_fwcmd_inprogress(%d)\n",
@@ -1449,15 +1452,24 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
         do {
                 /* We re-map to combined FW CMD ones if firmware version */
                 /* is v.53 or later. */
-                switch (fw_cmdio) {
-                case FW_CMD_RA_REFRESH_N:
-                        fw_cmdio = FW_CMD_RA_REFRESH_N_COMB;
-                        break;
-                case FW_CMD_RA_REFRESH_BG:
-                        fw_cmdio = FW_CMD_RA_REFRESH_BG_COMB;
-                        break;
-                default:
-                        break;
+                if (hal_get_firmwareversion(rtlpriv) >= 0x35) {
+                        switch (fw_cmdio) {
+                        case FW_CMD_RA_REFRESH_N:
+                                fw_cmdio = FW_CMD_RA_REFRESH_N_COMB;
+                                break;
+                        case FW_CMD_RA_REFRESH_BG:
+                                fw_cmdio = FW_CMD_RA_REFRESH_BG_COMB;
+                                break;
+                        default:
+                                break;
+                        }
+                } else {
+                        if ((fw_cmdio == FW_CMD_IQK_ENABLE) ||
+                            (fw_cmdio == FW_CMD_RA_REFRESH_N) ||
+                            (fw_cmdio == FW_CMD_RA_REFRESH_BG)) {
+                                postprocessing = true;
+                                break;
+                        }
                 }
 
                 /* If firmware version is v.62 or later,
@@ -1588,19 +1600,19 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
                                 fw_cmdmap &= ~FW_DIG_ENABLE_CTL;
 
                         FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
-                        bPostProcessing = true;
+                        postprocessing = true;
                         break;
                 case FW_CMD_PAUSE_DM_BY_SCAN:
                         fw_cmdmap &= ~(FW_DIG_ENABLE_CTL |
                                        FW_HIGH_PWR_ENABLE_CTL |
                                        FW_SS_CTL);
                         FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
-                        bPostProcessing = true;
+                        postprocessing = true;
                         break;
                 case FW_CMD_HIGH_PWR_DISABLE:
                         fw_cmdmap &= ~FW_HIGH_PWR_ENABLE_CTL;
                         FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
-                        bPostProcessing = true;
+                        postprocessing = true;
                         break;
                 case FW_CMD_HIGH_PWR_ENABLE:
                         if (!(rtlpriv->dm.dm_flag & HAL_DM_HIPWR_DISABLE) &&
@@ -1608,7 +1620,7 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
                                 fw_cmdmap |= (FW_HIGH_PWR_ENABLE_CTL |
                                               FW_SS_CTL);
                                 FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
-                                bPostProcessing = true;
+                                postprocessing = true;
                         }
                         break;
                 case FW_CMD_DIG_MODE_FA:
@@ -1629,14 +1641,15 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
                 default:
                         /* Pass to original FW CMD processing callback
                          * routine. */
-                        bPostProcessing = true;
+                        postprocessing = true;
                         break;
                 }
         } while (false);
 
         /* We shall post processing these FW CMD if
-         * variable bPostProcessing is set. */
-        if (bPostProcessing && !rtlhal->set_fwcmd_inprogress) {
+         * variable postprocessing is set.
+         */
+        if (postprocessing && !rtlhal->set_fwcmd_inprogress) {
                 rtlhal->set_fwcmd_inprogress = true;
                 /* Update current FW Cmd for callback use. */
                 rtlhal->current_fwcmd_io = fw_cmdio;
@@ -1697,8 +1710,18 @@ void rtl92s_phy_switch_ephy_parameter(struct ieee80211_hw *hw)
 
 }
 
-void rtl92s_phy_set_beacon_hwreg(struct ieee80211_hw *hw, u16 BeaconInterval)
+void rtl92s_phy_set_beacon_hwreg(struct ieee80211_hw *hw, u16 beaconinterval)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        rtl_write_dword(rtlpriv, WFM5, 0xF1000000 | (BeaconInterval << 8));
+        u32 new_bcn_num = 0;
+
+        if (hal_get_firmwareversion(rtlpriv) >= 0x33) {
+                /* Fw v.51 and later. */
+                rtl_write_dword(rtlpriv, WFM5, 0xF1000000 |
+                                (beaconinterval << 8));
+        } else {
+                new_bcn_num = beaconinterval * 32 - 64;
+                rtl_write_dword(rtlpriv, WFM3 + 4, new_bcn_num);
+                rtl_write_dword(rtlpriv, WFM3, 0xB026007C);
+        }
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/phy.h b/drivers/net/wireless/rtlwifi/rtl8192se/phy.h
index ac0387770630..8acf4765a7a6 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/phy.h
@@ -39,6 +39,7 @@
 #define MAX_POSTCMD_CNT                 16
 
 #define RF90_PATH_MAX                   4
+#define RF6052_MAX_PATH                 2
 
 enum version_8192s {
         VERSION_8192S_ACUT,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index cecc377e9e61..2e8e6f8d2d51 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -290,6 +290,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .enable_hw_sec = rtl92se_enable_hw_security_config,
         .set_key = rtl92se_set_key,
         .init_sw_leds = rtl92se_init_sw_leds,
+        .allow_all_destaddr = rtl92se_allow_all_destaddr,
         .get_bbreg = rtl92s_phy_query_bb_reg,
         .set_bbreg = rtl92s_phy_set_bb_reg,
         .get_rfreg = rtl92s_phy_query_rf_reg,
@@ -366,7 +367,7 @@ static struct rtl_hal_cfg rtl92se_hal_cfg = {
 
         .maps[RTL_IMR_TXFOVW] = IMR_TXFOVW,
         .maps[RTL_IMR_PSTIMEOUT] = IMR_PSTIMEOUT,
-        .maps[RTL_IMR_BcnInt] = IMR_BCNINT,
+        .maps[RTL_IMR_BCNINT] = IMR_BCNINT,
         .maps[RTL_IMR_RXFOVW] = IMR_RXFOVW,
         .maps[RTL_IMR_RDU] = IMR_RDU,
         .maps[RTL_IMR_ATIMEND] = IMR_ATIMEND,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 0b074f11f969..c7095118de6e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../pci.h"
 #include "../base.h"
+#include "../stats.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -43,7 +44,7 @@ static u8 _rtl92se_map_hwqueue_to_fwqueue(struct sk_buff *skb,	u8 skb_queue)
 
         if (unlikely(ieee80211_is_beacon(fc)))
                 return QSLT_BEACON;
-        if (ieee80211_is_mgmt(fc))
+        if (ieee80211_is_mgmt(fc) || ieee80211_is_ctl(fc))
                 return QSLT_MGNT;
         if (ieee80211_is_nullfunc(fc))
                 return QSLT_HIGH;
@@ -51,65 +52,6 @@ static u8 _rtl92se_map_hwqueue_to_fwqueue(struct sk_buff *skb,	u8 skb_queue)
         return skb->priority;
 }
 
-static u8 _rtl92s_query_rxpwrpercentage(char antpower)
-{
-        if ((antpower <= -100) || (antpower >= 20))
-                return 0;
-        else if (antpower >= 0)
-                return 100;
-        else
-                return 100 + antpower;
-}
-
-static u8 _rtl92s_evm_db_to_percentage(char value)
-{
-        char ret_val;
-        ret_val = value;
-
-        if (ret_val >= 0)
-                ret_val = 0;
-
-        if (ret_val <= -33)
-                ret_val = -33;
-
-        ret_val = 0 - ret_val;
-        ret_val *= 3;
-
-        if (ret_val == 99)
-                ret_val = 100;
-
-        return ret_val;
-}
-
-static long _rtl92se_translate_todbm(struct ieee80211_hw *hw,
-                                     u8 signal_strength_index)
-{
-        long signal_power;
-
-        signal_power = (long)((signal_strength_index + 1) >> 1);
-        signal_power -= 95;
-        return signal_power;
-}
-
-static long _rtl92se_signal_scale_mapping(struct ieee80211_hw *hw,
-                long currsig)
-{
-        long retsig = 0;
-
-        /* Step 1. Scale mapping. */
-        if (currsig > 47)
-                retsig = 100;
-        else if (currsig > 14 && currsig <= 47)
-                retsig = 100 - ((47 - currsig) * 3) / 2;
-        else if (currsig > 2 && currsig <= 14)
-                retsig = 48 - ((14 - currsig) * 15) / 7;
-        else if (currsig >= 0)
-                retsig = currsig * 9 + 1;
-
-        return retsig;
-}
-
-
 static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
                                        struct rtl_stats *pstats, u8 *pdesc,
                                        struct rx_fwinfo *p_drvinfo,
@@ -119,11 +61,11 @@ static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct phy_sts_cck_8192s_t *cck_buf;
+        struct rtl_ps_ctl *ppsc = rtl_psc(rtlpriv);
         s8 rx_pwr_all = 0, rx_pwr[4];
         u8 rf_rx_num = 0, evm, pwdb_all;
         u8 i, max_spatial_stream;
         u32 rssi, total_rssi = 0;
-        bool in_powersavemode = false;
         bool is_cck = pstats->is_cck;
 
         pstats->packet_matchbssid = packet_match_bssid;
@@ -136,7 +78,7 @@ static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
                 u8 report, cck_highpwr;
                 cck_buf = (struct phy_sts_cck_8192s_t *)p_drvinfo;
 
-                if (!in_powersavemode)
+                if (ppsc->rfpwr_state == ERFON)
                         cck_highpwr = (u8) rtl_get_bbreg(hw,
                                                 RFPGA0_XA_HSSIPARAMETER2,
                                                 0x200);
@@ -181,7 +123,7 @@ static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
                         }
                 }
 
-                pwdb_all = _rtl92s_query_rxpwrpercentage(rx_pwr_all);
+                pwdb_all = rtl_query_rxpwrpercentage(rx_pwr_all);
 
                 /* CCK gain is smaller than OFDM/MCS gain,  */
                 /* so we add gain diff by experiences, the val is 6 */
@@ -222,13 +164,13 @@ static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
         } else {
                 rtlpriv->dm.rfpath_rxenable[0] =
                     rtlpriv->dm.rfpath_rxenable[1] = true;
-                for (i = RF90_PATH_A; i < RF90_PATH_MAX; i++) {
+                for (i = RF90_PATH_A; i < RF6052_MAX_PATH; i++) {
                         if (rtlpriv->dm.rfpath_rxenable[i])
                                 rf_rx_num++;
 
                         rx_pwr[i] = ((p_drvinfo->gain_trsw[i] &
                                     0x3f) * 2) - 110;
-                        rssi = _rtl92s_query_rxpwrpercentage(rx_pwr[i]);
+                        rssi = rtl_query_rxpwrpercentage(rx_pwr[i]);
                         total_rssi += rssi;
                         rtlpriv->stats.rx_snr_db[i] =
                                          (long)(p_drvinfo->rxsnr[i] / 2);
@@ -238,7 +180,7 @@ static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
                 }
 
                 rx_pwr_all = ((p_drvinfo->pwdb_all >> 1) & 0x7f) - 110;
-                pwdb_all = _rtl92s_query_rxpwrpercentage(rx_pwr_all);
+                pwdb_all = rtl_query_rxpwrpercentage(rx_pwr_all);
                 pstats->rx_pwdb_all = pwdb_all;
                 pstats->rxpower = rx_pwr_all;
                 pstats->recvsignalpower = rx_pwr_all;
@@ -250,7 +192,7 @@ static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
                         max_spatial_stream = 1;
 
                 for (i = 0; i < max_spatial_stream; i++) {
-                        evm = _rtl92s_evm_db_to_percentage(p_drvinfo->rxevm[i]);
+                        evm = rtl_evm_db_to_percentage(p_drvinfo->rxevm[i]);
 
                         if (packet_match_bssid) {
                                 if (i == 0)
@@ -262,212 +204,13 @@ static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
         }
 
         if (is_cck)
-                pstats->signalstrength = (u8)(_rtl92se_signal_scale_mapping(hw,
+                pstats->signalstrength = (u8)(rtl_signal_scale_mapping(hw,
                                          pwdb_all));
         else if (rf_rx_num != 0)
-                pstats->signalstrength = (u8) (_rtl92se_signal_scale_mapping(hw,
+                pstats->signalstrength = (u8) (rtl_signal_scale_mapping(hw,
                                 total_rssi /= rf_rx_num));
 }
 
-static void _rtl92se_process_ui_rssi(struct ieee80211_hw *hw,
-                                     struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_phy *rtlphy = &(rtlpriv->phy);
-        u8 rfpath;
-        u32 last_rssi, tmpval;
-
-        if (pstats->packet_toself || pstats->packet_beacon) {
-                rtlpriv->stats.rssi_calculate_cnt++;
-
-                if (rtlpriv->stats.ui_rssi.total_num++ >=
-                    PHY_RSSI_SLID_WIN_MAX) {
-                        rtlpriv->stats.ui_rssi.total_num =
-                                         PHY_RSSI_SLID_WIN_MAX;
-                        last_rssi = rtlpriv->stats.ui_rssi.elements[
-                                rtlpriv->stats.ui_rssi.index];
-                        rtlpriv->stats.ui_rssi.total_val -= last_rssi;
-                }
-
-                rtlpriv->stats.ui_rssi.total_val += pstats->signalstrength;
-                rtlpriv->stats.ui_rssi.elements[rtlpriv->stats.ui_rssi.index++]
-                         = pstats->signalstrength;
-
-                if (rtlpriv->stats.ui_rssi.index >= PHY_RSSI_SLID_WIN_MAX)
-                        rtlpriv->stats.ui_rssi.index = 0;
-
-                tmpval = rtlpriv->stats.ui_rssi.total_val /
-                        rtlpriv->stats.ui_rssi.total_num;
-                rtlpriv->stats.signal_strength = _rtl92se_translate_todbm(hw,
-                                                                (u8) tmpval);
-                pstats->rssi = rtlpriv->stats.signal_strength;
-        }
-
-        if (!pstats->is_cck && pstats->packet_toself) {
-                for (rfpath = RF90_PATH_A; rfpath < rtlphy->num_total_rfpath;
-                     rfpath++) {
-                        if (rtlpriv->stats.rx_rssi_percentage[rfpath] == 0) {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    pstats->rx_mimo_signalstrength[rfpath];
-
-                        }
-
-                        if (pstats->rx_mimo_signalstrength[rfpath] >
-                            rtlpriv->stats.rx_rssi_percentage[rfpath]) {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    ((rtlpriv->stats.rx_rssi_percentage[rfpath]
-                                    * (RX_SMOOTH_FACTOR - 1)) +
-                                    (pstats->rx_mimo_signalstrength[rfpath])) /
-                                    (RX_SMOOTH_FACTOR);
-
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    rtlpriv->stats.rx_rssi_percentage[rfpath]
-                                    + 1;
-                        } else {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    ((rtlpriv->stats.rx_rssi_percentage[rfpath]
-                                    * (RX_SMOOTH_FACTOR - 1)) +
-                                    (pstats->rx_mimo_signalstrength[rfpath])) /
-                                    (RX_SMOOTH_FACTOR);
-                        }
-
-                }
-        }
-}
-
-static void _rtl92se_update_rxsignalstatistics(struct ieee80211_hw *hw,
-                                               struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        int weighting = 0;
-
-        if (rtlpriv->stats.recv_signal_power == 0)
-                rtlpriv->stats.recv_signal_power = pstats->recvsignalpower;
-
-        if (pstats->recvsignalpower > rtlpriv->stats.recv_signal_power)
-                weighting = 5;
-        else if (pstats->recvsignalpower < rtlpriv->stats.recv_signal_power)
-                weighting = (-5);
-
-        rtlpriv->stats.recv_signal_power = (rtlpriv->stats.recv_signal_power * 5
-                                           + pstats->recvsignalpower +
-                                           weighting) / 6;
-}
-
-static void _rtl92se_process_pwdb(struct ieee80211_hw *hw,
-                                  struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        long undec_sm_pwdb = 0;
-
-        if (mac->opmode == NL80211_IFTYPE_ADHOC) {
-                return;
-        } else {
-                undec_sm_pwdb =
-                    rtlpriv->dm.undec_sm_pwdb;
-        }
-
-        if (pstats->packet_toself || pstats->packet_beacon) {
-                if (undec_sm_pwdb < 0)
-                        undec_sm_pwdb = pstats->rx_pwdb_all;
-
-                if (pstats->rx_pwdb_all > (u32) undec_sm_pwdb) {
-                        undec_sm_pwdb =
-                            (((undec_sm_pwdb) *
-                            (RX_SMOOTH_FACTOR - 1)) +
-                            (pstats->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
-
-                        undec_sm_pwdb = undec_sm_pwdb + 1;
-                } else {
-                        undec_sm_pwdb = (((undec_sm_pwdb) *
-                              (RX_SMOOTH_FACTOR - 1)) + (pstats->rx_pwdb_all)) /
-                              (RX_SMOOTH_FACTOR);
-                }
-
-                rtlpriv->dm.undec_sm_pwdb = undec_sm_pwdb;
-                _rtl92se_update_rxsignalstatistics(hw, pstats);
-        }
-}
-
-static void rtl_92s_process_streams(struct ieee80211_hw *hw,
-                                    struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 stream;
-
-        for (stream = 0; stream < 2; stream++) {
-                if (pstats->rx_mimo_sig_qual[stream] != -1) {
-                        if (rtlpriv->stats.rx_evm_percentage[stream] == 0) {
-                                rtlpriv->stats.rx_evm_percentage[stream] =
-                                    pstats->rx_mimo_sig_qual[stream];
-                        }
-
-                        rtlpriv->stats.rx_evm_percentage[stream] =
-                            ((rtlpriv->stats.rx_evm_percentage[stream] *
-                                        (RX_SMOOTH_FACTOR - 1)) +
-                             (pstats->rx_mimo_sig_qual[stream] *
-                                        1)) / (RX_SMOOTH_FACTOR);
-                }
-        }
-}
-
-static void _rtl92se_process_ui_link_quality(struct ieee80211_hw *hw,
-                                             struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 last_evm = 0, tmpval;
-
-        if (pstats->signalquality != 0) {
-                if (pstats->packet_toself || pstats->packet_beacon) {
-
-                        if (rtlpriv->stats.ui_link_quality.total_num++ >=
-                            PHY_LINKQUALITY_SLID_WIN_MAX) {
-                                rtlpriv->stats.ui_link_quality.total_num =
-                                    PHY_LINKQUALITY_SLID_WIN_MAX;
-                                last_evm =
-                                    rtlpriv->stats.ui_link_quality.elements[
-                                    rtlpriv->stats.ui_link_quality.index];
-                                rtlpriv->stats.ui_link_quality.total_val -=
-                                    last_evm;
-                        }
-
-                        rtlpriv->stats.ui_link_quality.total_val +=
-                            pstats->signalquality;
-                        rtlpriv->stats.ui_link_quality.elements[
-                                rtlpriv->stats.ui_link_quality.index++] =
-                            pstats->signalquality;
-
-                        if (rtlpriv->stats.ui_link_quality.index >=
-                            PHY_LINKQUALITY_SLID_WIN_MAX)
-                                rtlpriv->stats.ui_link_quality.index = 0;
-
-                        tmpval = rtlpriv->stats.ui_link_quality.total_val /
-                            rtlpriv->stats.ui_link_quality.total_num;
-                        rtlpriv->stats.signal_quality = tmpval;
-
-                        rtlpriv->stats.last_sigstrength_inpercent = tmpval;
-
-                        rtl_92s_process_streams(hw, pstats);
-
-                }
-        }
-}
-
-static void _rtl92se_process_phyinfo(struct ieee80211_hw *hw,
-                                     u8 *buffer,
-                                     struct rtl_stats *pcurrent_stats)
-{
-
-        if (!pcurrent_stats->packet_matchbssid &&
-            !pcurrent_stats->packet_beacon)
-                return;
-
-        _rtl92se_process_ui_rssi(hw, pcurrent_stats);
-        _rtl92se_process_pwdb(hw, pcurrent_stats);
-        _rtl92se_process_ui_link_quality(hw, pcurrent_stats);
-}
-
 static void _rtl92se_translate_rx_signal_stuff(struct ieee80211_hw *hw,
                 struct sk_buff *skb, struct rtl_stats *pstats,
                 u8 *pdesc, struct rx_fwinfo *p_drvinfo)
@@ -505,7 +248,7 @@ static void _rtl92se_translate_rx_signal_stuff(struct ieee80211_hw *hw,
 
         _rtl92se_query_rxphystatus(hw, pstats, pdesc, p_drvinfo,
                         packet_matchbssid, packet_toself, packet_beacon);
-        _rtl92se_process_phyinfo(hw, tmp_buf, pstats);
+        rtl_process_phyinfo(hw, tmp_buf, pstats);
 }
 
 bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
@@ -541,9 +284,6 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
         rx_status->freq = hw->conf.chandef.chan->center_freq;
         rx_status->band = hw->conf.chandef.chan->band;
 
-        hdr = (struct ieee80211_hdr *)(skb->data + stats->rx_drvinfo_size
-              + stats->rx_bufshift);
-
         if (stats->crc)
                 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
 
@@ -563,6 +303,13 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
          * for IEEE80211w frame, and mac80211 sw will help
          * to decrypt it */
         if (stats->decrypted) {
+                hdr = (struct ieee80211_hdr *)(skb->data +
+                       stats->rx_drvinfo_size + stats->rx_bufshift);
+
+                if (!hdr) {
+                        /* during testing, hdr was NULL here */
+                        return false;
+                }
                 if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
                         (ieee80211_has_protected(hdr->frame_control)))
                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
@@ -630,6 +377,11 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
 
         CLEAR_PCI_TX_DESC_CONTENT(pdesc, TX_DESC_SIZE_RTL8192S);
 
+        if (ieee80211_is_nullfunc(fc) || ieee80211_is_ctl(fc)) {
+                firstseg = true;
+                lastseg = true;
+        }
+
         if (firstseg) {
                 if (rtlpriv->dm.useramask) {
                         /* set txdesc macId */
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
index 12e2a3cb0701..a36eee28f9e7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
@@ -166,8 +166,8 @@ static void rtl8723ae_dm_diginit(struct ieee80211_hw *hw)
         dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
         dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
         dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_range_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_range_min = DM_DIG_MIN;
+        dm_digtable->rx_gain_max = DM_DIG_MAX;
+        dm_digtable->rx_gain_min = DM_DIG_MIN;
         dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
         dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
         dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
@@ -291,11 +291,11 @@ static void rtl92c_dm_ctrl_initgain_by_rssi(struct ieee80211_hw *hw)
         }
 
         if ((dgtbl->rssi_val_min + 10 - dgtbl->back_val) >
-            dgtbl->rx_gain_range_max)
-                dgtbl->cur_igvalue = dgtbl->rx_gain_range_max;
+            dgtbl->rx_gain_max)
+                dgtbl->cur_igvalue = dgtbl->rx_gain_max;
         else if ((dgtbl->rssi_val_min + 10 -
-                  dgtbl->back_val) < dgtbl->rx_gain_range_min)
-                dgtbl->cur_igvalue = dgtbl->rx_gain_range_min;
+                  dgtbl->back_val) < dgtbl->rx_gain_min)
+                dgtbl->cur_igvalue = dgtbl->rx_gain_min;
         else
                 dgtbl->cur_igvalue = dgtbl->rssi_val_min + 10 - dgtbl->back_val;
 
@@ -707,6 +707,77 @@ void rtl8723ae_dm_init_rate_adaptive_mask(struct ieee80211_hw *hw)
                 rtlpriv->dm.useramask = false;
 }
 
+static void rtl8723ae_dm_refresh_rate_adaptive_mask(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        struct rate_adaptive *p_ra = &(rtlpriv->ra);
+        u32 low_rssithresh_for_ra, high_rssithresh_for_ra;
+        struct ieee80211_sta *sta = NULL;
+
+        if (is_hal_stop(rtlhal)) {
+                RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                         " driver is going to unload\n");
+                return;
+        }
+
+        if (!rtlpriv->dm.useramask) {
+                RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                         " driver does not control rate adaptive mask\n");
+                return;
+        }
+
+        if (mac->link_state == MAC80211_LINKED &&
+            mac->opmode == NL80211_IFTYPE_STATION) {
+                switch (p_ra->pre_ratr_state) {
+                case DM_RATR_STA_HIGH:
+                        high_rssithresh_for_ra = 50;
+                        low_rssithresh_for_ra = 20;
+                        break;
+                case DM_RATR_STA_MIDDLE:
+                        high_rssithresh_for_ra = 55;
+                        low_rssithresh_for_ra = 20;
+                        break;
+                case DM_RATR_STA_LOW:
+                        high_rssithresh_for_ra = 50;
+                        low_rssithresh_for_ra = 25;
+                        break;
+                default:
+                        high_rssithresh_for_ra = 50;
+                        low_rssithresh_for_ra = 20;
+                        break;
+                }
+
+                if (rtlpriv->dm.undec_sm_pwdb > high_rssithresh_for_ra)
+                        p_ra->ratr_state = DM_RATR_STA_HIGH;
+                else if (rtlpriv->dm.undec_sm_pwdb > low_rssithresh_for_ra)
+                        p_ra->ratr_state = DM_RATR_STA_MIDDLE;
+                else
+                        p_ra->ratr_state = DM_RATR_STA_LOW;
+
+                if (p_ra->pre_ratr_state != p_ra->ratr_state) {
+                        RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                                 "RSSI = %ld\n",
+                                 rtlpriv->dm.undec_sm_pwdb);
+                        RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                                 "RSSI_LEVEL = %d\n", p_ra->ratr_state);
+                        RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+                                 "PreState = %d, CurState = %d\n",
+                                 p_ra->pre_ratr_state, p_ra->ratr_state);
+
+                        rcu_read_lock();
+                        sta = rtl_find_sta(hw, mac->bssid);
+                        if (sta)
+                                rtlpriv->cfg->ops->update_rate_tbl(hw, sta,
+                                                           p_ra->ratr_state);
+                        rcu_read_unlock();
+
+                        p_ra->pre_ratr_state = p_ra->ratr_state;
+                }
+        }
+}
+
 static void rtl8723ae_dm_init_dynamic_bpowersaving(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -853,6 +924,9 @@ void rtl8723ae_dm_watchdog(struct ieee80211_hw *hw)
         rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_FWLPS_RF_ON,
                                       (u8 *) (&fw_ps_awake));
 
+        if (ppsc->p2p_ps_info.p2p_ps_mode)
+                fw_ps_awake = false;
+
         if ((ppsc->rfpwr_state == ERFON) &&
             ((!fw_current_inpsmode) && fw_ps_awake) &&
             (!ppsc->rfchange_inprogress)) {
@@ -861,7 +935,7 @@ void rtl8723ae_dm_watchdog(struct ieee80211_hw *hw)
                 rtl8723ae_dm_false_alarm_counter_statistics(hw);
                 rtl8723ae_dm_dynamic_bpowersaving(hw);
                 rtl8723ae_dm_dynamic_txpower(hw);
-                /* rtl92c_dm_refresh_rate_adaptive_mask(hw); */
+                rtl8723ae_dm_refresh_rate_adaptive_mask(hw);
                 rtl8723ae_dm_bt_coexist(hw);
                 rtl8723ae_dm_check_edca_turbo(hw);
         }
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
index 39d246196247..a372b0204456 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
@@ -55,7 +55,13 @@
 #define DM_DIG_BACKOFF_MIN                      -4
 #define DM_DIG_BACKOFF_DEFAULT                  10
 
+#define RXPATHSELECTION_SS_TH_LOW               30
+#define RXPATHSELECTION_DIFF_TH                 18
+
 #define DM_RATR_STA_INIT                        0
+#define DM_RATR_STA_HIGH                        1
+#define DM_RATR_STA_MIDDLE                      2
+#define DM_RATR_STA_LOW                         3
 
 #define TXHIGHPWRLEVEL_NORMAL                   0
 #define TXHIGHPWRLEVEL_LEVEL1                   1
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/fw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/fw.c
index 35cb8f83eed4..dedfa1ed3e02 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/fw.c
@@ -494,7 +494,9 @@ void rtl8723ae_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode)
         RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, "FW LPS mode = %d\n", mode);
 
         SET_H2CCMD_PWRMODE_PARM_MODE(u1_h2c_set_pwrmode, mode);
-        SET_H2CCMD_PWRMODE_PARM_SMART_PS(u1_h2c_set_pwrmode, 1);
+        SET_H2CCMD_PWRMODE_PARM_SMART_PS(u1_h2c_set_pwrmode,
+                                         (rtlpriv->mac80211.p2p) ?
+                                         ppsc->smart_ps : 1);
         SET_H2CCMD_PWRMODE_PARM_BCN_PASS_TIME(u1_h2c_set_pwrmode,
                                               ppsc->reg_max_lps_awakeintvl);
 
@@ -741,3 +743,96 @@ void rtl8723ae_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus)
 
         rtl8723ae_fill_h2c_cmd(hw, H2C_JOINBSSRPT, 1, u1_joinbssrpt_parm);
 }
+
+static void rtl8723e_set_p2p_ctw_period_cmd(struct ieee80211_hw *hw,
+                                            u8 ctwindow)
+{
+        u8 u1_ctwindow_period[1] = {ctwindow};
+
+        rtl8723ae_fill_h2c_cmd(hw, H2C_P2P_PS_CTW_CMD, 1, u1_ctwindow_period);
+}
+
+void rtl8723ae_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_ps_ctl *rtlps = rtl_psc(rtl_priv(hw));
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        struct rtl_p2p_ps_info *p2pinfo = &(rtlps->p2p_ps_info);
+        struct p2p_ps_offload_t *p2p_ps_offload = &rtlhal->p2p_ps_offload;
+        u8      i;
+        u16     ctwindow;
+        u32     start_time, tsf_low;
+
+        switch (p2p_ps_state) {
+        case P2P_PS_DISABLE:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_DISABLE\n");
+                memset(p2p_ps_offload, 0, sizeof(struct p2p_ps_offload_t));
+                break;
+        case P2P_PS_ENABLE:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_ENABLE\n");
+                /* update CTWindow value. */
+                if (p2pinfo->ctwindow > 0) {
+                        p2p_ps_offload->ctwindow_en = 1;
+                        ctwindow = p2pinfo->ctwindow;
+                        rtl8723e_set_p2p_ctw_period_cmd(hw, ctwindow);
+                }
+
+                /* hw only support 2 set of NoA */
+                for (i = 0; i < p2pinfo->noa_num; i++) {
+                        /* To control the register setting for which NOA*/
+                        rtl_write_byte(rtlpriv, 0x5cf, (i << 4));
+                        if (i == 0)
+                                p2p_ps_offload->noa0_en = 1;
+                        else
+                                p2p_ps_offload->noa1_en = 1;
+
+                        /* config P2P NoA Descriptor Register */
+                        rtl_write_dword(rtlpriv, 0x5E0,
+                                        p2pinfo->noa_duration[i]);
+                        rtl_write_dword(rtlpriv, 0x5E4,
+                                        p2pinfo->noa_interval[i]);
+
+                        /*Get Current TSF value */
+                        tsf_low = rtl_read_dword(rtlpriv, REG_TSFTR);
+
+                        start_time = p2pinfo->noa_start_time[i];
+                        if (p2pinfo->noa_count_type[i] != 1) {
+                                while (start_time <= (tsf_low+(50*1024))) {
+                                        start_time += p2pinfo->noa_interval[i];
+                                        if (p2pinfo->noa_count_type[i] != 255)
+                                                p2pinfo->noa_count_type[i]--;
+                                }
+                        }
+                        rtl_write_dword(rtlpriv, 0x5E8, start_time);
+                        rtl_write_dword(rtlpriv, 0x5EC,
+                                        p2pinfo->noa_count_type[i]);
+                }
+                if ((p2pinfo->opp_ps == 1) || (p2pinfo->noa_num > 0)) {
+                        /* rst p2p circuit */
+                        rtl_write_byte(rtlpriv, REG_DUAL_TSF_RST, BIT(4));
+
+                        p2p_ps_offload->offload_en = 1;
+
+                        if (P2P_ROLE_GO == rtlpriv->mac80211.p2p) {
+                                p2p_ps_offload->role = 1;
+                                p2p_ps_offload->allstasleep = 0;
+                        } else {
+                                p2p_ps_offload->role = 0;
+                        }
+                        p2p_ps_offload->discovery = 0;
+                }
+                break;
+        case P2P_PS_SCAN:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_SCAN\n");
+                p2p_ps_offload->discovery = 1;
+                break;
+        case P2P_PS_SCAN_DONE:
+                RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "P2P_PS_SCAN_DONE\n");
+                p2p_ps_offload->discovery = 0;
+                p2pinfo->p2p_ps_state = P2P_PS_ENABLE;
+                break;
+        default:
+                break;
+        }
+        rtl8723ae_fill_h2c_cmd(hw, H2C_P2P_PS_OFFLOAD, 1, (u8 *)p2p_ps_offload);
+}
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/fw.h b/drivers/net/wireless/rtlwifi/rtl8723ae/fw.h
index 89994e16dc83..ed3b795e6980 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/fw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/fw.h
@@ -70,8 +70,10 @@ enum rtl8192c_h2c_cmd {
         H2C_SETPWRMODE = 1,
         H2C_JOINBSSRPT = 2,
         H2C_RSVDPAGE = 3,
-        H2C_RSSI_REPORT = 5,
-        H2C_RA_MASK = 6,
+        H2C_RSSI_REPORT = 4,
+        H2C_P2P_PS_CTW_CMD = 5,
+        H2C_P2P_PS_OFFLOAD = 6,
+        H2C_RA_MASK = 7,
         MAX_H2CCMD
 };
 
@@ -97,5 +99,6 @@ void rtl8723ae_firmware_selfreset(struct ieee80211_hw *hw);
 void rtl8723ae_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
 void rtl8723ae_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
 void rtl8723ae_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
+void rtl8723ae_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
index 9a0c71c2e15e..c333dfd116b8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
@@ -449,6 +449,9 @@ void rtl8723ae_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 rtl8723ae_set_fw_joinbss_report_cmd(hw, (*(u8 *) val));
 
                 break; }
+        case HW_VAR_H2C_FW_P2P_PS_OFFLOAD:
+                rtl8723ae_set_p2p_ps_offload_cmd(hw, (*(u8 *)val));
+                break;
         case HW_VAR_AID:{
                 u16 u2btmp;
                 u2btmp = rtl_read_word(rtlpriv, REG_BCN_PSR_RPT);
@@ -474,6 +477,39 @@ void rtl8723ae_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 if (btype_ibss == true)
                         _rtl8723ae_resume_tx_beacon(hw);
                 break; }
+        case HW_VAR_FW_LPS_ACTION: {
+                bool enter_fwlps = *((bool *)val);
+                u8 rpwm_val, fw_pwrmode;
+                bool fw_current_inps;
+
+                if (enter_fwlps) {
+                        rpwm_val = 0x02;        /* RF off */
+                        fw_current_inps = true;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_FW_PSMODE_STATUS,
+                                        (u8 *)(&fw_current_inps));
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_H2C_FW_PWRMODE,
+                                        (u8 *)(&ppsc->fwctrl_psmode));
+
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_SET_RPWM,
+                                        (u8 *)(&rpwm_val));
+                } else {
+                        rpwm_val = 0x0C;        /* RF on */
+                        fw_pwrmode = FW_PS_ACTIVE_MODE;
+                        fw_current_inps = false;
+                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SET_RPWM,
+                                        (u8 *)(&rpwm_val));
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_H2C_FW_PWRMODE,
+                                        (u8 *)(&fw_pwrmode));
+
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                        HW_VAR_FW_PSMODE_STATUS,
+                                        (u8 *)(&fw_current_inps));
+                }
+                break; }
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "switch case not processed\n");
@@ -1379,7 +1415,7 @@ static void _rtl8723ae_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                 }
 
                 for (i = 0; i < 14; i++) {
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF(%d)-Ch(%d) [CCK / HT40_1S / HT40_2S] = "
                                 "[0x%x / 0x%x / 0x%x]\n", rf_path, i,
                                 rtlefuse->txpwrlevel_cck[rf_path][i],
@@ -1420,10 +1456,10 @@ static void _rtl8723ae_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                                     0xf0) >> 4);
                         }
 
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF-%d pwrgroup_ht20[%d] = 0x%x\n", rf_path, i,
                                 rtlefuse->pwrgroup_ht20[rf_path][i]);
-                        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                                 "RF-%d pwrgroup_ht40[%d] = 0x%x\n", rf_path, i,
                                 rtlefuse->pwrgroup_ht40[rf_path][i]);
                 }
@@ -1463,19 +1499,19 @@ static void _rtl8723ae_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
             rtlefuse->txpwr_legacyhtdiff[RF90_PATH_A][7];
 
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-A Ht20 to HT40 Diff[%d] = 0x%x\n", i,
                         rtlefuse->txpwr_ht20diff[RF90_PATH_A][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-A Legacy to Ht40 Diff[%d] = 0x%x\n", i,
                         rtlefuse->txpwr_legacyhtdiff[RF90_PATH_A][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-B Ht20 to HT40 Diff[%d] = 0x%x\n", i,
                         rtlefuse->txpwr_ht20diff[RF90_PATH_B][i]);
         for (i = 0; i < 14; i++)
-                RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+                RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                         "RF-B Legacy to HT40 Diff[%d] = 0x%x\n", i,
                         rtlefuse->txpwr_legacyhtdiff[RF90_PATH_B][i]);
 
@@ -1483,14 +1519,14 @@ static void _rtl8723ae_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                 rtlefuse->eeprom_regulatory = (hwinfo[RF_OPTION1] & 0x7);
         else
                 rtlefuse->eeprom_regulatory = 0;
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "eeprom_regulatory = 0x%x\n", rtlefuse->eeprom_regulatory);
 
         if (!autoload_fail)
                 rtlefuse->eeprom_tssi[RF90_PATH_A] = hwinfo[EEPROM_TSSI_A];
         else
                 rtlefuse->eeprom_tssi[RF90_PATH_A] = EEPROM_DEFAULT_TSSI;
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "TSSI_A = 0x%x, TSSI_B = 0x%x\n",
                 rtlefuse->eeprom_tssi[RF90_PATH_A],
                 rtlefuse->eeprom_tssi[RF90_PATH_B]);
@@ -1505,7 +1541,7 @@ static void _rtl8723ae_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
                 rtlefuse->apk_thermalmeterignore = true;
 
         rtlefuse->thermalmeter[0] = rtlefuse->eeprom_thermalmeter;
-        RTPRINT(rtlpriv, FINIT, INIT_TxPower,
+        RTPRINT(rtlpriv, FINIT, INIT_TXPOWER,
                 "thermalmeter = 0x%x\n", rtlefuse->eeprom_thermalmeter);
 }
 
@@ -1713,19 +1749,7 @@ static void _rtl8723ae_hal_customized_behavior(struct ieee80211_hw *hw)
         struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 
-        switch (rtlhal->oem_id) {
-        case RT_CID_819x_HP:
-                pcipriv->ledctl.led_opendrain = true;
-                break;
-        case RT_CID_819x_Lenovo:
-        case RT_CID_DEFAULT:
-        case RT_CID_TOSHIBA:
-        case RT_CID_CCX:
-        case RT_CID_819x_Acer:
-        case RT_CID_WHQL:
-        default:
-                break;
-        }
+        pcipriv->ledctl.led_opendrain = true;
         RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
                  "RT Customized ID: 0x%02X\n", rtlhal->oem_id);
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/led.c b/drivers/net/wireless/rtlwifi/rtl8723ae/led.c
index 9c4e1d811187..061526fe6e2d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/led.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/led.c
@@ -54,8 +54,9 @@ void rtl8723ae_sw_led_on(struct ieee80211_hw *hw, struct rtl_led *pled)
         case LED_PIN_GPIO0:
                 break;
         case LED_PIN_LED0:
+                ledcfg &= ~BIT(6);
                 rtl_write_byte(rtlpriv,
-                               REG_LEDCFG2, (ledcfg & 0xf0) | BIT(5) | BIT(6));
+                               REG_LEDCFG2, (ledcfg & 0xf0) | BIT(5));
                 break;
         case LED_PIN_LED1:
                 rtl_write_byte(rtlpriv, REG_LEDCFG2, (ledcfg & 0x0f) | BIT(5));
@@ -84,16 +85,21 @@ void rtl8723ae_sw_led_off(struct ieee80211_hw *hw, struct rtl_led *pled)
                 break;
         case LED_PIN_LED0:
                 ledcfg &= 0xf0;
-                if (pcipriv->ledctl.led_opendrain)
+                if (pcipriv->ledctl.led_opendrain) {
+                        ledcfg &= 0x90;
+                        rtl_write_byte(rtlpriv, REG_LEDCFG2, (ledcfg|BIT(3)));
+                        ledcfg = rtl_read_byte(rtlpriv, REG_MAC_PINMUX_CFG);
+                        ledcfg &= 0xFE;
+                        rtl_write_byte(rtlpriv, REG_MAC_PINMUX_CFG, ledcfg);
+                } else {
+                        ledcfg &= ~BIT(6);
                         rtl_write_byte(rtlpriv, REG_LEDCFG2,
-                                       (ledcfg | BIT(1) | BIT(5) | BIT(6)));
-                else
-                        rtl_write_byte(rtlpriv, REG_LEDCFG2,
-                                       (ledcfg | BIT(3) | BIT(5) | BIT(6)));
+                                       (ledcfg | BIT(3) | BIT(5)));
+                }
                 break;
         case LED_PIN_LED1:
-                ledcfg &= 0x0f;
-                rtl_write_byte(rtlpriv, REG_LEDCFG2, (ledcfg | BIT(3)));
+                ledcfg = rtl_read_byte(rtlpriv, REG_LEDCFG1) & 0x10;
+                rtl_write_byte(rtlpriv, REG_LEDCFG1, (ledcfg | BIT(3)));
                 break;
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
index bb7cc90bafb2..e4c4cdc3eb67 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
@@ -305,7 +305,7 @@ static struct rtl_hal_cfg rtl8723ae_hal_cfg = {
 
         .maps[RTL_IMR_TXFOVW] = PHIMR_TXFOVW,
         .maps[RTL_IMR_PSTIMEOUT] = PHIMR_PSTIMEOUT,
-        .maps[RTL_IMR_BcnInt] = PHIMR_BCNDMAINT0,
+        .maps[RTL_IMR_BCNINT] = PHIMR_BCNDMAINT0,
         .maps[RTL_IMR_RXFOVW] = PHIMR_RXFOVW,
         .maps[RTL_IMR_RDU] = PHIMR_RDU,
         .maps[RTL_IMR_ATIMEND] = PHIMR_ATIMEND_E,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
index 601261d67e84..c72758d8f4ed 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
@@ -307,9 +307,6 @@ bool rtl8723ae_rx_query_desc(struct ieee80211_hw *hw,
         rx_status->freq = hw->conf.chandef.chan->center_freq;
         rx_status->band = hw->conf.chandef.chan->band;
 
-        hdr = (struct ieee80211_hdr *)(skb->data + status->rx_drvinfo_size
-                + status->rx_bufshift);
-
         if (status->crc)
                 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
 
@@ -330,6 +327,13 @@ bool rtl8723ae_rx_query_desc(struct ieee80211_hw *hw,
          * to decrypt it
          */
         if (status->decrypted) {
+                hdr = (struct ieee80211_hdr *)(skb->data +
+                       status->rx_drvinfo_size + status->rx_bufshift);
+
+                if (!hdr) {
+                        /* during testing, hdr could be NULL here */
+                        return false;
+                }
                 if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
                         (ieee80211_has_protected(hdr->frame_control)))
                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 156b52732f3d..83915dcd0e58 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -224,10 +224,9 @@ static void _usb_writeN_sync(struct rtl_priv *rtlpriv, u32 addr, void *data,
         u8 *buffer;
 
         wvalue = (u16)(addr & 0x0000ffff);
-        buffer = kmalloc(len, GFP_ATOMIC);
+        buffer = kmemdup(data, len, GFP_ATOMIC);
         if (!buffer)
                 return;
-        memcpy(buffer, data, len);
         usb_control_msg(udev, pipe, request, reqtype, wvalue,
                         index, buffer, len, 50);
 
@@ -309,6 +308,8 @@ static int _rtl_usb_init_tx(struct ieee80211_hw *hw)
         return 0;
 }
 
+static void _rtl_rx_work(unsigned long param);
+
 static int _rtl_usb_init_rx(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -325,6 +326,12 @@ static int _rtl_usb_init_rx(struct ieee80211_hw *hw)
         pr_info("rx_max_size %d, rx_urb_num %d, in_ep %d\n",
                 rtlusb->rx_max_size, rtlusb->rx_urb_num, rtlusb->in_ep);
         init_usb_anchor(&rtlusb->rx_submitted);
+        init_usb_anchor(&rtlusb->rx_cleanup_urbs);
+
+        skb_queue_head_init(&rtlusb->rx_queue);
+        rtlusb->rx_work_tasklet.func = _rtl_rx_work;
+        rtlusb->rx_work_tasklet.data = (unsigned long)rtlusb;
+
         return 0;
 }
 
@@ -406,40 +413,30 @@ static void rtl_usb_init_sw(struct ieee80211_hw *hw)
         rtlusb->disableHWSM =  true;
 }
 
-#define __RADIO_TAP_SIZE_RSV    32
-
 static void _rtl_rx_completed(struct urb *urb);
 
-static struct sk_buff *_rtl_prep_rx_urb(struct ieee80211_hw *hw,
-                                        struct rtl_usb *rtlusb,
-                                        struct urb *urb,
-                                        gfp_t gfp_mask)
+static int _rtl_prep_rx_urb(struct ieee80211_hw *hw, struct rtl_usb *rtlusb,
+                              struct urb *urb, gfp_t gfp_mask)
 {
-        struct sk_buff *skb;
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        void *buf;
 
-        skb = __dev_alloc_skb((rtlusb->rx_max_size + __RADIO_TAP_SIZE_RSV),
-                               gfp_mask);
-        if (!skb) {
+        buf = usb_alloc_coherent(rtlusb->udev, rtlusb->rx_max_size, gfp_mask,
+                                 &urb->transfer_dma);
+        if (!buf) {
                 RT_TRACE(rtlpriv, COMP_USB, DBG_EMERG,
-                         "Failed to __dev_alloc_skb!!\n");
-                return ERR_PTR(-ENOMEM);
+                         "Failed to usb_alloc_coherent!!\n");
+                return -ENOMEM;
         }
 
-        /* reserve some space for mac80211's radiotap */
-        skb_reserve(skb, __RADIO_TAP_SIZE_RSV);
         usb_fill_bulk_urb(urb, rtlusb->udev,
                           usb_rcvbulkpipe(rtlusb->udev, rtlusb->in_ep),
-                          skb->data, min(skb_tailroom(skb),
-                          (int)rtlusb->rx_max_size),
-                          _rtl_rx_completed, skb);
+                          buf, rtlusb->rx_max_size, _rtl_rx_completed, rtlusb);
+        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
-        _rtl_install_trx_info(rtlusb, skb, rtlusb->in_ep);
-        return skb;
+        return 0;
 }
 
-#undef __RADIO_TAP_SIZE_RSV
-
 static void _rtl_usb_rx_process_agg(struct ieee80211_hw *hw,
                                     struct sk_buff *skb)
 {
@@ -523,22 +520,11 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw,
                         if (unicast)
                                 rtlpriv->link_info.num_rx_inperiod++;
                 }
-                if (likely(rtl_action_proc(hw, skb, false))) {
-                        struct sk_buff *uskb = NULL;
-                        u8 *pdata;
-
-                        uskb = dev_alloc_skb(skb->len + 128);
-                        if (uskb) {     /* drop packet on allocation failure */
-                                memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status,
-                                       sizeof(rx_status));
-                                pdata = (u8 *)skb_put(uskb, skb->len);
-                                memcpy(pdata, skb->data, skb->len);
-                                ieee80211_rx_irqsafe(hw, uskb);
-                        }
-                        dev_kfree_skb_any(skb);
-                } else {
+
+                if (likely(rtl_action_proc(hw, skb, false)))
+                        ieee80211_rx(hw, skb);
+                else
                         dev_kfree_skb_any(skb);
-                }
         }
 }
 
@@ -555,15 +541,70 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         while (!skb_queue_empty(&rx_queue)) {
                 _skb = skb_dequeue(&rx_queue);
                 _rtl_usb_rx_process_agg(hw, _skb);
-                ieee80211_rx_irqsafe(hw, _skb);
+                ieee80211_rx(hw, _skb);
         }
 }
 
+#define __RX_SKB_MAX_QUEUED     32
+
+static void _rtl_rx_work(unsigned long param)
+{
+        struct rtl_usb *rtlusb = (struct rtl_usb *)param;
+        struct ieee80211_hw *hw = usb_get_intfdata(rtlusb->intf);
+        struct sk_buff *skb;
+
+        while ((skb = skb_dequeue(&rtlusb->rx_queue))) {
+                if (unlikely(IS_USB_STOP(rtlusb))) {
+                        dev_kfree_skb_any(skb);
+                        continue;
+                }
+
+                if (likely(!rtlusb->usb_rx_segregate_hdl)) {
+                        _rtl_usb_rx_process_noagg(hw, skb);
+                } else {
+                        /* TO DO */
+                        _rtl_rx_pre_process(hw, skb);
+                        pr_err("rx agg not supported\n");
+                }
+        }
+}
+
+static unsigned int _rtl_rx_get_padding(struct ieee80211_hdr *hdr,
+                                        unsigned int len)
+{
+        unsigned int padding = 0;
+
+        /* make function no-op when possible */
+        if (NET_IP_ALIGN == 0 || len < sizeof(*hdr))
+                return 0;
+
+        /* alignment calculation as in lbtf_rx() / carl9170_rx_copy_data() */
+        /* TODO: deduplicate common code, define helper function instead? */
+
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                u8 *qc = ieee80211_get_qos_ctl(hdr);
+
+                padding ^= NET_IP_ALIGN;
+
+                /* Input might be invalid, avoid accessing memory outside
+                 * the buffer.
+                 */
+                if ((unsigned long)qc - (unsigned long)hdr < len &&
+                    *qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
+                        padding ^= NET_IP_ALIGN;
+        }
+
+        if (ieee80211_has_a4(hdr->frame_control))
+                padding ^= NET_IP_ALIGN;
+
+        return padding;
+}
+
+#define __RADIO_TAP_SIZE_RSV    32
+
 static void _rtl_rx_completed(struct urb *_urb)
 {
-        struct sk_buff *skb = (struct sk_buff *)_urb->context;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct rtl_usb *rtlusb = (struct rtl_usb *)info->rate_driver_data[0];
+        struct rtl_usb *rtlusb = (struct rtl_usb *)_urb->context;
         struct ieee80211_hw *hw = usb_get_intfdata(rtlusb->intf);
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         int err = 0;
@@ -572,28 +613,50 @@ static void _rtl_rx_completed(struct urb *_urb)
                 goto free;
 
         if (likely(0 == _urb->status)) {
-                /* If this code were moved to work queue, would CPU
-                 * utilization be improved?  NOTE: We shall allocate another skb
-                 * and reuse the original one.
-                 */
-                skb_put(skb, _urb->actual_length);
+                unsigned int padding;
+                struct sk_buff *skb;
+                unsigned int qlen;
+                unsigned int size = _urb->actual_length;
+                struct ieee80211_hdr *hdr;
 
-                if (likely(!rtlusb->usb_rx_segregate_hdl)) {
-                        struct sk_buff *_skb;
-                        _rtl_usb_rx_process_noagg(hw, skb);
-                        _skb = _rtl_prep_rx_urb(hw, rtlusb, _urb, GFP_ATOMIC);
-                        if (IS_ERR(_skb)) {
-                                err = PTR_ERR(_skb);
-                                RT_TRACE(rtlpriv, COMP_USB, DBG_EMERG,
-                                         "Can't allocate skb for bulk IN!\n");
-                                return;
-                        }
-                        skb = _skb;
-                } else{
-                        /* TO DO */
-                        _rtl_rx_pre_process(hw, skb);
-                        pr_err("rx agg not supported\n");
+                if (size < RTL_RX_DESC_SIZE + sizeof(struct ieee80211_hdr)) {
+                        RT_TRACE(rtlpriv, COMP_USB, DBG_EMERG,
+                                 "Too short packet from bulk IN! (len: %d)\n",
+                                 size);
+                        goto resubmit;
+                }
+
+                qlen = skb_queue_len(&rtlusb->rx_queue);
+                if (qlen >= __RX_SKB_MAX_QUEUED) {
+                        RT_TRACE(rtlpriv, COMP_USB, DBG_EMERG,
+                                 "Pending RX skbuff queue full! (qlen: %d)\n",
+                                 qlen);
+                        goto resubmit;
                 }
+
+                hdr = (void *)(_urb->transfer_buffer + RTL_RX_DESC_SIZE);
+                padding = _rtl_rx_get_padding(hdr, size - RTL_RX_DESC_SIZE);
+
+                skb = dev_alloc_skb(size + __RADIO_TAP_SIZE_RSV + padding);
+                if (!skb) {
+                        RT_TRACE(rtlpriv, COMP_USB, DBG_EMERG,
+                                 "Can't allocate skb for bulk IN!\n");
+                        goto resubmit;
+                }
+
+                _rtl_install_trx_info(rtlusb, skb, rtlusb->in_ep);
+
+                /* Make sure the payload data is 4 byte aligned. */
+                skb_reserve(skb, padding);
+
+                /* reserve some space for mac80211's radiotap */
+                skb_reserve(skb, __RADIO_TAP_SIZE_RSV);
+
+                memcpy(skb_put(skb, size), _urb->transfer_buffer, size);
+
+                skb_queue_tail(&rtlusb->rx_queue, skb);
+                tasklet_schedule(&rtlusb->rx_work_tasklet);
+
                 goto resubmit;
         }
 
@@ -609,9 +672,6 @@ static void _rtl_rx_completed(struct urb *_urb)
         }
 
 resubmit:
-        skb_reset_tail_pointer(skb);
-        skb_trim(skb, 0);
-
         usb_anchor_urb(_urb, &rtlusb->rx_submitted);
         err = usb_submit_urb(_urb, GFP_ATOMIC);
         if (unlikely(err)) {
@@ -621,13 +681,34 @@ resubmit:
         return;
 
 free:
-        dev_kfree_skb_irq(skb);
+        /* On some architectures, usb_free_coherent must not be called from
+         * hardirq context. Queue urb to cleanup list.
+         */
+        usb_anchor_urb(_urb, &rtlusb->rx_cleanup_urbs);
+}
+
+#undef __RADIO_TAP_SIZE_RSV
+
+static void _rtl_usb_cleanup_rx(struct ieee80211_hw *hw)
+{
+        struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
+        struct urb *urb;
+
+        usb_kill_anchored_urbs(&rtlusb->rx_submitted);
+
+        tasklet_kill(&rtlusb->rx_work_tasklet);
+        skb_queue_purge(&rtlusb->rx_queue);
+
+        while ((urb = usb_get_from_anchor(&rtlusb->rx_cleanup_urbs))) {
+                usb_free_coherent(urb->dev, urb->transfer_buffer_length,
+                                urb->transfer_buffer, urb->transfer_dma);
+                usb_free_urb(urb);
+        }
 }
 
 static int _rtl_usb_receive(struct ieee80211_hw *hw)
 {
         struct urb *urb;
-        struct sk_buff *skb;
         int err;
         int i;
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -646,11 +727,10 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
                         goto err_out;
                 }
 
-                skb = _rtl_prep_rx_urb(hw, rtlusb, urb, GFP_KERNEL);
-                if (IS_ERR(skb)) {
+                err = _rtl_prep_rx_urb(hw, rtlusb, urb, GFP_KERNEL);
+                if (err < 0) {
                         RT_TRACE(rtlpriv, COMP_USB, DBG_EMERG,
                                  "Failed to prep_rx_urb!!\n");
-                        err = PTR_ERR(skb);
                         usb_free_urb(urb);
                         goto err_out;
                 }
@@ -665,6 +745,7 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
 
 err_out:
         usb_kill_anchored_urbs(&rtlusb->rx_submitted);
+        _rtl_usb_cleanup_rx(hw);
         return err;
 }
 
@@ -706,7 +787,7 @@ static void rtl_usb_cleanup(struct ieee80211_hw *hw)
         SET_USB_STOP(rtlusb);
 
         /* clean up rx stuff. */
-        usb_kill_anchored_urbs(&rtlusb->rx_submitted);
+        _rtl_usb_cleanup_rx(hw);
 
         /* clean up tx stuff */
         for (i = 0; i < RTL_USB_MAX_EP_NUM; i++) {
@@ -851,6 +932,7 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (unlikely(!_urb)) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "Can't allocate urb. Drop skb!\n");
+                kfree_skb(skb);
                 return;
         }
         _rtl_submit_tx_urb(hw, _urb);
diff --git a/drivers/net/wireless/rtlwifi/usb.h b/drivers/net/wireless/rtlwifi/usb.h
index fb986f98d1df..685273ca9561 100644
--- a/drivers/net/wireless/rtlwifi/usb.h
+++ b/drivers/net/wireless/rtlwifi/usb.h
@@ -136,11 +136,14 @@ struct rtl_usb {
         void (*usb_tx_cleanup)(struct ieee80211_hw *, struct sk_buff *);
 
         /* Rx */
-        u8 in_ep_nums ;
+        u8 in_ep_nums;
         u32 in_ep;              /* Bulk IN endpoint number */
         u32 rx_max_size;        /* Bulk IN max buffer size */
         u32 rx_urb_num;         /* How many Bulk INs are submitted to host. */
         struct usb_anchor       rx_submitted;
+        struct usb_anchor       rx_cleanup_urbs;
+        struct tasklet_struct   rx_work_tasklet;
+        struct sk_buff_head     rx_queue;
         void (*usb_rx_segregate_hdl)(struct ieee80211_hw *, struct sk_buff *,
                                      struct sk_buff_head *);
         void (*usb_rx_hdl)(struct ieee80211_hw *, struct sk_buff *);
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index c3eff32acf6c..44328baa6389 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -99,11 +99,36 @@
 #define CHANNEL_GROUP_MAX_5G            9
 #define CHANNEL_MAX_NUMBER_2G           14
 #define AVG_THERMAL_NUM                 8
+#define AVG_THERMAL_NUM_88E             4
 #define MAX_TID_COUNT                   9
 
 /* for early mode */
 #define FCS_LEN                         4
 #define EM_HDR_LEN                      8
+
+#define MAX_TX_COUNT                    4
+#define MAX_RF_PATH                     4
+#define MAX_CHNL_GROUP_24G              6
+#define MAX_CHNL_GROUP_5G               14
+
+struct txpower_info_2g {
+        u8 index_cck_base[MAX_RF_PATH][MAX_CHNL_GROUP_24G];
+        u8 index_bw40_base[MAX_RF_PATH][MAX_CHNL_GROUP_24G];
+        /*If only one tx, only BW20 and OFDM are used.*/
+        u8 cck_diff[MAX_RF_PATH][MAX_TX_COUNT];
+        u8 ofdm_diff[MAX_RF_PATH][MAX_TX_COUNT];
+        u8 bw20_diff[MAX_RF_PATH][MAX_TX_COUNT];
+        u8 bw40_diff[MAX_RF_PATH][MAX_TX_COUNT];
+};
+
+struct txpower_info_5g {
+        u8 index_bw40_base[MAX_RF_PATH][MAX_CHNL_GROUP_5G];
+        /*If only one tx, only BW20, OFDM, BW80 and BW160 are used.*/
+        u8 ofdm_diff[MAX_RF_PATH][MAX_TX_COUNT];
+        u8 bw20_diff[MAX_RF_PATH][MAX_TX_COUNT];
+        u8 bw40_diff[MAX_RF_PATH][MAX_TX_COUNT];
+};
+
 enum intf_type {
         INTF_PCI = 0,
         INTF_USB = 1,
@@ -137,6 +162,7 @@ enum hardware_type {
         HARDWARE_TYPE_RTL8192DU,
         HARDWARE_TYPE_RTL8723AE,
         HARDWARE_TYPE_RTL8723U,
+        HARDWARE_TYPE_RTL8188EE,
 
         /* keep it last */
         HARDWARE_TYPE_NUM
@@ -263,7 +289,7 @@ enum hw_variables {
         HW_VAR_RATR_0,
         HW_VAR_RRSR,
         HW_VAR_CPU_RST,
-        HW_VAR_CECHK_BSSID,
+        HW_VAR_CHECK_BSSID,
         HW_VAR_LBK_MODE,
         HW_VAR_AES_11N_FIX,
         HW_VAR_USB_RX_AGGR,
@@ -278,7 +304,10 @@ enum hw_variables {
         HW_VAR_SET_RPWM,
         HW_VAR_H2C_FW_PWRMODE,
         HW_VAR_H2C_FW_JOINBSSRPT,
+        HW_VAR_H2C_FW_P2P_PS_OFFLOAD,
         HW_VAR_FW_PSMODE_STATUS,
+        HW_VAR_RESUME_CLK_ON,
+        HW_VAR_FW_LPS_ACTION,
         HW_VAR_1X1_RECV_COMBINE,
         HW_VAR_STOP_SEND_BEACON,
         HW_VAR_TSF_TIMER,
@@ -305,6 +334,7 @@ enum hw_variables {
         HW_VAR_INT_AC,
         HW_VAR_RF_TIMING,
 
+        HAL_DEF_WOWLAN,
         HW_VAR_MRC,
 
         HW_VAR_MGT_FILTER,
@@ -461,6 +491,7 @@ enum rtl_var_map {
         EFUSE_MAX_SECTION_MAP,
         EFUSE_REAL_CONTENT_SIZE,
         EFUSE_OOB_PROTECT_BYTES_LEN,
+        EFUSE_ACCESS,
 
         /*CAM map */
         RWCAM,
@@ -493,7 +524,7 @@ enum rtl_var_map {
         RTL_IMR_TIMEOUT1,       /*Timeout interrupt 1 */
         RTL_IMR_TXFOVW,         /*Transmit FIFO Overflow */
         RTL_IMR_PSTIMEOUT,      /*Power save time out interrupt */
-        RTL_IMR_BcnInt,         /*Beacon DMA Interrupt 0 */
+        RTL_IMR_BCNINT,         /*Beacon DMA Interrupt 0 */
         RTL_IMR_RXFOVW,         /*Receive FIFO Overflow */
         RTL_IMR_RDU,            /*Receive Descriptor Unavailable */
         RTL_IMR_ATIMEND,        /*For 92C,ATIM Window End Interrupt */
@@ -508,7 +539,7 @@ enum rtl_var_map {
         RTL_IMR_VIDOK,          /*AC_VI DMA OK Interrupt */
         RTL_IMR_VODOK,          /*AC_VO DMA Interrupt */
         RTL_IMR_ROK,            /*Receive DMA OK Interrupt */
-        RTL_IBSS_INT_MASKS,     /*(RTL_IMR_BcnInt | RTL_IMR_TBDOK |
+        RTL_IBSS_INT_MASKS,     /*(RTL_IMR_BCNINT | RTL_IMR_TBDOK |
                                  * RTL_IMR_TBDER) */
         RTL_IMR_C2HCMD,         /*fw interrupt*/
 
@@ -742,6 +773,11 @@ struct false_alarm_statistics {
         u32 cnt_ofdm_fail;
         u32 cnt_cck_fail;
         u32 cnt_all;
+        u32 cnt_ofdm_cca;
+        u32 cnt_cck_cca;
+        u32 cnt_cca_all;
+        u32 cnt_bw_usc;
+        u32 cnt_bw_lsc;
 };
 
 struct init_gain {
@@ -826,8 +862,67 @@ struct rtl_rfkill {
         bool rfkill_state;      /*0 is off, 1 is on */
 };
 
+/*for P2P PS**/
+#define P2P_MAX_NOA_NUM         2
+
+enum p2p_role {
+        P2P_ROLE_DISABLE = 0,
+        P2P_ROLE_DEVICE = 1,
+        P2P_ROLE_CLIENT = 2,
+        P2P_ROLE_GO = 3
+};
+
+enum p2p_ps_state {
+        P2P_PS_DISABLE = 0,
+        P2P_PS_ENABLE = 1,
+        P2P_PS_SCAN = 2,
+        P2P_PS_SCAN_DONE = 3,
+        P2P_PS_ALLSTASLEEP = 4, /* for P2P GO */
+};
+
+enum p2p_ps_mode {
+        P2P_PS_NONE = 0,
+        P2P_PS_CTWINDOW = 1,
+        P2P_PS_NOA       = 2,
+        P2P_PS_MIX = 3, /* CTWindow and NoA */
+};
+
+struct rtl_p2p_ps_info {
+        enum p2p_ps_mode p2p_ps_mode; /* indicate p2p ps mode */
+        enum p2p_ps_state p2p_ps_state; /*  indicate p2p ps state */
+        u8 noa_index; /*  Identifies instance of Notice of Absence timing. */
+        /*  Client traffic window. A period of time in TU after TBTT. */
+        u8 ctwindow;
+        u8 opp_ps; /*  opportunistic power save. */
+        u8 noa_num; /*  number of NoA descriptor in P2P IE. */
+        /*  Count for owner, Type of client. */
+        u8 noa_count_type[P2P_MAX_NOA_NUM];
+        /*  Max duration for owner, preferred or min acceptable duration
+         * for client.
+         */
+        u32 noa_duration[P2P_MAX_NOA_NUM];
+        /*  Length of interval for owner, preferred or max acceptable intervali
+         * of client.
+         */
+        u32 noa_interval[P2P_MAX_NOA_NUM];
+        /*  schedule in terms of the lower 4 bytes of the TSF timer. */
+        u32 noa_start_time[P2P_MAX_NOA_NUM];
+};
+
+struct p2p_ps_offload_t {
+        u8 offload_en:1;
+        u8 role:1; /* 1: Owner, 0: Client */
+        u8 ctwindow_en:1;
+        u8 noa0_en:1;
+        u8 noa1_en:1;
+        u8 allstasleep:1;
+        u8 discovery:1;
+        u8 reserved:1;
+};
+
 #define IQK_MATRIX_REG_NUM      8
 #define IQK_MATRIX_SETTINGS_NUM (1 + 24 + 21)
+
 struct iqk_matrix_regs {
         bool iqk_done;
         long value[1][IQK_MATRIX_REG_NUM];
@@ -889,7 +984,7 @@ struct rtl_phy {
 
         /* Dual mac */
         bool need_iqk;
-        struct iqk_matrix_regs iqk_matrix_regsetting[IQK_MATRIX_SETTINGS_NUM];
+        struct iqk_matrix_regs iqk_matrix[IQK_MATRIX_SETTINGS_NUM];
 
         bool rfpi_enable;
 
@@ -902,6 +997,8 @@ struct rtl_phy {
         /* the current Tx power level */
         u8 cur_cck_txpwridx;
         u8 cur_ofdm24g_txpwridx;
+        u8 cur_bw20_txpwridx;
+        u8 cur_bw40_txpwridx;
 
         u32 rfreg_chnlval[2];
         bool apk_done;
@@ -940,20 +1037,21 @@ struct rtl_ht_agg {
         u8 rx_agg_state;
 };
 
+struct rssi_sta {
+        long undec_sm_pwdb;
+};
+
 struct rtl_tid_data {
         u16 seq_number;
         struct rtl_ht_agg agg;
 };
 
-struct rssi_sta {
-        long undec_sm_pwdb;
-};
-
 struct rtl_sta_info {
         struct list_head list;
         u8 ratr_index;
         u8 wireless_mode;
         u8 mimo_ps;
+        u8 mac_addr[ETH_ALEN];
         struct rtl_tid_data tids[MAX_TID_COUNT];
 
         /* just used for ap adhoc or mesh*/
@@ -1005,6 +1103,8 @@ struct rtl_mac {
         int n_bitrates;
 
         bool offchan_delay;
+        u8 p2p; /*using p2p role*/
+        bool p2p_in_use;
 
         /*filters */
         u32 rx_conf;
@@ -1014,11 +1114,11 @@ struct rtl_mac {
 
         bool act_scanning;
         u8 cnt_after_linked;
+        bool skip_scan;
 
         /* early mode */
         /* skb wait queue */
         struct sk_buff_head skb_waitq[MAX_TID_COUNT];
-        u8 earlymode_threshold;
 
         /*RDG*/
         bool rdg_en;
@@ -1042,6 +1142,7 @@ struct rtl_mac {
         u8 retry_short;
         u8 retry_long;
         u16 assoc_id;
+        bool hiddenssid;
 
         /*IBSS*/
         int beacon_interval;
@@ -1111,10 +1212,13 @@ struct bt_coexist_8723 {
 
 struct rtl_hal {
         struct ieee80211_hw *hw;
-        struct bt_coexist_8723 hal_coex_8723;
+        bool driver_is_goingto_unload;
         bool up_first_time;
+        bool first_init;
         bool being_init_adapter;
         bool bbrf_ready;
+        bool mac_func_enable;
+        struct bt_coexist_8723 hal_coex_8723;
 
         enum intf_type interface;
         u16 hw_type;            /*92c or 92d or 92s and so on */
@@ -1122,6 +1226,7 @@ struct rtl_hal {
         u8 oem_id;
         u32 version;            /*version of chip */
         u8 state;               /*stop 0, start 1 */
+        u8 board_type;
 
         /*firmware */
         u32 fwsize;
@@ -1141,6 +1246,10 @@ struct rtl_hal {
         bool set_fwcmd_inprogress;
         u8 current_fwcmd_io;
 
+        struct p2p_ps_offload_t p2p_ps_offload;
+        bool fw_clk_change_in_progress;
+        bool allow_sw_to_change_hwclc;
+        u8 fw_ps_state;
         /**/
         bool driver_going2unload;
 
@@ -1157,6 +1266,7 @@ struct rtl_hal {
         /* just for DualMac S3S4 */
         u8 macphyctl_reg;
         bool earlymode_enable;
+        u8 max_earlymode_num;
         /* Dual mac*/
         bool during_mac0init_radiob;
         bool during_mac1init_radioa;
@@ -1193,6 +1303,29 @@ struct rtl_security {
         u8 *pairwise_key;
 };
 
+#define ASSOCIATE_ENTRY_NUM     33
+
+struct fast_ant_training {
+        u8      bssid[6];
+        u8      antsel_rx_keep_0;
+        u8      antsel_rx_keep_1;
+        u8      antsel_rx_keep_2;
+        u32     ant_sum[7];
+        u32     ant_cnt[7];
+        u32     ant_ave[7];
+        u8      fat_state;
+        u32     train_idx;
+        u8      antsel_a[ASSOCIATE_ENTRY_NUM];
+        u8      antsel_b[ASSOCIATE_ENTRY_NUM];
+        u8      antsel_c[ASSOCIATE_ENTRY_NUM];
+        u32     main_ant_sum[ASSOCIATE_ENTRY_NUM];
+        u32     aux_ant_sum[ASSOCIATE_ENTRY_NUM];
+        u32     main_ant_cnt[ASSOCIATE_ENTRY_NUM];
+        u32     aux_ant_cnt[ASSOCIATE_ENTRY_NUM];
+        u8      rx_idle_ant;
+        bool    becomelinked;
+};
+
 struct rtl_dm {
         /*PHY status for Dynamic Management */
         long entry_min_undec_sm_pwdb;
@@ -1229,9 +1362,24 @@ struct rtl_dm {
         bool disable_tx_int;
         char ofdm_index[2];
         char cck_index;
+        char delta_power_index;
+        char delta_power_index_last;
+        char power_index_offset;
+
+        /*88e tx power tracking*/
+        u8      swing_idx_ofdm[2];
+        u8      swing_idx_ofdm_cur;
+        u8      swing_idx_ofdm_base;
+        bool    swing_flag_ofdm;
+        u8      swing_idx_cck;
+        u8      swing_idx_cck_cur;
+        u8      swing_idx_cck_base;
+        bool    swing_flag_cck;
 
         /* DMSP */
         bool supp_phymode_switch;
+
+        struct fast_ant_training fat_table;
 };
 
 #define EFUSE_MAX_LOGICAL_SIZE                  256
@@ -1264,6 +1412,9 @@ struct rtl_efuse {
         u8 external_pa;
 
         u8 dev_addr[6];
+        u8 wowlan_enable;
+        u8 antenna_div_cfg;
+        u8 antenna_div_type;
 
         bool txpwr_fromeprom;
         u8 eeprom_crystalcap;
@@ -1319,14 +1470,12 @@ struct rtl_ps_ctl {
         bool rfchange_inprogress;
         bool swrf_processing;
         bool hwradiooff;
-
         /*
          * just for PCIE ASPM
          * If it supports ASPM, Offset[560h] = 0x40,
          * otherwise Offset[560h] = 0x00.
          * */
         bool support_aspm;
-
         bool support_backdoor;
 
         /*for LPS */
@@ -1341,6 +1490,7 @@ struct rtl_ps_ctl {
         bool fw_current_inpsmode;
         u8 reg_max_lps_awakeintvl;
         bool report_linked;
+        bool low_power_enable;/*for 32k*/
 
         /*for IPS */
         bool inactiveps;
@@ -1373,6 +1523,11 @@ struct rtl_ps_ctl {
         unsigned long last_beacon;
         unsigned long last_action;
         unsigned long last_slept;
+
+        /*For P2P PS */
+        struct rtl_p2p_ps_info p2p_ps_info;
+        u8 pwr_mode;
+        u8 smart_ps;
 };
 
 struct rtl_stats {
@@ -1381,7 +1536,7 @@ struct rtl_stats {
         s8 rssi;
         u8 signal;
         u8 noise;
-        u16 rate;               /*in 100 kbps */
+        u8 rate;                /* hw desc rate */
         u8 received_channel;
         u8 control;
         u8 mask;
@@ -1423,8 +1578,16 @@ struct rtl_stats {
         bool packet_toself;
         bool packet_beacon;     /*for rssi */
         char cck_adc_pwdb[4];   /*for rx path selection */
+
+        u8 packet_report_type;
+
+        u32 macid;
+        u8 wake_match;
+        u32 bt_rx_rssi_percentage;
+        u32 macid_valid_entry[2];
 };
 
+
 struct rt_link_detect {
         /* count for roaming */
         u32 bcn_rx_inperiod;
@@ -1477,7 +1640,8 @@ struct rtl_tcb_desc {
         /* early mode */
         u8 empkt_num;
         /* The max value by HW */
-        u32 empkt_len[5];
+        u32 empkt_len[10];
+        bool btx_enable_sw_calc_duration;
 };
 
 struct rtl_hal_ops {
@@ -1553,7 +1717,7 @@ struct rtl_hal_ops {
         void (*allow_all_destaddr)(struct ieee80211_hw *hw,
                 bool allow_all_da, bool write_into_reg);
         void (*linked_set_reg) (struct ieee80211_hw *hw);
-        void (*check_switch_to_dmdp) (struct ieee80211_hw *hw);
+        void (*chk_switch_dmdp) (struct ieee80211_hw *hw);
         void (*dualmac_easy_concurrent) (struct ieee80211_hw *hw);
         void (*dualmac_switch_to_dmdp) (struct ieee80211_hw *hw);
         bool (*phy_rf6052_config) (struct ieee80211_hw *hw);
@@ -1662,6 +1826,8 @@ struct rtl_locks {
         /*spin lock */
         spinlock_t ips_lock;
         spinlock_t irq_th_lock;
+        spinlock_t irq_pci_lock;
+        spinlock_t tx_lock;
         spinlock_t h2c_lock;
         spinlock_t rf_ps_lock;
         spinlock_t rf_lock;
@@ -1670,6 +1836,9 @@ struct rtl_locks {
         spinlock_t entry_list_lock;
         spinlock_t usb_lock;
 
+        /*FW clock change */
+        spinlock_t fw_ps_lock;
+
         /*Dual mac*/
         spinlock_t cck_and_rw_pagea_lock;
 
@@ -1683,7 +1852,8 @@ struct rtl_works {
         /*timer */
         struct timer_list watchdog_timer;
         struct timer_list dualmac_easyconcurrent_retrytimer;
-
+        struct timer_list fw_clockoff_timer;
+        struct timer_list fast_antenna_training_timer;
         /*task */
         struct tasklet_struct irq_tasklet;
         struct tasklet_struct irq_prepare_bcn_tasklet;
@@ -1696,8 +1866,9 @@ struct rtl_works {
         /* For SW LPS */
         struct delayed_work ps_work;
         struct delayed_work ps_rfon_wq;
+        struct delayed_work fwevt_wq;
 
-        struct work_struct lps_leave_work;
+        struct work_struct lps_change_work;
 };
 
 struct rtl_debug {
@@ -1767,10 +1938,12 @@ struct dig_t {
         char back_val;
         char back_range_max;
         char back_range_min;
-        u8 rx_gain_range_max;
-        u8 rx_gain_range_min;
+        u8 rx_gain_max;
+        u8 rx_gain_min;
         u8 min_undec_pwdb_for_dm;
         u8 rssi_val_min;
+        u8 pre_cck_cca_thres;
+        u8 cur_cck_cca_thres;
         u8 pre_cck_pd_state;
         u8 cur_cck_pd_state;
         u8 pre_cck_fa_state;
@@ -1792,6 +1965,13 @@ struct dig_t {
         u8 backoff_enable_flag;
         char backoffval_range_max;
         char backoffval_range_min;
+        u8 dig_min_0;
+        u8 dig_min_1;
+        bool media_connect_0;
+        bool media_connect_1;
+
+        u32 antdiv_rssi_max;
+        u32 rssi_max;
 };
 
 struct rtl_global_var {
@@ -1802,6 +1982,7 @@ struct rtl_global_var {
 };
 
 struct rtl_priv {
+        struct ieee80211_hw *hw;
         struct completion firmware_loading_complete;
         struct list_head list;
         struct rtl_priv *buddy_priv;
@@ -1866,6 +2047,7 @@ struct rtl_priv {
                         bool bt_operation_on;
                 };
         };
+        bool enter_ps;  /* true when entering PS */
 
         /*This must be the last item so
            that it points to the data allocated
@@ -2127,6 +2309,7 @@ value to host byte ordering.*/
 #define WLAN_FC_GET_TYPE(fc)    (le16_to_cpu(fc) & IEEE80211_FCTL_FTYPE)
 #define WLAN_FC_GET_STYPE(fc)   (le16_to_cpu(fc) & IEEE80211_FCTL_STYPE)
 #define WLAN_FC_MORE_DATA(fc)   (le16_to_cpu(fc) & IEEE80211_FCTL_MOREDATA)
+#define rtl_dm(rtlpriv)         (&((rtlpriv)->dm))
 
 #define RT_RF_OFF_LEVL_ASPM             BIT(0)  /*PCI ASPM */
 #define RT_RF_OFF_LEVL_CLK_REQ          BIT(1)  /*PCI clock request */
diff --git a/drivers/net/wireless/ti/wl1251/sdio.c b/drivers/net/wireless/ti/wl1251/sdio.c
index e57ee48edff6..e2b3d9c541e8 100644
--- a/drivers/net/wireless/ti/wl1251/sdio.c
+++ b/drivers/net/wireless/ti/wl1251/sdio.c
@@ -186,8 +186,10 @@ static int wl1251_sdio_set_power(struct wl1251 *wl, bool enable)
                         wl->set_power(true);
 
                 ret = pm_runtime_get_sync(&func->dev);
-                if (ret < 0)
+                if (ret < 0) {
+                        pm_runtime_put_sync(&func->dev);
                         goto out;
+                }
 
                 sdio_claim_host(func);
                 sdio_enable_func(func);
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index 09694e39bb14..1c627da85083 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -723,6 +723,7 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
         wl->sched_scan_templ_id_2_4 = CMD_TEMPL_CFG_PROBE_REQ_2_4;
         wl->sched_scan_templ_id_5 = CMD_TEMPL_CFG_PROBE_REQ_5;
         wl->max_channels_5 = WL12XX_MAX_CHANNELS_5GHZ;
+        wl->ba_rx_session_count_max = WL12XX_RX_BA_MAX_SESSIONS;
 out:
         return ret;
 }
diff --git a/drivers/net/wireless/ti/wl12xx/wl12xx.h b/drivers/net/wireless/ti/wl12xx/wl12xx.h
index d4552857480c..222d03540200 100644
--- a/drivers/net/wireless/ti/wl12xx/wl12xx.h
+++ b/drivers/net/wireless/ti/wl12xx/wl12xx.h
@@ -63,6 +63,8 @@
 
 #define WL12XX_NUM_MAC_ADDRESSES 2
 
+#define WL12XX_RX_BA_MAX_SESSIONS 3
+
 struct wl127x_rx_mem_pool_addr {
         u32 addr;
         u32 addr_extra;
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index da3ef1b10a9c..9fa692d11025 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -678,6 +678,7 @@ static int wl18xx_identify_chip(struct wl1271 *wl)
         wl->sched_scan_templ_id_2_4 = CMD_TEMPL_PROBE_REQ_2_4_PERIODIC;
         wl->sched_scan_templ_id_5 = CMD_TEMPL_PROBE_REQ_5_PERIODIC;
         wl->max_channels_5 = WL18XX_MAX_CHANNELS_5GHZ;
+        wl->ba_rx_session_count_max = WL18XX_RX_BA_MAX_SESSIONS;
 out:
         return ret;
 }
@@ -1144,6 +1145,7 @@ static u32 wl18xx_ap_get_mimo_wide_rate_mask(struct wl1271 *wl,
 static int wl18xx_get_pg_ver(struct wl1271 *wl, s8 *ver)
 {
         u32 fuse;
+        s8 rom = 0, metal = 0, pg_ver = 0, rdl_ver = 0;
         int ret;
 
         ret = wlcore_set_partition(wl, &wl->ptable[PART_TOP_PRCM_ELP_SOC]);
@@ -1154,8 +1156,29 @@ static int wl18xx_get_pg_ver(struct wl1271 *wl, s8 *ver)
         if (ret < 0)
                 goto out;
 
+        pg_ver = (fuse & WL18XX_PG_VER_MASK) >> WL18XX_PG_VER_OFFSET;
+        rom = (fuse & WL18XX_ROM_VER_MASK) >> WL18XX_ROM_VER_OFFSET;
+
+        if (rom <= 0xE)
+                metal = (fuse & WL18XX_METAL_VER_MASK) >>
+                        WL18XX_METAL_VER_OFFSET;
+        else
+                metal = (fuse & WL18XX_NEW_METAL_VER_MASK) >>
+                        WL18XX_NEW_METAL_VER_OFFSET;
+
+        ret = wlcore_read32(wl, WL18XX_REG_FUSE_DATA_2_3, &fuse);
+        if (ret < 0)
+                goto out;
+
+        rdl_ver = (fuse & WL18XX_RDL_VER_MASK) >> WL18XX_RDL_VER_OFFSET;
+        if (rdl_ver > RDL_MAX)
+                rdl_ver = RDL_NONE;
+
+        wl1271_info("wl18xx HW: RDL %d, %s, PG %x.%x (ROM %x)",
+                    rdl_ver, rdl_names[rdl_ver], pg_ver, metal, rom);
+
         if (ver)
-                *ver = (fuse & WL18XX_PG_VER_MASK) >> WL18XX_PG_VER_OFFSET;
+                *ver = pg_ver;
 
         ret = wlcore_set_partition(wl, &wl->ptable[PART_BOOT]);
 
diff --git a/drivers/net/wireless/ti/wl18xx/reg.h b/drivers/net/wireless/ti/wl18xx/reg.h
index 937b71d8783f..6306e04cd258 100644
--- a/drivers/net/wireless/ti/wl18xx/reg.h
+++ b/drivers/net/wireless/ti/wl18xx/reg.h
@@ -131,6 +131,16 @@
 #define WL18XX_REG_FUSE_DATA_1_3        0xA0260C
 #define WL18XX_PG_VER_MASK              0x70
 #define WL18XX_PG_VER_OFFSET            4
+#define WL18XX_ROM_VER_MASK             0x3
+#define WL18XX_ROM_VER_OFFSET           0
+#define WL18XX_METAL_VER_MASK           0xC
+#define WL18XX_METAL_VER_OFFSET         2
+#define WL18XX_NEW_METAL_VER_MASK       0x180
+#define WL18XX_NEW_METAL_VER_OFFSET     7
+
+#define WL18XX_REG_FUSE_DATA_2_3        0xA02614
+#define WL18XX_RDL_VER_MASK             0x1f00
+#define WL18XX_RDL_VER_OFFSET           8
 
 #define WL18XX_REG_FUSE_BD_ADDR_1       0xA02602
 #define WL18XX_REG_FUSE_BD_ADDR_2       0xA02606
@@ -188,4 +198,23 @@ enum {
         NUM_BOARD_TYPES,
 };
 
+enum {
+        RDL_NONE        = 0,
+        RDL_1_HP        = 1,
+        RDL_2_SP        = 2,
+        RDL_3_HP        = 3,
+        RDL_4_SP        = 4,
+
+        _RDL_LAST,
+        RDL_MAX = _RDL_LAST - 1,
+};
+
+static const char * const rdl_names[] = {
+        [RDL_NONE]      = "",
+        [RDL_1_HP]      = "1853 SISO",
+        [RDL_2_SP]      = "1857 MIMO",
+        [RDL_3_HP]      = "1893 SISO",
+        [RDL_4_SP]      = "1897 MIMO",
+};
+
 #endif /* __REG_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/wl18xx.h b/drivers/net/wireless/ti/wl18xx/wl18xx.h
index b6739e79efcf..9204e07ee432 100644
--- a/drivers/net/wireless/ti/wl18xx/wl18xx.h
+++ b/drivers/net/wireless/ti/wl18xx/wl18xx.h
@@ -29,7 +29,7 @@
 #define WL18XX_IFTYPE_VER       5
 #define WL18XX_MAJOR_VER        WLCORE_FW_VER_IGNORE
 #define WL18XX_SUBTYPE_VER      WLCORE_FW_VER_IGNORE
-#define WL18XX_MINOR_VER        28
+#define WL18XX_MINOR_VER        39
 
 #define WL18XX_CMD_MAX_SIZE          740
 
@@ -40,6 +40,8 @@
 
 #define WL18XX_NUM_MAC_ADDRESSES 3
 
+#define WL18XX_RX_BA_MAX_SESSIONS 5
+
 struct wl18xx_priv {
         /* buffer for sending commands to FW */
         u8 cmd_buf[WL18XX_CMD_MAX_SIZE];
diff --git a/drivers/net/wireless/ti/wlcore/acx.c b/drivers/net/wireless/ti/wlcore/acx.c
index c79654323396..7a970cd9c555 100644
--- a/drivers/net/wireless/ti/wlcore/acx.c
+++ b/drivers/net/wireless/ti/wlcore/acx.c
@@ -1736,6 +1736,35 @@ out:
 
 }
 
+int wlcore_acx_average_rssi(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                            s8 *avg_rssi)
+{
+        struct acx_roaming_stats *acx;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx roaming statistics");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->role_id = wlvif->role_id;
+        ret = wl1271_cmd_interrogate(wl, ACX_ROAMING_STATISTICS_TBL,
+                                     acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx roaming statistics failed: %d", ret);
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        *avg_rssi = acx->rssi_beacon;
+out:
+        kfree(acx);
+        return ret;
+}
+
 #ifdef CONFIG_PM
 /* Set the global behaviour of RX filters - On/Off + default action */
 int wl1271_acx_default_rx_filter_enable(struct wl1271 *wl, bool enable,
diff --git a/drivers/net/wireless/ti/wlcore/acx.h b/drivers/net/wireless/ti/wlcore/acx.h
index 126536c6a393..6dcfad9b0472 100644
--- a/drivers/net/wireless/ti/wlcore/acx.h
+++ b/drivers/net/wireless/ti/wlcore/acx.h
@@ -728,8 +728,6 @@ struct wl1271_acx_ht_information {
         u8 padding[2];
 } __packed;
 
-#define RX_BA_MAX_SESSIONS 3
-
 struct wl1271_acx_ba_initiator_policy {
         struct acx_header header;
 
@@ -955,6 +953,18 @@ struct acx_rx_filter_cfg {
         u8 fields[0];
 } __packed;
 
+struct acx_roaming_stats {
+        struct acx_header header;
+
+        u8      role_id;
+        u8      pad[3];
+        u32     missed_beacons;
+        u8      snr_data;
+        u8      snr_bacon;
+        s8      rssi_data;
+        s8      rssi_beacon;
+} __packed;
+
 enum {
         ACX_WAKE_UP_CONDITIONS           = 0x0000,
         ACX_MEM_CFG                      = 0x0001,
@@ -1112,6 +1122,8 @@ int wl1271_acx_set_inconnection_sta(struct wl1271 *wl, u8 *addr);
 int wl1271_acx_fm_coex(struct wl1271 *wl);
 int wl12xx_acx_set_rate_mgmt_params(struct wl1271 *wl);
 int wl12xx_acx_config_hangover(struct wl1271 *wl);
+int wlcore_acx_average_rssi(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                            s8 *avg_rssi);
 
 #ifdef CONFIG_PM
 int wl1271_acx_default_rx_filter_enable(struct wl1271 *wl, bool enable,
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 6331f9e1cb39..c9e060795d13 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -327,6 +327,14 @@ int wl12xx_allocate_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid)
         wl->links[link].prev_freed_pkts =
                         wl->fw_status_2->counters.tx_lnk_free_pkts[link];
         wl->links[link].wlvif = wlvif;
+
+        /*
+         * Take saved value for total freed packets from wlvif, in case this is
+         * recovery/resume
+         */
+        if (wlvif->bss_type != BSS_TYPE_AP_BSS)
+                wl->links[link].total_freed_pkts = wlvif->total_freed_pkts;
+
         *hlid = link;
 
         wl->active_link_count++;
@@ -358,6 +366,26 @@ void wl12xx_free_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid)
         wl1271_tx_reset_link_queues(wl, *hlid);
         wl->links[*hlid].wlvif = NULL;
 
+        if (wlvif->bss_type == BSS_TYPE_STA_BSS ||
+            (wlvif->bss_type == BSS_TYPE_AP_BSS &&
+             *hlid == wlvif->ap.bcast_hlid)) {
+                /*
+                 * save the total freed packets in the wlvif, in case this is
+                 * recovery or suspend
+                 */
+                wlvif->total_freed_pkts = wl->links[*hlid].total_freed_pkts;
+
+                /*
+                 * increment the initial seq number on recovery to account for
+                 * transmitted packets that we haven't yet got in the FW status
+                 */
+                if (test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags))
+                        wlvif->total_freed_pkts +=
+                                        WL1271_TX_SQN_POST_RECOVERY_PADDING;
+        }
+
+        wl->links[*hlid].total_freed_pkts = 0;
+
         *hlid = WL12XX_INVALID_LINK_ID;
         wl->active_link_count--;
         WARN_ON_ONCE(wl->active_link_count < 0);
@@ -609,6 +637,10 @@ int wl12xx_cmd_role_start_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if (ret < 0)
                 goto out_free_global;
 
+        /* use the previous security seq, if this is a recovery/resume */
+        wl->links[wlvif->ap.bcast_hlid].total_freed_pkts =
+                                                wlvif->total_freed_pkts;
+
         cmd->role_id = wlvif->role_id;
         cmd->ap.aging_period = cpu_to_le16(wl->conf.tx.ap_aging_period);
         cmd->ap.bss_index = WL1271_AP_BSS_INDEX;
diff --git a/drivers/net/wireless/ti/wlcore/debug.h b/drivers/net/wireless/ti/wlcore/debug.h
index db4bf5a68ce2..0420bd45e4ee 100644
--- a/drivers/net/wireless/ti/wlcore/debug.h
+++ b/drivers/net/wireless/ti/wlcore/debug.h
@@ -89,25 +89,24 @@ extern u32 wl12xx_debug_level;
         } while (0)
 #endif
 
-/* TODO: use pr_debug_hex_dump when it becomes available */
-#define wl1271_dump(level, prefix, buf, len)    \
-        do { \
-                if (level & wl12xx_debug_level) \
-                        print_hex_dump(KERN_DEBUG, DRIVER_PREFIX prefix, \
-                                       DUMP_PREFIX_OFFSET, 16, 1,       \
-                                       buf,                             \
-                                       min_t(size_t, len, DEBUG_DUMP_LIMIT), \
-                                       0);                              \
+#define wl1271_dump(level, prefix, buf, len)                                  \
+        do {                                                                  \
+                if (level & wl12xx_debug_level)                               \
+                        print_hex_dump_debug(DRIVER_PREFIX prefix,            \
+                                        DUMP_PREFIX_OFFSET, 16, 1,            \
+                                        buf,                                  \
+                                        min_t(size_t, len, DEBUG_DUMP_LIMIT), \
+                                        0);                                   \
         } while (0)
 
-#define wl1271_dump_ascii(level, prefix, buf, len)      \
-        do { \
-                if (level & wl12xx_debug_level) \
-                        print_hex_dump(KERN_DEBUG, DRIVER_PREFIX prefix, \
-                                       DUMP_PREFIX_OFFSET, 16, 1,       \
-                                       buf,                             \
-                                       min_t(size_t, len, DEBUG_DUMP_LIMIT), \
-                                       true);                           \
+#define wl1271_dump_ascii(level, prefix, buf, len)                            \
+        do {                                                                  \
+                if (level & wl12xx_debug_level)                               \
+                        print_hex_dump_debug(DRIVER_PREFIX prefix,            \
+                                        DUMP_PREFIX_OFFSET, 16, 1,            \
+                                        buf,                                  \
+                                        min_t(size_t, len, DEBUG_DUMP_LIMIT), \
+                                        true);                                \
         } while (0)
 
 #endif /* __DEBUG_H__ */
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.c b/drivers/net/wireless/ti/wlcore/debugfs.c
index e70a7c864865..c3e1f79c7856 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.c
+++ b/drivers/net/wireless/ti/wlcore/debugfs.c
@@ -598,8 +598,7 @@ static ssize_t vifs_state_read(struct file *file, char __user *user_buf,
                 VIF_STATE_PRINT_INT(last_rssi_event);
                 VIF_STATE_PRINT_INT(ba_support);
                 VIF_STATE_PRINT_INT(ba_allowed);
-                VIF_STATE_PRINT_LLHEX(tx_security_seq);
-                VIF_STATE_PRINT_INT(tx_security_last_seq_lsb);
+                VIF_STATE_PRINT_LLHEX(total_freed_pkts);
         }
 
 #undef VIF_STATE_PRINT_INT
diff --git a/drivers/net/wireless/ti/wlcore/event.c b/drivers/net/wireless/ti/wlcore/event.c
index 70f289aa1bc6..67f61689b49e 100644
--- a/drivers/net/wireless/ti/wlcore/event.c
+++ b/drivers/net/wireless/ti/wlcore/event.c
@@ -237,6 +237,14 @@ void wlcore_event_beacon_loss(struct wl1271 *wl, unsigned long roles_bitmap)
                     !test_bit(wlvif->role_id , &roles_bitmap))
                         continue;
 
+                vif = wl12xx_wlvif_to_vif(wlvif);
+
+                /* don't attempt roaming in case of p2p */
+                if (wlvif->p2p) {
+                        ieee80211_connection_loss(vif);
+                        continue;
+                }
+
                 /*
                  * if the work is already queued, it should take place.
                  * We don't want to delay the connection loss
@@ -246,7 +254,6 @@ void wlcore_event_beacon_loss(struct wl1271 *wl, unsigned long roles_bitmap)
                                              &wlvif->connection_loss_work,
                                              msecs_to_jiffies(delay));
 
-                vif = wl12xx_wlvif_to_vif(wlvif);
                 ieee80211_cqm_rssi_notify(
                                 vif,
                                 NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index c26cb095010c..953111a502ee 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -108,8 +108,7 @@ static void wl1271_reg_notify(struct wiphy *wiphy,
 
         }
 
-        if (likely(wl->state == WLCORE_STATE_ON))
-                wlcore_regdomain_config(wl);
+        wlcore_regdomain_config(wl);
 }
 
 static int wl1271_set_rx_streaming(struct wl1271 *wl, struct wl12xx_vif *wlvif,
@@ -332,10 +331,9 @@ static void wl12xx_irq_ps_regulate_link(struct wl1271 *wl,
                                         struct wl12xx_vif *wlvif,
                                         u8 hlid, u8 tx_pkts)
 {
-        bool fw_ps, single_link;
+        bool fw_ps;
 
         fw_ps = test_bit(hlid, (unsigned long *)&wl->ap_fw_ps_map);
-        single_link = (wl->active_link_count == 1);
 
         /*
          * Wake up from high level PS if the STA is asleep with too little
@@ -348,8 +346,13 @@ static void wl12xx_irq_ps_regulate_link(struct wl1271 *wl,
          * Start high-level PS if the STA is asleep with enough blocks in FW.
          * Make an exception if this is the only connected link. In this
          * case FW-memory congestion is less of a problem.
+         * Note that a single connected STA means 3 active links, since we must
+         * account for the global and broadcast AP links. The "fw_ps" check
+         * assures us the third link is a STA connected to the AP. Otherwise
+         * the FW would not set the PSM bit.
          */
-        else if (!single_link && fw_ps && tx_pkts >= WL1271_PS_STA_MAX_PACKETS)
+        else if (wl->active_link_count > 3 && fw_ps &&
+                 tx_pkts >= WL1271_PS_STA_MAX_PACKETS)
                 wl12xx_ps_link_start(wl, wlvif, hlid, true);
 }
 
@@ -414,13 +417,21 @@ static int wlcore_fw_status(struct wl1271 *wl,
 
 
         for_each_set_bit(i, wl->links_map, WL12XX_MAX_LINKS) {
+                u8 diff;
                 lnk = &wl->links[i];
+
                 /* prevent wrap-around in freed-packets counter */
-                lnk->allocated_pkts -=
-                        (status_2->counters.tx_lnk_free_pkts[i] -
-                         lnk->prev_freed_pkts) & 0xff;
+                diff = (status_2->counters.tx_lnk_free_pkts[i] -
+                       lnk->prev_freed_pkts) & 0xff;
+
+                if (diff == 0)
+                        continue;
 
+                lnk->allocated_pkts -= diff;
                 lnk->prev_freed_pkts = status_2->counters.tx_lnk_free_pkts[i];
+
+                /* accumulate the prev_freed_pkts counter */
+                lnk->total_freed_pkts += diff;
         }
 
         /* prevent wrap-around in total blocks counter */
@@ -640,6 +651,25 @@ static irqreturn_t wlcore_irq(int irq, void *cookie)
         unsigned long flags;
         struct wl1271 *wl = cookie;
 
+        /* complete the ELP completion */
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        set_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags);
+        if (wl->elp_compl) {
+                complete(wl->elp_compl);
+                wl->elp_compl = NULL;
+        }
+
+        if (test_bit(WL1271_FLAG_SUSPENDED, &wl->flags)) {
+                /* don't enqueue a work right now. mark it as pending */
+                set_bit(WL1271_FLAG_PENDING_WORK, &wl->flags);
+                wl1271_debug(DEBUG_IRQ, "should not enqueue work");
+                disable_irq_nosync(wl->irq);
+                pm_wakeup_event(wl->dev, 0);
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
+                return IRQ_HANDLED;
+        }
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
         /* TX might be handled here, avoid redundant work */
         set_bit(WL1271_FLAG_TX_PENDING, &wl->flags);
         cancel_work_sync(&wl->tx_work);
@@ -919,18 +949,6 @@ static void wl1271_recovery_work(struct work_struct *work)
                 goto out_unlock;
         }
 
-        /*
-         * Advance security sequence number to overcome potential progress
-         * in the firmware during recovery. This doens't hurt if the network is
-         * not encrypted.
-         */
-        wl12xx_for_each_wlvif(wl, wlvif) {
-                if (test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags) ||
-                    test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags))
-                        wlvif->tx_security_seq +=
-                                WL1271_TX_SQN_POST_RECOVERY_PADDING;
-        }
-
         /* Prevent spurious TX during FW restart */
         wlcore_stop_queues(wl, WLCORE_QUEUE_STOP_REASON_FW_RESTART);
 
@@ -2523,6 +2541,8 @@ static void __wl1271_op_remove_interface(struct wl1271 *wl,
                 wl1271_ps_elp_sleep(wl);
         }
 deinit:
+        wl12xx_tx_reset_wlvif(wl, wlvif);
+
         /* clear all hlids (except system_hlid) */
         wlvif->dev_hlid = WL12XX_INVALID_LINK_ID;
 
@@ -2546,7 +2566,6 @@ deinit:
 
         dev_kfree_skb(wlvif->probereq);
         wlvif->probereq = NULL;
-        wl12xx_tx_reset_wlvif(wl, wlvif);
         if (wl->last_wlvif == wlvif)
                 wl->last_wlvif = NULL;
         list_del(&wlvif->list);
@@ -2860,10 +2879,6 @@ static int wlcore_unset_assoc(struct wl1271 *wl, struct wl12xx_vif *wlvif)
                                      wlvif->sta.klv_template_id,
                                      ACX_KEEP_ALIVE_TPL_INVALID);
 
-        /* reset TX security counters on a clean disconnect */
-        wlvif->tx_security_last_seq_lsb = 0;
-        wlvif->tx_security_seq = 0;
-
         return 0;
 }
 
@@ -3262,6 +3277,7 @@ int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
         u32 tx_seq_32 = 0;
         u16 tx_seq_16 = 0;
         u8 key_type;
+        u8 hlid;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 set key");
 
@@ -3271,6 +3287,22 @@ int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
                      key_conf->keylen, key_conf->flags);
         wl1271_dump(DEBUG_CRYPT, "KEY: ", key_conf->key, key_conf->keylen);
 
+        if (wlvif->bss_type == BSS_TYPE_AP_BSS)
+                if (sta) {
+                        struct wl1271_station *wl_sta = (void *)sta->drv_priv;
+                        hlid = wl_sta->hlid;
+                } else {
+                        hlid = wlvif->ap.bcast_hlid;
+                }
+        else
+                hlid = wlvif->sta.hlid;
+
+        if (hlid != WL12XX_INVALID_LINK_ID) {
+                u64 tx_seq = wl->links[hlid].total_freed_pkts;
+                tx_seq_32 = WL1271_TX_SECURITY_HI32(tx_seq);
+                tx_seq_16 = WL1271_TX_SECURITY_LO16(tx_seq);
+        }
+
         switch (key_conf->cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
@@ -3280,22 +3312,14 @@ int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
                 key_type = KEY_TKIP;
-
                 key_conf->hw_key_idx = key_conf->keyidx;
-                tx_seq_32 = WL1271_TX_SECURITY_HI32(wlvif->tx_security_seq);
-                tx_seq_16 = WL1271_TX_SECURITY_LO16(wlvif->tx_security_seq);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
                 key_type = KEY_AES;
-
                 key_conf->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
-                tx_seq_32 = WL1271_TX_SECURITY_HI32(wlvif->tx_security_seq);
-                tx_seq_16 = WL1271_TX_SECURITY_LO16(wlvif->tx_security_seq);
                 break;
         case WL1271_CIPHER_SUITE_GEM:
                 key_type = KEY_GEM;
-                tx_seq_32 = WL1271_TX_SECURITY_HI32(wlvif->tx_security_seq);
-                tx_seq_16 = WL1271_TX_SECURITY_LO16(wlvif->tx_security_seq);
                 break;
         default:
                 wl1271_error("Unknown key algo 0x%x", key_conf->cipher);
@@ -3358,6 +3382,10 @@ void wlcore_regdomain_config(struct wl1271 *wl)
                 return;
 
         mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
         ret = wl1271_ps_elp_wakeup(wl);
         if (ret < 0)
                 goto out;
@@ -4499,6 +4527,9 @@ static int wl1271_allocate_sta(struct wl1271 *wl,
                 return -EBUSY;
         }
 
+        /* use the previous security seq, if this is a recovery/resume */
+        wl->links[wl_sta->hlid].total_freed_pkts = wl_sta->total_freed_pkts;
+
         set_bit(wl_sta->hlid, wlvif->ap.sta_hlid_map);
         memcpy(wl->links[wl_sta->hlid].addr, sta->addr, ETH_ALEN);
         wl->active_sta_count++;
@@ -4507,12 +4538,37 @@ static int wl1271_allocate_sta(struct wl1271 *wl,
 
 void wl1271_free_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 hlid)
 {
+        struct wl1271_station *wl_sta;
+        struct ieee80211_sta *sta;
+        struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
+
         if (!test_bit(hlid, wlvif->ap.sta_hlid_map))
                 return;
 
         clear_bit(hlid, wlvif->ap.sta_hlid_map);
         __clear_bit(hlid, &wl->ap_ps_map);
         __clear_bit(hlid, (unsigned long *)&wl->ap_fw_ps_map);
+
+        /*
+         * save the last used PN in the private part of iee80211_sta,
+         * in case of recovery/suspend
+         */
+        rcu_read_lock();
+        sta = ieee80211_find_sta(vif, wl->links[hlid].addr);
+        if (sta) {
+                wl_sta = (void *)sta->drv_priv;
+                wl_sta->total_freed_pkts = wl->links[hlid].total_freed_pkts;
+
+                /*
+                 * increment the initial seq number on recovery to account for
+                 * transmitted packets that we haven't yet got in the FW status
+                 */
+                if (test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags))
+                        wl_sta->total_freed_pkts +=
+                                        WL1271_TX_SQN_POST_RECOVERY_PADDING;
+        }
+        rcu_read_unlock();
+
         wl12xx_free_link(wl, wlvif, &hlid);
         wl->active_sta_count--;
 
@@ -4616,13 +4672,11 @@ static int wl12xx_update_sta_state(struct wl1271 *wl,
                                    enum ieee80211_sta_state new_state)
 {
         struct wl1271_station *wl_sta;
-        u8 hlid;
         bool is_ap = wlvif->bss_type == BSS_TYPE_AP_BSS;
         bool is_sta = wlvif->bss_type == BSS_TYPE_STA_BSS;
         int ret;
 
         wl_sta = (struct wl1271_station *)sta->drv_priv;
-        hlid = wl_sta->hlid;
 
         /* Add station (AP mode) */
         if (is_ap &&
@@ -4648,12 +4702,12 @@ static int wl12xx_update_sta_state(struct wl1271 *wl,
         /* Authorize station (AP mode) */
         if (is_ap &&
             new_state == IEEE80211_STA_AUTHORIZED) {
-                ret = wl12xx_cmd_set_peer_state(wl, wlvif, hlid);
+                ret = wl12xx_cmd_set_peer_state(wl, wlvif, wl_sta->hlid);
                 if (ret < 0)
                         return ret;
 
                 ret = wl1271_acx_set_ht_capabilities(wl, &sta->ht_cap, true,
-                                                     hlid);
+                                                     wl_sta->hlid);
                 if (ret)
                         return ret;
 
@@ -4784,7 +4838,7 @@ static int wl1271_op_ampdu_action(struct ieee80211_hw *hw,
                         break;
                 }
 
-                if (wl->ba_rx_session_count >= RX_BA_MAX_SESSIONS) {
+                if (wl->ba_rx_session_count >= wl->ba_rx_session_count_max) {
                         ret = -EBUSY;
                         wl1271_error("exceeded max RX BA sessions");
                         break;
@@ -5092,6 +5146,39 @@ static void wlcore_op_sta_rc_update(struct ieee80211_hw *hw,
         wlcore_hw_sta_rc_update(wl, wlvif, sta, changed);
 }
 
+static int wlcore_op_get_rssi(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta,
+                               s8 *rssi_dbm)
+{
+        struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        int ret = 0;
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 get_rssi");
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out_sleep;
+
+        ret = wlcore_acx_average_rssi(wl, wlvif, rssi_dbm);
+        if (ret < 0)
+                goto out_sleep;
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
 static bool wl1271_tx_frames_pending(struct ieee80211_hw *hw)
 {
         struct wl1271 *wl = hw->priv;
@@ -5291,6 +5378,7 @@ static const struct ieee80211_ops wl1271_ops = {
         .assign_vif_chanctx = wlcore_op_assign_vif_chanctx,
         .unassign_vif_chanctx = wlcore_op_unassign_vif_chanctx,
         .sta_rc_update = wlcore_op_sta_rc_update,
+        .get_rssi = wlcore_op_get_rssi,
         CFG80211_TESTMODE_CMD(wl1271_tm_cmd)
 };
 
@@ -5930,35 +6018,6 @@ int wlcore_free_hw(struct wl1271 *wl)
 }
 EXPORT_SYMBOL_GPL(wlcore_free_hw);
 
-static irqreturn_t wl12xx_hardirq(int irq, void *cookie)
-{
-        struct wl1271 *wl = cookie;
-        unsigned long flags;
-
-        wl1271_debug(DEBUG_IRQ, "IRQ");
-
-        /* complete the ELP completion */
-        spin_lock_irqsave(&wl->wl_lock, flags);
-        set_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags);
-        if (wl->elp_compl) {
-                complete(wl->elp_compl);
-                wl->elp_compl = NULL;
-        }
-
-        if (test_bit(WL1271_FLAG_SUSPENDED, &wl->flags)) {
-                /* don't enqueue a work right now. mark it as pending */
-                set_bit(WL1271_FLAG_PENDING_WORK, &wl->flags);
-                wl1271_debug(DEBUG_IRQ, "should not enqueue work");
-                disable_irq_nosync(wl->irq);
-                pm_wakeup_event(wl->dev, 0);
-                spin_unlock_irqrestore(&wl->wl_lock, flags);
-                return IRQ_HANDLED;
-        }
-        spin_unlock_irqrestore(&wl->wl_lock, flags);
-
-        return IRQ_WAKE_THREAD;
-}
-
 static void wlcore_nvs_cb(const struct firmware *fw, void *context)
 {
         struct wl1271 *wl = context;
@@ -6000,9 +6059,8 @@ static void wlcore_nvs_cb(const struct firmware *fw, void *context)
         else
                 irqflags = IRQF_TRIGGER_HIGH | IRQF_ONESHOT;
 
-        ret = request_threaded_irq(wl->irq, wl12xx_hardirq, wlcore_irq,
-                                   irqflags,
-                                   pdev->name, wl);
+        ret = request_threaded_irq(wl->irq, NULL, wlcore_irq,
+                                   irqflags, pdev->name, wl);
         if (ret < 0) {
                 wl1271_error("request_irq() failed: %d", ret);
                 goto out_free_nvs;
diff --git a/drivers/net/wireless/ti/wlcore/ps.c b/drivers/net/wireless/ti/wlcore/ps.c
index 9b7b6e2e4fbc..9654577efd01 100644
--- a/drivers/net/wireless/ti/wlcore/ps.c
+++ b/drivers/net/wireless/ti/wlcore/ps.c
@@ -29,6 +29,7 @@
 #define WL1271_WAKEUP_TIMEOUT 500
 
 #define ELP_ENTRY_DELAY  30
+#define ELP_ENTRY_DELAY_FORCE_PS  5
 
 void wl1271_elp_work(struct work_struct *work)
 {
@@ -98,7 +99,8 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
                         return;
         }
 
-        timeout = ELP_ENTRY_DELAY;
+        timeout = wl->conf.conn.forced_ps ?
+                        ELP_ENTRY_DELAY_FORCE_PS : ELP_ENTRY_DELAY;
         ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
                                      msecs_to_jiffies(timeout));
 }
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index ece392c54d9c..004d02e71f01 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -24,6 +24,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
+#include <linux/spinlock.h>
 
 #include "wlcore.h"
 #include "debug.h"
@@ -104,7 +105,7 @@ static void wl1271_tx_regulate_link(struct wl1271 *wl,
                                     struct wl12xx_vif *wlvif,
                                     u8 hlid)
 {
-        bool fw_ps, single_link;
+        bool fw_ps;
         u8 tx_pkts;
 
         if (WARN_ON(!test_bit(hlid, wlvif->links_map)))
@@ -112,15 +113,19 @@ static void wl1271_tx_regulate_link(struct wl1271 *wl,
 
         fw_ps = test_bit(hlid, (unsigned long *)&wl->ap_fw_ps_map);
         tx_pkts = wl->links[hlid].allocated_pkts;
-        single_link = (wl->active_link_count == 1);
 
         /*
          * if in FW PS and there is enough data in FW we can put the link
          * into high-level PS and clean out its TX queues.
          * Make an exception if this is the only connected link. In this
          * case FW-memory congestion is less of a problem.
+         * Note that a single connected STA means 3 active links, since we must
+         * account for the global and broadcast AP links. The "fw_ps" check
+         * assures us the third link is a STA connected to the AP. Otherwise
+         * the FW would not set the PSM bit.
          */
-        if (!single_link && fw_ps && tx_pkts >= WL1271_PS_STA_MAX_PACKETS)
+        if (wl->active_link_count > 3 && fw_ps &&
+            tx_pkts >= WL1271_PS_STA_MAX_PACKETS)
                 wl12xx_ps_link_start(wl, wlvif, hlid, true);
 }
 
@@ -639,6 +644,7 @@ next:
 
         }
 
+out:
         if (!skb &&
             test_and_clear_bit(WL1271_FLAG_DUMMY_PACKET_PENDING, &wl->flags)) {
                 int q;
@@ -652,7 +658,6 @@ next:
                 spin_unlock_irqrestore(&wl->wl_lock, flags);
         }
 
-out:
         return skb;
 }
 
@@ -928,25 +933,6 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
 
         wl->stats.retry_count += result->ack_failures;
 
-        /*
-         * update sequence number only when relevant, i.e. only in
-         * sessions of TKIP, AES and GEM (not in open or WEP sessions)
-         */
-        if (info->control.hw_key &&
-            (info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP ||
-             info->control.hw_key->cipher == WLAN_CIPHER_SUITE_CCMP ||
-             info->control.hw_key->cipher == WL1271_CIPHER_SUITE_GEM)) {
-                u8 fw_lsb = result->tx_security_sequence_number_lsb;
-                u8 cur_lsb = wlvif->tx_security_last_seq_lsb;
-
-                /*
-                 * update security sequence number, taking care of potential
-                 * wrap-around
-                 */
-                wlvif->tx_security_seq += (fw_lsb - cur_lsb) & 0xff;
-                wlvif->tx_security_last_seq_lsb = fw_lsb;
-        }
-
         /* remove private header from packet */
         skb_pull(skb, sizeof(struct wl1271_tx_hw_descr));
 
@@ -1061,7 +1047,8 @@ void wl12xx_tx_reset_wlvif(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 
         /* TX failure */
         for_each_set_bit(i, wlvif->links_map, WL12XX_MAX_LINKS) {
-                if (wlvif->bss_type == BSS_TYPE_AP_BSS) {
+                if (wlvif->bss_type == BSS_TYPE_AP_BSS &&
+                    i != wlvif->ap.bcast_hlid && i != wlvif->ap.global_hlid) {
                         /* this calls wl12xx_free_link */
                         wl1271_free_sta(wl, wlvif, i);
                 } else {
@@ -1304,7 +1291,7 @@ bool wlcore_is_queue_stopped_by_reason_locked(struct wl1271 *wl,
 {
         int hwq = wlcore_tx_get_mac80211_queue(wlvif, queue);
 
-        WARN_ON_ONCE(!spin_is_locked(&wl->wl_lock));
+        assert_spin_locked(&wl->wl_lock);
         return test_bit(reason, &wl->queue_stop_reasons[hwq]);
 }
 
@@ -1313,6 +1300,6 @@ bool wlcore_is_queue_stopped_locked(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 {
         int hwq = wlcore_tx_get_mac80211_queue(wlvif, queue);
 
-        WARN_ON_ONCE(!spin_is_locked(&wl->wl_lock));
+        assert_spin_locked(&wl->wl_lock);
         return !!wl->queue_stop_reasons[hwq];
 }
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index af9fecaefc30..0034979e97cb 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -390,6 +390,9 @@ struct wl1271 {
         /* number of currently active RX BA sessions */
         int ba_rx_session_count;
 
+        /* Maximum number of supported RX BA sessions */
+        int ba_rx_session_count_max;
+
         /* AP-mode - number of currently connected stations */
         int active_sta_count;
 
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 508f5b0f8a70..e5e146435fe7 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -274,6 +274,13 @@ struct wl1271_link {
 
         /* The wlvif this link belongs to. Might be null for global links */
         struct wl12xx_vif *wlvif;
+
+        /*
+         * total freed FW packets on the link - used for tracking the
+         * AES/TKIP PN across recoveries. Re-initialized each time
+         * from the wl1271_station structure.
+         */
+        u64 total_freed_pkts;
 };
 
 #define WL1271_MAX_RX_FILTERS 5
@@ -318,6 +325,13 @@ struct wl12xx_rx_filter {
 struct wl1271_station {
         u8 hlid;
         bool in_connection;
+
+        /*
+         * total freed FW packets on the link to the STA - used for tracking the
+         * AES/TKIP PN across recoveries. Re-initialized each time from the
+         * wl1271_station structure.
+         */
+        u64 total_freed_pkts;
 };
 
 struct wl12xx_vif {
@@ -449,16 +463,15 @@ struct wl12xx_vif {
          */
         struct {
                 u8 persistent[0];
+
                 /*
-                 * Security sequence number
-                 *     bits 0-15: lower 16 bits part of sequence number
-                 *     bits 16-47: higher 32 bits part of sequence number
-                 *     bits 48-63: not in use
+                 * total freed FW packets on the link - used for
+                 * storing the AES/TKIP PN during recovery, as this
+                 * structure is not zeroed out.
+                 * For STA this holds the PN of the link to the AP.
+                 * For AP this holds the PN of the broadcast link.
                  */
-                u64 tx_security_seq;
-
-                /* 8 bits of the last sequence number in use */
-                u8 tx_security_last_seq_lsb;
+                u64 total_freed_pkts;
         };
 };
 
diff --git a/drivers/nfc/microread/mei.c b/drivers/nfc/microread/mei.c
index eef38cfd812e..ca33ae193935 100644
--- a/drivers/nfc/microread/mei.c
+++ b/drivers/nfc/microread/mei.c
@@ -22,7 +22,7 @@
 #include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/gpio.h>
-#include <linux/mei_bus.h>
+#include <linux/mei_cl_bus.h>
 
 #include <linux/nfc.h>
 #include <net/nfc/hci.h>
@@ -32,9 +32,6 @@
 
 #define MICROREAD_DRIVER_NAME "microread"
 
-#define MICROREAD_UUID UUID_LE(0x0bb17a78, 0x2a8e, 0x4c50, 0x94, \
-                               0xd4, 0x50, 0x26, 0x67, 0x23, 0x77, 0x5c)
-
 struct mei_nfc_hdr {
         u8 cmd;
         u8 status;
@@ -48,7 +45,7 @@ struct mei_nfc_hdr {
 #define MEI_NFC_MAX_READ (MEI_NFC_HEADER_SIZE + MEI_NFC_MAX_HCI_PAYLOAD)
 
 struct microread_mei_phy {
-        struct mei_device *mei_device;
+        struct mei_cl_device *device;
         struct nfc_hci_dev *hdev;
 
         int powered;
@@ -105,14 +102,14 @@ static int microread_mei_write(void *phy_id, struct sk_buff *skb)
 
         MEI_DUMP_SKB_OUT("mei frame sent", skb);
 
-        r = mei_send(phy->device, skb->data, skb->len);
+        r = mei_cl_send(phy->device, skb->data, skb->len);
         if (r > 0)
                 r = 0;
 
         return r;
 }
 
-static void microread_event_cb(struct mei_device *device, u32 events,
+static void microread_event_cb(struct mei_cl_device *device, u32 events,
                                void *context)
 {
         struct microread_mei_phy *phy = context;
@@ -120,7 +117,7 @@ static void microread_event_cb(struct mei_device *device, u32 events,
         if (phy->hard_fault != 0)
                 return;
 
-        if (events & BIT(MEI_EVENT_RX)) {
+        if (events & BIT(MEI_CL_EVENT_RX)) {
                 struct sk_buff *skb;
                 int reply_size;
 
@@ -128,7 +125,7 @@ static void microread_event_cb(struct mei_device *device, u32 events,
                 if (!skb)
                         return;
 
-                reply_size = mei_recv(device, skb->data, MEI_NFC_MAX_READ);
+                reply_size = mei_cl_recv(device, skb->data, MEI_NFC_MAX_READ);
                 if (reply_size < MEI_NFC_HEADER_SIZE) {
                         kfree(skb);
                         return;
@@ -149,8 +146,8 @@ static struct nfc_phy_ops mei_phy_ops = {
         .disable = microread_mei_disable,
 };
 
-static int microread_mei_probe(struct mei_device *device,
-                               const struct mei_id *id)
+static int microread_mei_probe(struct mei_cl_device *device,
+                               const struct mei_cl_device_id *id)
 {
         struct microread_mei_phy *phy;
         int r;
@@ -164,9 +161,9 @@ static int microread_mei_probe(struct mei_device *device,
         }
 
         phy->device = device;
-        mei_set_clientdata(device, phy);
+        mei_cl_set_drvdata(device, phy);
 
-        r = mei_register_event_cb(device, microread_event_cb, phy);
+        r = mei_cl_register_event_cb(device, microread_event_cb, phy);
         if (r) {
                 pr_err(MICROREAD_DRIVER_NAME ": event cb registration failed\n");
                 goto err_out;
@@ -186,9 +183,9 @@ err_out:
         return r;
 }
 
-static int microread_mei_remove(struct mei_device *device)
+static int microread_mei_remove(struct mei_cl_device *device)
 {
-        struct microread_mei_phy *phy = mei_get_clientdata(device);
+        struct microread_mei_phy *phy = mei_cl_get_drvdata(device);
 
         pr_info("Removing microread\n");
 
@@ -202,16 +199,15 @@ static int microread_mei_remove(struct mei_device *device)
         return 0;
 }
 
-static struct mei_id microread_mei_tbl[] = {
-        { MICROREAD_DRIVER_NAME, MICROREAD_UUID },
+static struct mei_cl_device_id microread_mei_tbl[] = {
+        { MICROREAD_DRIVER_NAME },
 
         /* required last entry */
         { }
 };
-
 MODULE_DEVICE_TABLE(mei, microread_mei_tbl);
 
-static struct mei_driver microread_driver = {
+static struct mei_cl_driver microread_driver = {
         .id_table = microread_mei_tbl,
         .name = MICROREAD_DRIVER_NAME,
 
@@ -225,7 +221,7 @@ static int microread_mei_init(void)
 
         pr_debug(DRIVER_DESC ": %s\n", __func__);
 
-        r = mei_driver_register(&microread_driver);
+        r = mei_cl_driver_register(&microread_driver);
         if (r) {
                 pr_err(MICROREAD_DRIVER_NAME ": driver registration failed\n");
                 return r;
@@ -236,7 +232,7 @@ static int microread_mei_init(void)
 
 static void microread_mei_exit(void)
 {
-        mei_driver_unregister(&microread_driver);
+        mei_cl_driver_unregister(&microread_driver);
 }
 
 module_init(microread_mei_init);
diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
index 71098a7b5fed..7cb7d2c8fd86 100644
--- a/drivers/ssb/driver_chipcommon.c
+++ b/drivers/ssb/driver_chipcommon.c
@@ -354,7 +354,7 @@ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
 
         if (cc->dev->id.revision >= 11)
                 cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
-        ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
+        ssb_dbg("chipcommon status is 0x%x\n", cc->status);
 
         if (cc->dev->id.revision >= 20) {
                 chipco_write32(cc, SSB_CHIPCO_GPIOPULLUP, 0);
diff --git a/drivers/ssb/driver_chipcommon_pmu.c b/drivers/ssb/driver_chipcommon_pmu.c
index 4c0f6d883dd3..791da2c0d8f6 100644
--- a/drivers/ssb/driver_chipcommon_pmu.c
+++ b/drivers/ssb/driver_chipcommon_pmu.c
@@ -110,8 +110,8 @@ static void ssb_pmu0_pllinit_r0(struct ssb_chipcommon *cc,
                 return;
         }
 
-        ssb_printk(KERN_INFO PFX "Programming PLL to %u.%03u MHz\n",
-                   (crystalfreq / 1000), (crystalfreq % 1000));
+        ssb_info("Programming PLL to %u.%03u MHz\n",
+                 crystalfreq / 1000, crystalfreq % 1000);
 
         /* First turn the PLL off. */
         switch (bus->chip_id) {
@@ -138,7 +138,7 @@ static void ssb_pmu0_pllinit_r0(struct ssb_chipcommon *cc,
         }
         tmp = chipco_read32(cc, SSB_CHIPCO_CLKCTLST);
         if (tmp & SSB_CHIPCO_CLKCTLST_HAVEHT)
-                ssb_printk(KERN_EMERG PFX "Failed to turn the PLL off!\n");
+                ssb_emerg("Failed to turn the PLL off!\n");
 
         /* Set PDIV in PLL control 0. */
         pllctl = ssb_chipco_pll_read(cc, SSB_PMU0_PLLCTL0);
@@ -249,8 +249,8 @@ static void ssb_pmu1_pllinit_r0(struct ssb_chipcommon *cc,
                 return;
         }
 
-        ssb_printk(KERN_INFO PFX "Programming PLL to %u.%03u MHz\n",
-                   (crystalfreq / 1000), (crystalfreq % 1000));
+        ssb_info("Programming PLL to %u.%03u MHz\n",
+                 crystalfreq / 1000, crystalfreq % 1000);
 
         /* First turn the PLL off. */
         switch (bus->chip_id) {
@@ -275,7 +275,7 @@ static void ssb_pmu1_pllinit_r0(struct ssb_chipcommon *cc,
         }
         tmp = chipco_read32(cc, SSB_CHIPCO_CLKCTLST);
         if (tmp & SSB_CHIPCO_CLKCTLST_HAVEHT)
-                ssb_printk(KERN_EMERG PFX "Failed to turn the PLL off!\n");
+                ssb_emerg("Failed to turn the PLL off!\n");
 
         /* Set p1div and p2div. */
         pllctl = ssb_chipco_pll_read(cc, SSB_PMU1_PLLCTL0);
@@ -349,9 +349,8 @@ static void ssb_pmu_pll_init(struct ssb_chipcommon *cc)
         case 43222:
                 break;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PLL init unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PLL init unknown for device %04X\n",
+                        bus->chip_id);
         }
 }
 
@@ -472,9 +471,8 @@ static void ssb_pmu_resources_init(struct ssb_chipcommon *cc)
                 max_msk = 0xFFFFF;
                 break;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PMU resource config unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PMU resource config unknown for device %04X\n",
+                        bus->chip_id);
         }
 
         if (updown_tab) {
@@ -526,8 +524,8 @@ void ssb_pmu_init(struct ssb_chipcommon *cc)
         pmucap = chipco_read32(cc, SSB_CHIPCO_PMU_CAP);
         cc->pmu.rev = (pmucap & SSB_CHIPCO_PMU_CAP_REVISION);
 
-        ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
-                    cc->pmu.rev, pmucap);
+        ssb_dbg("Found rev %u PMU (capabilities 0x%08X)\n",
+                cc->pmu.rev, pmucap);
 
         if (cc->pmu.rev == 1)
                 chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
@@ -638,9 +636,8 @@ u32 ssb_pmu_get_alp_clock(struct ssb_chipcommon *cc)
         case 0x5354:
                 ssb_pmu_get_alp_clock_clk0(cc);
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PMU alp clock unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PMU alp clock unknown for device %04X\n",
+                        bus->chip_id);
                 return 0;
         }
 }
@@ -654,9 +651,8 @@ u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
                 /* 5354 chip uses a non programmable PLL of frequency 240MHz */
                 return 240000000;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PMU cpu clock unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PMU cpu clock unknown for device %04X\n",
+                        bus->chip_id);
                 return 0;
         }
 }
@@ -669,9 +665,8 @@ u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
         case 0x5354:
                 return 120000000;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PMU controlclock unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PMU controlclock unknown for device %04X\n",
+                        bus->chip_id);
                 return 0;
         }
 }
diff --git a/drivers/ssb/driver_mipscore.c b/drivers/ssb/driver_mipscore.c
index 33b37dac40bd..fa385a368a56 100644
--- a/drivers/ssb/driver_mipscore.c
+++ b/drivers/ssb/driver_mipscore.c
@@ -167,21 +167,22 @@ static void set_irq(struct ssb_device *dev, unsigned int irq)
                 irqflag |= (ipsflag & ~ipsflag_irq_mask[irq]);
                 ssb_write32(mdev, SSB_IPSFLAG, irqflag);
         }
-        ssb_dprintk(KERN_INFO PFX
-                    "set_irq: core 0x%04x, irq %d => %d\n",
-                    dev->id.coreid, oldirq+2, irq+2);
+        ssb_dbg("set_irq: core 0x%04x, irq %d => %d\n",
+                dev->id.coreid, oldirq+2, irq+2);
 }
 
 static void print_irq(struct ssb_device *dev, unsigned int irq)
 {
-        int i;
         static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"};
-        ssb_dprintk(KERN_INFO PFX
-                "core 0x%04x, irq :", dev->id.coreid);
-        for (i = 0; i <= 6; i++) {
-                ssb_dprintk(" %s%s", irq_name[i], i==irq?"*":" ");
-        }
-        ssb_dprintk("\n");
+        ssb_dbg("core 0x%04x, irq : %s%s %s%s %s%s %s%s %s%s %s%s %s%s\n",
+                dev->id.coreid,
+                irq_name[0], irq == 0 ? "*" : " ",
+                irq_name[1], irq == 1 ? "*" : " ",
+                irq_name[2], irq == 2 ? "*" : " ",
+                irq_name[3], irq == 3 ? "*" : " ",
+                irq_name[4], irq == 4 ? "*" : " ",
+                irq_name[5], irq == 5 ? "*" : " ",
+                irq_name[6], irq == 6 ? "*" : " ");
 }
 
 static void dump_irq(struct ssb_bus *bus)
@@ -286,7 +287,7 @@ void ssb_mipscore_init(struct ssb_mipscore *mcore)
         if (!mcore->dev)
                 return; /* We don't have a MIPS core */
 
-        ssb_dprintk(KERN_INFO PFX "Initializing MIPS core...\n");
+        ssb_dbg("Initializing MIPS core...\n");
 
         bus = mcore->dev->bus;
         hz = ssb_clockspeed(bus);
@@ -334,7 +335,7 @@ void ssb_mipscore_init(struct ssb_mipscore *mcore)
                         break;
                 }
         }
-        ssb_dprintk(KERN_INFO PFX "after irq reconfiguration\n");
+        ssb_dbg("after irq reconfiguration\n");
         dump_irq(bus);
 
         ssb_mips_serial_init(mcore);
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 59801d23d7ec..d75b72ba2672 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -263,8 +263,7 @@ int ssb_pcicore_plat_dev_init(struct pci_dev *d)
                 return -ENODEV;
         }
 
-        ssb_printk(KERN_INFO "PCI: Fixing up device %s\n",
-                   pci_name(d));
+        ssb_info("PCI: Fixing up device %s\n", pci_name(d));
 
         /* Fix up interrupt lines */
         d->irq = ssb_mips_irq(extpci_core->dev) + 2;
@@ -285,12 +284,12 @@ static void ssb_pcicore_fixup_pcibridge(struct pci_dev *dev)
         if (dev->bus->number != 0 || PCI_SLOT(dev->devfn) != 0)
                 return;
 
-        ssb_printk(KERN_INFO "PCI: Fixing up bridge %s\n", pci_name(dev));
+        ssb_info("PCI: Fixing up bridge %s\n", pci_name(dev));
 
         /* Enable PCI bridge bus mastering and memory space */
         pci_set_master(dev);
         if (pcibios_enable_device(dev, ~0) < 0) {
-                ssb_printk(KERN_ERR "PCI: SSB bridge enable failed\n");
+                ssb_err("PCI: SSB bridge enable failed\n");
                 return;
         }
 
@@ -299,8 +298,8 @@ static void ssb_pcicore_fixup_pcibridge(struct pci_dev *dev)
 
         /* Make sure our latency is high enough to handle the devices behind us */
         lat = 168;
-        ssb_printk(KERN_INFO "PCI: Fixing latency timer of device %s to %u\n",
-                   pci_name(dev), lat);
+        ssb_info("PCI: Fixing latency timer of device %s to %u\n",
+                 pci_name(dev), lat);
         pci_write_config_byte(dev, PCI_LATENCY_TIMER, lat);
 }
 DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, ssb_pcicore_fixup_pcibridge);
@@ -323,7 +322,7 @@ static void ssb_pcicore_init_hostmode(struct ssb_pcicore *pc)
                 return;
         extpci_core = pc;
 
-        ssb_dprintk(KERN_INFO PFX "PCIcore in host mode found\n");
+        ssb_dbg("PCIcore in host mode found\n");
         /* Reset devices on the external PCI bus */
         val = SSB_PCICORE_CTL_RST_OE;
         val |= SSB_PCICORE_CTL_CLK_OE;
@@ -338,7 +337,7 @@ static void ssb_pcicore_init_hostmode(struct ssb_pcicore *pc)
         udelay(1); /* Assertion time demanded by the PCI standard */
 
         if (pc->dev->bus->has_cardbus_slot) {
-                ssb_dprintk(KERN_INFO PFX "CardBus slot detected\n");
+                ssb_dbg("CardBus slot detected\n");
                 pc->cardbusmode = 1;
                 /* GPIO 1 resets the bridge */
                 ssb_gpio_out(pc->dev->bus, 1, 1);
diff --git a/drivers/ssb/embedded.c b/drivers/ssb/embedded.c
index bb18d76f9f2c..55e101115038 100644
--- a/drivers/ssb/embedded.c
+++ b/drivers/ssb/embedded.c
@@ -57,9 +57,8 @@ int ssb_watchdog_register(struct ssb_bus *bus)
                                              bus->busnumber, &wdt,
                                              sizeof(wdt));
         if (IS_ERR(pdev)) {
-                ssb_dprintk(KERN_INFO PFX
-                            "can not register watchdog device, err: %li\n",
-                            PTR_ERR(pdev));
+                ssb_dbg("can not register watchdog device, err: %li\n",
+                        PTR_ERR(pdev));
                 return PTR_ERR(pdev);
         }
 
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 3b645b8a261f..812775a4bfb6 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -275,8 +275,8 @@ int ssb_devices_thaw(struct ssb_freeze_context *ctx)
 
                 err = sdrv->probe(sdev, &sdev->id);
                 if (err) {
-                        ssb_printk(KERN_ERR PFX "Failed to thaw device %s\n",
-                                   dev_name(sdev->dev));
+                        ssb_err("Failed to thaw device %s\n",
+                                dev_name(sdev->dev));
                         result = err;
                 }
                 ssb_device_put(sdev);
@@ -447,10 +447,9 @@ void ssb_bus_unregister(struct ssb_bus *bus)
 
         err = ssb_gpio_unregister(bus);
         if (err == -EBUSY)
-                ssb_dprintk(KERN_ERR PFX "Some GPIOs are still in use.\n");
+                ssb_dbg("Some GPIOs are still in use\n");
         else if (err)
-                ssb_dprintk(KERN_ERR PFX
-                            "Can not unregister GPIO driver: %i\n", err);
+                ssb_dbg("Can not unregister GPIO driver: %i\n", err);
 
         ssb_buses_lock();
         ssb_devices_unregister(bus);
@@ -497,8 +496,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
 
                 devwrap = kzalloc(sizeof(*devwrap), GFP_KERNEL);
                 if (!devwrap) {
-                        ssb_printk(KERN_ERR PFX
-                                   "Could not allocate device\n");
+                        ssb_err("Could not allocate device\n");
                         err = -ENOMEM;
                         goto error;
                 }
@@ -537,9 +535,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
                 sdev->dev = dev;
                 err = device_register(dev);
                 if (err) {
-                        ssb_printk(KERN_ERR PFX
-                                   "Could not register %s\n",
-                                   dev_name(dev));
+                        ssb_err("Could not register %s\n", dev_name(dev));
                         /* Set dev to NULL to not unregister
                          * dev on error unwinding. */
                         sdev->dev = NULL;
@@ -825,10 +821,9 @@ static int ssb_bus_register(struct ssb_bus *bus,
         ssb_mipscore_init(&bus->mipscore);
         err = ssb_gpio_init(bus);
         if (err == -ENOTSUPP)
-                ssb_dprintk(KERN_DEBUG PFX "GPIO driver not activated\n");
+                ssb_dbg("GPIO driver not activated\n");
         else if (err)
-                ssb_dprintk(KERN_ERR PFX
-                           "Error registering GPIO driver: %i\n", err);
+                ssb_dbg("Error registering GPIO driver: %i\n", err);
         err = ssb_fetch_invariants(bus, get_invariants);
         if (err) {
                 ssb_bus_may_powerdown(bus);
@@ -878,11 +873,11 @@ int ssb_bus_pcibus_register(struct ssb_bus *bus, struct pci_dev *host_pci)
 
         err = ssb_bus_register(bus, ssb_pci_get_invariants, 0);
         if (!err) {
-                ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
-                           "PCI device %s\n", dev_name(&host_pci->dev));
+                ssb_info("Sonics Silicon Backplane found on PCI device %s\n",
+                         dev_name(&host_pci->dev));
         } else {
-                ssb_printk(KERN_ERR PFX "Failed to register PCI version"
-                           " of SSB with error %d\n", err);
+                ssb_err("Failed to register PCI version of SSB with error %d\n",
+                        err);
         }
 
         return err;
@@ -903,8 +898,8 @@ int ssb_bus_pcmciabus_register(struct ssb_bus *bus,
 
         err = ssb_bus_register(bus, ssb_pcmcia_get_invariants, baseaddr);
         if (!err) {
-                ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
-                           "PCMCIA device %s\n", pcmcia_dev->devname);
+                ssb_info("Sonics Silicon Backplane found on PCMCIA device %s\n",
+                         pcmcia_dev->devname);
         }
 
         return err;
@@ -925,8 +920,8 @@ int ssb_bus_sdiobus_register(struct ssb_bus *bus, struct sdio_func *func,
 
         err = ssb_bus_register(bus, ssb_sdio_get_invariants, ~0);
         if (!err) {
-                ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
-                           "SDIO device %s\n", sdio_func_id(func));
+                ssb_info("Sonics Silicon Backplane found on SDIO device %s\n",
+                         sdio_func_id(func));
         }
 
         return err;
@@ -944,8 +939,8 @@ int ssb_bus_ssbbus_register(struct ssb_bus *bus, unsigned long baseaddr,
 
         err = ssb_bus_register(bus, get_invariants, baseaddr);
         if (!err) {
-                ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found at "
-                           "address 0x%08lX\n", baseaddr);
+                ssb_info("Sonics Silicon Backplane found at address 0x%08lX\n",
+                         baseaddr);
         }
 
         return err;
@@ -1339,7 +1334,7 @@ out:
 #endif
         return err;
 error:
-        ssb_printk(KERN_ERR PFX "Bus powerdown failed\n");
+        ssb_err("Bus powerdown failed\n");
         goto out;
 }
 EXPORT_SYMBOL(ssb_bus_may_powerdown);
@@ -1362,7 +1357,7 @@ int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl)
 
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Bus powerup failed\n");
+        ssb_err("Bus powerup failed\n");
         return err;
 }
 EXPORT_SYMBOL(ssb_bus_powerup);
@@ -1470,15 +1465,13 @@ static int __init ssb_modinit(void)
 
         err = b43_pci_ssb_bridge_init();
         if (err) {
-                ssb_printk(KERN_ERR "Broadcom 43xx PCI-SSB-bridge "
-                           "initialization failed\n");
+                ssb_err("Broadcom 43xx PCI-SSB-bridge initialization failed\n");
                 /* don't fail SSB init because of this */
                 err = 0;
         }
         err = ssb_gige_init();
         if (err) {
-                ssb_printk(KERN_ERR "SSB Broadcom Gigabit Ethernet "
-                           "driver initialization failed\n");
+                ssb_err("SSB Broadcom Gigabit Ethernet driver initialization failed\n");
                 /* don't fail SSB init because of this */
                 err = 0;
         }
diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
index e9d94968f394..a8dc95ebf2d6 100644
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -56,7 +56,7 @@ int ssb_pci_switch_coreidx(struct ssb_bus *bus, u8 coreidx)
         }
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Failed to switch to core %u\n", coreidx);
+        ssb_err("Failed to switch to core %u\n", coreidx);
         return -ENODEV;
 }
 
@@ -67,10 +67,9 @@ int ssb_pci_switch_core(struct ssb_bus *bus,
         unsigned long flags;
 
 #if SSB_VERBOSE_PCICORESWITCH_DEBUG
-        ssb_printk(KERN_INFO PFX
-                   "Switching to %s core, index %d\n",
-                   ssb_core_name(dev->id.coreid),
-                   dev->core_index);
+        ssb_info("Switching to %s core, index %d\n",
+                 ssb_core_name(dev->id.coreid),
+                 dev->core_index);
 #endif
 
         spin_lock_irqsave(&bus->bar_lock, flags);
@@ -231,6 +230,15 @@ static inline u8 ssb_crc8(u8 crc, u8 data)
         return t[crc ^ data];
 }
 
+static void sprom_get_mac(char *mac, const u16 *in)
+{
+        int i;
+        for (i = 0; i < 3; i++) {
+                *mac++ = in[i] >> 8;
+                *mac++ = in[i];
+        }
+}
+
 static u8 ssb_sprom_crc(const u16 *sprom, u16 size)
 {
         int word;
@@ -278,7 +286,7 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
         u32 spromctl;
         u16 size = bus->sprom_size;
 
-        ssb_printk(KERN_NOTICE PFX "Writing SPROM. Do NOT turn off the power! Please stand by...\n");
+        ssb_notice("Writing SPROM. Do NOT turn off the power! Please stand by...\n");
         err = pci_read_config_dword(pdev, SSB_SPROMCTL, &spromctl);
         if (err)
                 goto err_ctlreg;
@@ -286,17 +294,17 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
         err = pci_write_config_dword(pdev, SSB_SPROMCTL, spromctl);
         if (err)
                 goto err_ctlreg;
-        ssb_printk(KERN_NOTICE PFX "[ 0%%");
+        ssb_notice("[ 0%%");
         msleep(500);
         for (i = 0; i < size; i++) {
                 if (i == size / 4)
-                        ssb_printk("25%%");
+                        ssb_cont("25%%");
                 else if (i == size / 2)
-                        ssb_printk("50%%");
+                        ssb_cont("50%%");
                 else if (i == (size * 3) / 4)
-                        ssb_printk("75%%");
+                        ssb_cont("75%%");
                 else if (i % 2)
-                        ssb_printk(".");
+                        ssb_cont(".");
                 writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2));
                 mmiowb();
                 msleep(20);
@@ -309,12 +317,12 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
         if (err)
                 goto err_ctlreg;
         msleep(500);
-        ssb_printk("100%% ]\n");
-        ssb_printk(KERN_NOTICE PFX "SPROM written.\n");
+        ssb_cont("100%% ]\n");
+        ssb_notice("SPROM written\n");
 
         return 0;
 err_ctlreg:
-        ssb_printk(KERN_ERR PFX "Could not access SPROM control register.\n");
+        ssb_err("Could not access SPROM control register.\n");
         return err;
 }
 
@@ -339,10 +347,23 @@ static s8 r123_extract_antgain(u8 sprom_revision, const u16 *in,
         return (s8)gain;
 }
 
+static void sprom_extract_r23(struct ssb_sprom *out, const u16 *in)
+{
+        SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+        SPEX(opo, SSB_SPROM2_OPO, SSB_SPROM2_OPO_VALUE, 0);
+        SPEX(pa1lob0, SSB_SPROM2_PA1LOB0, 0xFFFF, 0);
+        SPEX(pa1lob1, SSB_SPROM2_PA1LOB1, 0xFFFF, 0);
+        SPEX(pa1lob2, SSB_SPROM2_PA1LOB2, 0xFFFF, 0);
+        SPEX(pa1hib0, SSB_SPROM2_PA1HIB0, 0xFFFF, 0);
+        SPEX(pa1hib1, SSB_SPROM2_PA1HIB1, 0xFFFF, 0);
+        SPEX(pa1hib2, SSB_SPROM2_PA1HIB2, 0xFFFF, 0);
+        SPEX(maxpwr_ah, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_HI, 0);
+        SPEX(maxpwr_al, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_LO,
+             SSB_SPROM2_MAXP_A_LO_SHIFT);
+}
+
 static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
 {
-        int i;
-        u16 v;
         u16 loc[3];
 
         if (out->revision == 3)                 /* rev 3 moved MAC */
@@ -352,19 +373,10 @@ static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
                 loc[1] = SSB_SPROM1_ET0MAC;
                 loc[2] = SSB_SPROM1_ET1MAC;
         }
-        for (i = 0; i < 3; i++) {
-                v = in[SPOFF(loc[0]) + i];
-                *(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
-        }
+        sprom_get_mac(out->il0mac, &in[SPOFF(loc[0])]);
         if (out->revision < 3) {        /* only rev 1-2 have et0, et1 */
-                for (i = 0; i < 3; i++) {
-                        v = in[SPOFF(loc[1]) + i];
-                        *(((__be16 *)out->et0mac) + i) = cpu_to_be16(v);
-                }
-                for (i = 0; i < 3; i++) {
-                        v = in[SPOFF(loc[2]) + i];
-                        *(((__be16 *)out->et1mac) + i) = cpu_to_be16(v);
-                }
+                sprom_get_mac(out->et0mac, &in[SPOFF(loc[1])]);
+                sprom_get_mac(out->et1mac, &in[SPOFF(loc[2])]);
         }
         SPEX(et0phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0A, 0);
         SPEX(et1phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1A,
@@ -372,6 +384,7 @@ static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
         SPEX(et0mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0M, 14);
         SPEX(et1mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1M, 15);
         SPEX(board_rev, SSB_SPROM1_BINF, SSB_SPROM1_BINF_BREV, 0);
+        SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
         if (out->revision == 1)
                 SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
                      SSB_SPROM1_BINF_CCODE_SHIFT);
@@ -398,8 +411,7 @@ static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
              SSB_SPROM1_ITSSI_A_SHIFT);
         SPEX(itssi_bg, SSB_SPROM1_ITSSI, SSB_SPROM1_ITSSI_BG, 0);
         SPEX(boardflags_lo, SSB_SPROM1_BFLLO, 0xFFFF, 0);
-        if (out->revision >= 2)
-                SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+
         SPEX(alpha2[0], SSB_SPROM1_CCODE, 0xff00, 8);
         SPEX(alpha2[1], SSB_SPROM1_CCODE, 0x00ff, 0);
 
@@ -410,6 +422,8 @@ static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
         out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
                                                     SSB_SPROM1_AGAIN_A,
                                                     SSB_SPROM1_AGAIN_A_SHIFT);
+        if (out->revision >= 2)
+                sprom_extract_r23(out, in);
 }
 
 /* Revs 4 5 and 8 have partially shared layout */
@@ -454,23 +468,20 @@ static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
 
 static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
 {
-        int i;
-        u16 v;
         u16 il0mac_offset;
 
         if (out->revision == 4)
                 il0mac_offset = SSB_SPROM4_IL0MAC;
         else
                 il0mac_offset = SSB_SPROM5_IL0MAC;
-        /* extract the MAC address */
-        for (i = 0; i < 3; i++) {
-                v = in[SPOFF(il0mac_offset) + i];
-                *(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
-        }
+
+        sprom_get_mac(out->il0mac, &in[SPOFF(il0mac_offset)]);
+
         SPEX(et0phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET0A, 0);
         SPEX(et1phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET1A,
              SSB_SPROM4_ETHPHY_ET1A_SHIFT);
         SPEX(board_rev, SSB_SPROM4_BOARDREV, 0xFFFF, 0);
+        SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
         if (out->revision == 4) {
                 SPEX(alpha2[0], SSB_SPROM4_CCODE, 0xff00, 8);
                 SPEX(alpha2[1], SSB_SPROM4_CCODE, 0x00ff, 0);
@@ -530,7 +541,7 @@ static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
 static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
 {
         int i;
-        u16 v, o;
+        u16 o;
         u16 pwr_info_offset[] = {
                 SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
                 SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
@@ -539,11 +550,10 @@ static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
                         ARRAY_SIZE(out->core_pwr_info));
 
         /* extract the MAC address */
-        for (i = 0; i < 3; i++) {
-                v = in[SPOFF(SSB_SPROM8_IL0MAC) + i];
-                *(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
-        }
+        sprom_get_mac(out->il0mac, &in[SPOFF(SSB_SPROM8_IL0MAC)]);
+
         SPEX(board_rev, SSB_SPROM8_BOARDREV, 0xFFFF, 0);
+        SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
         SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
         SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
         SPEX(boardflags_lo, SSB_SPROM8_BFLLO, 0xFFFF, 0);
@@ -743,7 +753,7 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
         memset(out, 0, sizeof(*out));
 
         out->revision = in[size - 1] & 0x00FF;
-        ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
+        ssb_dbg("SPROM revision %d detected\n", out->revision);
         memset(out->et0mac, 0xFF, 6);           /* preset et0 and et1 mac */
         memset(out->et1mac, 0xFF, 6);
 
@@ -752,7 +762,7 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
                  * number stored in the SPROM.
                  * Always extract r1. */
                 out->revision = 1;
-                ssb_dprintk(KERN_DEBUG PFX "SPROM treated as revision %d\n", out->revision);
+                ssb_dbg("SPROM treated as revision %d\n", out->revision);
         }
 
         switch (out->revision) {
@@ -769,9 +779,8 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
                 sprom_extract_r8(out, in);
                 break;
         default:
-                ssb_printk(KERN_WARNING PFX "Unsupported SPROM"
-                           " revision %d detected. Will extract"
-                           " v1\n", out->revision);
+                ssb_warn("Unsupported SPROM revision %d detected. Will extract v1\n",
+                         out->revision);
                 out->revision = 1;
                 sprom_extract_r123(out, in);
         }
@@ -791,7 +800,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
         u16 *buf;
 
         if (!ssb_is_sprom_available(bus)) {
-                ssb_printk(KERN_ERR PFX "No SPROM available!\n");
+                ssb_err("No SPROM available!\n");
                 return -ENODEV;
         }
         if (bus->chipco.dev) {  /* can be unavailable! */
@@ -810,7 +819,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
         } else {
                 bus->sprom_offset = SSB_SPROM_BASE1;
         }
-        ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset);
+        ssb_dbg("SPROM offset is 0x%x\n", bus->sprom_offset);
 
         buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
         if (!buf)
@@ -835,18 +844,15 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
                          * available for this device in some other storage */
                         err = ssb_fill_sprom_with_fallback(bus, sprom);
                         if (err) {
-                                ssb_printk(KERN_WARNING PFX "WARNING: Using"
-                                           " fallback SPROM failed (err %d)\n",
-                                           err);
+                                ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n",
+                                         err);
                         } else {
-                                ssb_dprintk(KERN_DEBUG PFX "Using SPROM"
-                                            " revision %d provided by"
-                                            " platform.\n", sprom->revision);
+                                ssb_dbg("Using SPROM revision %d provided by platform\n",
+                                        sprom->revision);
                                 err = 0;
                                 goto out_free;
                         }
-                        ssb_printk(KERN_WARNING PFX "WARNING: Invalid"
-                                   " SPROM CRC (corrupt SPROM)\n");
+                        ssb_warn("WARNING: Invalid SPROM CRC (corrupt SPROM)\n");
                 }
         }
         err = sprom_extract(bus, sprom, buf, bus->sprom_size);
diff --git a/drivers/ssb/pcmcia.c b/drivers/ssb/pcmcia.c
index fbafed5b729b..b413e0187087 100644
--- a/drivers/ssb/pcmcia.c
+++ b/drivers/ssb/pcmcia.c
@@ -143,7 +143,7 @@ int ssb_pcmcia_switch_coreidx(struct ssb_bus *bus,
 
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Failed to switch to core %u\n", coreidx);
+        ssb_err("Failed to switch to core %u\n", coreidx);
         return err;
 }
 
@@ -153,10 +153,9 @@ int ssb_pcmcia_switch_core(struct ssb_bus *bus,
         int err;
 
 #if SSB_VERBOSE_PCMCIACORESWITCH_DEBUG
-        ssb_printk(KERN_INFO PFX
-                   "Switching to %s core, index %d\n",
-                   ssb_core_name(dev->id.coreid),
-                   dev->core_index);
+        ssb_info("Switching to %s core, index %d\n",
+                 ssb_core_name(dev->id.coreid),
+                 dev->core_index);
 #endif
 
         err = ssb_pcmcia_switch_coreidx(bus, dev->core_index);
@@ -192,7 +191,7 @@ int ssb_pcmcia_switch_segment(struct ssb_bus *bus, u8 seg)
 
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Failed to switch pcmcia segment\n");
+        ssb_err("Failed to switch pcmcia segment\n");
         return err;
 }
 
@@ -549,44 +548,39 @@ static int ssb_pcmcia_sprom_write_all(struct ssb_bus *bus, const u16 *sprom)
         bool failed = 0;
         size_t size = SSB_PCMCIA_SPROM_SIZE;
 
-        ssb_printk(KERN_NOTICE PFX
-                   "Writing SPROM. Do NOT turn off the power! "
-                   "Please stand by...\n");
+        ssb_notice("Writing SPROM. Do NOT turn off the power! Please stand by...\n");
         err = ssb_pcmcia_sprom_command(bus, SSB_PCMCIA_SPROMCTL_WRITEEN);
         if (err) {
-                ssb_printk(KERN_NOTICE PFX
-                           "Could not enable SPROM write access.\n");
+                ssb_notice("Could not enable SPROM write access\n");
                 return -EBUSY;
         }
-        ssb_printk(KERN_NOTICE PFX "[ 0%%");
+        ssb_notice("[ 0%%");
         msleep(500);
         for (i = 0; i < size; i++) {
                 if (i == size / 4)
-                        ssb_printk("25%%");
+                        ssb_cont("25%%");
                 else if (i == size / 2)
-                        ssb_printk("50%%");
+                        ssb_cont("50%%");
                 else if (i == (size * 3) / 4)
-                        ssb_printk("75%%");
+                        ssb_cont("75%%");
                 else if (i % 2)
-                        ssb_printk(".");
+                        ssb_cont(".");
                 err = ssb_pcmcia_sprom_write(bus, i, sprom[i]);
                 if (err) {
-                        ssb_printk(KERN_NOTICE PFX
-                                   "Failed to write to SPROM.\n");
+                        ssb_notice("Failed to write to SPROM\n");
                         failed = 1;
                         break;
                 }
         }
         err = ssb_pcmcia_sprom_command(bus, SSB_PCMCIA_SPROMCTL_WRITEDIS);
         if (err) {
-                ssb_printk(KERN_NOTICE PFX
-                           "Could not disable SPROM write access.\n");
+                ssb_notice("Could not disable SPROM write access\n");
                 failed = 1;
         }
         msleep(500);
         if (!failed) {
-                ssb_printk("100%% ]\n");
-                ssb_printk(KERN_NOTICE PFX "SPROM written.\n");
+                ssb_cont("100%% ]\n");
+                ssb_notice("SPROM written\n");
         }
 
         return failed ? -EBUSY : 0;
@@ -700,7 +694,7 @@ static int ssb_pcmcia_do_get_invariants(struct pcmcia_device *p_dev,
         return -ENOSPC; /* continue with next entry */
 
 error:
-        ssb_printk(KERN_ERR PFX
+        ssb_err(
                    "PCMCIA: Failed to fetch device invariants: %s\n",
                    error_description);
         return -ENODEV;
@@ -722,7 +716,7 @@ int ssb_pcmcia_get_invariants(struct ssb_bus *bus,
         res = pcmcia_loop_tuple(bus->host_pcmcia, CISTPL_FUNCE,
                                 ssb_pcmcia_get_mac, sprom);
         if (res != 0) {
-                ssb_printk(KERN_ERR PFX
+                ssb_err(
                         "PCMCIA: Failed to fetch MAC address\n");
                 return -ENODEV;
         }
@@ -733,7 +727,7 @@ int ssb_pcmcia_get_invariants(struct ssb_bus *bus,
         if ((res == 0) || (res == -ENOSPC))
                 return 0;
 
-        ssb_printk(KERN_ERR PFX
+        ssb_err(
                         "PCMCIA: Failed to fetch device invariants\n");
         return -ENODEV;
 }
@@ -843,6 +837,6 @@ int ssb_pcmcia_init(struct ssb_bus *bus)
 
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Failed to initialize PCMCIA host device\n");
+        ssb_err("Failed to initialize PCMCIA host device\n");
         return err;
 }
diff --git a/drivers/ssb/scan.c b/drivers/ssb/scan.c
index ab4627cf1114..b9429df583eb 100644
--- a/drivers/ssb/scan.c
+++ b/drivers/ssb/scan.c
@@ -125,8 +125,7 @@ static u16 pcidev_to_chipid(struct pci_dev *pci_dev)
                 chipid_fallback = 0x4401;
                 break;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "PCI-ID not in fallback list\n");
+                ssb_err("PCI-ID not in fallback list\n");
         }
 
         return chipid_fallback;
@@ -152,8 +151,7 @@ static u8 chipid_to_nrcores(u16 chipid)
         case 0x4704:
                 return 9;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "CHIPID not in nrcores fallback list\n");
+                ssb_err("CHIPID not in nrcores fallback list\n");
         }
 
         return 1;
@@ -320,15 +318,13 @@ int ssb_bus_scan(struct ssb_bus *bus,
                         bus->chip_package = 0;
                 }
         }
-        ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
-                   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
-                   bus->chip_package);
+        ssb_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
+                 bus->chip_id, bus->chip_rev, bus->chip_package);
         if (!bus->nr_devices)
                 bus->nr_devices = chipid_to_nrcores(bus->chip_id);
         if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
-                ssb_printk(KERN_ERR PFX
-                           "More than %d ssb cores found (%d)\n",
-                           SSB_MAX_NR_CORES, bus->nr_devices);
+                ssb_err("More than %d ssb cores found (%d)\n",
+                        SSB_MAX_NR_CORES, bus->nr_devices);
                 goto err_unmap;
         }
         if (bus->bustype == SSB_BUSTYPE_SSB) {
@@ -370,8 +366,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                         nr_80211_cores++;
                         if (nr_80211_cores > 1) {
                                 if (!we_support_multiple_80211_cores(bus)) {
-                                        ssb_dprintk(KERN_INFO PFX "Ignoring additional "
-                                                    "802.11 core\n");
+                                        ssb_dbg("Ignoring additional 802.11 core\n");
                                         continue;
                                 }
                         }
@@ -379,8 +374,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                 case SSB_DEV_EXTIF:
 #ifdef CONFIG_SSB_DRIVER_EXTIF
                         if (bus->extif.dev) {
-                                ssb_printk(KERN_WARNING PFX
-                                           "WARNING: Multiple EXTIFs found\n");
+                                ssb_warn("WARNING: Multiple EXTIFs found\n");
                                 break;
                         }
                         bus->extif.dev = dev;
@@ -388,8 +382,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                         break;
                 case SSB_DEV_CHIPCOMMON:
                         if (bus->chipco.dev) {
-                                ssb_printk(KERN_WARNING PFX
-                                           "WARNING: Multiple ChipCommon found\n");
+                                ssb_warn("WARNING: Multiple ChipCommon found\n");
                                 break;
                         }
                         bus->chipco.dev = dev;
@@ -398,8 +391,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                 case SSB_DEV_MIPS_3302:
 #ifdef CONFIG_SSB_DRIVER_MIPS
                         if (bus->mipscore.dev) {
-                                ssb_printk(KERN_WARNING PFX
-                                           "WARNING: Multiple MIPS cores found\n");
+                                ssb_warn("WARNING: Multiple MIPS cores found\n");
                                 break;
                         }
                         bus->mipscore.dev = dev;
@@ -420,8 +412,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                                 }
                         }
                         if (bus->pcicore.dev) {
-                                ssb_printk(KERN_WARNING PFX
-                                           "WARNING: Multiple PCI(E) cores found\n");
+                                ssb_warn("WARNING: Multiple PCI(E) cores found\n");
                                 break;
                         }
                         bus->pcicore.dev = dev;
diff --git a/drivers/ssb/sprom.c b/drivers/ssb/sprom.c
index 80d366fcf8d3..a3b23644b0fb 100644
--- a/drivers/ssb/sprom.c
+++ b/drivers/ssb/sprom.c
@@ -127,13 +127,13 @@ ssize_t ssb_attr_sprom_store(struct ssb_bus *bus,
                 goto out_kfree;
         err = ssb_devices_freeze(bus, &freeze);
         if (err) {
-                ssb_printk(KERN_ERR PFX "SPROM write: Could not freeze all devices\n");
+                ssb_err("SPROM write: Could not freeze all devices\n");
                 goto out_unlock;
         }
         res = sprom_write(bus, sprom);
         err = ssb_devices_thaw(&freeze);
         if (err)
-                ssb_printk(KERN_ERR PFX "SPROM write: Could not thaw all devices\n");
+                ssb_err("SPROM write: Could not thaw all devices\n");
 out_unlock:
         mutex_unlock(&bus->sprom_mutex);
 out_kfree:
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index 466171b77f68..4671f17f09af 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -9,16 +9,27 @@
 #define PFX     "ssb: "
 
 #ifdef CONFIG_SSB_SILENT
-# define ssb_printk(fmt, x...)  do { /* nothing */ } while (0)
+# define ssb_printk(fmt, ...)                                   \
+        do { if (0) printk(fmt, ##__VA_ARGS__); } while (0)
 #else
-# define ssb_printk             printk
+# define ssb_printk(fmt, ...)                                   \
+        printk(fmt, ##__VA_ARGS__)
 #endif /* CONFIG_SSB_SILENT */
 
+#define ssb_emerg(fmt, ...)     ssb_printk(KERN_EMERG PFX fmt, ##__VA_ARGS__)
+#define ssb_err(fmt, ...)       ssb_printk(KERN_ERR PFX fmt, ##__VA_ARGS__)
+#define ssb_warn(fmt, ...)      ssb_printk(KERN_WARNING PFX fmt, ##__VA_ARGS__)
+#define ssb_notice(fmt, ...)    ssb_printk(KERN_NOTICE PFX fmt, ##__VA_ARGS__)
+#define ssb_info(fmt, ...)      ssb_printk(KERN_INFO PFX fmt, ##__VA_ARGS__)
+#define ssb_cont(fmt, ...)      ssb_printk(KERN_CONT fmt, ##__VA_ARGS__)
+
 /* dprintk: Debugging printk; vanishes for non-debug compilation */
 #ifdef CONFIG_SSB_DEBUG
-# define ssb_dprintk(fmt, x...) ssb_printk(fmt , ##x)
+# define ssb_dbg(fmt, ...)                                      \
+        ssb_printk(KERN_DEBUG PFX fmt, ##__VA_ARGS__)
 #else
-# define ssb_dprintk(fmt, x...) do { /* nothing */ } while (0)
+# define ssb_dbg(fmt, ...)                                      \
+        do { if (0) printk(KERN_DEBUG PFX fmt, ##__VA_ARGS__); } while (0)
 #endif
 
 #ifdef CONFIG_SSB_DEBUG
diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index 1956593ee89d..81e939e90c4c 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -881,17 +881,12 @@ static struct vio_driver hvcs_vio_driver = {
 /* Only called from hvcs_get_pi please */
 static void hvcs_set_pi(struct hvcs_partner_info *pi, struct hvcs_struct *hvcsd)
 {
-        int clclength;
-
         hvcsd->p_unit_address = pi->unit_address;
         hvcsd->p_partition_ID  = pi->partition_ID;
-        clclength = strlen(&pi->location_code[0]);
-        if (clclength > HVCS_CLC_LENGTH)
-                clclength = HVCS_CLC_LENGTH;
 
         /* copy the null-term char too */
-        strncpy(&hvcsd->p_location_code[0],
-                        &pi->location_code[0], clclength + 1);
+        strlcpy(&hvcsd->p_location_code[0],
+                        &pi->location_code[0], sizeof(hvcsd->p_location_code));
 }
 
 /*
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index e0ce311011c0..f14a98a79c9d 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -134,6 +134,7 @@ struct bcma_host_ops {
 #define BCMA_CORE_I2S                   0x834
 #define BCMA_CORE_SDR_DDR1_MEM_CTL      0x835   /* SDR/DDR1 memory controller core */
 #define BCMA_CORE_SHIM                  0x837   /* SHIM component in ubus/6362 */
+#define BCMA_CORE_ARM_CR4               0x83e
 #define BCMA_CORE_DEFAULT               0xFFF
 
 #define BCMA_MAX_NR_CORES               16
@@ -173,6 +174,60 @@ struct bcma_host_ops {
 #define BCMA_CHIP_ID_BCM53572   53572
 #define  BCMA_PKG_ID_BCM47188   9
 
+/* Board types (on PCI usually equals to the subsystem dev id) */
+/* BCM4313 */
+#define BCMA_BOARD_TYPE_BCM94313BU      0X050F
+#define BCMA_BOARD_TYPE_BCM94313HM      0X0510
+#define BCMA_BOARD_TYPE_BCM94313EPA     0X0511
+#define BCMA_BOARD_TYPE_BCM94313HMG     0X051C
+/* BCM4716 */
+#define BCMA_BOARD_TYPE_BCM94716NR2     0X04CD
+/* BCM43224 */
+#define BCMA_BOARD_TYPE_BCM943224X21    0X056E
+#define BCMA_BOARD_TYPE_BCM943224X21_FCC        0X00D1
+#define BCMA_BOARD_TYPE_BCM943224X21B   0X00E9
+#define BCMA_BOARD_TYPE_BCM943224M93    0X008B
+#define BCMA_BOARD_TYPE_BCM943224M93A   0X0090
+#define BCMA_BOARD_TYPE_BCM943224X16    0X0093
+#define BCMA_BOARD_TYPE_BCM94322X9      0X008D
+#define BCMA_BOARD_TYPE_BCM94322M35E    0X008E
+/* BCM43228 */
+#define BCMA_BOARD_TYPE_BCM943228BU8    0X0540
+#define BCMA_BOARD_TYPE_BCM943228BU9    0X0541
+#define BCMA_BOARD_TYPE_BCM943228BU     0X0542
+#define BCMA_BOARD_TYPE_BCM943227HM4L   0X0543
+#define BCMA_BOARD_TYPE_BCM943227HMB    0X0544
+#define BCMA_BOARD_TYPE_BCM943228HM4L   0X0545
+#define BCMA_BOARD_TYPE_BCM943228SD     0X0573
+/* BCM4331 */
+#define BCMA_BOARD_TYPE_BCM94331X19     0X00D6
+#define BCMA_BOARD_TYPE_BCM94331X28     0X00E4
+#define BCMA_BOARD_TYPE_BCM94331X28B    0X010E
+#define BCMA_BOARD_TYPE_BCM94331PCIEBT3AX       0X00E4
+#define BCMA_BOARD_TYPE_BCM94331X12_2G  0X00EC
+#define BCMA_BOARD_TYPE_BCM94331X12_5G  0X00ED
+#define BCMA_BOARD_TYPE_BCM94331X29B    0X00EF
+#define BCMA_BOARD_TYPE_BCM94331CSAX    0X00EF
+#define BCMA_BOARD_TYPE_BCM94331X19C    0X00F5
+#define BCMA_BOARD_TYPE_BCM94331X33     0X00F4
+#define BCMA_BOARD_TYPE_BCM94331BU      0X0523
+#define BCMA_BOARD_TYPE_BCM94331S9BU    0X0524
+#define BCMA_BOARD_TYPE_BCM94331MC      0X0525
+#define BCMA_BOARD_TYPE_BCM94331MCI     0X0526
+#define BCMA_BOARD_TYPE_BCM94331PCIEBT4 0X0527
+#define BCMA_BOARD_TYPE_BCM94331HM      0X0574
+#define BCMA_BOARD_TYPE_BCM94331PCIEDUAL        0X059B
+#define BCMA_BOARD_TYPE_BCM94331MCH5    0X05A9
+#define BCMA_BOARD_TYPE_BCM94331CS      0X05C6
+#define BCMA_BOARD_TYPE_BCM94331CD      0X05DA
+/* BCM53572 */
+#define BCMA_BOARD_TYPE_BCM953572BU     0X058D
+#define BCMA_BOARD_TYPE_BCM953572NR2    0X058E
+#define BCMA_BOARD_TYPE_BCM947188NR2    0X058F
+#define BCMA_BOARD_TYPE_BCM953572SDRNR2 0X0590
+/* BCM43142 */
+#define BCMA_BOARD_TYPE_BCM943142HM     0X05E0
+
 struct bcma_device {
         struct bcma_bus *bus;
         struct bcma_device_id id;
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 8390c474f69a..b8b09eac60a4 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -104,6 +104,7 @@
 #define  BCMA_CC_CHIPST_4706_MIPS_BENDIAN       BIT(3) /* 0: little, 1: big endian */
 #define  BCMA_CC_CHIPST_4706_PCIE1_DISABLE      BIT(5) /* PCIE1 enable strap pin */
 #define  BCMA_CC_CHIPST_5357_NAND_BOOT          BIT(4) /* NAND boot, valid for CC rev 38 and/or BCM5357 */
+#define  BCMA_CC_CHIPST_4360_XTAL_40MZ          0x00000001
 #define BCMA_CC_JCMD                    0x0030          /* Rev >= 10 only */
 #define  BCMA_CC_JCMD_START             0x80000000
 #define  BCMA_CC_JCMD_BUSY              0x80000000
@@ -315,6 +316,9 @@
 #define BCMA_CC_PMU_CTL                 0x0600 /* PMU control */
 #define  BCMA_CC_PMU_CTL_ILP_DIV        0xFFFF0000 /* ILP div mask */
 #define  BCMA_CC_PMU_CTL_ILP_DIV_SHIFT  16
+#define  BCMA_CC_PMU_CTL_RES            0x00006000 /* reset control mask */
+#define  BCMA_CC_PMU_CTL_RES_SHIFT      13
+#define  BCMA_CC_PMU_CTL_RES_RELOAD     0x2     /* reload POR values */
 #define  BCMA_CC_PMU_CTL_PLL_UPD        0x00000400
 #define  BCMA_CC_PMU_CTL_NOILPONW       0x00000200 /* No ILP on wait */
 #define  BCMA_CC_PMU_CTL_HTREQEN        0x00000100 /* HT req enable */
@@ -607,6 +611,8 @@ void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
 
 extern u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks);
 
+extern u32 bcma_chipco_get_alp_clock(struct bcma_drv_cc *cc);
+
 void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value);
 
 u32 bcma_chipco_irq_status(struct bcma_drv_cc *cc, u32 mask);
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
index 7e8104bb7a7e..917dcd7965e7 100644
--- a/include/linux/bcma/bcma_regs.h
+++ b/include/linux/bcma/bcma_regs.h
@@ -37,6 +37,7 @@
 #define  BCMA_IOST_BIST_DONE            0x8000
 #define BCMA_RESET_CTL                  0x0800
 #define  BCMA_RESET_CTL_RESET           0x0001
+#define BCMA_RESET_ST                   0x0804
 
 /* BCMA PCI config space registers. */
 #define BCMA_PCI_PMCSR                  0x44
diff --git a/include/linux/hardirq.h b/include/linux/hardirq.h
index 29eb805ea4a6..c1d6555d2567 100644
--- a/include/linux/hardirq.h
+++ b/include/linux/hardirq.h
@@ -118,10 +118,8 @@
 
 #ifdef CONFIG_PREEMPT_COUNT
 # define preemptible()  (preempt_count() == 0 && !irqs_disabled())
-# define IRQ_EXIT_OFFSET (HARDIRQ_OFFSET-1)
 #else
 # define preemptible()  0
-# define IRQ_EXIT_OFFSET HARDIRQ_OFFSET
 #endif
 
 #if defined(CONFIG_SMP) || defined(CONFIG_GENERIC_HARDIRQS)
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index ef9acd3c8450..01d25e6fc792 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -854,6 +854,8 @@ type_pf_tresize(struct ip_set *set, bool retried)
 retry:
         ret = 0;
         htable_bits++;
+        pr_debug("attempt to resize set %s from %u to %u, t %p\n",
+                 set->name, orig->htable_bits, htable_bits, orig);
         if (!htable_bits) {
                 /* In case we have plenty of memory :-) */
                 pr_warning("Cannot increase the hashsize of set %s further\n",
@@ -873,7 +875,7 @@ retry:
                         data = ahash_tdata(n, j);
                         m = hbucket(t, HKEY(data, h->initval, htable_bits));
                         ret = type_pf_elem_tadd(m, data, AHASH_MAX(h), 0,
-                                                type_pf_data_timeout(data));
+                                                ip_set_timeout_get(type_pf_data_timeout(data)));
                         if (ret < 0) {
                                 read_unlock_bh(&set->lock);
                                 ahash_destroy(t);
diff --git a/include/linux/platform_data/brcmfmac-sdio.h b/include/linux/platform_data/brcmfmac-sdio.h
new file mode 100644
index 000000000000..1ade657d5fc1
--- /dev/null
+++ b/include/linux/platform_data/brcmfmac-sdio.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LINUX_BRCMFMAC_PLATFORM_H
+#define _LINUX_BRCMFMAC_PLATFORM_H
+
+/*
+ * Platform specific driver functions and data. Through the platform specific
+ * device data functions can be provided to help the brcmfmac driver to
+ * operate with the device in combination with the used platform.
+ *
+ * Use the platform data in the following (similar) way:
+ *
+ *
+#include <brcmfmac_platform.h>
+
+
+static void brcmfmac_power_on(void)
+{
+}
+
+static void brcmfmac_power_off(void)
+{
+}
+
+static void brcmfmac_reset(void)
+{
+}
+
+static struct brcmfmac_sdio_platform_data brcmfmac_sdio_pdata = {
+        .power_on               = brcmfmac_power_on,
+        .power_off              = brcmfmac_power_off,
+        .reset                  = brcmfmac_reset
+};
+
+static struct platform_device brcmfmac_device = {
+        .name                   = BRCMFMAC_SDIO_PDATA_NAME,
+        .id                     = PLATFORM_DEVID_NONE,
+        .dev.platform_data      = &brcmfmac_sdio_pdata
+};
+
+void __init brcmfmac_init_pdata(void)
+{
+        brcmfmac_sdio_pdata.oob_irq_supported = true;
+        brcmfmac_sdio_pdata.oob_irq_nr = gpio_to_irq(GPIO_BRCMF_SDIO_OOB);
+        brcmfmac_sdio_pdata.oob_irq_flags = IORESOURCE_IRQ |
+                                            IORESOURCE_IRQ_HIGHLEVEL;
+        platform_device_register(&brcmfmac_device);
+}
+ *
+ *
+ * Note: the brcmfmac can be loaded as module or be statically built-in into
+ * the kernel. If built-in then do note that it uses module_init (and
+ * module_exit) routines which equal device_initcall. So if you intend to
+ * create a module with the platform specific data for the brcmfmac and have
+ * it built-in to the kernel then use a higher initcall then device_initcall
+ * (see init.h). If this is not done then brcmfmac will load without problems
+ * but will not pickup the platform data.
+ *
+ * When the driver does not "detect" platform driver data then it will continue
+ * without reporting anything and just assume there is no data needed. Which is
+ * probably true for most platforms.
+ *
+ * Explanation of the platform_data fields:
+ *
+ * drive_strength: is the preferred drive_strength to be used for the SDIO
+ * pins. If 0 then a default value will be used. This is the target drive
+ * strength, the exact drive strength which will be used depends on the
+ * capabilities of the device.
+ *
+ * oob_irq_supported: does the board have support for OOB interrupts. SDIO
+ * in-band interrupts are relatively slow and for having less overhead on
+ * interrupt processing an out of band interrupt can be used. If the HW
+ * supports this then enable this by setting this field to true and configure
+ * the oob related fields.
+ *
+ * oob_irq_nr, oob_irq_flags: the OOB interrupt information. The values are
+ * used for registering the irq using request_irq function.
+ *
+ * power_on: This function is called by the brcmfmac when the module gets
+ * loaded. This can be particularly useful for low power devices. The platform
+ * spcific routine may for example decide to power up the complete device.
+ * If there is no use-case for this function then provide NULL.
+ *
+ * power_off: This function is called by the brcmfmac when the module gets
+ * unloaded. At this point the device can be powered down or otherwise be reset.
+ * So if an actual power_off is not supported but reset is then reset the device
+ * when this function gets called. This can be particularly useful for low power
+ * devices. If there is no use-case for this function (either power-down or
+ * reset) then provide NULL.
+ *
+ * reset: This function can get called if the device communication broke down.
+ * This functionality is particularly useful in case of SDIO type devices. It is
+ * possible to reset a dongle via sdio data interface, but it requires that
+ * this is fully functional. This function is chip/module specific and this
+ * function should return only after the complete reset has completed.
+ */
+
+#define BRCMFMAC_SDIO_PDATA_NAME        "brcmfmac_sdio"
+
+struct brcmfmac_sdio_platform_data {
+        unsigned int drive_strength;
+        bool oob_irq_supported;
+        unsigned int oob_irq_nr;
+        unsigned long oob_irq_flags;
+        void (*power_on)(void);
+        void (*power_off)(void);
+        void (*reset)(void);
+};
+
+#endif /* _LINUX_BRCMFMAC_PLATFORM_H */
diff --git a/include/linux/smpboot.h b/include/linux/smpboot.h
index c65dee059913..13e929679550 100644
--- a/include/linux/smpboot.h
+++ b/include/linux/smpboot.h
@@ -24,6 +24,9 @@ struct smpboot_thread_data;
  *                      parked (cpu offline)
  * @unpark:             Optional unpark function, called when the thread is
  *                      unparked (cpu online)
+ * @pre_unpark:         Optional unpark function, called before the thread is
+ *                      unparked (cpu online). This is not guaranteed to be
+ *                      called on the target cpu of the thread. Careful!
  * @selfparking:        Thread is not parked by the park function.
  * @thread_comm:        The base name of the thread
  */
@@ -37,6 +40,7 @@ struct smp_hotplug_thread {
         void                            (*cleanup)(unsigned int cpu, bool online);
         void                            (*park)(unsigned int cpu);
         void                            (*unpark)(unsigned int cpu);
+        void                            (*pre_unpark)(unsigned int cpu);
         bool                            selfparking;
         const char                      *thread_comm;
 };
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 2b9f74b0ffea..428c37a1f95c 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -298,6 +298,7 @@ struct ucred {
 #define SOL_IUCV        277
 #define SOL_CAIF        278
 #define SOL_ALG         279
+#define SOL_NFC         280
 
 /* IPX options */
 #define IPX_TYPE        1
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 22958d68ecfe..c64999fd1660 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -26,9 +26,9 @@ struct ssb_sprom_core_pwr_info {
 
 struct ssb_sprom {
         u8 revision;
-        u8 il0mac[6];           /* MAC address for 802.11b/g */
-        u8 et0mac[6];           /* MAC address for Ethernet */
-        u8 et1mac[6];           /* MAC address for 802.11a */
+        u8 il0mac[6] __aligned(sizeof(u16));    /* MAC address for 802.11b/g */
+        u8 et0mac[6] __aligned(sizeof(u16));    /* MAC address for Ethernet */
+        u8 et1mac[6] __aligned(sizeof(u16));    /* MAC address for 802.11a */
         u8 et0phyaddr;          /* MII address for enet0 */
         u8 et1phyaddr;          /* MII address for enet1 */
         u8 et0mdcport;          /* MDIO for enet0 */
@@ -340,13 +340,61 @@ enum ssb_bustype {
 #define SSB_BOARDVENDOR_DELL    0x1028  /* Dell */
 #define SSB_BOARDVENDOR_HP      0x0E11  /* HP */
 /* board_type */
+#define SSB_BOARD_BCM94301CB    0x0406
+#define SSB_BOARD_BCM94301MP    0x0407
+#define SSB_BOARD_BU4309        0x040A
+#define SSB_BOARD_BCM94309CB    0x040B
+#define SSB_BOARD_BCM4309MP     0x040C
+#define SSB_BOARD_BU4306        0x0416
 #define SSB_BOARD_BCM94306MP    0x0418
 #define SSB_BOARD_BCM4309G      0x0421
 #define SSB_BOARD_BCM4306CB     0x0417
-#define SSB_BOARD_BCM4309MP     0x040C
+#define SSB_BOARD_BCM94306PC    0x0425  /* pcmcia 3.3v 4306 card */
+#define SSB_BOARD_BCM94306CBSG  0x042B  /* with SiGe PA */
+#define SSB_BOARD_PCSG94306     0x042D  /* with SiGe PA */
+#define SSB_BOARD_BU4704SD      0x042E  /* with sdram */
+#define SSB_BOARD_BCM94704AGR   0x042F  /* dual 11a/11g Router */
+#define SSB_BOARD_BCM94308MP    0x0430  /* 11a-only minipci */
+#define SSB_BOARD_BU4318        0x0447
+#define SSB_BOARD_CB4318        0x0448
+#define SSB_BOARD_MPG4318       0x0449
 #define SSB_BOARD_MP4318        0x044A
-#define SSB_BOARD_BU4306        0x0416
-#define SSB_BOARD_BU4309        0x040A
+#define SSB_BOARD_SD4318        0x044B
+#define SSB_BOARD_BCM94306P     0x044C  /* with SiGe */
+#define SSB_BOARD_BCM94303MP    0x044E
+#define SSB_BOARD_BCM94306MPM   0x0450
+#define SSB_BOARD_BCM94306MPL   0x0453
+#define SSB_BOARD_PC4303        0x0454  /* pcmcia */
+#define SSB_BOARD_BCM94306MPLNA 0x0457
+#define SSB_BOARD_BCM94306MPH   0x045B
+#define SSB_BOARD_BCM94306PCIV  0x045C
+#define SSB_BOARD_BCM94318MPGH  0x0463
+#define SSB_BOARD_BU4311        0x0464
+#define SSB_BOARD_BCM94311MC    0x0465
+#define SSB_BOARD_BCM94311MCAG  0x0466
+/* 4321 boards */
+#define SSB_BOARD_BU4321        0x046B
+#define SSB_BOARD_BU4321E       0x047C
+#define SSB_BOARD_MP4321        0x046C
+#define SSB_BOARD_CB2_4321      0x046D
+#define SSB_BOARD_CB2_4321_AG   0x0066
+#define SSB_BOARD_MC4321        0x046E
+/* 4325 boards */
+#define SSB_BOARD_BCM94325DEVBU 0x0490
+#define SSB_BOARD_BCM94325BGABU 0x0491
+#define SSB_BOARD_BCM94325SDGWB 0x0492
+#define SSB_BOARD_BCM94325SDGMDL        0x04AA
+#define SSB_BOARD_BCM94325SDGMDL2       0x04C6
+#define SSB_BOARD_BCM94325SDGMDL3       0x04C9
+#define SSB_BOARD_BCM94325SDABGWBA      0x04E1
+/* 4322 boards */
+#define SSB_BOARD_BCM94322MC    0x04A4
+#define SSB_BOARD_BCM94322USB   0x04A8  /* dualband */
+#define SSB_BOARD_BCM94322HM    0x04B0
+#define SSB_BOARD_BCM94322USB2D 0x04Bf  /* single band discrete front end */
+/* 4312 boards */
+#define SSB_BOARD_BU4312        0x048A
+#define SSB_BOARD_BCM4312MCGSG  0x04B5
 /* chip_package */
 #define SSB_CHIPPACK_BCM4712S   1       /* Small 200pin 4712 */
 #define SSB_CHIPPACK_BCM4712M   2       /* Medium 225pin 4712 */
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index 6ecfa02ddbac..3a7256955b10 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -289,11 +289,11 @@
 #define  SSB_SPROM4_ETHPHY_ET1A_SHIFT   5
 #define  SSB_SPROM4_ETHPHY_ET0M         (1<<14) /* MDIO for enet0 */
 #define  SSB_SPROM4_ETHPHY_ET1M         (1<<15) /* MDIO for enet1 */
-#define SSB_SPROM4_ANTAVAIL             0x005D  /* Antenna available bitfields */
-#define  SSB_SPROM4_ANTAVAIL_A          0x00FF  /* A-PHY bitfield */
-#define  SSB_SPROM4_ANTAVAIL_A_SHIFT    0
-#define  SSB_SPROM4_ANTAVAIL_BG         0xFF00  /* B-PHY and G-PHY bitfield */
-#define  SSB_SPROM4_ANTAVAIL_BG_SHIFT   8
+#define SSB_SPROM4_ANTAVAIL             0x005C  /* Antenna available bitfields */
+#define  SSB_SPROM4_ANTAVAIL_BG         0x00FF  /* B-PHY and G-PHY bitfield */
+#define  SSB_SPROM4_ANTAVAIL_BG_SHIFT   0
+#define  SSB_SPROM4_ANTAVAIL_A          0xFF00  /* A-PHY bitfield */
+#define  SSB_SPROM4_ANTAVAIL_A_SHIFT    8
 #define SSB_SPROM4_AGAIN01              0x005E  /* Antenna Gain (in dBm Q5.2) */
 #define  SSB_SPROM4_AGAIN0              0x00FF  /* Antenna 0 */
 #define  SSB_SPROM4_AGAIN0_SHIFT        0
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 9531beee09b5..ed6e9552252e 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -232,7 +232,7 @@ struct bt_sock_list {
 };
 
 int  bt_sock_register(int proto, const struct net_proto_family *ops);
-int  bt_sock_unregister(int proto);
+void bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
 int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
@@ -260,12 +260,22 @@ struct l2cap_ctrl {
         __u8            retries;
 };
 
+struct hci_dev;
+
+typedef void (*hci_req_complete_t)(struct hci_dev *hdev, u8 status);
+
+struct hci_req_ctrl {
+        bool                    start;
+        hci_req_complete_t      complete;
+};
+
 struct bt_skb_cb {
         __u8 pkt_type;
         __u8 incoming;
         __u16 expect;
         __u8 force_active;
         struct l2cap_ctrl control;
+        struct hci_req_ctrl req;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 7f12c25f1fca..b3308927a0a1 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -119,10 +119,16 @@ enum {
         HCI_CONNECTABLE,
         HCI_DISCOVERABLE,
         HCI_LINK_SECURITY,
-        HCI_PENDING_CLASS,
         HCI_PERIODIC_INQ,
+        HCI_FAST_CONNECTABLE,
 };
 
+/* A mask for the flags that are supposed to remain when a reset happens
+ * or the HCI device is closed.
+ */
+#define HCI_PERSISTENT_MASK (BIT(HCI_LE_SCAN) | BIT(HCI_PERIODIC_INQ) | \
+                              BIT(HCI_FAST_CONNECTABLE))
+
 /* HCI ioctl defines */
 #define HCIDEVUP        _IOW('H', 201, int)
 #define HCIDEVDOWN      _IOW('H', 202, int)
@@ -881,12 +887,25 @@ struct hci_rp_read_data_block_size {
         __le16   num_blocks;
 } __packed;
 
+#define HCI_OP_READ_PAGE_SCAN_ACTIVITY  0x0c1b
+struct hci_rp_read_page_scan_activity {
+        __u8     status;
+        __le16   interval;
+        __le16   window;
+} __packed;
+
 #define HCI_OP_WRITE_PAGE_SCAN_ACTIVITY 0x0c1c
 struct hci_cp_write_page_scan_activity {
         __le16   interval;
         __le16   window;
 } __packed;
 
+#define HCI_OP_READ_PAGE_SCAN_TYPE      0x0c46
+struct hci_rp_read_page_scan_type {
+        __u8     status;
+        __u8     type;
+} __packed;
+
 #define HCI_OP_WRITE_PAGE_SCAN_TYPE     0x0c47
         #define PAGE_SCAN_TYPE_STANDARD         0x00
         #define PAGE_SCAN_TYPE_INTERLACED       0x01
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 90cf75afcb02..358a6983d3bb 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -165,6 +165,10 @@ struct hci_dev {
         __u16           voice_setting;
         __u8            io_capability;
         __s8            inq_tx_power;
+        __u16           page_scan_interval;
+        __u16           page_scan_window;
+        __u8            page_scan_type;
+
         __u16           devid_source;
         __u16           devid_vendor;
         __u16           devid_product;
@@ -248,8 +252,6 @@ struct hci_dev {
         __u32                   req_status;
         __u32                   req_result;
 
-        __u16                   init_last_cmd;
-
         struct list_head        mgmt_pending;
 
         struct discovery_state  discovery;
@@ -574,7 +576,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_state(struct hci_dev *hdev,
         return NULL;
 }
 
-void hci_acl_disconn(struct hci_conn *conn, __u8 reason);
+void hci_disconnect(struct hci_conn *conn, __u8 reason);
 void hci_setup_sync(struct hci_conn *conn, __u16 handle);
 void hci_sco_setup(struct hci_conn *conn, __u8 status);
 
@@ -742,8 +744,6 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                                                                 u8 *randomizer);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
-int hci_update_ad(struct hci_dev *hdev);
-
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 
 int hci_recv_frame(struct sk_buff *skb);
@@ -1041,6 +1041,22 @@ static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
 int hci_register_cb(struct hci_cb *hcb);
 int hci_unregister_cb(struct hci_cb *hcb);
 
+struct hci_request {
+        struct hci_dev          *hdev;
+        struct sk_buff_head     cmd_q;
+
+        /* If something goes wrong when building the HCI request, the error
+         * value is stored in this field.
+         */
+        int                     err;
+};
+
+void hci_req_init(struct hci_request *req, struct hci_dev *hdev);
+int hci_req_run(struct hci_request *req, hci_req_complete_t complete);
+void hci_req_add(struct hci_request *req, u16 opcode, u32 plen, void *param);
+void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status);
+void hci_req_cmd_status(struct hci_dev *hdev, u16 opcode, u8 status);
+
 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param);
 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags);
 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb);
@@ -1153,7 +1169,7 @@ struct hci_sec_filter {
 #define hci_req_lock(d)         mutex_lock(&d->req_lock)
 #define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
 
-void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result);
+void hci_update_ad(struct hci_request *req);
 
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index e2e3ecad1008..7afd4199d6b6 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -158,7 +158,6 @@ struct rfcomm_session {
         struct timer_list timer;
         unsigned long    state;
         unsigned long    flags;
-        atomic_t         refcnt;
         int              initiator;
 
         /* Default DLC parameters */
@@ -276,11 +275,6 @@ static inline void rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 void   rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src,
                                                                 bdaddr_t *dst);
 
-static inline void rfcomm_session_hold(struct rfcomm_session *s)
-{
-        atomic_inc(&s->refcnt);
-}
-
 /* ---- RFCOMM sockets ---- */
 struct sockaddr_rc {
         sa_family_t     rc_family;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 23f2e98d4b65..cf0694d4ad60 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1045,6 +1045,10 @@ static inline bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
         if (sysctl_tcp_low_latency || !tp->ucopy.task)
                 return false;
 
+        if (skb->len <= tcp_hdrlen(skb) &&
+            skb_queue_len(&tp->ucopy.prequeue) == 0)
+                return false;
+
         __skb_queue_tail(&tp->ucopy.prequeue, skb);
         tp->ucopy.memory += skb->truesize;
         if (tp->ucopy.memory > sk->sk_rcvbuf) {
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 7969f46f1bb3..7440bc81a04b 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -90,6 +90,8 @@ enum nfc_commands {
         NFC_CMD_LLC_SET_PARAMS,
         NFC_CMD_ENABLE_SE,
         NFC_CMD_DISABLE_SE,
+        NFC_CMD_LLC_SDREQ,
+        NFC_EVENT_LLC_SDRES,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -140,11 +142,21 @@ enum nfc_attrs {
         NFC_ATTR_LLC_PARAM_RW,
         NFC_ATTR_LLC_PARAM_MIUX,
         NFC_ATTR_SE,
+        NFC_ATTR_LLC_SDP,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
 #define NFC_ATTR_MAX (__NFC_ATTR_AFTER_LAST - 1)
 
+enum nfc_sdp_attr {
+        NFC_SDP_ATTR_UNSPEC,
+        NFC_SDP_ATTR_URI,
+        NFC_SDP_ATTR_SAP,
+/* private: internal use only */
+        __NFC_SDP_ATTR_AFTER_LAST
+};
+#define NFC_SDP_ATTR_MAX (__NFC_SDP_ATTR_AFTER_LAST - 1)
+
 #define NFC_DEVICE_NAME_MAXSIZE 8
 #define NFC_NFCID1_MAXSIZE 10
 #define NFC_SENSB_RES_MAXSIZE 12
@@ -220,4 +232,8 @@ struct sockaddr_nfc_llcp {
 #define NFC_LLCP_DIRECTION_RX           0x00
 #define NFC_LLCP_DIRECTION_TX           0x01
 
+/* socket option names */
+#define NFC_LLCP_RW   0
+#define NFC_LLCP_MIUX 1
+
 #endif /*__LINUX_NFC_H */
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index b9bde5727829..25d3d8b6e4e1 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -209,6 +209,8 @@ static void smpboot_unpark_thread(struct smp_hotplug_thread *ht, unsigned int cp
 {
         struct task_struct *tsk = *per_cpu_ptr(ht->store, cpu);
 
+        if (ht->pre_unpark)
+                ht->pre_unpark(cpu);
         kthread_unpark(tsk);
 }
 
diff --git a/kernel/softirq.c b/kernel/softirq.c
index b4d252fd195b..14d7758074aa 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -323,18 +323,10 @@ void irq_enter(void)
 
 static inline void invoke_softirq(void)
 {
-        if (!force_irqthreads) {
-#ifdef __ARCH_IRQ_EXIT_IRQS_DISABLED
+        if (!force_irqthreads)
                 __do_softirq();
-#else
-                do_softirq();
-#endif
-        } else {
-                __local_bh_disable((unsigned long)__builtin_return_address(0),
-                                SOFTIRQ_OFFSET);
+        else
                 wakeup_softirqd();
-                __local_bh_enable(SOFTIRQ_OFFSET);
-        }
 }
 
 /*
@@ -342,9 +334,15 @@ static inline void invoke_softirq(void)
  */
 void irq_exit(void)
 {
+#ifndef __ARCH_IRQ_EXIT_IRQS_DISABLED
+        local_irq_disable();
+#else
+        WARN_ON_ONCE(!irqs_disabled());
+#endif
+
         account_irq_exit_time(current);
         trace_hardirq_exit();
-        sub_preempt_count(IRQ_EXIT_OFFSET);
+        sub_preempt_count(HARDIRQ_OFFSET);
         if (!in_interrupt() && local_softirq_pending())
                 invoke_softirq();
 
@@ -354,7 +352,6 @@ void irq_exit(void)
                 tick_nohz_irq_exit();
 #endif
         rcu_irq_exit();
-        sched_preempt_enable_no_resched();
 }
 
 /*
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 95d178c62d5a..c09f2955ae30 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -336,7 +336,7 @@ static struct smp_hotplug_thread cpu_stop_threads = {
         .create                 = cpu_stop_create,
         .setup                  = cpu_stop_unpark,
         .park                   = cpu_stop_park,
-        .unpark                 = cpu_stop_unpark,
+        .pre_unpark             = cpu_stop_unpark,
         .selfparking            = true,
 };
 
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index eb0f4b16ff09..17f33a62f6db 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -397,13 +397,12 @@ static int a2mp_getampassoc_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
         if (ctrl) {
                 u8 *assoc;
 
-                assoc = kzalloc(assoc_len, GFP_KERNEL);
+                assoc = kmemdup(rsp->amp_assoc, assoc_len, GFP_KERNEL);
                 if (!assoc) {
                         amp_ctrl_put(ctrl);
                         return -ENOMEM;
                 }
 
-                memcpy(assoc, rsp->amp_assoc, assoc_len);
                 ctrl->assoc = assoc;
                 ctrl->assoc_len = assoc_len;
                 ctrl->assoc_rem_len = assoc_len;
@@ -472,13 +471,12 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
                 size_t assoc_len = le16_to_cpu(hdr->len) - sizeof(*req);
                 u8 *assoc;
 
-                assoc = kzalloc(assoc_len, GFP_KERNEL);
+                assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL);
                 if (!assoc) {
                         amp_ctrl_put(ctrl);
                         return -ENOMEM;
                 }
 
-                memcpy(assoc, req->amp_assoc, assoc_len);
                 ctrl->assoc = assoc;
                 ctrl->assoc_len = assoc_len;
                 ctrl->assoc_rem_len = assoc_len;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index d3ee69b35a78..81598e588f7f 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -92,23 +92,14 @@ int bt_sock_register(int proto, const struct net_proto_family *ops)
 }
 EXPORT_SYMBOL(bt_sock_register);
 
-int bt_sock_unregister(int proto)
+void bt_sock_unregister(int proto)
 {
-        int err = 0;
-
         if (proto < 0 || proto >= BT_MAX_PROTO)
-                return -EINVAL;
+                return;
 
         write_lock(&bt_proto_lock);
-
-        if (!bt_proto[proto])
-                err = -ENOENT;
-        else
-                bt_proto[proto] = NULL;
-
+        bt_proto[proto] = NULL;
         write_unlock(&bt_proto_lock);
-
-        return err;
 }
 EXPORT_SYMBOL(bt_sock_unregister);
 
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index e7154a58465f..5b1c04e28821 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -253,8 +253,6 @@ error:
 void __exit bnep_sock_cleanup(void)
 {
         bt_procfs_cleanup(&init_net, "bnep");
-        if (bt_sock_unregister(BTPROTO_BNEP) < 0)
-                BT_ERR("Can't unregister BNEP socket");
-
+        bt_sock_unregister(BTPROTO_BNEP);
         proto_unregister(&bnep_proto);
 }
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 1c57482112b6..58d9edebab4b 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -264,8 +264,6 @@ error:
 void cmtp_cleanup_sockets(void)
 {
         bt_procfs_cleanup(&init_net, "cmtp");
-        if (bt_sock_unregister(BTPROTO_CMTP) < 0)
-                BT_ERR("Can't unregister CMTP socket");
-
+        bt_sock_unregister(BTPROTO_CMTP);
         proto_unregister(&cmtp_proto);
 }
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 4925a02ae7e4..b9f90169940b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -117,7 +117,7 @@ static void hci_acl_create_connection_cancel(struct hci_conn *conn)
         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 }
 
-void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
+void hci_disconnect(struct hci_conn *conn, __u8 reason)
 {
         struct hci_cp_disconnect cp;
 
@@ -253,7 +253,7 @@ static void hci_conn_disconnect(struct hci_conn *conn)
                 hci_amp_disconn(conn, reason);
                 break;
         default:
-                hci_acl_disconn(conn, reason);
+                hci_disconnect(conn, reason);
                 break;
         }
 }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 60793e7b768b..cfcad5423f1c 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -57,36 +57,9 @@ static void hci_notify(struct hci_dev *hdev, int event)
 
 /* ---- HCI requests ---- */
 
-void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
+static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
 {
-        BT_DBG("%s command 0x%4.4x result 0x%2.2x", hdev->name, cmd, result);
-
-        /* If this is the init phase check if the completed command matches
-         * the last init command, and if not just return.
-         */
-        if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd) {
-                struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
-                u16 opcode = __le16_to_cpu(sent->opcode);
-                struct sk_buff *skb;
-
-                /* Some CSR based controllers generate a spontaneous
-                 * reset complete event during init and any pending
-                 * command will never be completed. In such a case we
-                 * need to resend whatever was the last sent
-                 * command.
-                 */
-
-                if (cmd != HCI_OP_RESET || opcode == HCI_OP_RESET)
-                        return;
-
-                skb = skb_clone(hdev->sent_cmd, GFP_ATOMIC);
-                if (skb) {
-                        skb_queue_head(&hdev->cmd_q, skb);
-                        queue_work(hdev->workqueue, &hdev->cmd_work);
-                }
-
-                return;
-        }
+        BT_DBG("%s result 0x%2.2x", hdev->name, result);
 
         if (hdev->req_status == HCI_REQ_PEND) {
                 hdev->req_result = result;
@@ -107,21 +80,41 @@ static void hci_req_cancel(struct hci_dev *hdev, int err)
 }
 
 /* Execute request and wait for completion. */
-static int __hci_request(struct hci_dev *hdev,
-                         void (*req)(struct hci_dev *hdev, unsigned long opt),
-                         unsigned long opt, __u32 timeout)
+static int __hci_req_sync(struct hci_dev *hdev,
+                          void (*func)(struct hci_request *req,
+                                      unsigned long opt),
+                          unsigned long opt, __u32 timeout)
 {
+        struct hci_request req;
         DECLARE_WAITQUEUE(wait, current);
         int err = 0;
 
         BT_DBG("%s start", hdev->name);
 
+        hci_req_init(&req, hdev);
+
         hdev->req_status = HCI_REQ_PEND;
 
+        func(&req, opt);
+
+        err = hci_req_run(&req, hci_req_sync_complete);
+        if (err < 0) {
+                hdev->req_status = 0;
+
+                /* ENODATA means the HCI request command queue is empty.
+                 * This can happen when a request with conditionals doesn't
+                 * trigger any commands to be sent. This is normal behavior
+                 * and should not trigger an error return.
+                 */
+                if (err == -ENODATA)
+                        return 0;
+
+                return err;
+        }
+
         add_wait_queue(&hdev->req_wait_q, &wait);
         set_current_state(TASK_INTERRUPTIBLE);
 
-        req(hdev, opt);
         schedule_timeout(timeout);
 
         remove_wait_queue(&hdev->req_wait_q, &wait);
@@ -150,9 +143,10 @@ static int __hci_request(struct hci_dev *hdev,
         return err;
 }
 
-static int hci_request(struct hci_dev *hdev,
-                       void (*req)(struct hci_dev *hdev, unsigned long opt),
-                       unsigned long opt, __u32 timeout)
+static int hci_req_sync(struct hci_dev *hdev,
+                        void (*req)(struct hci_request *req,
+                                    unsigned long opt),
+                        unsigned long opt, __u32 timeout)
 {
         int ret;
 
@@ -161,75 +155,86 @@ static int hci_request(struct hci_dev *hdev,
 
         /* Serialize all requests */
         hci_req_lock(hdev);
-        ret = __hci_request(hdev, req, opt, timeout);
+        ret = __hci_req_sync(hdev, req, opt, timeout);
         hci_req_unlock(hdev);
 
         return ret;
 }
 
-static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
+static void hci_reset_req(struct hci_request *req, unsigned long opt)
 {
-        BT_DBG("%s %ld", hdev->name, opt);
+        BT_DBG("%s %ld", req->hdev->name, opt);
 
         /* Reset device */
-        set_bit(HCI_RESET, &hdev->flags);
-        hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
+        set_bit(HCI_RESET, &req->hdev->flags);
+        hci_req_add(req, HCI_OP_RESET, 0, NULL);
 }
 
-static void bredr_init(struct hci_dev *hdev)
+static void bredr_init(struct hci_request *req)
 {
-        hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
+        req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 
         /* Read Local Supported Features */
-        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
+        hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 
         /* Read Local Version */
-        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
+        hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
+
+        /* Read BD Address */
+        hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 }
 
-static void amp_init(struct hci_dev *hdev)
+static void amp_init(struct hci_request *req)
 {
-        hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
+        req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 
         /* Read Local Version */
-        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
+        hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 
         /* Read Local AMP Info */
-        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
+        hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 
         /* Read Data Blk size */
-        hci_send_cmd(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
+        hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
 }
 
-static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
+static void hci_init1_req(struct hci_request *req, unsigned long opt)
 {
+        struct hci_dev *hdev = req->hdev;
+        struct hci_request init_req;
         struct sk_buff *skb;
 
         BT_DBG("%s %ld", hdev->name, opt);
 
         /* Driver initialization */
 
+        hci_req_init(&init_req, hdev);
+
         /* Special commands */
         while ((skb = skb_dequeue(&hdev->driver_init))) {
                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
                 skb->dev = (void *) hdev;
 
-                skb_queue_tail(&hdev->cmd_q, skb);
-                queue_work(hdev->workqueue, &hdev->cmd_work);
+                if (skb_queue_empty(&init_req.cmd_q))
+                        bt_cb(skb)->req.start = true;
+
+                skb_queue_tail(&init_req.cmd_q, skb);
         }
         skb_queue_purge(&hdev->driver_init);
 
+        hci_req_run(&init_req, NULL);
+
         /* Reset */
         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
-                hci_reset_req(hdev, 0);
+                hci_reset_req(req, 0);
 
         switch (hdev->dev_type) {
         case HCI_BREDR:
-                bredr_init(hdev);
+                bredr_init(req);
                 break;
 
         case HCI_AMP:
-                amp_init(hdev);
+                amp_init(req);
                 break;
 
         default:
@@ -238,44 +243,327 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
         }
 }
 
-static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
+static void bredr_setup(struct hci_request *req)
+{
+        struct hci_cp_delete_stored_link_key cp;
+        __le16 param;
+        __u8 flt_type;
+
+        /* Read Buffer Size (ACL mtu, max pkt, etc.) */
+        hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
+
+        /* Read Class of Device */
+        hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
+
+        /* Read Local Name */
+        hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
+
+        /* Read Voice Setting */
+        hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
+
+        /* Clear Event Filters */
+        flt_type = HCI_FLT_CLEAR_ALL;
+        hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
+
+        /* Connection accept timeout ~20 secs */
+        param = __constant_cpu_to_le16(0x7d00);
+        hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
+
+        bacpy(&cp.bdaddr, BDADDR_ANY);
+        cp.delete_all = 0x01;
+        hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
+
+        /* Read page scan parameters */
+        if (req->hdev->hci_ver > BLUETOOTH_VER_1_1) {
+                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
+                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
+        }
+}
+
+static void le_setup(struct hci_request *req)
+{
+        /* Read LE Buffer Size */
+        hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
+
+        /* Read LE Local Supported Features */
+        hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
+
+        /* Read LE Advertising Channel TX Power */
+        hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
+
+        /* Read LE White List Size */
+        hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
+
+        /* Read LE Supported States */
+        hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
+}
+
+static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
+{
+        if (lmp_ext_inq_capable(hdev))
+                return 0x02;
+
+        if (lmp_inq_rssi_capable(hdev))
+                return 0x01;
+
+        if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
+            hdev->lmp_subver == 0x0757)
+                return 0x01;
+
+        if (hdev->manufacturer == 15) {
+                if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
+                        return 0x01;
+                if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
+                        return 0x01;
+                if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
+                        return 0x01;
+        }
+
+        if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
+            hdev->lmp_subver == 0x1805)
+                return 0x01;
+
+        return 0x00;
+}
+
+static void hci_setup_inquiry_mode(struct hci_request *req)
+{
+        u8 mode;
+
+        mode = hci_get_inquiry_mode(req->hdev);
+
+        hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
+}
+
+static void hci_setup_event_mask(struct hci_request *req)
+{
+        struct hci_dev *hdev = req->hdev;
+
+        /* The second byte is 0xff instead of 0x9f (two reserved bits
+         * disabled) since a Broadcom 1.2 dongle doesn't respond to the
+         * command otherwise.
+         */
+        u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
+
+        /* CSR 1.1 dongles does not accept any bitfield so don't try to set
+         * any event mask for pre 1.2 devices.
+         */
+        if (hdev->hci_ver < BLUETOOTH_VER_1_2)
+                return;
+
+        if (lmp_bredr_capable(hdev)) {
+                events[4] |= 0x01; /* Flow Specification Complete */
+                events[4] |= 0x02; /* Inquiry Result with RSSI */
+                events[4] |= 0x04; /* Read Remote Extended Features Complete */
+                events[5] |= 0x08; /* Synchronous Connection Complete */
+                events[5] |= 0x10; /* Synchronous Connection Changed */
+        }
+
+        if (lmp_inq_rssi_capable(hdev))
+                events[4] |= 0x02; /* Inquiry Result with RSSI */
+
+        if (lmp_sniffsubr_capable(hdev))
+                events[5] |= 0x20; /* Sniff Subrating */
+
+        if (lmp_pause_enc_capable(hdev))
+                events[5] |= 0x80; /* Encryption Key Refresh Complete */
+
+        if (lmp_ext_inq_capable(hdev))
+                events[5] |= 0x40; /* Extended Inquiry Result */
+
+        if (lmp_no_flush_capable(hdev))
+                events[7] |= 0x01; /* Enhanced Flush Complete */
+
+        if (lmp_lsto_capable(hdev))
+                events[6] |= 0x80; /* Link Supervision Timeout Changed */
+
+        if (lmp_ssp_capable(hdev)) {
+                events[6] |= 0x01;      /* IO Capability Request */
+                events[6] |= 0x02;      /* IO Capability Response */
+                events[6] |= 0x04;      /* User Confirmation Request */
+                events[6] |= 0x08;      /* User Passkey Request */
+                events[6] |= 0x10;      /* Remote OOB Data Request */
+                events[6] |= 0x20;      /* Simple Pairing Complete */
+                events[7] |= 0x04;      /* User Passkey Notification */
+                events[7] |= 0x08;      /* Keypress Notification */
+                events[7] |= 0x10;      /* Remote Host Supported
+                                         * Features Notification
+                                         */
+        }
+
+        if (lmp_le_capable(hdev))
+                events[7] |= 0x20;      /* LE Meta-Event */
+
+        hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
+
+        if (lmp_le_capable(hdev)) {
+                memset(events, 0, sizeof(events));
+                events[0] = 0x1f;
+                hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK,
+                            sizeof(events), events);
+        }
+}
+
+static void hci_init2_req(struct hci_request *req, unsigned long opt)
+{
+        struct hci_dev *hdev = req->hdev;
+
+        if (lmp_bredr_capable(hdev))
+                bredr_setup(req);
+
+        if (lmp_le_capable(hdev))
+                le_setup(req);
+
+        hci_setup_event_mask(req);
+
+        if (hdev->hci_ver > BLUETOOTH_VER_1_1)
+                hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
+
+        if (lmp_ssp_capable(hdev)) {
+                if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
+                        u8 mode = 0x01;
+                        hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
+                                    sizeof(mode), &mode);
+                } else {
+                        struct hci_cp_write_eir cp;
+
+                        memset(hdev->eir, 0, sizeof(hdev->eir));
+                        memset(&cp, 0, sizeof(cp));
+
+                        hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+                }
+        }
+
+        if (lmp_inq_rssi_capable(hdev))
+                hci_setup_inquiry_mode(req);
+
+        if (lmp_inq_tx_pwr_capable(hdev))
+                hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
+
+        if (lmp_ext_feat_capable(hdev)) {
+                struct hci_cp_read_local_ext_features cp;
+
+                cp.page = 0x01;
+                hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
+                            sizeof(cp), &cp);
+        }
+
+        if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
+                u8 enable = 1;
+                hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
+                            &enable);
+        }
+}
+
+static void hci_setup_link_policy(struct hci_request *req)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct hci_cp_write_def_link_policy cp;
+        u16 link_policy = 0;
+
+        if (lmp_rswitch_capable(hdev))
+                link_policy |= HCI_LP_RSWITCH;
+        if (lmp_hold_capable(hdev))
+                link_policy |= HCI_LP_HOLD;
+        if (lmp_sniff_capable(hdev))
+                link_policy |= HCI_LP_SNIFF;
+        if (lmp_park_capable(hdev))
+                link_policy |= HCI_LP_PARK;
+
+        cp.policy = cpu_to_le16(link_policy);
+        hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
+}
+
+static void hci_set_le_support(struct hci_request *req)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct hci_cp_write_le_host_supported cp;
+
+        memset(&cp, 0, sizeof(cp));
+
+        if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+                cp.le = 0x01;
+                cp.simul = lmp_le_br_capable(hdev);
+        }
+
+        if (cp.le != lmp_host_le_capable(hdev))
+                hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
+                            &cp);
+}
+
+static void hci_init3_req(struct hci_request *req, unsigned long opt)
+{
+        struct hci_dev *hdev = req->hdev;
+
+        if (hdev->commands[5] & 0x10)
+                hci_setup_link_policy(req);
+
+        if (lmp_le_capable(hdev)) {
+                hci_set_le_support(req);
+                hci_update_ad(req);
+        }
+}
+
+static int __hci_init(struct hci_dev *hdev)
+{
+        int err;
+
+        err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
+        if (err < 0)
+                return err;
+
+        /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
+         * BR/EDR/LE type controllers. AMP controllers only need the
+         * first stage init.
+         */
+        if (hdev->dev_type != HCI_BREDR)
+                return 0;
+
+        err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
+        if (err < 0)
+                return err;
+
+        return __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
+}
+
+static void hci_scan_req(struct hci_request *req, unsigned long opt)
 {
         __u8 scan = opt;
 
-        BT_DBG("%s %x", hdev->name, scan);
+        BT_DBG("%s %x", req->hdev->name, scan);
 
         /* Inquiry and Page scans */
-        hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+        hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 }
 
-static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
+static void hci_auth_req(struct hci_request *req, unsigned long opt)
 {
         __u8 auth = opt;
 
-        BT_DBG("%s %x", hdev->name, auth);
+        BT_DBG("%s %x", req->hdev->name, auth);
 
         /* Authentication */
-        hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
+        hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 }
 
-static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
+static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
 {
         __u8 encrypt = opt;
 
-        BT_DBG("%s %x", hdev->name, encrypt);
+        BT_DBG("%s %x", req->hdev->name, encrypt);
 
         /* Encryption */
-        hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
+        hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 }
 
-static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
+static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
 {
         __le16 policy = cpu_to_le16(opt);
 
-        BT_DBG("%s %x", hdev->name, policy);
+        BT_DBG("%s %x", req->hdev->name, policy);
 
         /* Default link policy */
-        hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
+        hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 }
 
 /* Get HCI device by index.
@@ -512,9 +800,10 @@ static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
         return copied;
 }
 
-static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
+static void hci_inq_req(struct hci_request *req, unsigned long opt)
 {
         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
+        struct hci_dev *hdev = req->hdev;
         struct hci_cp_inquiry cp;
 
         BT_DBG("%s", hdev->name);
@@ -526,7 +815,7 @@ static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
         memcpy(&cp.lap, &ir->lap, 3);
         cp.length  = ir->length;
         cp.num_rsp = ir->num_rsp;
-        hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
+        hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
 }
 
 int hci_inquiry(void __user *arg)
@@ -556,7 +845,8 @@ int hci_inquiry(void __user *arg)
         timeo = ir.length * msecs_to_jiffies(2000);
 
         if (do_inquiry) {
-                err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
+                err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
+                                   timeo);
                 if (err < 0)
                         goto done;
         }
@@ -654,39 +944,29 @@ static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
         return ad_len;
 }
 
-int hci_update_ad(struct hci_dev *hdev)
+void hci_update_ad(struct hci_request *req)
 {
+        struct hci_dev *hdev = req->hdev;
         struct hci_cp_le_set_adv_data cp;
         u8 len;
-        int err;
 
-        hci_dev_lock(hdev);
-
-        if (!lmp_le_capable(hdev)) {
-                err = -EINVAL;
-                goto unlock;
-        }
+        if (!lmp_le_capable(hdev))
+                return;
 
         memset(&cp, 0, sizeof(cp));
 
         len = create_ad(hdev, cp.data);
 
         if (hdev->adv_data_len == len &&
-            memcmp(cp.data, hdev->adv_data, len) == 0) {
-                err = 0;
-                goto unlock;
-        }
+            memcmp(cp.data, hdev->adv_data, len) == 0)
+                return;
 
         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
         hdev->adv_data_len = len;
 
         cp.length = len;
-        err = hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 
-unlock:
-        hci_dev_unlock(hdev);
-
-        return err;
+        hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 }
 
 /* ---- HCI ioctl helpers ---- */
@@ -735,10 +1015,7 @@ int hci_dev_open(__u16 dev)
         if (!test_bit(HCI_RAW, &hdev->flags)) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 set_bit(HCI_INIT, &hdev->flags);
-                hdev->init_last_cmd = 0;
-
-                ret = __hci_request(hdev, hci_init_req, 0, HCI_INIT_TIMEOUT);
-
+                ret = __hci_init(hdev);
                 clear_bit(HCI_INIT, &hdev->flags);
         }
 
@@ -746,7 +1023,6 @@ int hci_dev_open(__u16 dev)
                 hci_dev_hold(hdev);
                 set_bit(HCI_UP, &hdev->flags);
                 hci_notify(hdev, HCI_DEV_UP);
-                hci_update_ad(hdev);
                 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
                     mgmt_valid_hdev(hdev)) {
                         hci_dev_lock(hdev);
@@ -828,7 +1104,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         if (!test_bit(HCI_RAW, &hdev->flags) &&
             test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
                 set_bit(HCI_INIT, &hdev->flags);
-                __hci_request(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
+                __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
                 clear_bit(HCI_INIT, &hdev->flags);
         }
 
@@ -851,6 +1127,10 @@ static int hci_dev_do_close(struct hci_dev *hdev)
          * and no tasks are scheduled. */
         hdev->close(hdev);
 
+        /* Clear flags */
+        hdev->flags = 0;
+        hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
+
         if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
             mgmt_valid_hdev(hdev)) {
                 hci_dev_lock(hdev);
@@ -858,9 +1138,6 @@ static int hci_dev_do_close(struct hci_dev *hdev)
                 hci_dev_unlock(hdev);
         }
 
-        /* Clear flags */
-        hdev->flags = 0;
-
         /* Controller radio is available but is currently powered down */
         hdev->amp_status = 0;
 
@@ -921,7 +1198,7 @@ int hci_dev_reset(__u16 dev)
         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
 
         if (!test_bit(HCI_RAW, &hdev->flags))
-                ret = __hci_request(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
+                ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
 
 done:
         hci_req_unlock(hdev);
@@ -960,8 +1237,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
 
         switch (cmd) {
         case HCISETAUTH:
-                err = hci_request(hdev, hci_auth_req, dr.dev_opt,
-                                  HCI_INIT_TIMEOUT);
+                err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
+                                   HCI_INIT_TIMEOUT);
                 break;
 
         case HCISETENCRYPT:
@@ -972,24 +1249,24 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
 
                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
                         /* Auth must be enabled first */
-                        err = hci_request(hdev, hci_auth_req, dr.dev_opt,
-                                          HCI_INIT_TIMEOUT);
+                        err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
+                                           HCI_INIT_TIMEOUT);
                         if (err)
                                 break;
                 }
 
-                err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
-                                  HCI_INIT_TIMEOUT);
+                err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
+                                   HCI_INIT_TIMEOUT);
                 break;
 
         case HCISETSCAN:
-                err = hci_request(hdev, hci_scan_req, dr.dev_opt,
-                                  HCI_INIT_TIMEOUT);
+                err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
+                                   HCI_INIT_TIMEOUT);
                 break;
 
         case HCISETLINKPOL:
-                err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
-                                  HCI_INIT_TIMEOUT);
+                err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
+                                   HCI_INIT_TIMEOUT);
                 break;
 
         case HCISETLINKMODE:
@@ -1566,7 +1843,7 @@ int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
         return mgmt_device_unblocked(hdev, bdaddr, type);
 }
 
-static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
+static void le_scan_param_req(struct hci_request *req, unsigned long opt)
 {
         struct le_scan_params *param =  (struct le_scan_params *) opt;
         struct hci_cp_le_set_scan_param cp;
@@ -1576,10 +1853,10 @@ static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
         cp.interval = cpu_to_le16(param->interval);
         cp.window = cpu_to_le16(param->window);
 
-        hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
+        hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
 }
 
-static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
+static void le_scan_enable_req(struct hci_request *req, unsigned long opt)
 {
         struct hci_cp_le_set_scan_enable cp;
 
@@ -1587,7 +1864,7 @@ static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
         cp.enable = 1;
         cp.filter_dup = 1;
 
-        hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
+        hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
 }
 
 static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
@@ -1608,10 +1885,10 @@ static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
 
         hci_req_lock(hdev);
 
-        err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
-                            timeo);
+        err = __hci_req_sync(hdev, le_scan_param_req, (unsigned long) &param,
+                             timeo);
         if (!err)
-                err = __hci_request(hdev, le_scan_enable_req, 0, timeo);
+                err = __hci_req_sync(hdev, le_scan_enable_req, 0, timeo);
 
         hci_req_unlock(hdev);
 
@@ -2160,20 +2437,55 @@ static int hci_send_frame(struct sk_buff *skb)
         return hdev->send(skb);
 }
 
-/* Send HCI command */
-int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
+void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
+{
+        skb_queue_head_init(&req->cmd_q);
+        req->hdev = hdev;
+        req->err = 0;
+}
+
+int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct sk_buff *skb;
+        unsigned long flags;
+
+        BT_DBG("length %u", skb_queue_len(&req->cmd_q));
+
+        /* If an error occured during request building, remove all HCI
+         * commands queued on the HCI request queue.
+         */
+        if (req->err) {
+                skb_queue_purge(&req->cmd_q);
+                return req->err;
+        }
+
+        /* Do not allow empty requests */
+        if (skb_queue_empty(&req->cmd_q))
+                return -ENODATA;
+
+        skb = skb_peek_tail(&req->cmd_q);
+        bt_cb(skb)->req.complete = complete;
+
+        spin_lock_irqsave(&hdev->cmd_q.lock, flags);
+        skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
+        spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
+
+        queue_work(hdev->workqueue, &hdev->cmd_work);
+
+        return 0;
+}
+
+static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
+                                       u32 plen, void *param)
 {
         int len = HCI_COMMAND_HDR_SIZE + plen;
         struct hci_command_hdr *hdr;
         struct sk_buff *skb;
 
-        BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
-
         skb = bt_skb_alloc(len, GFP_ATOMIC);
-        if (!skb) {
-                BT_ERR("%s no memory for command", hdev->name);
-                return -ENOMEM;
-        }
+        if (!skb)
+                return NULL;
 
         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
         hdr->opcode = cpu_to_le16(opcode);
@@ -2187,8 +2499,26 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
         skb->dev = (void *) hdev;
 
-        if (test_bit(HCI_INIT, &hdev->flags))
-                hdev->init_last_cmd = opcode;
+        return skb;
+}
+
+/* Send HCI command */
+int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
+{
+        struct sk_buff *skb;
+
+        BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
+
+        skb = hci_prepare_cmd(hdev, opcode, plen, param);
+        if (!skb) {
+                BT_ERR("%s no memory for command", hdev->name);
+                return -ENOMEM;
+        }
+
+        /* Stand-alone HCI commands must be flaged as
+         * single-command requests.
+         */
+        bt_cb(skb)->req.start = true;
 
         skb_queue_tail(&hdev->cmd_q, skb);
         queue_work(hdev->workqueue, &hdev->cmd_work);
@@ -2196,6 +2526,34 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
         return 0;
 }
 
+/* Queue a command to an asynchronous HCI request */
+void hci_req_add(struct hci_request *req, u16 opcode, u32 plen, void *param)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct sk_buff *skb;
+
+        BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
+
+        /* If an error occured during request building, there is no point in
+         * queueing the HCI command. We can simply return.
+         */
+        if (req->err)
+                return;
+
+        skb = hci_prepare_cmd(hdev, opcode, plen, param);
+        if (!skb) {
+                BT_ERR("%s no memory for command (opcode 0x%4.4x)",
+                       hdev->name, opcode);
+                req->err = -ENOMEM;
+                return;
+        }
+
+        if (skb_queue_empty(&req->cmd_q))
+                bt_cb(skb)->req.start = true;
+
+        skb_queue_tail(&req->cmd_q, skb);
+}
+
 /* Get data from the previously sent command */
 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
 {
@@ -2398,7 +2756,7 @@ static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
                 if (c->type == type && c->sent) {
                         BT_ERR("%s killing stalled connection %pMR",
                                hdev->name, &c->dst);
-                        hci_acl_disconn(c, HCI_ERROR_REMOTE_USER_TERM);
+                        hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
                 }
         }
 
@@ -2860,6 +3218,123 @@ static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
         kfree_skb(skb);
 }
 
+static bool hci_req_is_complete(struct hci_dev *hdev)
+{
+        struct sk_buff *skb;
+
+        skb = skb_peek(&hdev->cmd_q);
+        if (!skb)
+                return true;
+
+        return bt_cb(skb)->req.start;
+}
+
+static void hci_resend_last(struct hci_dev *hdev)
+{
+        struct hci_command_hdr *sent;
+        struct sk_buff *skb;
+        u16 opcode;
+
+        if (!hdev->sent_cmd)
+                return;
+
+        sent = (void *) hdev->sent_cmd->data;
+        opcode = __le16_to_cpu(sent->opcode);
+        if (opcode == HCI_OP_RESET)
+                return;
+
+        skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
+        if (!skb)
+                return;
+
+        skb_queue_head(&hdev->cmd_q, skb);
+        queue_work(hdev->workqueue, &hdev->cmd_work);
+}
+
+void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
+{
+        hci_req_complete_t req_complete = NULL;
+        struct sk_buff *skb;
+        unsigned long flags;
+
+        BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
+
+        /* If the completed command doesn't match the last one that was
+         * sent we need to do special handling of it.
+         */
+        if (!hci_sent_cmd_data(hdev, opcode)) {
+                /* Some CSR based controllers generate a spontaneous
+                 * reset complete event during init and any pending
+                 * command will never be completed. In such a case we
+                 * need to resend whatever was the last sent
+                 * command.
+                 */
+                if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
+                        hci_resend_last(hdev);
+
+                return;
+        }
+
+        /* If the command succeeded and there's still more commands in
+         * this request the request is not yet complete.
+         */
+        if (!status && !hci_req_is_complete(hdev))
+                return;
+
+        /* If this was the last command in a request the complete
+         * callback would be found in hdev->sent_cmd instead of the
+         * command queue (hdev->cmd_q).
+         */
+        if (hdev->sent_cmd) {
+                req_complete = bt_cb(hdev->sent_cmd)->req.complete;
+                if (req_complete)
+                        goto call_complete;
+        }
+
+        /* Remove all pending commands belonging to this request */
+        spin_lock_irqsave(&hdev->cmd_q.lock, flags);
+        while ((skb = __skb_dequeue(&hdev->cmd_q))) {
+                if (bt_cb(skb)->req.start) {
+                        __skb_queue_head(&hdev->cmd_q, skb);
+                        break;
+                }
+
+                req_complete = bt_cb(skb)->req.complete;
+                kfree_skb(skb);
+        }
+        spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
+
+call_complete:
+        if (req_complete)
+                req_complete(hdev, status);
+}
+
+void hci_req_cmd_status(struct hci_dev *hdev, u16 opcode, u8 status)
+{
+        hci_req_complete_t req_complete = NULL;
+
+        BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
+
+        if (status) {
+                hci_req_cmd_complete(hdev, opcode, status);
+                return;
+        }
+
+        /* No need to handle success status if there are more commands */
+        if (!hci_req_is_complete(hdev))
+                return;
+
+        if (hdev->sent_cmd)
+                req_complete = bt_cb(hdev->sent_cmd)->req.complete;
+
+        /* If the request doesn't have a complete callback or there
+         * are other commands/requests in the hdev queue we consider
+         * this request as completed.
+         */
+        if (!req_complete || !skb_queue_empty(&hdev->cmd_q))
+                hci_req_cmd_complete(hdev, opcode, status);
+}
+
 static void hci_rx_work(struct work_struct *work)
 {
         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 477726a63512..138580745c2c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -53,7 +53,7 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
         hci_dev_unlock(hdev);
 
-        hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
+        hci_req_cmd_complete(hdev, HCI_OP_INQUIRY, status);
 
         hci_conn_check_pending(hdev);
 }
@@ -183,8 +183,6 @@ static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 
         if (!status)
                 hdev->link_policy = get_unaligned_le16(sent);
-
-        hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 }
 
 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
@@ -195,11 +193,8 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 
         clear_bit(HCI_RESET, &hdev->flags);
 
-        hci_req_complete(hdev, HCI_OP_RESET, status);
-
         /* Reset all non-persistent flags */
-        hdev->dev_flags &= ~(BIT(HCI_LE_SCAN) | BIT(HCI_PENDING_CLASS) |
-                             BIT(HCI_PERIODIC_INQ));
+        hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 
         hdev->discovery.state = DISCOVERY_STOPPED;
         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
@@ -228,11 +223,6 @@ static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 
         hci_dev_unlock(hdev);
-
-        if (!status && !test_bit(HCI_INIT, &hdev->flags))
-                hci_update_ad(hdev);
-
-        hci_req_complete(hdev, HCI_OP_WRITE_LOCAL_NAME, status);
 }
 
 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -270,8 +260,6 @@ static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 
         if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_auth_enable_complete(hdev, status);
-
-        hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 }
 
 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
@@ -293,8 +281,6 @@ static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
                 else
                         clear_bit(HCI_ENCRYPT, &hdev->flags);
         }
-
-        hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 }
 
 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
@@ -343,7 +329,6 @@ static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 
 done:
         hci_dev_unlock(hdev);
-        hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 }
 
 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
@@ -435,15 +420,6 @@ static void hci_cc_write_voice_setting(struct hci_dev *hdev,
                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 }
 
-static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
-        hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
-}
-
 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
@@ -472,211 +448,6 @@ static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
         }
 }
 
-static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
-{
-        if (lmp_ext_inq_capable(hdev))
-                return 2;
-
-        if (lmp_inq_rssi_capable(hdev))
-                return 1;
-
-        if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
-            hdev->lmp_subver == 0x0757)
-                return 1;
-
-        if (hdev->manufacturer == 15) {
-                if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
-                        return 1;
-                if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
-                        return 1;
-                if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
-                        return 1;
-        }
-
-        if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
-            hdev->lmp_subver == 0x1805)
-                return 1;
-
-        return 0;
-}
-
-static void hci_setup_inquiry_mode(struct hci_dev *hdev)
-{
-        u8 mode;
-
-        mode = hci_get_inquiry_mode(hdev);
-
-        hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
-}
-
-static void hci_setup_event_mask(struct hci_dev *hdev)
-{
-        /* The second byte is 0xff instead of 0x9f (two reserved bits
-         * disabled) since a Broadcom 1.2 dongle doesn't respond to the
-         * command otherwise */
-        u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
-
-        /* CSR 1.1 dongles does not accept any bitfield so don't try to set
-         * any event mask for pre 1.2 devices */
-        if (hdev->hci_ver < BLUETOOTH_VER_1_2)
-                return;
-
-        if (lmp_bredr_capable(hdev)) {
-                events[4] |= 0x01; /* Flow Specification Complete */
-                events[4] |= 0x02; /* Inquiry Result with RSSI */
-                events[4] |= 0x04; /* Read Remote Extended Features Complete */
-                events[5] |= 0x08; /* Synchronous Connection Complete */
-                events[5] |= 0x10; /* Synchronous Connection Changed */
-        }
-
-        if (lmp_inq_rssi_capable(hdev))
-                events[4] |= 0x02; /* Inquiry Result with RSSI */
-
-        if (lmp_sniffsubr_capable(hdev))
-                events[5] |= 0x20; /* Sniff Subrating */
-
-        if (lmp_pause_enc_capable(hdev))
-                events[5] |= 0x80; /* Encryption Key Refresh Complete */
-
-        if (lmp_ext_inq_capable(hdev))
-                events[5] |= 0x40; /* Extended Inquiry Result */
-
-        if (lmp_no_flush_capable(hdev))
-                events[7] |= 0x01; /* Enhanced Flush Complete */
-
-        if (lmp_lsto_capable(hdev))
-                events[6] |= 0x80; /* Link Supervision Timeout Changed */
-
-        if (lmp_ssp_capable(hdev)) {
-                events[6] |= 0x01;      /* IO Capability Request */
-                events[6] |= 0x02;      /* IO Capability Response */
-                events[6] |= 0x04;      /* User Confirmation Request */
-                events[6] |= 0x08;      /* User Passkey Request */
-                events[6] |= 0x10;      /* Remote OOB Data Request */
-                events[6] |= 0x20;      /* Simple Pairing Complete */
-                events[7] |= 0x04;      /* User Passkey Notification */
-                events[7] |= 0x08;      /* Keypress Notification */
-                events[7] |= 0x10;      /* Remote Host Supported
-                                         * Features Notification */
-        }
-
-        if (lmp_le_capable(hdev))
-                events[7] |= 0x20;      /* LE Meta-Event */
-
-        hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
-
-        if (lmp_le_capable(hdev)) {
-                memset(events, 0, sizeof(events));
-                events[0] = 0x1f;
-                hci_send_cmd(hdev, HCI_OP_LE_SET_EVENT_MASK,
-                             sizeof(events), events);
-        }
-}
-
-static void bredr_setup(struct hci_dev *hdev)
-{
-        struct hci_cp_delete_stored_link_key cp;
-        __le16 param;
-        __u8 flt_type;
-
-        /* Read Buffer Size (ACL mtu, max pkt, etc.) */
-        hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
-
-        /* Read Class of Device */
-        hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
-
-        /* Read Local Name */
-        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
-
-        /* Read Voice Setting */
-        hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
-
-        /* Clear Event Filters */
-        flt_type = HCI_FLT_CLEAR_ALL;
-        hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
-
-        /* Connection accept timeout ~20 secs */
-        param = __constant_cpu_to_le16(0x7d00);
-        hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
-
-        bacpy(&cp.bdaddr, BDADDR_ANY);
-        cp.delete_all = 1;
-        hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
-}
-
-static void le_setup(struct hci_dev *hdev)
-{
-        /* Read LE Buffer Size */
-        hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
-
-        /* Read LE Local Supported Features */
-        hci_send_cmd(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
-
-        /* Read LE Advertising Channel TX Power */
-        hci_send_cmd(hdev, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
-
-        /* Read LE White List Size */
-        hci_send_cmd(hdev, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
-
-        /* Read LE Supported States */
-        hci_send_cmd(hdev, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
-}
-
-static void hci_setup(struct hci_dev *hdev)
-{
-        if (hdev->dev_type != HCI_BREDR)
-                return;
-
-        /* Read BD Address */
-        hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
-
-        if (lmp_bredr_capable(hdev))
-                bredr_setup(hdev);
-
-        if (lmp_le_capable(hdev))
-                le_setup(hdev);
-
-        hci_setup_event_mask(hdev);
-
-        if (hdev->hci_ver > BLUETOOTH_VER_1_1)
-                hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
-
-        if (lmp_ssp_capable(hdev)) {
-                if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
-                        u8 mode = 0x01;
-                        hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE,
-                                     sizeof(mode), &mode);
-                } else {
-                        struct hci_cp_write_eir cp;
-
-                        memset(hdev->eir, 0, sizeof(hdev->eir));
-                        memset(&cp, 0, sizeof(cp));
-
-                        hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
-                }
-        }
-
-        if (lmp_inq_rssi_capable(hdev))
-                hci_setup_inquiry_mode(hdev);
-
-        if (lmp_inq_tx_pwr_capable(hdev))
-                hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
-
-        if (lmp_ext_feat_capable(hdev)) {
-                struct hci_cp_read_local_ext_features cp;
-
-                cp.page = 0x01;
-                hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp),
-                             &cp);
-        }
-
-        if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
-                u8 enable = 1;
-                hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
-                             &enable);
-        }
-}
-
 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_rp_read_local_version *rp = (void *) skb->data;
@@ -684,7 +455,7 @@ static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 
         if (rp->status)
-                goto done;
+                return;
 
         hdev->hci_ver = rp->hci_ver;
         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
@@ -694,30 +465,6 @@ static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s manufacturer 0x%4.4x hci ver %d:%d", hdev->name,
                hdev->manufacturer, hdev->hci_ver, hdev->hci_rev);
-
-        if (test_bit(HCI_INIT, &hdev->flags))
-                hci_setup(hdev);
-
-done:
-        hci_req_complete(hdev, HCI_OP_READ_LOCAL_VERSION, rp->status);
-}
-
-static void hci_setup_link_policy(struct hci_dev *hdev)
-{
-        struct hci_cp_write_def_link_policy cp;
-        u16 link_policy = 0;
-
-        if (lmp_rswitch_capable(hdev))
-                link_policy |= HCI_LP_RSWITCH;
-        if (lmp_hold_capable(hdev))
-                link_policy |= HCI_LP_HOLD;
-        if (lmp_sniff_capable(hdev))
-                link_policy |= HCI_LP_SNIFF;
-        if (lmp_park_capable(hdev))
-                link_policy |= HCI_LP_PARK;
-
-        cp.policy = cpu_to_le16(link_policy);
-        hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 }
 
 static void hci_cc_read_local_commands(struct hci_dev *hdev,
@@ -727,16 +474,8 @@ static void hci_cc_read_local_commands(struct hci_dev *hdev,
 
         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 
-        if (rp->status)
-                goto done;
-
-        memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
-
-        if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
-                hci_setup_link_policy(hdev);
-
-done:
-        hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
+        if (!rp->status)
+                memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 }
 
 static void hci_cc_read_local_features(struct hci_dev *hdev,
@@ -795,22 +534,6 @@ static void hci_cc_read_local_features(struct hci_dev *hdev,
                hdev->features[6], hdev->features[7]);
 }
 
-static void hci_set_le_support(struct hci_dev *hdev)
-{
-        struct hci_cp_write_le_host_supported cp;
-
-        memset(&cp, 0, sizeof(cp));
-
-        if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
-                cp.le = 1;
-                cp.simul = lmp_le_br_capable(hdev);
-        }
-
-        if (cp.le != lmp_host_le_capable(hdev))
-                hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
-                             &cp);
-}
-
 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
                                            struct sk_buff *skb)
 {
@@ -819,7 +542,7 @@ static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 
         if (rp->status)
-                goto done;
+                return;
 
         switch (rp->page) {
         case 0:
@@ -829,12 +552,6 @@ static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
                 memcpy(hdev->host_features, rp->features, 8);
                 break;
         }
-
-        if (test_bit(HCI_INIT, &hdev->flags) && lmp_le_capable(hdev))
-                hci_set_le_support(hdev);
-
-done:
-        hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 }
 
 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
@@ -844,12 +561,8 @@ static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 
         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 
-        if (rp->status)
-                return;
-
-        hdev->flow_ctl_mode = rp->mode;
-
-        hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
+        if (!rp->status)
+                hdev->flow_ctl_mode = rp->mode;
 }
 
 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
@@ -886,8 +599,65 @@ static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 
         if (!rp->status)
                 bacpy(&hdev->bdaddr, &rp->bdaddr);
+}
+
+static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
+                                           struct sk_buff *skb)
+{
+        struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+
+        if (test_bit(HCI_INIT, &hdev->flags) && !rp->status) {
+                hdev->page_scan_interval = __le16_to_cpu(rp->interval);
+                hdev->page_scan_window = __le16_to_cpu(rp->window);
+        }
+}
+
+static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
+                                            struct sk_buff *skb)
+{
+        u8 status = *((u8 *) skb->data);
+        struct hci_cp_write_page_scan_activity *sent;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        if (status)
+                return;
+
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
+        if (!sent)
+                return;
+
+        hdev->page_scan_interval = __le16_to_cpu(sent->interval);
+        hdev->page_scan_window = __le16_to_cpu(sent->window);
+}
+
+static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
+                                           struct sk_buff *skb)
+{
+        struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+
+        if (test_bit(HCI_INIT, &hdev->flags) && !rp->status)
+                hdev->page_scan_type = rp->type;
+}
+
+static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
+                                        struct sk_buff *skb)
+{
+        u8 status = *((u8 *) skb->data);
+        u8 *type;
 
-        hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        if (status)
+                return;
+
+        type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
+        if (type)
+                hdev->page_scan_type = *type;
 }
 
 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
@@ -908,17 +678,6 @@ static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 
         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
                hdev->block_cnt, hdev->block_len);
-
-        hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
-}
-
-static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
-        hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 }
 
 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
@@ -942,8 +701,6 @@ static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 
-        hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
-
 a2mp_rsp:
         a2mp_send_getinfo_rsp(hdev);
 }
@@ -985,35 +742,6 @@ a2mp_rsp:
         a2mp_send_create_phy_link_req(hdev, rp->status);
 }
 
-static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
-                                          struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
-        hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
-}
-
-static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
-        hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
-}
-
-static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
-                                      struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
-        hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
-}
-
 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
                                          struct sk_buff *skb)
 {
@@ -1023,17 +751,6 @@ static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 
         if (!rp->status)
                 hdev->inq_tx_power = rp->tx_power;
-
-        hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, rp->status);
-}
-
-static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
-        hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 }
 
 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1095,8 +812,6 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
         hdev->le_cnt = hdev->le_pkts;
 
         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
-
-        hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 }
 
 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
@@ -1108,8 +823,6 @@ static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 
         if (!rp->status)
                 memcpy(hdev->le_features, rp->features, 8);
-
-        hci_req_complete(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, rp->status);
 }
 
 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
@@ -1119,22 +832,8 @@ static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 
         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 
-        if (!rp->status) {
+        if (!rp->status)
                 hdev->adv_tx_power = rp->tx_power;
-                if (!test_bit(HCI_INIT, &hdev->flags))
-                        hci_update_ad(hdev);
-        }
-
-        hci_req_complete(hdev, HCI_OP_LE_READ_ADV_TX_POWER, rp->status);
-}
-
-static void hci_cc_le_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
-        hci_req_complete(hdev, HCI_OP_LE_SET_EVENT_MASK, status);
 }
 
 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1231,12 +930,15 @@ static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
                         clear_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
         }
 
-        hci_dev_unlock(hdev);
+        if (!test_bit(HCI_INIT, &hdev->flags)) {
+                struct hci_request req;
 
-        if (!test_bit(HCI_INIT, &hdev->flags))
-                hci_update_ad(hdev);
+                hci_req_init(&req, hdev);
+                hci_update_ad(&req);
+                hci_req_run(&req, NULL);
+        }
 
-        hci_req_complete(hdev, HCI_OP_LE_SET_ADV_ENABLE, status);
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1245,8 +947,6 @@ static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 
-        hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_PARAM, status);
-
         if (status) {
                 hci_dev_lock(hdev);
                 mgmt_start_discovery_failed(hdev, status);
@@ -1269,8 +969,6 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 
         switch (cp->enable) {
         case LE_SCANNING_ENABLED:
-                hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_ENABLE, status);
-
                 if (status) {
                         hci_dev_lock(hdev);
                         mgmt_start_discovery_failed(hdev, status);
@@ -1321,32 +1019,6 @@ static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
 
         if (!rp->status)
                 hdev->le_white_list_size = rp->size;
-
-        hci_req_complete(hdev, HCI_OP_LE_READ_WHITE_LIST_SIZE, rp->status);
-}
-
-static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
-
-        if (rp->status)
-                return;
-
-        hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
-}
-
-static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
-
-        if (rp->status)
-                return;
-
-        hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
 }
 
 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
@@ -1358,8 +1030,6 @@ static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
 
         if (!rp->status)
                 memcpy(hdev->le_states, rp->le_states, 8);
-
-        hci_req_complete(hdev, HCI_OP_LE_READ_SUPPORTED_STATES, rp->status);
 }
 
 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
@@ -1389,8 +1059,6 @@ static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
             !test_bit(HCI_INIT, &hdev->flags))
                 mgmt_le_enable_complete(hdev, sent->le, status);
-
-        hci_req_complete(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, status);
 }
 
 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
@@ -1412,7 +1080,6 @@ static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 
         if (status) {
-                hci_req_complete(hdev, HCI_OP_INQUIRY, status);
                 hci_conn_check_pending(hdev);
                 hci_dev_lock(hdev);
                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
@@ -1884,11 +1551,6 @@ static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
         }
 }
 
-static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
-{
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-}
-
 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
 {
         struct hci_cp_create_phy_link *cp;
@@ -1930,11 +1592,6 @@ static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
         amp_write_remote_assoc(hdev, cp->phy_handle);
 }
 
-static void hci_cs_create_logical_link(struct hci_dev *hdev, u8 status)
-{
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-}
-
 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
@@ -1943,7 +1600,7 @@ static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 
-        hci_req_complete(hdev, HCI_OP_INQUIRY, status);
+        hci_req_cmd_complete(hdev, HCI_OP_INQUIRY, status);
 
         hci_conn_check_pending(hdev);
 
@@ -2399,7 +2056,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 
                 if (ev->status && conn->state == BT_CONNECTED) {
-                        hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
+                        hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
                         hci_conn_put(conn);
                         goto unlock;
                 }
@@ -2491,20 +2148,10 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        BT_DBG("%s", hdev->name);
-}
-
-static void hci_qos_setup_complete_evt(struct hci_dev *hdev,
-                                       struct sk_buff *skb)
-{
-        BT_DBG("%s", hdev->name);
-}
-
 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_cmd_complete *ev = (void *) skb->data;
+        u8 status = skb->data[sizeof(*ev)];
         __u16 opcode;
 
         skb_pull(skb, sizeof(*ev));
@@ -2588,10 +2235,6 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_write_voice_setting(hdev, skb);
                 break;
 
-        case HCI_OP_HOST_BUFFER_SIZE:
-                hci_cc_host_buffer_size(hdev, skb);
-                break;
-
         case HCI_OP_WRITE_SSP_MODE:
                 hci_cc_write_ssp_mode(hdev, skb);
                 break;
@@ -2620,46 +2263,42 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_read_bd_addr(hdev, skb);
                 break;
 
-        case HCI_OP_READ_DATA_BLOCK_SIZE:
-                hci_cc_read_data_block_size(hdev, skb);
+        case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
+                hci_cc_read_page_scan_activity(hdev, skb);
                 break;
 
-        case HCI_OP_WRITE_CA_TIMEOUT:
-                hci_cc_write_ca_timeout(hdev, skb);
+        case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
+                hci_cc_write_page_scan_activity(hdev, skb);
                 break;
 
-        case HCI_OP_READ_FLOW_CONTROL_MODE:
-                hci_cc_read_flow_control_mode(hdev, skb);
+        case HCI_OP_READ_PAGE_SCAN_TYPE:
+                hci_cc_read_page_scan_type(hdev, skb);
                 break;
 
-        case HCI_OP_READ_LOCAL_AMP_INFO:
-                hci_cc_read_local_amp_info(hdev, skb);
+        case HCI_OP_WRITE_PAGE_SCAN_TYPE:
+                hci_cc_write_page_scan_type(hdev, skb);
                 break;
 
-        case HCI_OP_READ_LOCAL_AMP_ASSOC:
-                hci_cc_read_local_amp_assoc(hdev, skb);
+        case HCI_OP_READ_DATA_BLOCK_SIZE:
+                hci_cc_read_data_block_size(hdev, skb);
                 break;
 
-        case HCI_OP_DELETE_STORED_LINK_KEY:
-                hci_cc_delete_stored_link_key(hdev, skb);
+        case HCI_OP_READ_FLOW_CONTROL_MODE:
+                hci_cc_read_flow_control_mode(hdev, skb);
                 break;
 
-        case HCI_OP_SET_EVENT_MASK:
-                hci_cc_set_event_mask(hdev, skb);
+        case HCI_OP_READ_LOCAL_AMP_INFO:
+                hci_cc_read_local_amp_info(hdev, skb);
                 break;
 
-        case HCI_OP_WRITE_INQUIRY_MODE:
-                hci_cc_write_inquiry_mode(hdev, skb);
+        case HCI_OP_READ_LOCAL_AMP_ASSOC:
+                hci_cc_read_local_amp_assoc(hdev, skb);
                 break;
 
         case HCI_OP_READ_INQ_RSP_TX_POWER:
                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
                 break;
 
-        case HCI_OP_SET_EVENT_FLT:
-                hci_cc_set_event_flt(hdev, skb);
-                break;
-
         case HCI_OP_PIN_CODE_REPLY:
                 hci_cc_pin_code_reply(hdev, skb);
                 break;
@@ -2684,10 +2323,6 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_le_read_adv_tx_power(hdev, skb);
                 break;
 
-        case HCI_OP_LE_SET_EVENT_MASK:
-                hci_cc_le_set_event_mask(hdev, skb);
-                break;
-
         case HCI_OP_USER_CONFIRM_REPLY:
                 hci_cc_user_confirm_reply(hdev, skb);
                 break;
@@ -2720,14 +2355,6 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_le_read_white_list_size(hdev, skb);
                 break;
 
-        case HCI_OP_LE_LTK_REPLY:
-                hci_cc_le_ltk_reply(hdev, skb);
-                break;
-
-        case HCI_OP_LE_LTK_NEG_REPLY:
-                hci_cc_le_ltk_neg_reply(hdev, skb);
-                break;
-
         case HCI_OP_LE_READ_SUPPORTED_STATES:
                 hci_cc_le_read_supported_states(hdev, skb);
                 break;
@@ -2745,9 +2372,11 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 break;
         }
 
-        if (ev->opcode != HCI_OP_NOP)
+        if (opcode != HCI_OP_NOP)
                 del_timer(&hdev->cmd_timer);
 
+        hci_req_cmd_complete(hdev, opcode, status);
+
         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
@@ -2817,10 +2446,6 @@ static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cs_le_create_conn(hdev, ev->status);
                 break;
 
-        case HCI_OP_LE_START_ENC:
-                hci_cs_le_start_enc(hdev, ev->status);
-                break;
-
         case HCI_OP_CREATE_PHY_LINK:
                 hci_cs_create_phylink(hdev, ev->status);
                 break;
@@ -2829,18 +2454,16 @@ static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cs_accept_phylink(hdev, ev->status);
                 break;
 
-        case HCI_OP_CREATE_LOGICAL_LINK:
-                hci_cs_create_logical_link(hdev, ev->status);
-                break;
-
         default:
                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
                 break;
         }
 
-        if (ev->opcode != HCI_OP_NOP)
+        if (opcode != HCI_OP_NOP)
                 del_timer(&hdev->cmd_timer);
 
+        hci_req_cmd_status(hdev, opcode, ev->status);
+
         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
@@ -3391,18 +3014,6 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        BT_DBG("%s", hdev->name);
-}
-
-static void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        struct hci_ev_sniff_subrate *ev = (void *) skb->data;
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
-}
-
 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
                                             struct sk_buff *skb)
 {
@@ -3472,7 +3083,7 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 
         if (ev->status && conn->state == BT_CONNECTED) {
-                hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
+                hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
                 hci_conn_put(conn);
                 goto unlock;
         }
@@ -4130,14 +3741,6 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_remote_features_evt(hdev, skb);
                 break;
 
-        case HCI_EV_REMOTE_VERSION:
-                hci_remote_version_evt(hdev, skb);
-                break;
-
-        case HCI_EV_QOS_SETUP_COMPLETE:
-                hci_qos_setup_complete_evt(hdev, skb);
-                break;
-
         case HCI_EV_CMD_COMPLETE:
                 hci_cmd_complete_evt(hdev, skb);
                 break;
@@ -4194,14 +3797,6 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_sync_conn_complete_evt(hdev, skb);
                 break;
 
-        case HCI_EV_SYNC_CONN_CHANGED:
-                hci_sync_conn_changed_evt(hdev, skb);
-                break;
-
-        case HCI_EV_SNIFF_SUBRATE:
-                hci_sniff_subrate_evt(hdev, skb);
-                break;
-
         case HCI_EV_EXTENDED_INQUIRY_RESULT:
                 hci_extended_inquiry_result_evt(hdev, skb);
                 break;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 6a93614f2c49..aa4354fca77c 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -854,6 +854,11 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         skb_queue_tail(&hdev->raw_q, skb);
                         queue_work(hdev->workqueue, &hdev->tx_work);
                 } else {
+                        /* Stand-alone HCI commands must be flaged as
+                         * single-command requests.
+                         */
+                        bt_cb(skb)->req.start = true;
+
                         skb_queue_tail(&hdev->cmd_q, skb);
                         queue_work(hdev->workqueue, &hdev->cmd_work);
                 }
@@ -1121,8 +1126,6 @@ error:
 void hci_sock_cleanup(void)
 {
         bt_procfs_cleanup(&init_net, "hci");
-        if (bt_sock_unregister(BTPROTO_HCI) < 0)
-                BT_ERR("HCI socket unregistration failed");
-
+        bt_sock_unregister(BTPROTO_HCI);
         proto_unregister(&hci_sk_proto);
 }
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 23b4e242a31a..ff38561385de 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -590,10 +590,8 @@ int __init bt_sysfs_init(void)
         bt_debugfs = debugfs_create_dir("bluetooth", NULL);
 
         bt_class = class_create(THIS_MODULE, "bluetooth");
-        if (IS_ERR(bt_class))
-                return PTR_ERR(bt_class);
 
-        return 0;
+        return PTR_RET(bt_class);
 }
 
 void bt_sysfs_cleanup(void)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index a7352ff3fd1e..2342327f3335 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -311,6 +311,9 @@ static int hidp_get_raw_report(struct hid_device *hid,
         int numbered_reports = hid->report_enum[report_type].numbered;
         int ret;
 
+        if (atomic_read(&session->terminate))
+                return -EIO;
+
         switch (report_type) {
         case HID_FEATURE_REPORT:
                 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_FEATURE;
@@ -722,6 +725,7 @@ static int hidp_session(void *arg)
                 set_current_state(TASK_INTERRUPTIBLE);
         }
         set_current_state(TASK_RUNNING);
+        atomic_inc(&session->terminate);
         remove_wait_queue(sk_sleep(intr_sk), &intr_wait);
         remove_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
 
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 82a829d90b0f..5d0f1ca0a314 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -304,8 +304,6 @@ error:
 void __exit hidp_cleanup_sockets(void)
 {
         bt_procfs_cleanup(&init_net, "hidp");
-        if (bt_sock_unregister(BTPROTO_HIDP) < 0)
-                BT_ERR("Can't unregister HIDP socket");
-
+        bt_sock_unregister(BTPROTO_HIDP);
         proto_unregister(&hidp_proto);
 }
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1bcfb8422fdc..7f9704993b74 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1312,8 +1312,6 @@ error:
 void l2cap_cleanup_sockets(void)
 {
         bt_procfs_cleanup(&init_net, "l2cap");
-        if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
-                BT_ERR("L2CAP socket unregistration failed");
-
+        bt_sock_unregister(BTPROTO_L2CAP);
         proto_unregister(&l2cap_proto);
 }
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 39395c7144aa..03e7e732215f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -384,7 +384,8 @@ static u32 get_supported_settings(struct hci_dev *hdev)
 
         if (lmp_bredr_capable(hdev)) {
                 settings |= MGMT_SETTING_CONNECTABLE;
-                settings |= MGMT_SETTING_FAST_CONNECTABLE;
+                if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
+                        settings |= MGMT_SETTING_FAST_CONNECTABLE;
                 settings |= MGMT_SETTING_DISCOVERABLE;
                 settings |= MGMT_SETTING_BREDR;
                 settings |= MGMT_SETTING_LINK_SECURITY;
@@ -409,6 +410,9 @@ static u32 get_current_settings(struct hci_dev *hdev)
         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
                 settings |= MGMT_SETTING_CONNECTABLE;
 
+        if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
+                settings |= MGMT_SETTING_FAST_CONNECTABLE;
+
         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
                 settings |= MGMT_SETTING_DISCOVERABLE;
 
@@ -591,32 +595,33 @@ static void create_eir(struct hci_dev *hdev, u8 *data)
         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 }
 
-static int update_eir(struct hci_dev *hdev)
+static void update_eir(struct hci_request *req)
 {
+        struct hci_dev *hdev = req->hdev;
         struct hci_cp_write_eir cp;
 
         if (!hdev_is_powered(hdev))
-                return 0;
+                return;
 
         if (!lmp_ext_inq_capable(hdev))
-                return 0;
+                return;
 
         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
-                return 0;
+                return;
 
         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
-                return 0;
+                return;
 
         memset(&cp, 0, sizeof(cp));
 
         create_eir(hdev, cp.data);
 
         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
-                return 0;
+                return;
 
         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 
-        return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+        hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 }
 
 static u8 get_service_classes(struct hci_dev *hdev)
@@ -630,47 +635,48 @@ static u8 get_service_classes(struct hci_dev *hdev)
         return val;
 }
 
-static int update_class(struct hci_dev *hdev)
+static void update_class(struct hci_request *req)
 {
+        struct hci_dev *hdev = req->hdev;
         u8 cod[3];
-        int err;
 
         BT_DBG("%s", hdev->name);
 
         if (!hdev_is_powered(hdev))
-                return 0;
+                return;
 
         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
-                return 0;
+                return;
 
         cod[0] = hdev->minor_class;
         cod[1] = hdev->major_class;
         cod[2] = get_service_classes(hdev);
 
         if (memcmp(cod, hdev->dev_class, 3) == 0)
-                return 0;
-
-        err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
-        if (err == 0)
-                set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
+                return;
 
-        return err;
+        hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 }
 
 static void service_cache_off(struct work_struct *work)
 {
         struct hci_dev *hdev = container_of(work, struct hci_dev,
                                             service_cache.work);
+        struct hci_request req;
 
         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
                 return;
 
+        hci_req_init(&req, hdev);
+
         hci_dev_lock(hdev);
 
-        update_eir(hdev);
-        update_class(hdev);
+        update_eir(&req);
+        update_class(&req);
 
         hci_dev_unlock(hdev);
+
+        hci_req_run(&req, NULL);
 }
 
 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
@@ -994,11 +1000,64 @@ failed:
         return err;
 }
 
+static void write_fast_connectable(struct hci_request *req, bool enable)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct hci_cp_write_page_scan_activity acp;
+        u8 type;
+
+        if (hdev->hci_ver < BLUETOOTH_VER_1_2)
+                return;
+
+        if (enable) {
+                type = PAGE_SCAN_TYPE_INTERLACED;
+
+                /* 160 msec page scan interval */
+                acp.interval = __constant_cpu_to_le16(0x0100);
+        } else {
+                type = PAGE_SCAN_TYPE_STANDARD; /* default */
+
+                /* default 1.28 sec page scan */
+                acp.interval = __constant_cpu_to_le16(0x0800);
+        }
+
+        acp.window = __constant_cpu_to_le16(0x0012);
+
+        if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
+            __cpu_to_le16(hdev->page_scan_window) != acp.window)
+                hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
+                            sizeof(acp), &acp);
+
+        if (hdev->page_scan_type != type)
+                hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
+}
+
+static void set_connectable_complete(struct hci_dev *hdev, u8 status)
+{
+        struct pending_cmd *cmd;
+
+        BT_DBG("status 0x%02x", status);
+
+        hci_dev_lock(hdev);
+
+        cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
+        if (!cmd)
+                goto unlock;
+
+        send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
+
+        mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
                            u16 len)
 {
         struct mgmt_mode *cp = data;
         struct pending_cmd *cmd;
+        struct hci_request req;
         u8 scan;
         int err;
 
@@ -1065,7 +1124,20 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
                         cancel_delayed_work(&hdev->discov_off);
         }
 
-        err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+        hci_req_init(&req, hdev);
+
+        hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+
+        /* If we're going from non-connectable to connectable or
+         * vice-versa when fast connectable is enabled ensure that fast
+         * connectable gets disabled. write_fast_connectable won't do
+         * anything if the page scan parameters are already what they
+         * should be.
+         */
+        if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
+                write_fast_connectable(&req, false);
+
+        err = hci_req_run(&req, set_connectable_complete);
         if (err < 0)
                 mgmt_pending_remove(cmd);
 
@@ -1332,6 +1404,29 @@ unlock:
         return err;
 }
 
+/* This is a helper function to test for pending mgmt commands that can
+ * cause CoD or EIR HCI commands. We can only allow one such pending
+ * mgmt command at a time since otherwise we cannot easily track what
+ * the current values are, will be, and based on that calculate if a new
+ * HCI command needs to be sent and if yes with what value.
+ */
+static bool pending_eir_or_class(struct hci_dev *hdev)
+{
+        struct pending_cmd *cmd;
+
+        list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
+                switch (cmd->opcode) {
+                case MGMT_OP_ADD_UUID:
+                case MGMT_OP_REMOVE_UUID:
+                case MGMT_OP_SET_DEV_CLASS:
+                case MGMT_OP_SET_POWERED:
+                        return true;
+                }
+        }
+
+        return false;
+}
+
 static const u8 bluetooth_base_uuid[] = {
                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -1351,10 +1446,37 @@ static u8 get_uuid_size(const u8 *uuid)
         return 16;
 }
 
+static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
+{
+        struct pending_cmd *cmd;
+
+        hci_dev_lock(hdev);
+
+        cmd = mgmt_pending_find(mgmt_op, hdev);
+        if (!cmd)
+                goto unlock;
+
+        cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
+                     hdev->dev_class, 3);
+
+        mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
+static void add_uuid_complete(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("status 0x%02x", status);
+
+        mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
+}
+
 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
         struct mgmt_cp_add_uuid *cp = data;
         struct pending_cmd *cmd;
+        struct hci_request req;
         struct bt_uuid *uuid;
         int err;
 
@@ -1362,7 +1484,7 @@ static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
+        if (pending_eir_or_class(hdev)) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
                                  MGMT_STATUS_BUSY);
                 goto failed;
@@ -1380,23 +1502,28 @@ static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         list_add_tail(&uuid->list, &hdev->uuids);
 
-        err = update_class(hdev);
-        if (err < 0)
-                goto failed;
+        hci_req_init(&req, hdev);
 
-        err = update_eir(hdev);
-        if (err < 0)
-                goto failed;
+        update_class(&req);
+        update_eir(&req);
+
+        err = hci_req_run(&req, add_uuid_complete);
+        if (err < 0) {
+                if (err != -ENODATA)
+                        goto failed;
 
-        if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
                                    hdev->dev_class, 3);
                 goto failed;
         }
 
         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
-        if (!cmd)
+        if (!cmd) {
                 err = -ENOMEM;
+                goto failed;
+        }
+
+        err = 0;
 
 failed:
         hci_dev_unlock(hdev);
@@ -1417,6 +1544,13 @@ static bool enable_service_cache(struct hci_dev *hdev)
         return false;
 }
 
+static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("status 0x%02x", status);
+
+        mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
+}
+
 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
                        u16 len)
 {
@@ -1424,13 +1558,14 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
         struct pending_cmd *cmd;
         struct bt_uuid *match, *tmp;
         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
+        struct hci_request req;
         int err, found;
 
         BT_DBG("request for %s", hdev->name);
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
+        if (pending_eir_or_class(hdev)) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
                                  MGMT_STATUS_BUSY);
                 goto unlock;
@@ -1466,34 +1601,47 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
 update_class:
-        err = update_class(hdev);
-        if (err < 0)
-                goto unlock;
+        hci_req_init(&req, hdev);
 
-        err = update_eir(hdev);
-        if (err < 0)
-                goto unlock;
+        update_class(&req);
+        update_eir(&req);
+
+        err = hci_req_run(&req, remove_uuid_complete);
+        if (err < 0) {
+                if (err != -ENODATA)
+                        goto unlock;
 
-        if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
                                    hdev->dev_class, 3);
                 goto unlock;
         }
 
         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
-        if (!cmd)
+        if (!cmd) {
                 err = -ENOMEM;
+                goto unlock;
+        }
+
+        err = 0;
 
 unlock:
         hci_dev_unlock(hdev);
         return err;
 }
 
+static void set_class_complete(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("status 0x%02x", status);
+
+        mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
+}
+
 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
                          u16 len)
 {
         struct mgmt_cp_set_dev_class *cp = data;
         struct pending_cmd *cmd;
+        struct hci_request req;
         int err;
 
         BT_DBG("request for %s", hdev->name);
@@ -1502,15 +1650,19 @@ static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
-        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags))
-                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
-                                  MGMT_STATUS_BUSY);
+        hci_dev_lock(hdev);
 
-        if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0)
-                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
-                                  MGMT_STATUS_INVALID_PARAMS);
+        if (pending_eir_or_class(hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                 MGMT_STATUS_BUSY);
+                goto unlock;
+        }
 
-        hci_dev_lock(hdev);
+        if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                 MGMT_STATUS_INVALID_PARAMS);
+                goto unlock;
+        }
 
         hdev->major_class = cp->major;
         hdev->minor_class = cp->minor;
@@ -1521,26 +1673,34 @@ static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto unlock;
         }
 
+        hci_req_init(&req, hdev);
+
         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
                 hci_dev_unlock(hdev);
                 cancel_delayed_work_sync(&hdev->service_cache);
                 hci_dev_lock(hdev);
-                update_eir(hdev);
+                update_eir(&req);
         }
 
-        err = update_class(hdev);
-        if (err < 0)
-                goto unlock;
+        update_class(&req);
+
+        err = hci_req_run(&req, set_class_complete);
+        if (err < 0) {
+                if (err != -ENODATA)
+                        goto unlock;
 
-        if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
                                    hdev->dev_class, 3);
                 goto unlock;
         }
 
         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
-        if (!cmd)
+        if (!cmd) {
                 err = -ENOMEM;
+                goto unlock;
+        }
+
+        err = 0;
 
 unlock:
         hci_dev_unlock(hdev);
@@ -2140,7 +2300,7 @@ unlock:
 }
 
 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
-                             bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
+                             struct mgmt_addr_info *addr, u16 mgmt_op,
                              u16 hci_op, __le32 passkey)
 {
         struct pending_cmd *cmd;
@@ -2150,37 +2310,41 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
         hci_dev_lock(hdev);
 
         if (!hdev_is_powered(hdev)) {
-                err = cmd_status(sk, hdev->id, mgmt_op,
-                                 MGMT_STATUS_NOT_POWERED);
+                err = cmd_complete(sk, hdev->id, mgmt_op,
+                                   MGMT_STATUS_NOT_POWERED, addr,
+                                   sizeof(*addr));
                 goto done;
         }
 
-        if (type == BDADDR_BREDR)
-                conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
+        if (addr->type == BDADDR_BREDR)
+                conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
         else
-                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
+                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
 
         if (!conn) {
-                err = cmd_status(sk, hdev->id, mgmt_op,
-                                 MGMT_STATUS_NOT_CONNECTED);
+                err = cmd_complete(sk, hdev->id, mgmt_op,
+                                   MGMT_STATUS_NOT_CONNECTED, addr,
+                                   sizeof(*addr));
                 goto done;
         }
 
-        if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
+        if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
                 /* Continue with pairing via SMP */
                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
 
                 if (!err)
-                        err = cmd_status(sk, hdev->id, mgmt_op,
-                                         MGMT_STATUS_SUCCESS);
+                        err = cmd_complete(sk, hdev->id, mgmt_op,
+                                           MGMT_STATUS_SUCCESS, addr,
+                                           sizeof(*addr));
                 else
-                        err = cmd_status(sk, hdev->id, mgmt_op,
-                                         MGMT_STATUS_FAILED);
+                        err = cmd_complete(sk, hdev->id, mgmt_op,
+                                           MGMT_STATUS_FAILED, addr,
+                                           sizeof(*addr));
 
                 goto done;
         }
 
-        cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
+        cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
         if (!cmd) {
                 err = -ENOMEM;
                 goto done;
@@ -2190,11 +2354,12 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
                 struct hci_cp_user_passkey_reply cp;
 
-                bacpy(&cp.bdaddr, bdaddr);
+                bacpy(&cp.bdaddr, &addr->bdaddr);
                 cp.passkey = passkey;
                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
         } else
-                err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
+                err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
+                                   &addr->bdaddr);
 
         if (err < 0)
                 mgmt_pending_remove(cmd);
@@ -2211,7 +2376,7 @@ static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
 
         BT_DBG("");
 
-        return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+        return user_pairing_resp(sk, hdev, &cp->addr,
                                 MGMT_OP_PIN_CODE_NEG_REPLY,
                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
 }
@@ -2227,7 +2392,7 @@ static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
                                   MGMT_STATUS_INVALID_PARAMS);
 
-        return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+        return user_pairing_resp(sk, hdev, &cp->addr,
                                  MGMT_OP_USER_CONFIRM_REPLY,
                                  HCI_OP_USER_CONFIRM_REPLY, 0);
 }
@@ -2239,7 +2404,7 @@ static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
 
         BT_DBG("");
 
-        return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+        return user_pairing_resp(sk, hdev, &cp->addr,
                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
 }
@@ -2251,7 +2416,7 @@ static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("");
 
-        return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+        return user_pairing_resp(sk, hdev, &cp->addr,
                                  MGMT_OP_USER_PASSKEY_REPLY,
                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
 }
@@ -2263,18 +2428,47 @@ static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
 
         BT_DBG("");
 
-        return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+        return user_pairing_resp(sk, hdev, &cp->addr,
                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
 }
 
-static int update_name(struct hci_dev *hdev, const char *name)
+static void update_name(struct hci_request *req)
 {
+        struct hci_dev *hdev = req->hdev;
         struct hci_cp_write_local_name cp;
 
-        memcpy(cp.name, name, sizeof(cp.name));
+        memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
+
+        hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
+}
+
+static void set_name_complete(struct hci_dev *hdev, u8 status)
+{
+        struct mgmt_cp_set_local_name *cp;
+        struct pending_cmd *cmd;
+
+        BT_DBG("status 0x%02x", status);
+
+        hci_dev_lock(hdev);
+
+        cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
+        if (!cmd)
+                goto unlock;
+
+        cp = cmd->param;
 
-        return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
+        if (status)
+                cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
+                           mgmt_status(status));
+        else
+                cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
+                             cp, sizeof(*cp));
+
+        mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
 }
 
 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -2282,12 +2476,24 @@ static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
 {
         struct mgmt_cp_set_local_name *cp = data;
         struct pending_cmd *cmd;
+        struct hci_request req;
         int err;
 
         BT_DBG("");
 
         hci_dev_lock(hdev);
 
+        /* If the old values are the same as the new ones just return a
+         * direct command complete event.
+         */
+        if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
+            !memcmp(hdev->short_name, cp->short_name,
+                    sizeof(hdev->short_name))) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
+                                   data, len);
+                goto failed;
+        }
+
         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
 
         if (!hdev_is_powered(hdev)) {
@@ -2310,7 +2516,19 @@ static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto failed;
         }
 
-        err = update_name(hdev, cp->name);
+        memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
+
+        hci_req_init(&req, hdev);
+
+        if (lmp_bredr_capable(hdev)) {
+                update_name(&req);
+                update_eir(&req);
+        }
+
+        if (lmp_le_capable(hdev))
+                hci_update_ad(&req);
+
+        err = hci_req_run(&req, set_name_complete);
         if (err < 0)
                 mgmt_pending_remove(cmd);
 
@@ -2698,6 +2916,7 @@ static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
                          u16 len)
 {
         struct mgmt_cp_set_device_id *cp = data;
+        struct hci_request req;
         int err;
         __u16 source;
 
@@ -2718,24 +2937,59 @@ static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
 
-        update_eir(hdev);
+        hci_req_init(&req, hdev);
+        update_eir(&req);
+        hci_req_run(&req, NULL);
 
         hci_dev_unlock(hdev);
 
         return err;
 }
 
+static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
+{
+        struct pending_cmd *cmd;
+
+        BT_DBG("status 0x%02x", status);
+
+        hci_dev_lock(hdev);
+
+        cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
+        if (!cmd)
+                goto unlock;
+
+        if (status) {
+                cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                           mgmt_status(status));
+        } else {
+                struct mgmt_mode *cp = cmd->param;
+
+                if (cp->val)
+                        set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
+                else
+                        clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
+
+                send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
+                new_settings(hdev, cmd->sk);
+        }
+
+        mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
                                 void *data, u16 len)
 {
         struct mgmt_mode *cp = data;
-        struct hci_cp_write_page_scan_activity acp;
-        u8 type;
+        struct pending_cmd *cmd;
+        struct hci_request req;
         int err;
 
         BT_DBG("%s", hdev->name);
 
-        if (!lmp_bredr_capable(hdev))
+        if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
@@ -2753,40 +3007,39 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (cp->val) {
-                type = PAGE_SCAN_TYPE_INTERLACED;
+        if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                 MGMT_STATUS_BUSY);
+                goto unlock;
+        }
 
-                /* 160 msec page scan interval */
-                acp.interval = __constant_cpu_to_le16(0x0100);
-        } else {
-                type = PAGE_SCAN_TYPE_STANDARD; /* default */
+        if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
+                err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
+                                        hdev);
+                goto unlock;
+        }
 
-                /* default 1.28 sec page scan */
-                acp.interval = __constant_cpu_to_le16(0x0800);
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
+                               data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto unlock;
         }
 
-        /* default 11.25 msec page scan window */
-        acp.window = __constant_cpu_to_le16(0x0012);
+        hci_req_init(&req, hdev);
 
-        err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
-                           &acp);
-        if (err < 0) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
-                                 MGMT_STATUS_FAILED);
-                goto done;
-        }
+        write_fast_connectable(&req, cp->val);
 
-        err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
+        err = hci_req_run(&req, fast_connectable_complete);
         if (err < 0) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
                                  MGMT_STATUS_FAILED);
-                goto done;
+                mgmt_pending_remove(cmd);
         }
 
-        err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
-                           NULL, 0);
-done:
+unlock:
         hci_dev_unlock(hdev);
+
         return err;
 }
 
@@ -3043,79 +3296,115 @@ static void settings_rsp(struct pending_cmd *cmd, void *data)
         mgmt_pending_free(cmd);
 }
 
-static int set_bredr_scan(struct hci_dev *hdev)
+static void set_bredr_scan(struct hci_request *req)
 {
+        struct hci_dev *hdev = req->hdev;
         u8 scan = 0;
 
+        /* Ensure that fast connectable is disabled. This function will
+         * not do anything if the page scan parameters are already what
+         * they should be.
+         */
+        write_fast_connectable(req, false);
+
         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
                 scan |= SCAN_PAGE;
         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
                 scan |= SCAN_INQUIRY;
 
-        if (!scan)
-                return 0;
-
-        return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+        if (scan)
+                hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 }
 
-int mgmt_powered(struct hci_dev *hdev, u8 powered)
+static void powered_complete(struct hci_dev *hdev, u8 status)
 {
         struct cmd_lookup match = { NULL, hdev };
-        int err;
 
-        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
-                return 0;
+        BT_DBG("status 0x%02x", status);
+
+        hci_dev_lock(hdev);
 
         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
 
-        if (powered) {
-                u8 link_sec;
+        new_settings(hdev, match.sk);
 
-                if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
-                    !lmp_host_ssp_capable(hdev)) {
-                        u8 ssp = 1;
+        hci_dev_unlock(hdev);
 
-                        hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
-                }
+        if (match.sk)
+                sock_put(match.sk);
+}
 
-                if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
-                        struct hci_cp_write_le_host_supported cp;
+static int powered_update_hci(struct hci_dev *hdev)
+{
+        struct hci_request req;
+        u8 link_sec;
 
-                        cp.le = 1;
-                        cp.simul = lmp_le_br_capable(hdev);
+        hci_req_init(&req, hdev);
 
-                        /* Check first if we already have the right
-                         * host state (host features set)
-                         */
-                        if (cp.le != lmp_host_le_capable(hdev) ||
-                            cp.simul != lmp_host_le_br_capable(hdev))
-                                hci_send_cmd(hdev,
-                                             HCI_OP_WRITE_LE_HOST_SUPPORTED,
-                                             sizeof(cp), &cp);
-                }
+        if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
+            !lmp_host_ssp_capable(hdev)) {
+                u8 ssp = 1;
 
-                link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
-                if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
-                        hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE,
-                                     sizeof(link_sec), &link_sec);
+                hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
+        }
 
-                if (lmp_bredr_capable(hdev)) {
-                        set_bredr_scan(hdev);
-                        update_class(hdev);
-                        update_name(hdev, hdev->dev_name);
-                        update_eir(hdev);
-                }
-        } else {
-                u8 status = MGMT_STATUS_NOT_POWERED;
-                u8 zero_cod[] = { 0, 0, 0 };
+        if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+                struct hci_cp_write_le_host_supported cp;
 
-                mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
+                cp.le = 1;
+                cp.simul = lmp_le_br_capable(hdev);
 
-                if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
-                        mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
-                                   zero_cod, sizeof(zero_cod), NULL);
+                /* Check first if we already have the right
+                 * host state (host features set)
+                 */
+                if (cp.le != lmp_host_le_capable(hdev) ||
+                    cp.simul != lmp_host_le_br_capable(hdev))
+                        hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
+                                    sizeof(cp), &cp);
         }
 
+        link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
+        if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
+                hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
+                            sizeof(link_sec), &link_sec);
+
+        if (lmp_bredr_capable(hdev)) {
+                set_bredr_scan(&req);
+                update_class(&req);
+                update_name(&req);
+                update_eir(&req);
+        }
+
+        return hci_req_run(&req, powered_complete);
+}
+
+int mgmt_powered(struct hci_dev *hdev, u8 powered)
+{
+        struct cmd_lookup match = { NULL, hdev };
+        u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
+        u8 zero_cod[] = { 0, 0, 0 };
+        int err;
+
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
+                return 0;
+
+        if (powered) {
+                if (powered_update_hci(hdev) == 0)
+                        return 0;
+
+                mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
+                                     &match);
+                goto new_settings;
+        }
+
+        mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
+        mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
+
+        if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
+                mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
+                           zero_cod, sizeof(zero_cod), NULL);
+
+new_settings:
         err = new_settings(hdev, match.sk);
 
         if (match.sk)
@@ -3152,7 +3441,7 @@ int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
 
 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
 {
-        struct cmd_lookup match = { NULL, hdev };
+        struct pending_cmd *cmd;
         bool changed = false;
         int err = 0;
 
@@ -3164,14 +3453,10 @@ int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
                         changed = true;
         }
 
-        mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
-                             &match);
+        cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 
         if (changed)
-                err = new_settings(hdev, match.sk);
-
-        if (match.sk)
-                sock_put(match.sk);
+                err = new_settings(hdev, cmd ? cmd->sk : NULL);
 
         return err;
 }
@@ -3555,23 +3840,25 @@ int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
         return err;
 }
 
-static int clear_eir(struct hci_dev *hdev)
+static void clear_eir(struct hci_request *req)
 {
+        struct hci_dev *hdev = req->hdev;
         struct hci_cp_write_eir cp;
 
         if (!lmp_ext_inq_capable(hdev))
-                return 0;
+                return;
 
         memset(hdev->eir, 0, sizeof(hdev->eir));
 
         memset(&cp, 0, sizeof(cp));
 
-        return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+        hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 }
 
 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
 {
         struct cmd_lookup match = { NULL, hdev };
+        struct hci_request req;
         bool changed = false;
         int err = 0;
 
@@ -3604,29 +3891,26 @@ int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
         if (match.sk)
                 sock_put(match.sk);
 
+        hci_req_init(&req, hdev);
+
         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
-                update_eir(hdev);
+                update_eir(&req);
         else
-                clear_eir(hdev);
+                clear_eir(&req);
+
+        hci_req_run(&req, NULL);
 
         return err;
 }
 
-static void class_rsp(struct pending_cmd *cmd, void *data)
+static void sk_lookup(struct pending_cmd *cmd, void *data)
 {
         struct cmd_lookup *match = data;
 
-        cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
-                     match->hdev->dev_class, 3);
-
-        list_del(&cmd->list);
-
         if (match->sk == NULL) {
                 match->sk = cmd->sk;
                 sock_hold(match->sk);
         }
-
-        mgmt_pending_free(cmd);
 }
 
 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
@@ -3635,11 +3919,9 @@ int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
         int err = 0;
 
-        clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
-
-        mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
-        mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
-        mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
+        mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
+        mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
+        mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
 
         if (!status)
                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
@@ -3653,55 +3935,29 @@ int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
 
 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
 {
-        struct pending_cmd *cmd;
         struct mgmt_cp_set_local_name ev;
-        bool changed = false;
-        int err = 0;
+        struct pending_cmd *cmd;
 
-        if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
-                memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
-                changed = true;
-        }
+        if (status)
+                return 0;
 
         memset(&ev, 0, sizeof(ev));
         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
 
         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
-        if (!cmd)
-                goto send_event;
-
-        /* Always assume that either the short or the complete name has
-         * changed if there was a pending mgmt command */
-        changed = true;
+        if (!cmd) {
+                memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
 
-        if (status) {
-                err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
-                                 mgmt_status(status));
-                goto failed;
+                /* If this is a HCI command related to powering on the
+                 * HCI dev don't send any mgmt signals.
+                 */
+                if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
+                        return 0;
         }
 
-        err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
-                           sizeof(ev));
-        if (err < 0)
-                goto failed;
-
-send_event:
-        if (changed)
-                err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
-                                 sizeof(ev), cmd ? cmd->sk : NULL);
-
-        /* EIR is taken care of separately when powering on the
-         * adapter so only update them here if this is a name change
-         * unrelated to power on.
-         */
-        if (!test_bit(HCI_INIT, &hdev->flags))
-                update_eir(hdev);
-
-failed:
-        if (cmd)
-                mgmt_pending_remove(cmd);
-        return err;
+        return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
+                          cmd ? cmd->sk : NULL);
 }
 
 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index b23e2713fea8..ca957d34b0c8 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -69,7 +69,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
                                                         u8 sec_level,
                                                         int *err);
 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
-static void rfcomm_session_del(struct rfcomm_session *s);
+static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
 
 /* ---- RFCOMM frame parsing macros ---- */
 #define __get_dlci(b)     ((b & 0xfc) >> 2)
@@ -108,12 +108,6 @@ static void rfcomm_schedule(void)
         wake_up_process(rfcomm_thread);
 }
 
-static void rfcomm_session_put(struct rfcomm_session *s)
-{
-        if (atomic_dec_and_test(&s->refcnt))
-                rfcomm_session_del(s);
-}
-
 /* ---- RFCOMM FCS computation ---- */
 
 /* reversed, 8-bit, poly=0x07 */
@@ -249,16 +243,14 @@ static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
 {
         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
 
-        if (!mod_timer(&s->timer, jiffies + timeout))
-                rfcomm_session_hold(s);
+        mod_timer(&s->timer, jiffies + timeout);
 }
 
 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 {
         BT_DBG("session %p state %ld", s, s->state);
 
-        if (del_timer(&s->timer))
-                rfcomm_session_put(s);
+        del_timer_sync(&s->timer);
 }
 
 /* ---- RFCOMM DLCs ---- */
@@ -336,8 +328,6 @@ static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 {
         BT_DBG("dlc %p session %p", d, s);
 
-        rfcomm_session_hold(s);
-
         rfcomm_session_clear_timer(s);
         rfcomm_dlc_hold(d);
         list_add(&d->list, &s->dlcs);
@@ -356,8 +346,6 @@ static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 
         if (list_empty(&s->dlcs))
                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
-
-        rfcomm_session_put(s);
 }
 
 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
@@ -493,12 +481,34 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 
 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 {
-        int r;
+        int r = 0;
+        struct rfcomm_dlc *d_list;
+        struct rfcomm_session *s, *s_list;
+
+        BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
 
         rfcomm_lock();
 
-        r = __rfcomm_dlc_close(d, err);
+        s = d->session;
+        if (!s)
+                goto no_session;
+
+        /* after waiting on the mutex check the session still exists
+         * then check the dlc still exists
+         */
+        list_for_each_entry(s_list, &session_list, list) {
+                if (s_list == s) {
+                        list_for_each_entry(d_list, &s->dlcs, list) {
+                                if (d_list == d) {
+                                        r = __rfcomm_dlc_close(d, err);
+                                        break;
+                                }
+                        }
+                        break;
+                }
+        }
 
+no_session:
         rfcomm_unlock();
         return r;
 }
@@ -609,7 +619,7 @@ static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
         return s;
 }
 
-static void rfcomm_session_del(struct rfcomm_session *s)
+static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
 {
         int state = s->state;
 
@@ -617,15 +627,14 @@ static void rfcomm_session_del(struct rfcomm_session *s)
 
         list_del(&s->list);
 
-        if (state == BT_CONNECTED)
-                rfcomm_send_disc(s, 0);
-
         rfcomm_session_clear_timer(s);
         sock_release(s->sock);
         kfree(s);
 
         if (state != BT_LISTEN)
                 module_put(THIS_MODULE);
+
+        return NULL;
 }
 
 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
@@ -644,17 +653,16 @@ static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
         return NULL;
 }
 
-static void rfcomm_session_close(struct rfcomm_session *s, int err)
+static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
+                                                   int err)
 {
         struct rfcomm_dlc *d;
         struct list_head *p, *n;
 
-        BT_DBG("session %p state %ld err %d", s, s->state, err);
-
-        rfcomm_session_hold(s);
-
         s->state = BT_CLOSED;
 
+        BT_DBG("session %p state %ld err %d", s, s->state, err);
+
         /* Close all dlcs */
         list_for_each_safe(p, n, &s->dlcs) {
                 d = list_entry(p, struct rfcomm_dlc, list);
@@ -663,7 +671,7 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
         }
 
         rfcomm_session_clear_timer(s);
-        rfcomm_session_put(s);
+        return rfcomm_session_del(s);
 }
 
 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
@@ -715,8 +723,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         if (*err == 0 || *err == -EINPROGRESS)
                 return s;
 
-        rfcomm_session_del(s);
-        return NULL;
+        return rfcomm_session_del(s);
 
 failed:
         sock_release(sock);
@@ -1105,7 +1112,7 @@ static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
 }
 
 /* ---- RFCOMM frame reception ---- */
-static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
+static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
 {
         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
 
@@ -1114,7 +1121,7 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
                 if (!d) {
                         rfcomm_send_dm(s, dlci);
-                        return 0;
+                        return s;
                 }
 
                 switch (d->state) {
@@ -1150,25 +1157,14 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                         break;
 
                 case BT_DISCONN:
-                        /* rfcomm_session_put is called later so don't do
-                         * anything here otherwise we will mess up the session
-                         * reference counter:
-                         *
-                         * (a) when we are the initiator dlc_unlink will drive
-                         * the reference counter to 0 (there is no initial put
-                         * after session_add)
-                         *
-                         * (b) when we are not the initiator rfcomm_rx_process
-                         * will explicitly call put to balance the initial hold
-                         * done after session add.
-                         */
+                        s = rfcomm_session_close(s, ECONNRESET);
                         break;
                 }
         }
-        return 0;
+        return s;
 }
 
-static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
+static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
 {
         int err = 0;
 
@@ -1192,13 +1188,13 @@ static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
                 else
                         err = ECONNRESET;
 
-                s->state = BT_CLOSED;
-                rfcomm_session_close(s, err);
+                s = rfcomm_session_close(s, err);
         }
-        return 0;
+        return s;
 }
 
-static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
+static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
+                                               u8 dlci)
 {
         int err = 0;
 
@@ -1227,11 +1223,9 @@ static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
                 else
                         err = ECONNRESET;
 
-                s->state = BT_CLOSED;
-                rfcomm_session_close(s, err);
+                s = rfcomm_session_close(s, err);
         }
-
-        return 0;
+        return s;
 }
 
 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
@@ -1652,11 +1646,18 @@ drop:
         return 0;
 }
 
-static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
+static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
+                                                struct sk_buff *skb)
 {
         struct rfcomm_hdr *hdr = (void *) skb->data;
         u8 type, dlci, fcs;
 
+        if (!s) {
+                /* no session, so free socket data */
+                kfree_skb(skb);
+                return s;
+        }
+
         dlci = __get_dlci(hdr->addr);
         type = __get_type(hdr->ctrl);
 
@@ -1667,7 +1668,7 @@ static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
         if (__check_fcs(skb->data, type, fcs)) {
                 BT_ERR("bad checksum in packet");
                 kfree_skb(skb);
-                return -EILSEQ;
+                return s;
         }
 
         if (__test_ea(hdr->len))
@@ -1683,22 +1684,23 @@ static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
 
         case RFCOMM_DISC:
                 if (__test_pf(hdr->ctrl))
-                        rfcomm_recv_disc(s, dlci);
+                        s = rfcomm_recv_disc(s, dlci);
                 break;
 
         case RFCOMM_UA:
                 if (__test_pf(hdr->ctrl))
-                        rfcomm_recv_ua(s, dlci);
+                        s = rfcomm_recv_ua(s, dlci);
                 break;
 
         case RFCOMM_DM:
-                rfcomm_recv_dm(s, dlci);
+                s = rfcomm_recv_dm(s, dlci);
                 break;
 
         case RFCOMM_UIH:
-                if (dlci)
-                        return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
-
+                if (dlci) {
+                        rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
+                        return s;
+                }
                 rfcomm_recv_mcc(s, skb);
                 break;
 
@@ -1707,7 +1709,7 @@ static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
                 break;
         }
         kfree_skb(skb);
-        return 0;
+        return s;
 }
 
 /* ---- Connection and data processing ---- */
@@ -1844,7 +1846,7 @@ static void rfcomm_process_dlcs(struct rfcomm_session *s)
         }
 }
 
-static void rfcomm_process_rx(struct rfcomm_session *s)
+static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
 {
         struct socket *sock = s->sock;
         struct sock *sk = sock->sk;
@@ -1856,17 +1858,15 @@ static void rfcomm_process_rx(struct rfcomm_session *s)
         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
                 skb_orphan(skb);
                 if (!skb_linearize(skb))
-                        rfcomm_recv_frame(s, skb);
+                        s = rfcomm_recv_frame(s, skb);
                 else
                         kfree_skb(skb);
         }
 
-        if (sk->sk_state == BT_CLOSED) {
-                if (!s->initiator)
-                        rfcomm_session_put(s);
+        if (s && (sk->sk_state == BT_CLOSED))
+                s = rfcomm_session_close(s, sk->sk_err);
 
-                rfcomm_session_close(s, sk->sk_err);
-        }
+        return s;
 }
 
 static void rfcomm_accept_connection(struct rfcomm_session *s)
@@ -1891,8 +1891,6 @@ static void rfcomm_accept_connection(struct rfcomm_session *s)
 
         s = rfcomm_session_add(nsock, BT_OPEN);
         if (s) {
-                rfcomm_session_hold(s);
-
                 /* We should adjust MTU on incoming sessions.
                  * L2CAP MTU minus UIH header and FCS. */
                 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
@@ -1903,7 +1901,7 @@ static void rfcomm_accept_connection(struct rfcomm_session *s)
                 sock_release(nsock);
 }
 
-static void rfcomm_check_connection(struct rfcomm_session *s)
+static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
 {
         struct sock *sk = s->sock->sk;
 
@@ -1921,10 +1919,10 @@ static void rfcomm_check_connection(struct rfcomm_session *s)
                 break;
 
         case BT_CLOSED:
-                s->state = BT_CLOSED;
-                rfcomm_session_close(s, sk->sk_err);
+                s = rfcomm_session_close(s, sk->sk_err);
                 break;
         }
+        return s;
 }
 
 static void rfcomm_process_sessions(void)
@@ -1940,7 +1938,6 @@ static void rfcomm_process_sessions(void)
                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
                         s->state = BT_DISCONN;
                         rfcomm_send_disc(s, 0);
-                        rfcomm_session_put(s);
                         continue;
                 }
 
@@ -1949,21 +1946,18 @@ static void rfcomm_process_sessions(void)
                         continue;
                 }
 
-                rfcomm_session_hold(s);
-
                 switch (s->state) {
                 case BT_BOUND:
-                        rfcomm_check_connection(s);
+                        s = rfcomm_check_connection(s);
                         break;
 
                 default:
-                        rfcomm_process_rx(s);
+                        s = rfcomm_process_rx(s);
                         break;
                 }
 
-                rfcomm_process_dlcs(s);
-
-                rfcomm_session_put(s);
+                if (s)
+                        rfcomm_process_dlcs(s);
         }
 
         rfcomm_unlock();
@@ -2010,10 +2004,11 @@ static int rfcomm_add_listener(bdaddr_t *ba)
 
         /* Add listening session */
         s = rfcomm_session_add(sock, BT_LISTEN);
-        if (!s)
+        if (!s) {
+                err = -ENOMEM;
                 goto failed;
+        }
 
-        rfcomm_session_hold(s);
         return 0;
 failed:
         sock_release(sock);
@@ -2071,8 +2066,6 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
         if (!s)
                 return;
 
-        rfcomm_session_hold(s);
-
         list_for_each_safe(p, n, &s->dlcs) {
                 d = list_entry(p, struct rfcomm_dlc, list);
 
@@ -2104,8 +2097,6 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
         }
 
-        rfcomm_session_put(s);
-
         rfcomm_schedule();
 }
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c23bae86263b..3786ddc45152 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1065,8 +1065,7 @@ void __exit rfcomm_cleanup_sockets(void)
 
         debugfs_remove(rfcomm_sock_debugfs);
 
-        if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
-                BT_ERR("RFCOMM socket layer unregistration failed");
+        bt_sock_unregister(BTPROTO_RFCOMM);
 
         proto_unregister(&rfcomm_proto);
 }
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 79d87d8d4f51..d919d1161ab4 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -359,6 +359,7 @@ static void __sco_sock_close(struct sock *sk)
                         sco_chan_del(sk, ECONNRESET);
                 break;
 
+        case BT_CONNECT2:
         case BT_CONNECT:
         case BT_DISCONN:
                 sco_chan_del(sk, ECONNRESET);
@@ -1111,8 +1112,7 @@ void __exit sco_exit(void)
 
         debugfs_remove(sco_debugfs);
 
-        if (bt_sock_unregister(BTPROTO_SCO) < 0)
-                BT_ERR("SCO socket unregistration failed");
+        bt_sock_unregister(BTPROTO_SCO);
 
         proto_unregister(&sco_proto);
 }
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 1ae1d9cb278d..21760f008974 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -118,7 +118,7 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
         return NULL;
 }
 
-void caif_flow_cb(struct sk_buff *skb)
+static void caif_flow_cb(struct sk_buff *skb)
 {
         struct caif_device_entry *caifd;
         void (*dtor)(struct sk_buff *skb) = NULL;
diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
index 3ebc8cbc91ff..ef8ebaa993cf 100644
--- a/net/caif/caif_usb.c
+++ b/net/caif/caif_usb.c
@@ -81,8 +81,8 @@ static void cfusbl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
                 layr->up->ctrlcmd(layr->up, ctrl, layr->id);
 }
 
-struct cflayer *cfusbl_create(int phyid, u8 ethaddr[ETH_ALEN],
-                                        u8 braddr[ETH_ALEN])
+static struct cflayer *cfusbl_create(int phyid, u8 ethaddr[ETH_ALEN],
+                                      u8 braddr[ETH_ALEN])
 {
         struct cfusbl *this = kmalloc(sizeof(struct cfusbl), GFP_ATOMIC);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index a06a7a58dd11..8f152f904f70 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4103,7 +4103,7 @@ static void net_rx_action(struct softirq_action *h)
                  * Allow this to run for 2 jiffies since which will allow
                  * an average latency of 1.5/HZ.
                  */
-                if (unlikely(budget <= 0 || time_after(jiffies, time_limit)))
+                if (unlikely(budget <= 0 || time_after_eq(jiffies, time_limit)))
                         goto softnet_break;
 
                 local_irq_enable();
@@ -4780,7 +4780,7 @@ EXPORT_SYMBOL(dev_set_mac_address);
 /**
  *      dev_change_carrier - Change device carrier
  *      @dev: device
- *      @new_carries: new value
+ *      @new_carrier: new value
  *
  *      Change device carrier
  */
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 87abd3e2bd32..2bdf802e28e2 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -228,9 +228,11 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
                                         icmp_send(skb, ICMP_DEST_UNREACH,
                                                   ICMP_PROT_UNREACH, 0);
                                 }
-                        } else
+                                kfree_skb(skb);
+                        } else {
                                 IP_INC_STATS_BH(net, IPSTATS_MIB_INDELIVERS);
-                        kfree_skb(skb);
+                                consume_skb(skb);
+                        }
                 }
         }
  out:
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index f6289bf6f332..310a3647c83d 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -423,7 +423,7 @@ int ip_options_compile(struct net *net,
                                         put_unaligned_be32(midtime, timeptr);
                                         opt->is_changed = 1;
                                 }
-                        } else {
+                        } else if ((optptr[3]&0xF) != IPOPT_TS_PRESPEC) {
                                 unsigned int overflow = optptr[3]>>4;
                                 if (overflow == 15) {
                                         pp_ptr = optptr + 3;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a759e19496d2..0d9bdacce99f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5485,6 +5485,9 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                 if (tcp_checksum_complete_user(sk, skb))
                                         goto csum_error;
 
+                                if ((int)skb->truesize > sk->sk_forward_alloc)
+                                        goto step5;
+
                                 /* Predicted packet is in window by definition.
                                  * seq == rcv_nxt and rcv_wup <= rcv_nxt.
                                  * Hence, check seq<=rcv_wup reduces to:
@@ -5496,9 +5499,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 
                                 tcp_rcv_rtt_measure_ts(sk, skb);
 
-                                if ((int)skb->truesize > sk->sk_forward_alloc)
-                                        goto step5;
-
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPHPHITS);
 
                                 /* Bulk data transfer: receiver */
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 5b10414e619e..b1876e52091e 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -241,9 +241,11 @@ resubmit:
                                 icmpv6_send(skb, ICMPV6_PARAMPROB,
                                             ICMPV6_UNK_NEXTHDR, nhoff);
                         }
-                } else
+                        kfree_skb(skb);
+                } else {
                         IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDELIVERS);
-                kfree_skb(skb);
+                        consume_skb(skb);
+                }
         }
         rcu_read_unlock();
         return 0;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 928266569689..e5fe0041adfa 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1915,7 +1915,8 @@ void rt6_purge_dflt_routers(struct net *net)
 restart:
         read_lock_bh(&table->tb6_lock);
         for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
-                if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) {
+                if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
+                    (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
                         dst_hold(&rt->dst);
                         read_unlock_bh(&table->tb6_lock);
                         ip6_del_rt(rt);
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 9a5fd3c3e530..362ba47968e4 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -280,7 +280,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
         struct tty_port *port = &self->port;
         DECLARE_WAITQUEUE(wait, current);
         int             retval;
-        int             do_clocal = 0, extra_count = 0;
+        int             do_clocal = 0;
         unsigned long   flags;
 
         IRDA_DEBUG(2, "%s()\n", __func__ );
@@ -289,8 +289,15 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
          * If non-blocking mode is set, or the port is not enabled,
          * then make the check up front and then exit.
          */
-        if (filp->f_flags & O_NONBLOCK || tty->flags & (1 << TTY_IO_ERROR)){
-                /* nonblock mode is set or port is not enabled */
+        if (test_bit(TTY_IO_ERROR, &tty->flags)) {
+                port->flags |= ASYNC_NORMAL_ACTIVE;
+                return 0;
+        }
+
+        if (filp->f_flags & O_NONBLOCK) {
+                /* nonblock mode is set */
+                if (tty->termios.c_cflag & CBAUD)
+                        tty_port_raise_dtr_rts(port);
                 port->flags |= ASYNC_NORMAL_ACTIVE;
                 IRDA_DEBUG(1, "%s(), O_NONBLOCK requested!\n", __func__ );
                 return 0;
@@ -315,18 +322,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
               __FILE__, __LINE__, tty->driver->name, port->count);
 
         spin_lock_irqsave(&port->lock, flags);
-        if (!tty_hung_up_p(filp)) {
-                extra_count = 1;
+        if (!tty_hung_up_p(filp))
                 port->count--;
-        }
-        spin_unlock_irqrestore(&port->lock, flags);
         port->blocked_open++;
+        spin_unlock_irqrestore(&port->lock, flags);
 
         while (1) {
                 if (tty->termios.c_cflag & CBAUD)
                         tty_port_raise_dtr_rts(port);
 
-                current->state = TASK_INTERRUPTIBLE;
+                set_current_state(TASK_INTERRUPTIBLE);
 
                 if (tty_hung_up_p(filp) ||
                     !test_bit(ASYNCB_INITIALIZED, &port->flags)) {
@@ -361,13 +366,11 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
         __set_current_state(TASK_RUNNING);
         remove_wait_queue(&port->open_wait, &wait);
 
-        if (extra_count) {
-                /* ++ is not atomic, so this should be protected - Jean II */
-                spin_lock_irqsave(&port->lock, flags);
+        spin_lock_irqsave(&port->lock, flags);
+        if (!tty_hung_up_p(filp))
                 port->count++;
-                spin_unlock_irqrestore(&port->lock, flags);
-        }
         port->blocked_open--;
+        spin_unlock_irqrestore(&port->lock, flags);
 
         IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
               __FILE__, __LINE__, tty->driver->name, port->count);
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index e71e85ba2bf1..29340a9a6fb9 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -495,8 +495,11 @@ static void iriap_getvaluebyclass_confirm(struct iriap_cb *self,
 /*              case CS_ISO_8859_9: */
 /*              case CS_UNICODE: */
                 default:
-                        IRDA_DEBUG(0, "%s(), charset %s, not supported\n",
-                                   __func__, ias_charset_types[charset]);
+                        IRDA_DEBUG(0, "%s(), charset [%d] %s, not supported\n",
+                                   __func__, charset,
+                                   charset < ARRAY_SIZE(ias_charset_types) ?
+                                        ias_charset_types[charset] :
+                                        "(unknown)");
 
                         /* Aborting, close connection! */
                         iriap_disconnect_request(self);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 3f4e3afc191a..6a53371dba1f 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -355,6 +355,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
         l2tp_xmit_skb(session, skb, session->hdr_len);
 
         sock_put(ps->tunnel_sock);
+        sock_put(sk);
 
         return error;
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 72ab1c0e3ca7..490990e3fc38 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2661,7 +2661,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
                         list_del(&dep->list);
                         mutex_unlock(&local->mtx);
 
-                        ieee80211_roc_notify_destroy(dep);
+                        ieee80211_roc_notify_destroy(dep, true);
                         return 0;
                 }
 
@@ -2701,7 +2701,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
                         ieee80211_start_next_roc(local);
                 mutex_unlock(&local->mtx);
 
-                ieee80211_roc_notify_destroy(found);
+                ieee80211_roc_notify_destroy(found, true);
         } else {
                 /* work may be pending so use it all the time */
                 found->abort = true;
@@ -2711,6 +2711,8 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
 
                 /* work will clean up etc */
                 flush_delayed_work(&found->work);
+                WARN_ON(!found->to_be_freed);
+                kfree(found);
         }
 
         return 0;
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 166165efd8e2..03e8d2e3270e 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -79,6 +79,7 @@ ieee80211_new_chanctx(struct ieee80211_local *local,
                       enum ieee80211_chanctx_mode mode)
 {
         struct ieee80211_chanctx *ctx;
+        u32 changed;
         int err;
 
         lockdep_assert_held(&local->chanctx_mtx);
@@ -95,6 +96,13 @@ ieee80211_new_chanctx(struct ieee80211_local *local,
         if (!local->use_chanctx)
                 local->hw.conf.radar_enabled = ctx->conf.radar_enabled;
 
+        /* acquire mutex to prevent idle from changing */
+        mutex_lock(&local->mtx);
+        /* turn idle off *before* setting channel -- some drivers need that */
+        changed = ieee80211_idle_off(local);
+        if (changed)
+                ieee80211_hw_config(local, changed);
+
         if (!local->use_chanctx) {
                 local->_oper_chandef = *chandef;
                 ieee80211_hw_config(local, 0);
@@ -102,14 +110,17 @@ ieee80211_new_chanctx(struct ieee80211_local *local,
                 err = drv_add_chanctx(local, ctx);
                 if (err) {
                         kfree(ctx);
-                        return ERR_PTR(err);
+                        ctx = ERR_PTR(err);
+
+                        ieee80211_recalc_idle(local);
+                        goto out;
                 }
         }
 
+        /* and keep the mutex held until the new chanctx is on the list */
         list_add_rcu(&ctx->list, &local->chanctx_list);
 
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
+ out:
         mutex_unlock(&local->mtx);
 
         return ctx;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 21c1720eee00..af8410e1291e 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -309,6 +309,7 @@ struct ieee80211_roc_work {
         struct ieee80211_channel *chan;
 
         bool started, abort, hw_begun, notified;
+        bool to_be_freed;
 
         unsigned long hw_start_time;
 
@@ -1318,7 +1319,7 @@ void ieee80211_roc_setup(struct ieee80211_local *local);
 void ieee80211_start_next_roc(struct ieee80211_local *local);
 void ieee80211_roc_purge(struct ieee80211_local *local,
                          struct ieee80211_sub_if_data *sdata);
-void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc);
+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free);
 void ieee80211_sw_roc_work(struct work_struct *work);
 void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
 
@@ -1332,6 +1333,7 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                              enum nl80211_iftype type);
 void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata);
 void ieee80211_remove_interfaces(struct ieee80211_local *local);
+u32 ieee80211_idle_off(struct ieee80211_local *local);
 void ieee80211_recalc_idle(struct ieee80211_local *local);
 void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
                                     const int offset);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index b6abaaa3676f..146b1320af4e 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -78,7 +78,7 @@ void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_TXPOWER);
 }
 
-static u32 ieee80211_idle_off(struct ieee80211_local *local)
+u32 ieee80211_idle_off(struct ieee80211_local *local)
 {
         if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
                 return 0;
@@ -349,21 +349,19 @@ static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
 int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
-        int ret = 0;
+        int ret;
 
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return 0;
 
-        mutex_lock(&local->iflist_mtx);
+        ASSERT_RTNL();
 
         if (local->monitor_sdata)
-                goto out_unlock;
+                return 0;
 
         sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
-        if (!sdata) {
-                ret = -ENOMEM;
-                goto out_unlock;
-        }
+        if (!sdata)
+                return -ENOMEM;
 
         /* set up data */
         sdata->local = local;
@@ -377,13 +375,13 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (WARN_ON(ret)) {
                 /* ok .. stupid driver, it asked for this! */
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
         ret = ieee80211_check_queues(sdata);
         if (ret) {
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
         ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
@@ -391,13 +389,14 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (ret) {
                 drv_remove_interface(local, sdata);
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
+        mutex_lock(&local->iflist_mtx);
         rcu_assign_pointer(local->monitor_sdata, sdata);
- out_unlock:
         mutex_unlock(&local->iflist_mtx);
-        return ret;
+
+        return 0;
 }
 
 void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
@@ -407,14 +406,20 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return;
 
+        ASSERT_RTNL();
+
         mutex_lock(&local->iflist_mtx);
 
         sdata = rcu_dereference_protected(local->monitor_sdata,
                                           lockdep_is_held(&local->iflist_mtx));
-        if (!sdata)
-                goto out_unlock;
+        if (!sdata) {
+                mutex_unlock(&local->iflist_mtx);
+                return;
+        }
 
         rcu_assign_pointer(local->monitor_sdata, NULL);
+        mutex_unlock(&local->iflist_mtx);
+
         synchronize_net();
 
         ieee80211_vif_release_channel(sdata);
@@ -422,8 +427,6 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         drv_remove_interface(local, sdata);
 
         kfree(sdata);
- out_unlock:
-        mutex_unlock(&local->iflist_mtx);
 }
 
 /*
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 4b984765d62d..6952760881c8 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1004,7 +1004,8 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                if (ieee80211_vif_is_mesh(&sdata->vif))
+                if (ieee80211_vif_is_mesh(&sdata->vif) &&
+                    ieee80211_sdata_running(sdata))
                         ieee80211_queue_work(&local->hw, &sdata->work);
         rcu_read_unlock();
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index c7860d0450dd..f7beb12abde2 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3665,8 +3665,10 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 
         /* Restart STA timers */
         rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                ieee80211_restart_sta_timer(sdata);
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (ieee80211_sdata_running(sdata))
+                        ieee80211_restart_sta_timer(sdata);
+        }
         rcu_read_unlock();
 }
 
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index e19d6cf26dde..acd1f71adc03 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -297,10 +297,13 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
         }
 }
 
-void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free)
 {
         struct ieee80211_roc_work *dep, *tmp;
 
+        if (WARN_ON(roc->to_be_freed))
+                return;
+
         /* was never transmitted */
         if (roc->frame) {
                 cfg80211_mgmt_tx_status(&roc->sdata->wdev,
@@ -316,9 +319,12 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
                                                    GFP_KERNEL);
 
         list_for_each_entry_safe(dep, tmp, &roc->dependents, list)
-                ieee80211_roc_notify_destroy(dep);
+                ieee80211_roc_notify_destroy(dep, true);
 
-        kfree(roc);
+        if (free)
+                kfree(roc);
+        else
+                roc->to_be_freed = true;
 }
 
 void ieee80211_sw_roc_work(struct work_struct *work)
@@ -331,6 +337,9 @@ void ieee80211_sw_roc_work(struct work_struct *work)
 
         mutex_lock(&local->mtx);
 
+        if (roc->to_be_freed)
+                goto out_unlock;
+
         if (roc->abort)
                 goto finish;
 
@@ -370,7 +379,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
  finish:
                 list_del(&roc->list);
                 started = roc->started;
-                ieee80211_roc_notify_destroy(roc);
+                ieee80211_roc_notify_destroy(roc, !roc->abort);
 
                 if (started) {
                         ieee80211_flush_queues(local, NULL);
@@ -410,7 +419,7 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
 
         list_del(&roc->list);
 
-        ieee80211_roc_notify_destroy(roc);
+        ieee80211_roc_notify_destroy(roc, true);
 
         /* if there's another roc, start it now */
         ieee80211_start_next_roc(local);
@@ -460,12 +469,14 @@ void ieee80211_roc_purge(struct ieee80211_local *local,
         list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
                 if (local->ops->remain_on_channel) {
                         list_del(&roc->list);
-                        ieee80211_roc_notify_destroy(roc);
+                        ieee80211_roc_notify_destroy(roc, true);
                 } else {
                         ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
 
                         /* work will clean up etc */
                         flush_delayed_work(&roc->work);
+                        WARN_ON(!roc->to_be_freed);
+                        kfree(roc);
                 }
         }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 14b32a4cd7bb..c8447af76ead 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2679,7 +2679,19 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
 
                 memset(nskb->cb, 0, sizeof(nskb->cb));
 
-                ieee80211_tx_skb(rx->sdata, nskb);
+                if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
+
+                        info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
+                                      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
+                                      IEEE80211_TX_CTL_NO_CCK_RATE;
+                        if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                                info->hw_queue =
+                                        local->hw.offchannel_tx_hw_queue;
+                }
+
+                __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
+                                            status->band);
         }
         dev_kfree_skb(rx->skb);
         return RX_QUEUED;
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index f82b2e606cfd..1ba9dbc0e107 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1470,7 +1470,8 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb,
         if (ret == -EAGAIN)
                 ret = 1;
 
-        return ret < 0 ? ret : ret > 0 ? 0 : -IPSET_ERR_EXIST;
+        return (ret < 0 && ret != -ENOTEMPTY) ? ret :
+                ret > 0 ? 0 : -IPSET_ERR_EXIST;
 }
 
 /* Get headed data of a set */
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index c6bc3bd95052..b75a9b3f9e89 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -117,6 +117,88 @@ u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length)
         return tlv;
 }
 
+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap)
+{
+        struct nfc_llcp_sdp_tlv *sdres;
+        u8 value[2];
+
+        sdres = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
+        if (sdres == NULL)
+                return NULL;
+
+        value[0] = tid;
+        value[1] = sap;
+
+        sdres->tlv = nfc_llcp_build_tlv(LLCP_TLV_SDRES, value, 2,
+                                        &sdres->tlv_len);
+        if (sdres->tlv == NULL) {
+                kfree(sdres);
+                return NULL;
+        }
+
+        sdres->tid = tid;
+        sdres->sap = sap;
+
+        INIT_HLIST_NODE(&sdres->node);
+
+        return sdres;
+}
+
+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
+                                                  size_t uri_len)
+{
+        struct nfc_llcp_sdp_tlv *sdreq;
+
+        pr_debug("uri: %s, len: %zu\n", uri, uri_len);
+
+        sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
+        if (sdreq == NULL)
+                return NULL;
+
+        sdreq->tlv_len = uri_len + 3;
+
+        if (uri[uri_len - 1] == 0)
+                sdreq->tlv_len--;
+
+        sdreq->tlv = kzalloc(sdreq->tlv_len + 1, GFP_KERNEL);
+        if (sdreq->tlv == NULL) {
+                kfree(sdreq);
+                return NULL;
+        }
+
+        sdreq->tlv[0] = LLCP_TLV_SDREQ;
+        sdreq->tlv[1] = sdreq->tlv_len - 2;
+        sdreq->tlv[2] = tid;
+
+        sdreq->tid = tid;
+        sdreq->uri = sdreq->tlv + 3;
+        memcpy(sdreq->uri, uri, uri_len);
+
+        sdreq->time = jiffies;
+
+        INIT_HLIST_NODE(&sdreq->node);
+
+        return sdreq;
+}
+
+void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp)
+{
+        kfree(sdp->tlv);
+        kfree(sdp);
+}
+
+void nfc_llcp_free_sdp_tlv_list(struct hlist_head *head)
+{
+        struct nfc_llcp_sdp_tlv *sdp;
+        struct hlist_node *n;
+
+        hlist_for_each_entry_safe(sdp, n, head, node) {
+                hlist_del(&sdp->node);
+
+                nfc_llcp_free_sdp_tlv(sdp);
+        }
+}
+
 int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
                           u8 *tlv_array, u16 tlv_array_len)
 {
@@ -184,10 +266,10 @@ int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
 
                 switch (type) {
                 case LLCP_TLV_MIUX:
-                        sock->miu = llcp_tlv_miux(tlv) + 128;
+                        sock->remote_miu = llcp_tlv_miux(tlv) + 128;
                         break;
                 case LLCP_TLV_RW:
-                        sock->rw = llcp_tlv_rw(tlv);
+                        sock->remote_rw = llcp_tlv_rw(tlv);
                         break;
                 case LLCP_TLV_SN:
                         break;
@@ -200,7 +282,8 @@ int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
                 tlv += length + 2;
         }
 
-        pr_debug("sock %p rw %d miu %d\n", sock, sock->rw, sock->miu);
+        pr_debug("sock %p rw %d miu %d\n", sock,
+                 sock->remote_rw, sock->remote_miu);
 
         return 0;
 }
@@ -318,9 +401,9 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
         struct sk_buff *skb;
         u8 *service_name_tlv = NULL, service_name_tlv_length;
         u8 *miux_tlv = NULL, miux_tlv_length;
-        u8 *rw_tlv = NULL, rw_tlv_length;
+        u8 *rw_tlv = NULL, rw_tlv_length, rw;
         int err;
-        u16 size = 0;
+        u16 size = 0, miux;
 
         pr_debug("Sending CONNECT\n");
 
@@ -336,11 +419,15 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
                 size += service_name_tlv_length;
         }
 
-        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&local->miux, 0,
+        /* If the socket parameters are not set, use the local ones */
+        miux = sock->miux > LLCP_MAX_MIUX ? local->miux : sock->miux;
+        rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;
+
+        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
                                       &miux_tlv_length);
         size += miux_tlv_length;
 
-        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &local->rw, 0, &rw_tlv_length);
+        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
         size += rw_tlv_length;
 
         pr_debug("SKB size %d SN length %zu\n", size, sock->service_name_len);
@@ -377,9 +464,9 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
         struct nfc_llcp_local *local;
         struct sk_buff *skb;
         u8 *miux_tlv = NULL, miux_tlv_length;
-        u8 *rw_tlv = NULL, rw_tlv_length;
+        u8 *rw_tlv = NULL, rw_tlv_length, rw;
         int err;
-        u16 size = 0;
+        u16 size = 0, miux;
 
         pr_debug("Sending CC\n");
 
@@ -387,11 +474,15 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
         if (local == NULL)
                 return -ENODEV;
 
-        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&local->miux, 0,
+        /* If the socket parameters are not set, use the local ones */
+        miux = sock->miux > LLCP_MAX_MIUX ? local->miux : sock->miux;
+        rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;
+
+        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
                                       &miux_tlv_length);
         size += miux_tlv_length;
 
-        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &local->rw, 0, &rw_tlv_length);
+        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
         size += rw_tlv_length;
 
         skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, size);
@@ -416,48 +507,90 @@ error_tlv:
         return err;
 }
 
-int nfc_llcp_send_snl(struct nfc_llcp_local *local, u8 tid, u8 sap)
+static struct sk_buff *nfc_llcp_allocate_snl(struct nfc_llcp_local *local,
+                                             size_t tlv_length)
 {
         struct sk_buff *skb;
         struct nfc_dev *dev;
-        u8 *sdres_tlv = NULL, sdres_tlv_length, sdres[2];
         u16 size = 0;
 
-        pr_debug("Sending SNL tid 0x%x sap 0x%x\n", tid, sap);
-
         if (local == NULL)
-                return -ENODEV;
+                return ERR_PTR(-ENODEV);
 
         dev = local->dev;
         if (dev == NULL)
-                return -ENODEV;
-
-        sdres[0] = tid;
-        sdres[1] = sap;
-        sdres_tlv = nfc_llcp_build_tlv(LLCP_TLV_SDRES, sdres, 0,
-                                       &sdres_tlv_length);
-        if (sdres_tlv == NULL)
-                return -ENOMEM;
+                return ERR_PTR(-ENODEV);
 
         size += LLCP_HEADER_SIZE;
         size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
-        size += sdres_tlv_length;
+        size += tlv_length;
 
         skb = alloc_skb(size, GFP_KERNEL);
-        if (skb == NULL) {
-                kfree(sdres_tlv);
-                return -ENOMEM;
-        }
+        if (skb == NULL)
+                return ERR_PTR(-ENOMEM);
 
         skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
 
         skb = llcp_add_header(skb, LLCP_SAP_SDP, LLCP_SAP_SDP, LLCP_PDU_SNL);
 
-        memcpy(skb_put(skb, sdres_tlv_length), sdres_tlv, sdres_tlv_length);
+        return skb;
+}
+
+int nfc_llcp_send_snl_sdres(struct nfc_llcp_local *local,
+                            struct hlist_head *tlv_list, size_t tlvs_len)
+{
+        struct nfc_llcp_sdp_tlv *sdp;
+        struct hlist_node *n;
+        struct sk_buff *skb;
+
+        skb = nfc_llcp_allocate_snl(local, tlvs_len);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        hlist_for_each_entry_safe(sdp, n, tlv_list, node) {
+                memcpy(skb_put(skb, sdp->tlv_len), sdp->tlv, sdp->tlv_len);
+
+                hlist_del(&sdp->node);
+
+                nfc_llcp_free_sdp_tlv(sdp);
+        }
 
         skb_queue_tail(&local->tx_queue, skb);
 
-        kfree(sdres_tlv);
+        return 0;
+}
+
+int nfc_llcp_send_snl_sdreq(struct nfc_llcp_local *local,
+                            struct hlist_head *tlv_list, size_t tlvs_len)
+{
+        struct nfc_llcp_sdp_tlv *sdreq;
+        struct hlist_node *n;
+        struct sk_buff *skb;
+
+        skb = nfc_llcp_allocate_snl(local, tlvs_len);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        mutex_lock(&local->sdreq_lock);
+
+        if (hlist_empty(&local->pending_sdreqs))
+                mod_timer(&local->sdreq_timer,
+                          jiffies + msecs_to_jiffies(3 * local->remote_lto));
+
+        hlist_for_each_entry_safe(sdreq, n, tlv_list, node) {
+                pr_debug("tid %d for %s\n", sdreq->tid, sdreq->uri);
+
+                memcpy(skb_put(skb, sdreq->tlv_len), sdreq->tlv,
+                       sdreq->tlv_len);
+
+                hlist_del(&sdreq->node);
+
+                hlist_add_head(&sdreq->node, &local->pending_sdreqs);
+        }
+
+        mutex_unlock(&local->sdreq_lock);
+
+        skb_queue_tail(&local->tx_queue, skb);
 
         return 0;
 }
@@ -532,8 +665,8 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         /* Remote is ready but has not acknowledged our frames */
         if((sock->remote_ready &&
-            skb_queue_len(&sock->tx_pending_queue) >= sock->rw &&
-            skb_queue_len(&sock->tx_queue) >= 2 * sock->rw)) {
+            skb_queue_len(&sock->tx_pending_queue) >= sock->remote_rw &&
+            skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
                 pr_err("Pending queue is full %d frames\n",
                        skb_queue_len(&sock->tx_pending_queue));
                 return -ENOBUFS;
@@ -541,7 +674,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         /* Remote is not ready and we've been queueing enough frames */
         if ((!sock->remote_ready &&
-             skb_queue_len(&sock->tx_queue) >= 2 * sock->rw)) {
+             skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
                 pr_err("Tx queue is full %d frames\n",
                        skb_queue_len(&sock->tx_queue));
                 return -ENOBUFS;
@@ -561,7 +694,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         while (remaining_len > 0) {
 
-                frag_len = min_t(size_t, sock->miu, remaining_len);
+                frag_len = min_t(size_t, sock->remote_miu, remaining_len);
 
                 pr_debug("Fragment %zd bytes remaining %zd",
                          frag_len, remaining_len);
@@ -621,7 +754,7 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,
 
         while (remaining_len > 0) {
 
-                frag_len = min_t(size_t, sock->miu, remaining_len);
+                frag_len = min_t(size_t, sock->remote_miu, remaining_len);
 
                 pr_debug("Fragment %zd bytes remaining %zd",
                          frag_len, remaining_len);
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 7f8266dd14cb..7de0368aff0c 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -68,7 +68,8 @@ static void nfc_llcp_socket_purge(struct nfc_llcp_sock *sock)
         }
 }
 
-static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
+static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen,
+                                    int err)
 {
         struct sock *sk;
         struct hlist_node *tmp;
@@ -100,11 +101,12 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
 
                                 nfc_llcp_accept_unlink(accept_sk);
 
+                                if (err)
+                                        accept_sk->sk_err = err;
                                 accept_sk->sk_state = LLCP_CLOSED;
+                                accept_sk->sk_state_change(sk);
 
                                 bh_unlock_sock(accept_sk);
-
-                                sock_orphan(accept_sk);
                         }
 
                         if (listen == true) {
@@ -123,16 +125,45 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
                         continue;
                 }
 
+                if (err)
+                        sk->sk_err = err;
                 sk->sk_state = LLCP_CLOSED;
+                sk->sk_state_change(sk);
 
                 bh_unlock_sock(sk);
 
-                sock_orphan(sk);
-
                 sk_del_node_init(sk);
         }
 
         write_unlock(&local->sockets.lock);
+
+        /*
+         * If we want to keep the listening sockets alive,
+         * we don't touch the RAW ones.
+         */
+        if (listen == true)
+                return;
+
+        write_lock(&local->raw_sockets.lock);
+
+        sk_for_each_safe(sk, tmp, &local->raw_sockets.head) {
+                llcp_sock = nfc_llcp_sock(sk);
+
+                bh_lock_sock(sk);
+
+                nfc_llcp_socket_purge(llcp_sock);
+
+                if (err)
+                        sk->sk_err = err;
+                sk->sk_state = LLCP_CLOSED;
+                sk->sk_state_change(sk);
+
+                bh_unlock_sock(sk);
+
+                sk_del_node_init(sk);
+        }
+
+        write_unlock(&local->raw_sockets.lock);
 }
 
 struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
@@ -142,20 +173,28 @@ struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
         return local;
 }
 
-static void local_release(struct kref *ref)
+static void local_cleanup(struct nfc_llcp_local *local, bool listen)
 {
-        struct nfc_llcp_local *local;
-
-        local = container_of(ref, struct nfc_llcp_local, ref);
-
-        list_del(&local->list);
-        nfc_llcp_socket_release(local, false);
+        nfc_llcp_socket_release(local, listen, ENXIO);
         del_timer_sync(&local->link_timer);
         skb_queue_purge(&local->tx_queue);
         cancel_work_sync(&local->tx_work);
         cancel_work_sync(&local->rx_work);
         cancel_work_sync(&local->timeout_work);
         kfree_skb(local->rx_pending);
+        del_timer_sync(&local->sdreq_timer);
+        cancel_work_sync(&local->sdreq_timeout_work);
+        nfc_llcp_free_sdp_tlv_list(&local->pending_sdreqs);
+}
+
+static void local_release(struct kref *ref)
+{
+        struct nfc_llcp_local *local;
+
+        local = container_of(ref, struct nfc_llcp_local, ref);
+
+        list_del(&local->list);
+        local_cleanup(local, false);
         kfree(local);
 }
 
@@ -223,6 +262,47 @@ static void nfc_llcp_symm_timer(unsigned long data)
         schedule_work(&local->timeout_work);
 }
 
+static void nfc_llcp_sdreq_timeout_work(struct work_struct *work)
+{
+        unsigned long time;
+        HLIST_HEAD(nl_sdres_list);
+        struct hlist_node *n;
+        struct nfc_llcp_sdp_tlv *sdp;
+        struct nfc_llcp_local *local = container_of(work, struct nfc_llcp_local,
+                                                    sdreq_timeout_work);
+
+        mutex_lock(&local->sdreq_lock);
+
+        time = jiffies - msecs_to_jiffies(3 * local->remote_lto);
+
+        hlist_for_each_entry_safe(sdp, n, &local->pending_sdreqs, node) {
+                if (time_after(sdp->time, time))
+                        continue;
+
+                sdp->sap = LLCP_SDP_UNBOUND;
+
+                hlist_del(&sdp->node);
+
+                hlist_add_head(&sdp->node, &nl_sdres_list);
+        }
+
+        if (!hlist_empty(&local->pending_sdreqs))
+                mod_timer(&local->sdreq_timer,
+                          jiffies + msecs_to_jiffies(3 * local->remote_lto));
+
+        mutex_unlock(&local->sdreq_lock);
+
+        if (!hlist_empty(&nl_sdres_list))
+                nfc_genl_llc_send_sdres(local->dev, &nl_sdres_list);
+}
+
+static void nfc_llcp_sdreq_timer(unsigned long data)
+{
+        struct nfc_llcp_local *local = (struct nfc_llcp_local *) data;
+
+        schedule_work(&local->sdreq_timeout_work);
+}
+
 struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev)
 {
         struct nfc_llcp_local *local, *n;
@@ -766,8 +846,6 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
         ui_cb->dsap = dsap;
         ui_cb->ssap = ssap;
 
-        printk("%s %d %d\n", __func__, dsap, ssap);
-
         pr_debug("%d %d\n", dsap, ssap);
 
         /* We're looking for a bound socket, not a client one */
@@ -785,7 +863,6 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
                 skb_get(skb);
         } else {
                 pr_err("Receive queue is full\n");
-                kfree_skb(skb);
         }
 
         nfc_llcp_sock_put(llcp_sock);
@@ -865,7 +942,9 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
         new_sock = nfc_llcp_sock(new_sk);
         new_sock->dev = local->dev;
         new_sock->local = nfc_llcp_local_get(local);
-        new_sock->miu = local->remote_miu;
+        new_sock->rw = sock->rw;
+        new_sock->miux = sock->miux;
+        new_sock->remote_miu = local->remote_miu;
         new_sock->nfc_protocol = sock->nfc_protocol;
         new_sock->dsap = ssap;
         new_sock->target_idx = local->target_idx;
@@ -919,11 +998,11 @@ int nfc_llcp_queue_i_frames(struct nfc_llcp_sock *sock)
 
         pr_debug("Remote ready %d tx queue len %d remote rw %d",
                  sock->remote_ready, skb_queue_len(&sock->tx_pending_queue),
-                 sock->rw);
+                 sock->remote_rw);
 
         /* Try to queue some I frames for transmission */
         while (sock->remote_ready &&
-               skb_queue_len(&sock->tx_pending_queue) < sock->rw) {
+               skb_queue_len(&sock->tx_pending_queue) < sock->remote_rw) {
                 struct sk_buff *pdu;
 
                 pdu = skb_dequeue(&sock->tx_queue);
@@ -986,7 +1065,6 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
                         skb_get(skb);
                 } else {
                         pr_err("Receive queue is full\n");
-                        kfree_skb(skb);
                 }
         }
 
@@ -1144,6 +1222,10 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
         u16 tlv_len, offset;
         char *service_name;
         size_t service_name_len;
+        struct nfc_llcp_sdp_tlv *sdp;
+        HLIST_HEAD(llc_sdres_list);
+        size_t sdres_tlvs_len;
+        HLIST_HEAD(nl_sdres_list);
 
         dsap = nfc_llcp_dsap(skb);
         ssap = nfc_llcp_ssap(skb);
@@ -1158,6 +1240,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
         tlv = &skb->data[LLCP_HEADER_SIZE];
         tlv_len = skb->len - LLCP_HEADER_SIZE;
         offset = 0;
+        sdres_tlvs_len = 0;
 
         while (offset < tlv_len) {
                 type = tlv[0];
@@ -1175,14 +1258,14 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
                             !strncmp(service_name, "urn:nfc:sn:sdp",
                                      service_name_len)) {
                                 sap = 1;
-                                goto send_snl;
+                                goto add_snl;
                         }
 
                         llcp_sock = nfc_llcp_sock_from_sn(local, service_name,
                                                           service_name_len);
                         if (!llcp_sock) {
                                 sap = 0;
-                                goto send_snl;
+                                goto add_snl;
                         }
 
                         /*
@@ -1199,7 +1282,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
 
                                 if (sap == LLCP_SAP_MAX) {
                                         sap = 0;
-                                        goto send_snl;
+                                        goto add_snl;
                                 }
 
                                 client_count =
@@ -1216,8 +1299,37 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
 
                         pr_debug("%p %d\n", llcp_sock, sap);
 
-send_snl:
-                        nfc_llcp_send_snl(local, tid, sap);
+add_snl:
+                        sdp = nfc_llcp_build_sdres_tlv(tid, sap);
+                        if (sdp == NULL)
+                                goto exit;
+
+                        sdres_tlvs_len += sdp->tlv_len;
+                        hlist_add_head(&sdp->node, &llc_sdres_list);
+                        break;
+
+                case LLCP_TLV_SDRES:
+                        mutex_lock(&local->sdreq_lock);
+
+                        pr_debug("LLCP_TLV_SDRES: searching tid %d\n", tlv[2]);
+
+                        hlist_for_each_entry(sdp, &local->pending_sdreqs, node) {
+                                if (sdp->tid != tlv[2])
+                                        continue;
+
+                                sdp->sap = tlv[3];
+
+                                pr_debug("Found: uri=%s, sap=%d\n",
+                                         sdp->uri, sdp->sap);
+
+                                hlist_del(&sdp->node);
+
+                                hlist_add_head(&sdp->node, &nl_sdres_list);
+
+                                break;
+                        }
+
+                        mutex_unlock(&local->sdreq_lock);
                         break;
 
                 default:
@@ -1228,6 +1340,13 @@ send_snl:
                 offset += length + 2;
                 tlv += length + 2;
         }
+
+exit:
+        if (!hlist_empty(&nl_sdres_list))
+                nfc_genl_llc_send_sdres(local->dev, &nl_sdres_list);
+
+        if (!hlist_empty(&llc_sdres_list))
+                nfc_llcp_send_snl_sdres(local, &llc_sdres_list, sdres_tlvs_len);
 }
 
 static void nfc_llcp_rx_work(struct work_struct *work)
@@ -1348,7 +1467,7 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev)
                 return;
 
         /* Close and purge all existing sockets */
-        nfc_llcp_socket_release(local, true);
+        nfc_llcp_socket_release(local, true, 0);
 }
 
 void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
@@ -1413,6 +1532,13 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
         local->remote_miu = LLCP_DEFAULT_MIU;
         local->remote_lto = LLCP_DEFAULT_LTO;
 
+        mutex_init(&local->sdreq_lock);
+        INIT_HLIST_HEAD(&local->pending_sdreqs);
+        init_timer(&local->sdreq_timer);
+        local->sdreq_timer.data = (unsigned long) local;
+        local->sdreq_timer.function = nfc_llcp_sdreq_timer;
+        INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work);
+
         list_add(&local->list, &llcp_devices);
 
         return 0;
@@ -1427,6 +1553,8 @@ void nfc_llcp_unregister_device(struct nfc_dev *dev)
                 return;
         }
 
+        local_cleanup(local, false);
+
         nfc_llcp_local_put(local);
 }
 
diff --git a/net/nfc/llcp/llcp.h b/net/nfc/llcp/llcp.h
index 0eae5c509504..7e87a66b02ec 100644
--- a/net/nfc/llcp/llcp.h
+++ b/net/nfc/llcp/llcp.h
@@ -46,6 +46,19 @@ struct llcp_sock_list {
         rwlock_t          lock;
 };
 
+struct nfc_llcp_sdp_tlv {
+        u8 *tlv;
+        u8 tlv_len;
+
+        char *uri;
+        u8 tid;
+        u8 sap;
+
+        unsigned long time;
+
+        struct hlist_node node;
+};
+
 struct nfc_llcp_local {
         struct list_head list;
         struct nfc_dev *dev;
@@ -86,6 +99,12 @@ struct nfc_llcp_local {
         u8  remote_opt;
         u16 remote_wks;
 
+        struct mutex sdreq_lock;
+        struct hlist_head pending_sdreqs;
+        struct timer_list sdreq_timer;
+        struct work_struct sdreq_timeout_work;
+        u8 sdreq_next_tid;
+
         /* sockets array */
         struct llcp_sock_list sockets;
         struct llcp_sock_list connecting_sockets;
@@ -105,7 +124,12 @@ struct nfc_llcp_sock {
         char *service_name;
         size_t service_name_len;
         u8 rw;
-        u16 miu;
+        u16 miux;
+
+
+        /* Remote link parameters */
+        u8 remote_rw;
+        u16 remote_miu;
 
         /* Link variables */
         u8 send_n;
@@ -213,12 +237,20 @@ int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
 /* Commands API */
 void nfc_llcp_recv(void *data, struct sk_buff *skb, int err);
 u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length);
+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap);
+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
+                                                  size_t uri_len);
+void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp);
+void nfc_llcp_free_sdp_tlv_list(struct hlist_head *sdp_head);
 void nfc_llcp_recv(void *data, struct sk_buff *skb, int err);
 int nfc_llcp_disconnect(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_symm(struct nfc_dev *dev);
 int nfc_llcp_send_connect(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_cc(struct nfc_llcp_sock *sock);
-int nfc_llcp_send_snl(struct nfc_llcp_local *local, u8 tid, u8 sap);
+int nfc_llcp_send_snl_sdres(struct nfc_llcp_local *local,
+                            struct hlist_head *tlv_list, size_t tlvs_len);
+int nfc_llcp_send_snl_sdreq(struct nfc_llcp_local *local,
+                            struct hlist_head *tlv_list, size_t tlvs_len);
 int nfc_llcp_send_dm(struct nfc_llcp_local *local, u8 ssap, u8 dsap, u8 reason);
 int nfc_llcp_send_disconnect(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 5332751943a9..6fa76704cb13 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -223,6 +223,124 @@ error:
         return ret;
 }
 
+static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
+                               char __user *optval, unsigned int optlen)
+{
+        struct sock *sk = sock->sk;
+        struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
+        u32 opt;
+        int err = 0;
+
+        pr_debug("%p optname %d\n", sk, optname);
+
+        if (level != SOL_NFC)
+                return -ENOPROTOOPT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case NFC_LLCP_RW:
+                if (sk->sk_state == LLCP_CONNECTED ||
+                    sk->sk_state == LLCP_BOUND ||
+                    sk->sk_state == LLCP_LISTEN) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (opt > LLCP_MAX_RW) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                llcp_sock->rw = (u8) opt;
+
+                break;
+
+        case NFC_LLCP_MIUX:
+                if (sk->sk_state == LLCP_CONNECTED ||
+                    sk->sk_state == LLCP_BOUND ||
+                    sk->sk_state == LLCP_LISTEN) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (opt > LLCP_MAX_MIUX) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                llcp_sock->miux = (u16) opt;
+
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+
+        pr_debug("%p rw %d miux %d\n", llcp_sock,
+                 llcp_sock->rw, llcp_sock->miux);
+
+        return err;
+}
+
+static int nfc_llcp_getsockopt(struct socket *sock, int level, int optname,
+                               char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
+        int len, err = 0;
+
+        pr_debug("%p optname %d\n", sk, optname);
+
+        if (level != SOL_NFC)
+                return -ENOPROTOOPT;
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        len = min_t(u32, len, sizeof(u32));
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case NFC_LLCP_RW:
+                if (put_user(llcp_sock->rw, (u32 __user *) optval))
+                        err = -EFAULT;
+
+                break;
+
+        case NFC_LLCP_MIUX:
+                if (put_user(llcp_sock->miux, (u32 __user *) optval))
+                        err = -EFAULT;
+
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+
+        if (put_user(len, optlen))
+                return -EFAULT;
+
+        return err;
+}
+
 void nfc_llcp_accept_unlink(struct sock *sk)
 {
         struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
@@ -270,7 +388,9 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
                 }
 
                 if (sk->sk_state == LLCP_CONNECTED || !newsock) {
-                        nfc_llcp_accept_unlink(sk);
+                        list_del_init(&lsk->accept_queue);
+                        sock_put(sk);
+
                         if (newsock)
                                 sock_graft(sk, newsock);
 
@@ -278,6 +398,8 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
 
                         pr_debug("Returning sk state %d\n", sk->sk_state);
 
+                        sk_acceptq_removed(parent);
+
                         return sk;
                 }
 
@@ -462,8 +584,6 @@ static int llcp_sock_release(struct socket *sock)
                         nfc_llcp_accept_unlink(accept_sk);
 
                         release_sock(accept_sk);
-
-                        sock_orphan(accept_sk);
                 }
         }
 
@@ -541,7 +661,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
 
         llcp_sock->dev = dev;
         llcp_sock->local = nfc_llcp_local_get(local);
-        llcp_sock->miu = llcp_sock->local->remote_miu;
+        llcp_sock->remote_miu = llcp_sock->local->remote_miu;
         llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
         if (llcp_sock->ssap == LLCP_SAP_MAX) {
                 ret = -ENOMEM;
@@ -735,8 +855,8 @@ static const struct proto_ops llcp_sock_ops = {
         .ioctl          = sock_no_ioctl,
         .listen         = llcp_sock_listen,
         .shutdown       = sock_no_shutdown,
-        .setsockopt     = sock_no_setsockopt,
-        .getsockopt     = sock_no_getsockopt,
+        .setsockopt     = nfc_llcp_setsockopt,
+        .getsockopt     = nfc_llcp_getsockopt,
         .sendmsg        = llcp_sock_sendmsg,
         .recvmsg        = llcp_sock_recvmsg,
         .mmap           = sock_no_mmap,
@@ -800,8 +920,10 @@ struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp)
 
         llcp_sock->ssap = 0;
         llcp_sock->dsap = LLCP_SAP_SDP;
-        llcp_sock->rw = LLCP_DEFAULT_RW;
-        llcp_sock->miu = LLCP_DEFAULT_MIU;
+        llcp_sock->rw = LLCP_MAX_RW + 1;
+        llcp_sock->miux = LLCP_MAX_MIUX + 1;
+        llcp_sock->remote_rw = LLCP_DEFAULT_RW;
+        llcp_sock->remote_miu = LLCP_DEFAULT_MIU;
         llcp_sock->send_n = llcp_sock->send_ack_n = 0;
         llcp_sock->recv_n = llcp_sock->recv_ack_n = 0;
         llcp_sock->remote_ready = 1;
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 504b883439f1..73fd51098f4d 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -53,6 +53,15 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
         [NFC_ATTR_DEVICE_POWERED] = { .type = NLA_U8 },
         [NFC_ATTR_IM_PROTOCOLS] = { .type = NLA_U32 },
         [NFC_ATTR_TM_PROTOCOLS] = { .type = NLA_U32 },
+        [NFC_ATTR_LLC_PARAM_LTO] = { .type = NLA_U8 },
+        [NFC_ATTR_LLC_PARAM_RW] = { .type = NLA_U8 },
+        [NFC_ATTR_LLC_PARAM_MIUX] = { .type = NLA_U16 },
+        [NFC_ATTR_LLC_SDP] = { .type = NLA_NESTED },
+};
+
+static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
+        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING },
+        [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
 };
 
 static int nfc_genl_send_target(struct sk_buff *msg, struct nfc_target *target,
@@ -348,6 +357,74 @@ free_msg:
         return -EMSGSIZE;
 }
 
+int nfc_genl_llc_send_sdres(struct nfc_dev *dev, struct hlist_head *sdres_list)
+{
+        struct sk_buff *msg;
+        struct nlattr *sdp_attr, *uri_attr;
+        struct nfc_llcp_sdp_tlv *sdres;
+        struct hlist_node *n;
+        void *hdr;
+        int rc = -EMSGSIZE;
+        int i;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
+                          NFC_EVENT_LLC_SDRES);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
+                goto nla_put_failure;
+
+        sdp_attr = nla_nest_start(msg, NFC_ATTR_LLC_SDP);
+        if (sdp_attr == NULL) {
+                rc = -ENOMEM;
+                goto nla_put_failure;
+        }
+
+        i = 1;
+        hlist_for_each_entry_safe(sdres, n, sdres_list, node) {
+                pr_debug("uri: %s, sap: %d\n", sdres->uri, sdres->sap);
+
+                uri_attr = nla_nest_start(msg, i++);
+                if (uri_attr == NULL) {
+                        rc = -ENOMEM;
+                        goto nla_put_failure;
+                }
+
+                if (nla_put_u8(msg, NFC_SDP_ATTR_SAP, sdres->sap))
+                        goto nla_put_failure;
+
+                if (nla_put_string(msg, NFC_SDP_ATTR_URI, sdres->uri))
+                        goto nla_put_failure;
+
+                nla_nest_end(msg, uri_attr);
+
+                hlist_del(&sdres->node);
+
+                nfc_llcp_free_sdp_tlv(sdres);
+        }
+
+        nla_nest_end(msg, sdp_attr);
+
+        genlmsg_end(msg, hdr);
+
+        return genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+
+free_msg:
+        nlmsg_free(msg);
+
+        nfc_llcp_free_sdp_tlv_list(sdres_list);
+
+        return rc;
+}
+
 static int nfc_genl_send_device(struct sk_buff *msg, struct nfc_dev *dev,
                                 u32 portid, u32 seq,
                                 struct netlink_callback *cb,
@@ -859,6 +936,96 @@ exit:
         return rc;
 }
 
+static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nfc_dev *dev;
+        struct nfc_llcp_local *local;
+        struct nlattr *attr, *sdp_attrs[NFC_SDP_ATTR_MAX+1];
+        u32 idx;
+        u8 tid;
+        char *uri;
+        int rc = 0, rem;
+        size_t uri_len, tlvs_len;
+        struct hlist_head sdreq_list;
+        struct nfc_llcp_sdp_tlv *sdreq;
+
+        if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+            !info->attrs[NFC_ATTR_LLC_SDP])
+                return -EINVAL;
+
+        idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+
+        dev = nfc_get_device(idx);
+        if (!dev) {
+                rc = -ENODEV;
+                goto exit;
+        }
+
+        device_lock(&dev->dev);
+
+        if (dev->dep_link_up == false) {
+                rc = -ENOLINK;
+                goto exit;
+        }
+
+        local = nfc_llcp_find_local(dev);
+        if (!local) {
+                nfc_put_device(dev);
+                rc = -ENODEV;
+                goto exit;
+        }
+
+        INIT_HLIST_HEAD(&sdreq_list);
+
+        tlvs_len = 0;
+
+        nla_for_each_nested(attr, info->attrs[NFC_ATTR_LLC_SDP], rem) {
+                rc = nla_parse_nested(sdp_attrs, NFC_SDP_ATTR_MAX, attr,
+                                      nfc_sdp_genl_policy);
+
+                if (rc != 0) {
+                        rc = -EINVAL;
+                        goto exit;
+                }
+
+                if (!sdp_attrs[NFC_SDP_ATTR_URI])
+                        continue;
+
+                uri_len = nla_len(sdp_attrs[NFC_SDP_ATTR_URI]);
+                if (uri_len == 0)
+                        continue;
+
+                uri = nla_data(sdp_attrs[NFC_SDP_ATTR_URI]);
+                if (uri == NULL || *uri == 0)
+                        continue;
+
+                tid = local->sdreq_next_tid++;
+
+                sdreq = nfc_llcp_build_sdreq_tlv(tid, uri, uri_len);
+                if (sdreq == NULL) {
+                        rc = -ENOMEM;
+                        goto exit;
+                }
+
+                tlvs_len += sdreq->tlv_len;
+
+                hlist_add_head(&sdreq->node, &sdreq_list);
+        }
+
+        if (hlist_empty(&sdreq_list)) {
+                rc = -EINVAL;
+                goto exit;
+        }
+
+        rc = nfc_llcp_send_snl_sdreq(local, &sdreq_list, tlvs_len);
+exit:
+        device_unlock(&dev->dev);
+
+        nfc_put_device(dev);
+
+        return rc;
+}
+
 static struct genl_ops nfc_genl_ops[] = {
         {
                 .cmd = NFC_CMD_GET_DEVICE,
@@ -913,6 +1080,11 @@ static struct genl_ops nfc_genl_ops[] = {
                 .doit = nfc_genl_llc_set_params,
                 .policy = nfc_genl_policy,
         },
+        {
+                .cmd = NFC_CMD_LLC_SDREQ,
+                .doit = nfc_genl_llc_sdreq,
+                .policy = nfc_genl_policy,
+        },
 };
 
 
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index 87d914d2876a..94bfe19ba678 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -46,6 +46,8 @@ struct nfc_rawsock {
 #define to_rawsock_sk(_tx_work) \
         ((struct sock *) container_of(_tx_work, struct nfc_rawsock, tx_work))
 
+struct nfc_llcp_sdp_tlv;
+
 #ifdef CONFIG_NFC_LLCP
 
 void nfc_llcp_mac_is_down(struct nfc_dev *dev);
@@ -59,6 +61,8 @@ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb);
 struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
 int __init nfc_llcp_init(void);
 void nfc_llcp_exit(void);
+void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp);
+void nfc_llcp_free_sdp_tlv_list(struct hlist_head *head);
 
 #else
 
@@ -112,6 +116,14 @@ static inline void nfc_llcp_exit(void)
 {
 }
 
+static inline void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp)
+{
+}
+
+static inline void nfc_llcp_free_sdp_tlv_list(struct hlist_head *sdp_head)
+{
+}
+
 #endif
 
 int __init rawsock_init(void);
@@ -144,6 +156,8 @@ int nfc_genl_dep_link_down_event(struct nfc_dev *dev);
 int nfc_genl_tm_activated(struct nfc_dev *dev, u32 protocol);
 int nfc_genl_tm_deactivated(struct nfc_dev *dev);
 
+int nfc_genl_llc_send_sdres(struct nfc_dev *dev, struct hlist_head *sdres_list);
+
 struct nfc_dev *nfc_get_device(unsigned int idx);
 
 static inline void nfc_put_device(struct nfc_dev *dev)
diff --git a/net/rds/message.c b/net/rds/message.c
index f0a4658f3273..aba232f9f308 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -82,10 +82,7 @@ static void rds_message_purge(struct rds_message *rm)
 void rds_message_put(struct rds_message *rm)
 {
         rdsdebug("put rm %p ref %d\n", rm, atomic_read(&rm->m_refcount));
-        if (atomic_read(&rm->m_refcount) == 0) {
-printk(KERN_CRIT "danger refcount zero on %p\n", rm);
-WARN_ON(1);
-        }
+        WARN(!atomic_read(&rm->m_refcount), "danger refcount zero on %p\n", rm);
         if (atomic_dec_and_test(&rm->m_refcount)) {
                 BUG_ON(!list_empty(&rm->m_sock_item));
                 BUG_ON(!list_empty(&rm->m_conn_item));
@@ -197,6 +194,9 @@ struct rds_message *rds_message_alloc(unsigned int extra_len, gfp_t gfp)
 {
         struct rds_message *rm;
 
+        if (extra_len > KMALLOC_MAX_SIZE - sizeof(struct rds_message))
+                return NULL;
+
         rm = kzalloc(sizeof(struct rds_message) + extra_len, gfp);
         if (!rm)
                 goto out;
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index e9a77f621c3d..d51852bba01c 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -298,6 +298,10 @@ static void qfq_update_agg(struct qfq_sched *q, struct qfq_aggregate *agg,
             new_num_classes == q->max_agg_classes - 1) /* agg no more full */
                 hlist_add_head(&agg->nonfull_next, &q->nonfull_aggs);
 
+        /* The next assignment may let
+         * agg->initial_budget > agg->budgetmax
+         * hold, we will take it into account in charge_actual_service().
+         */
         agg->budgetmax = new_num_classes * agg->lmax;
         new_agg_weight = agg->class_weight * new_num_classes;
         agg->inv_w = ONE_FP/new_agg_weight;
@@ -817,7 +821,7 @@ static void qfq_make_eligible(struct qfq_sched *q)
         unsigned long old_vslot = q->oldV >> q->min_slot_shift;
 
         if (vslot != old_vslot) {
-                unsigned long mask = (1UL << fls(vslot ^ old_vslot)) - 1;
+                unsigned long mask = (1ULL << fls(vslot ^ old_vslot)) - 1;
                 qfq_move_groups(q, mask, IR, ER);
                 qfq_move_groups(q, mask, IB, EB);
         }
@@ -988,12 +992,23 @@ static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
 /* Update F according to the actual service received by the aggregate. */
 static inline void charge_actual_service(struct qfq_aggregate *agg)
 {
-        /* compute the service received by the aggregate */
-        u32 service_received = agg->initial_budget - agg->budget;
+        /* Compute the service received by the aggregate, taking into
+         * account that, after decreasing the number of classes in
+         * agg, it may happen that
+         * agg->initial_budget - agg->budget > agg->bugdetmax
+         */
+        u32 service_received = min(agg->budgetmax,
+                                   agg->initial_budget - agg->budget);
 
         agg->F = agg->S + (u64)service_received * agg->inv_w;
 }
 
+static inline void qfq_update_agg_ts(struct qfq_sched *q,
+                                     struct qfq_aggregate *agg,
+                                     enum update_reason reason);
+
+static void qfq_schedule_agg(struct qfq_sched *q, struct qfq_aggregate *agg);
+
 static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
 {
         struct qfq_sched *q = qdisc_priv(sch);
@@ -1021,7 +1036,7 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
                 in_serv_agg->initial_budget = in_serv_agg->budget =
                         in_serv_agg->budgetmax;
 
-                if (!list_empty(&in_serv_agg->active))
+                if (!list_empty(&in_serv_agg->active)) {
                         /*
                          * Still active: reschedule for
                          * service. Possible optimization: if no other
@@ -1032,8 +1047,9 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
                          * handle it, we would need to maintain an
                          * extra num_active_aggs field.
                         */
-                        qfq_activate_agg(q, in_serv_agg, requeue);
-                else if (sch->q.qlen == 0) { /* no aggregate to serve */
+                        qfq_update_agg_ts(q, in_serv_agg, requeue);
+                        qfq_schedule_agg(q, in_serv_agg);
+                } else if (sch->q.qlen == 0) { /* no aggregate to serve */
                         q->in_serv_agg = NULL;
                         return NULL;
                 }
@@ -1052,7 +1068,15 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
         qdisc_bstats_update(sch, skb);
 
         agg_dequeue(in_serv_agg, cl, len);
-        in_serv_agg->budget -= len;
+        /* If lmax is lowered, through qfq_change_class, for a class
+         * owning pending packets with larger size than the new value
+         * of lmax, then the following condition may hold.
+         */
+        if (unlikely(in_serv_agg->budget < len))
+                in_serv_agg->budget = 0;
+        else
+                in_serv_agg->budget -= len;
+
         q->V += (u64)len * IWSUM;
         pr_debug("qfq dequeue: len %u F %lld now %lld\n",
                  len, (unsigned long long) in_serv_agg->F,
@@ -1217,17 +1241,11 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         cl->deficit = agg->lmax;
         list_add_tail(&cl->alist, &agg->active);
 
-        if (list_first_entry(&agg->active, struct qfq_class, alist) != cl)
-                return err; /* aggregate was not empty, nothing else to do */
+        if (list_first_entry(&agg->active, struct qfq_class, alist) != cl ||
+            q->in_serv_agg == agg)
+                return err; /* non-empty or in service, nothing else to do */
 
-        /* recharge budget */
-        agg->initial_budget = agg->budget = agg->budgetmax;
-
-        qfq_update_agg_ts(q, agg, enqueue);
-        if (q->in_serv_agg == NULL)
-                q->in_serv_agg = agg;
-        else if (agg != q->in_serv_agg)
-                qfq_schedule_agg(q, agg);
+        qfq_activate_agg(q, agg, enqueue);
 
         return err;
 }
@@ -1261,7 +1279,8 @@ static void qfq_schedule_agg(struct qfq_sched *q, struct qfq_aggregate *agg)
                 /* group was surely ineligible, remove */
                 __clear_bit(grp->index, &q->bitmaps[IR]);
                 __clear_bit(grp->index, &q->bitmaps[IB]);
-        } else if (!q->bitmaps[ER] && qfq_gt(roundedS, q->V))
+        } else if (!q->bitmaps[ER] && qfq_gt(roundedS, q->V) &&
+                   q->in_serv_agg == NULL)
                 q->V = roundedS;
 
         grp->S = roundedS;
@@ -1284,8 +1303,15 @@ skip_update:
 static void qfq_activate_agg(struct qfq_sched *q, struct qfq_aggregate *agg,
                              enum update_reason reason)
 {
+        agg->initial_budget = agg->budget = agg->budgetmax; /* recharge budg. */
+
         qfq_update_agg_ts(q, agg, reason);
-        qfq_schedule_agg(q, agg);
+        if (q->in_serv_agg == NULL) { /* no aggr. in service or scheduled */
+                q->in_serv_agg = agg; /* start serving this aggregate */
+                 /* update V: to be in service, agg must be eligible */
+                q->oldV = q->V = agg->S;
+        } else if (agg != q->in_serv_agg)
+                qfq_schedule_agg(q, agg);
 }
 
 static void qfq_slot_remove(struct qfq_sched *q, struct qfq_group *grp,
@@ -1357,8 +1383,6 @@ static void qfq_deactivate_agg(struct qfq_sched *q, struct qfq_aggregate *agg)
                         __set_bit(grp->index, &q->bitmaps[s]);
                 }
         }
-
-        qfq_update_eligible(q);
 }
 
 static void qfq_qlen_notify(struct Qdisc *sch, unsigned long arg)
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 2b3ef03c6098..12ed45dbe75d 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -155,7 +155,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
 
         /* SCTP-AUTH extensions*/
         INIT_LIST_HEAD(&ep->endpoint_shared_keys);
-        null_key = sctp_auth_shkey_create(0, GFP_KERNEL);
+        null_key = sctp_auth_shkey_create(0, gfp);
         if (!null_key)
                 goto nomem;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c99458df3f3f..b9070736b8d9 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5653,6 +5653,9 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
         if (len < sizeof(sctp_assoc_t))
                 return -EINVAL;
 
+        /* Allow the struct to grow and fill in as much as possible */
+        len = min_t(size_t, len, sizeof(sas));
+
         if (copy_from_user(&sas, optval, len))
                 return -EFAULT;
 
@@ -5686,9 +5689,6 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
         /* Mark beginning of a new observation period */
         asoc->stats.max_obs_rto = asoc->rto_min;
 
-        /* Allow the struct to grow and fill in as much as possible */
-        len = min_t(size_t, len, sizeof(sas));
-
         if (put_user(len, optlen))
                 return -EFAULT;
 
diff --git a/net/sctp/ssnmap.c b/net/sctp/ssnmap.c
index 442ad4ed6315..825ea94415b3 100644
--- a/net/sctp/ssnmap.c
+++ b/net/sctp/ssnmap.c
@@ -41,8 +41,6 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 
-#define MAX_KMALLOC_SIZE        131072
-
 static struct sctp_ssnmap *sctp_ssnmap_init(struct sctp_ssnmap *map, __u16 in,
                                             __u16 out);
 
@@ -65,7 +63,7 @@ struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
         int size;
 
         size = sctp_ssnmap_size(in, out);
-        if (size <= MAX_KMALLOC_SIZE)
+        if (size <= KMALLOC_MAX_SIZE)
                 retval = kmalloc(size, gfp);
         else
                 retval = (struct sctp_ssnmap *)
@@ -82,7 +80,7 @@ struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
         return retval;
 
 fail_map:
-        if (size <= MAX_KMALLOC_SIZE)
+        if (size <= KMALLOC_MAX_SIZE)
                 kfree(retval);
         else
                 free_pages((unsigned long)retval, get_order(size));
@@ -124,7 +122,7 @@ void sctp_ssnmap_free(struct sctp_ssnmap *map)
                 int size;
 
                 size = sctp_ssnmap_size(map->in.len, map->out.len);
-                if (size <= MAX_KMALLOC_SIZE)
+                if (size <= KMALLOC_MAX_SIZE)
                         kfree(map);
                 else
                         free_pages((unsigned long)map, get_order(size));
diff --git a/net/sctp/tsnmap.c b/net/sctp/tsnmap.c
index 5f25e0c92c31..396c45174e5b 100644
--- a/net/sctp/tsnmap.c
+++ b/net/sctp/tsnmap.c
@@ -51,7 +51,7 @@
 static void sctp_tsnmap_update(struct sctp_tsnmap *map);
 static void sctp_tsnmap_find_gap_ack(unsigned long *map, __u16 off,
                                      __u16 len, __u16 *start, __u16 *end);
-static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 gap);
+static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 size);
 
 /* Initialize a block of memory as a tsnmap.  */
 struct sctp_tsnmap *sctp_tsnmap_init(struct sctp_tsnmap *map, __u16 len,
@@ -124,7 +124,7 @@ int sctp_tsnmap_mark(struct sctp_tsnmap *map, __u32 tsn,
 
         gap = tsn - map->base_tsn;
 
-        if (gap >= map->len && !sctp_tsnmap_grow(map, gap))
+        if (gap >= map->len && !sctp_tsnmap_grow(map, gap + 1))
                 return -ENOMEM;
 
         if (!sctp_tsnmap_has_gap(map) && gap == 0) {
@@ -360,23 +360,24 @@ __u16 sctp_tsnmap_num_gabs(struct sctp_tsnmap *map,
         return ngaps;
 }
 
-static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 gap)
+static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 size)
 {
         unsigned long *new;
         unsigned long inc;
         u16  len;
 
-        if (gap >= SCTP_TSN_MAP_SIZE)
+        if (size > SCTP_TSN_MAP_SIZE)
                 return 0;
 
-        inc = ALIGN((gap - map->len),BITS_PER_LONG) + SCTP_TSN_MAP_INCREMENT;
+        inc = ALIGN((size - map->len), BITS_PER_LONG) + SCTP_TSN_MAP_INCREMENT;
         len = min_t(u16, map->len + inc, SCTP_TSN_MAP_SIZE);
 
         new = kzalloc(len>>3, GFP_ATOMIC);
         if (!new)
                 return 0;
 
-        bitmap_copy(new, map->tsn_map, map->max_tsn_seen - map->base_tsn);
+        bitmap_copy(new, map->tsn_map,
+                map->max_tsn_seen - map->cumulative_tsn_ack_point);
         kfree(map->tsn_map);
         map->tsn_map = new;
         map->len = len;
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index ada17464b65b..0fd5b3d2df03 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -106,6 +106,7 @@ int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
 {
         struct sk_buff_head temp;
         struct sctp_ulpevent *event;
+        int event_eor = 0;
 
         /* Create an event from the incoming chunk. */
         event = sctp_ulpevent_make_rcvmsg(chunk->asoc, chunk, gfp);
@@ -127,10 +128,12 @@ int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
         /* Send event to the ULP.  'event' is the sctp_ulpevent for
          * very first SKB on the 'temp' list.
          */
-        if (event)
+        if (event) {
+                event_eor = (event->msg_flags & MSG_EOR) ? 1 : 0;
                 sctp_ulpq_tail_event(ulpq, event);
+        }
 
-        return 0;
+        return event_eor;
 }
 
 /* Add a new event for propagation to the ULP.  */
@@ -540,14 +543,19 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_partial(struct sctp_ulpq *ulpq)
                 ctsn = cevent->tsn;
 
                 switch (cevent->msg_flags & SCTP_DATA_FRAG_MASK) {
+                case SCTP_DATA_FIRST_FRAG:
+                        if (!first_frag)
+                                return NULL;
+                        goto done;
                 case SCTP_DATA_MIDDLE_FRAG:
                         if (!first_frag) {
                                 first_frag = pos;
                                 next_tsn = ctsn + 1;
                                 last_frag = pos;
-                        } else if (next_tsn == ctsn)
+                        } else if (next_tsn == ctsn) {
                                 next_tsn++;
-                        else
+                                last_frag = pos;
+                        } else
                                 goto done;
                         break;
                 case SCTP_DATA_LAST_FRAG:
@@ -651,6 +659,14 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_first(struct sctp_ulpq *ulpq)
                         } else
                                 goto done;
                         break;
+
+                case SCTP_DATA_LAST_FRAG:
+                        if (!first_frag)
+                                return NULL;
+                        else
+                                goto done;
+                        break;
+
                 default:
                         return NULL;
                 }
@@ -962,20 +978,43 @@ static __u16 sctp_ulpq_renege_list(struct sctp_ulpq *ulpq,
                 struct sk_buff_head *list, __u16 needed)
 {
         __u16 freed = 0;
-        __u32 tsn;
-        struct sk_buff *skb;
+        __u32 tsn, last_tsn;
+        struct sk_buff *skb, *flist, *last;
         struct sctp_ulpevent *event;
         struct sctp_tsnmap *tsnmap;
 
         tsnmap = &ulpq->asoc->peer.tsn_map;
 
-        while ((skb = __skb_dequeue_tail(list)) != NULL) {
-                freed += skb_headlen(skb);
+        while ((skb = skb_peek_tail(list)) != NULL) {
                 event = sctp_skb2event(skb);
                 tsn = event->tsn;
 
+                /* Don't renege below the Cumulative TSN ACK Point. */
+                if (TSN_lte(tsn, sctp_tsnmap_get_ctsn(tsnmap)))
+                        break;
+
+                /* Events in ordering queue may have multiple fragments
+                 * corresponding to additional TSNs.  Sum the total
+                 * freed space; find the last TSN.
+                 */
+                freed += skb_headlen(skb);
+                flist = skb_shinfo(skb)->frag_list;
+                for (last = flist; flist; flist = flist->next) {
+                        last = flist;
+                        freed += skb_headlen(last);
+                }
+                if (last)
+                        last_tsn = sctp_skb2event(last)->tsn;
+                else
+                        last_tsn = tsn;
+
+                /* Unlink the event, then renege all applicable TSNs. */
+                __skb_unlink(skb, list);
                 sctp_ulpevent_free(event);
-                sctp_tsnmap_renege(tsnmap, tsn);
+                while (TSN_lte(tsn, last_tsn)) {
+                        sctp_tsnmap_renege(tsnmap, tsn);
+                        tsn++;
+                }
                 if (freed >= needed)
                         return freed;
         }
@@ -1002,16 +1041,28 @@ void sctp_ulpq_partial_delivery(struct sctp_ulpq *ulpq,
         struct sctp_ulpevent *event;
         struct sctp_association *asoc;
         struct sctp_sock *sp;
+        __u32 ctsn;
+        struct sk_buff *skb;
 
         asoc = ulpq->asoc;
         sp = sctp_sk(asoc->base.sk);
 
         /* If the association is already in Partial Delivery mode
-         * we have noting to do.
+         * we have nothing to do.
          */
         if (ulpq->pd_mode)
                 return;
 
+        /* Data must be at or below the Cumulative TSN ACK Point to
+         * start partial delivery.
+         */
+        skb = skb_peek(&asoc->ulpq.reasm);
+        if (skb != NULL) {
+                ctsn = sctp_skb2event(skb)->tsn;
+                if (!TSN_lte(ctsn, sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map)))
+                        return;
+        }
+
         /* If the user enabled fragment interleave socket option,
          * multiple associations can enter partial delivery.
          * Otherwise, we can only enter partial delivery if the
@@ -1054,12 +1105,16 @@ void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
         }
         /* If able to free enough room, accept this chunk. */
         if (chunk && (freed >= needed)) {
-                __u32 tsn;
-                tsn = ntohl(chunk->subh.data_hdr->tsn);
-                sctp_tsnmap_mark(&asoc->peer.tsn_map, tsn, chunk->transport);
-                sctp_ulpq_tail_data(ulpq, chunk, gfp);
-
-                sctp_ulpq_partial_delivery(ulpq, gfp);
+                int retval;
+                retval = sctp_ulpq_tail_data(ulpq, chunk, gfp);
+                /*
+                 * Enter partial delivery if chunk has not been
+                 * delivered; otherwise, drain the reassembly queue.
+                 */
+                if (retval <= 0)
+                        sctp_ulpq_partial_delivery(ulpq, gfp);
+                else if (retval == 1)
+                        sctp_ulpq_reasm_drain(ulpq);
         }
 
         sk_mem_reclaim(asoc->base.sk);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 92e3fd44e3b0..84c9ad7e1dca 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -212,6 +212,39 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
         rdev_rfkill_poll(rdev);
 }
 
+void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev)
+{
+        lockdep_assert_held(&rdev->devlist_mtx);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_P2P_DEVICE))
+                return;
+
+        if (!wdev->p2p_started)
+                return;
+
+        rdev_stop_p2p_device(rdev, wdev);
+        wdev->p2p_started = false;
+
+        rdev->opencount--;
+
+        if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
+                bool busy = work_busy(&rdev->scan_done_wk);
+
+                /*
+                 * If the work isn't pending or running (in which case it would
+                 * be waiting for the lock we hold) the driver didn't properly
+                 * cancel the scan when the interface was removed. In this case
+                 * warn and leak the scan request object to not crash later.
+                 */
+                WARN_ON(!busy);
+
+                rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, !busy);
+        }
+}
+
 static int cfg80211_rfkill_set_block(void *data, bool blocked)
 {
         struct cfg80211_registered_device *rdev = data;
@@ -221,7 +254,8 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 return 0;
 
         rtnl_lock();
-        mutex_lock(&rdev->devlist_mtx);
+
+        /* read-only iteration need not hold the devlist_mtx */
 
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (wdev->netdev) {
@@ -231,18 +265,18 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 /* otherwise, check iftype */
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_P2P_DEVICE:
-                        if (!wdev->p2p_started)
-                                break;
-                        rdev_stop_p2p_device(rdev, wdev);
-                        wdev->p2p_started = false;
-                        rdev->opencount--;
+                        /* but this requires it */
+                        mutex_lock(&rdev->devlist_mtx);
+                        mutex_lock(&rdev->sched_scan_mtx);
+                        cfg80211_stop_p2p_device(rdev, wdev);
+                        mutex_unlock(&rdev->sched_scan_mtx);
+                        mutex_unlock(&rdev->devlist_mtx);
                         break;
                 default:
                         break;
                 }
         }
 
-        mutex_unlock(&rdev->devlist_mtx);
         rtnl_unlock();
 
         return 0;
@@ -745,17 +779,13 @@ static void wdev_cleanup_work(struct work_struct *work)
         wdev = container_of(work, struct wireless_dev, cleanup_work);
         rdev = wiphy_to_dev(wdev->wiphy);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
 
         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
                 rdev->scan_req->aborted = true;
                 ___cfg80211_scan_done(rdev, true);
         }
 
-        cfg80211_unlock_rdev(rdev);
-
-        mutex_lock(&rdev->sched_scan_mtx);
-
         if (WARN_ON(rdev->sched_scan_req &&
                     rdev->sched_scan_req->dev == wdev->netdev)) {
                 __cfg80211_stop_sched_scan(rdev, false);
@@ -781,21 +811,19 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
                 return;
 
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         list_del_rcu(&wdev->list);
         rdev->devlist_generation++;
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_P2P_DEVICE:
-                if (!wdev->p2p_started)
-                        break;
-                rdev_stop_p2p_device(rdev, wdev);
-                wdev->p2p_started = false;
-                rdev->opencount--;
+                cfg80211_stop_p2p_device(rdev, wdev);
                 break;
         default:
                 WARN_ON_ONCE(1);
                 break;
         }
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
 }
 EXPORT_SYMBOL(cfg80211_unregister_wdev);
@@ -945,6 +973,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 cfg80211_update_iface_num(rdev, wdev->iftype, 1);
                 cfg80211_lock_rdev(rdev);
                 mutex_lock(&rdev->devlist_mtx);
+                mutex_lock(&rdev->sched_scan_mtx);
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
 #ifdef CONFIG_CFG80211_WEXT
@@ -976,6 +1005,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         break;
                 }
                 wdev_unlock(wdev);
+                mutex_unlock(&rdev->sched_scan_mtx);
                 rdev->opencount++;
                 mutex_unlock(&rdev->devlist_mtx);
                 cfg80211_unlock_rdev(rdev);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index d5d06fdea961..124e5e773fbc 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -503,6 +503,9 @@ void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
 void cfg80211_leave(struct cfg80211_registered_device *rdev,
                     struct wireless_dev *wdev);
 
+void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev);
+
 #define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
 
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 8c8a57937b22..212d2aa7a1c5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5060,14 +5060,19 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->scan)
                 return -EOPNOTSUPP;
 
-        if (rdev->scan_req)
-                return -EBUSY;
+        mutex_lock(&rdev->sched_scan_mtx);
+        if (rdev->scan_req) {
+                err = -EBUSY;
+                goto unlock;
+        }
 
         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
                 n_channels = validate_scan_freqs(
                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
-                if (!n_channels)
-                        return -EINVAL;
+                if (!n_channels) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
         } else {
                 enum ieee80211_band band;
                 n_channels = 0;
@@ -5081,23 +5086,29 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
                         n_ssids++;
 
-        if (n_ssids > wiphy->max_scan_ssids)
-                return -EINVAL;
+        if (n_ssids > wiphy->max_scan_ssids) {
+                err = -EINVAL;
+                goto unlock;
+        }
 
         if (info->attrs[NL80211_ATTR_IE])
                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         else
                 ie_len = 0;
 
-        if (ie_len > wiphy->max_scan_ie_len)
-                return -EINVAL;
+        if (ie_len > wiphy->max_scan_ie_len) {
+                err = -EINVAL;
+                goto unlock;
+        }
 
         request = kzalloc(sizeof(*request)
                         + sizeof(*request->ssids) * n_ssids
                         + sizeof(*request->channels) * n_channels
                         + ie_len, GFP_KERNEL);
-        if (!request)
-                return -ENOMEM;
+        if (!request) {
+                err = -ENOMEM;
+                goto unlock;
+        }
 
         if (n_ssids)
                 request->ssids = (void *)&request->channels[n_channels];
@@ -5234,6 +5245,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 kfree(request);
         }
 
+ unlock:
+        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -8146,20 +8159,9 @@ static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->stop_p2p_device)
                 return -EOPNOTSUPP;
 
-        if (!wdev->p2p_started)
-                return 0;
-
-        rdev_stop_p2p_device(rdev, wdev);
-        wdev->p2p_started = false;
-
-        mutex_lock(&rdev->devlist_mtx);
-        rdev->opencount--;
-        mutex_unlock(&rdev->devlist_mtx);
-
-        if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
-                rdev->scan_req->aborted = true;
-                ___cfg80211_scan_done(rdev, true);
-        }
+        mutex_lock(&rdev->sched_scan_mtx);
+        cfg80211_stop_p2p_device(rdev, wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 
         return 0;
 }
@@ -8945,7 +8947,7 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         struct nlattr *nest;
         int i;
 
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (WARN_ON(!req))
                 return 0;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 674aadca0079..fd99ea495b7e 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -169,7 +169,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         union iwreq_data wrqu;
 #endif
 
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         request = rdev->scan_req;
 
@@ -230,9 +230,9 @@ void __cfg80211_scan_done(struct work_struct *wk)
         rdev = container_of(wk, struct cfg80211_registered_device,
                             scan_done_wk);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
         ___cfg80211_scan_done(rdev, false);
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
@@ -698,11 +698,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
         found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
 
         if (found) {
-                found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.signal = tmp->pub.signal;
-                found->pub.capability = tmp->pub.capability;
-                found->ts = tmp->ts;
-
                 /* Update IEs */
                 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
                         const struct cfg80211_bss_ies *old;
@@ -723,6 +718,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
 
                         if (found->pub.hidden_beacon_bss &&
                             !list_empty(&found->hidden_list)) {
+                                const struct cfg80211_bss_ies *f;
+
                                 /*
                                  * The found BSS struct is one of the probe
                                  * response members of a group, but we're
@@ -732,6 +729,10 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                  * SSID to showing it, which is confusing so
                                  * drop this information.
                                  */
+
+                                f = rcu_access_pointer(tmp->pub.beacon_ies);
+                                kfree_rcu((struct cfg80211_bss_ies *)f,
+                                          rcu_head);
                                 goto drop;
                         }
 
@@ -761,6 +762,11 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
                 }
+
+                found->pub.beacon_interval = tmp->pub.beacon_interval;
+                found->pub.signal = tmp->pub.signal;
+                found->pub.capability = tmp->pub.capability;
+                found->ts = tmp->ts;
         } else {
                 struct cfg80211_internal_bss *new;
                 struct cfg80211_internal_bss *hidden;
@@ -1056,6 +1062,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
+        mutex_lock(&rdev->sched_scan_mtx);
         if (rdev->scan_req) {
                 err = -EBUSY;
                 goto out;
@@ -1162,6 +1169,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
                 dev_hold(dev);
         }
  out:
+        mutex_unlock(&rdev->sched_scan_mtx);
         kfree(creq);
         cfg80211_unlock_rdev(rdev);
         return err;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 88fc9aa54fe0..a9dc5c736df0 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -85,6 +85,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         ASSERT_RTNL();
         ASSERT_RDEV_LOCK(rdev);
         ASSERT_WDEV_LOCK(wdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (rdev->scan_req)
                 return -EBUSY;
@@ -227,6 +228,7 @@ void cfg80211_conn_work(struct work_struct *work)
         rtnl_lock();
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
 
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 wdev_lock(wdev);
@@ -251,6 +253,7 @@ void cfg80211_conn_work(struct work_struct *work)
                 wdev_unlock(wdev);
         }
 
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
@@ -324,11 +327,9 @@ void cfg80211_sme_scan_done(struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        mutex_lock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
         wdev_lock(wdev);
         __cfg80211_sme_scan_done(dev);
         wdev_unlock(wdev);
-        mutex_unlock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
 }
 
 void cfg80211_sme_rx_auth(struct net_device *dev,
@@ -928,9 +929,12 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
         int err;
 
         mutex_lock(&rdev->devlist_mtx);
+        /* might request scan - scan_mtx -> wdev_mtx dependency */
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
         wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
 
         return err;
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index ccadef2106ac..3c2033b8f596 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -27,7 +27,8 @@
 #define WIPHY_PR_ARG    __entry->wiphy_name
 
 #define WDEV_ENTRY      __field(u32, id)
-#define WDEV_ASSIGN     (__entry->id) = (wdev ? wdev->identifier : 0)
+#define WDEV_ASSIGN     (__entry->id) = (!IS_ERR_OR_NULL(wdev)  \
+                                         ? wdev->identifier : 0)
 #define WDEV_PR_FMT     "wdev(%u)"
 #define WDEV_PR_ARG     (__entry->id)
 
@@ -1778,7 +1779,7 @@ TRACE_EVENT(rdev_set_mac_acl,
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
-                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
                 __entry->acl_policy = params->acl_policy;
         ),
         TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", acl policy: %d",
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index fb9622f6d99c..e79cb5c0655a 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -89,6 +89,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -135,6 +136,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
@@ -190,6 +192,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         err = 0;
@@ -223,6 +226,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
@@ -285,6 +289,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -313,6 +318,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;